Cheatsheets
Master sheets by topic. Each opens its own page with subsections and the real commands from the boxes.
Recon & initial access3
Network enumeration
From host discovery to attacking each network service, with the real invocations that recur across the boxes. Each service by phase: enumerate, find vulnerabilities, exploit.
Web attacks
Discovery, CMS and each injection on its own, because each is detected and exploited differently: SQLi, LFI, upload-to-RCE, SSTI, command injection, XXE, SSRF, NoSQL, LDAP, JWT and deserialization.
Databases
Every engine enumerates and exploits differently: MySQL/MariaDB, MSSQL, PostgreSQL, Redis and SQLite each have their own syntax, paths to RCE and tricks. One sheet per engine.
Post-exploitation & escalation3
Shells, transfer & stabilisation
Catch the shell, turn it into a usable TTY, move files between attacker and target and drive Metasploit (msfconsole, meterpreter and msfvenom).
Privilege escalation · Linux
Every Linux escalation vector seen across the boxes, with the exact command: sudo, SUID, capabilities, cron, services, PATH, files, kernel.
Privilege escalation · Windows
Token privileges, services, credentials and exploits, with the real tools and commands from the Windows boxes.
Active Directory, pivoting & credentials3
Active Directory
Enumeration, Kerberos, ACL abuse, AD CS and post-exploitation, chaining ACEs and tickets up to the DC.
Pivoting & tunnelling
Reaching the internal network: SSH port forwarding, chisel, proxychains and friends.
Cracking & credentials
Crack offline what you already stole: hashes, encrypted containers and /etc/shadow, plus building the wordlists to do it.
No results