the_open_door
coffee
ESEN

Concepts

Each technique in its category. A thematic index: search above or scroll through the categories.

grep>

SQL injection9

Blind SQL Injection (Boolean-based)

WebMulti

Error-based SQL Injection

WebMulti

Magento Shoplift (CVE-2015-1397)

WebMulti

Out-of-Band SQL Injection

WebMulti

SQL Injection Authentication Bypass

WebMulti

SQL Injection to File Write (INTO OUTFILE)

WebMulti

SQL Truncation

WebMulti

Union-based SQL Injection

WebMulti

WP Advanced Search SQLi (CVE-2024-9796)

WebMulti

LFI / RFI / Path Traversal17

Arbitrary File Read

WebMulti

ColdFusion directory traversal (CVE-2010-2861)

WebMulti

Directory traversal in Argus Surveillance DVR (CVE-2018-13388)

WebWindows

Ghost file read via symlink (CVE-2023-40028)

WebMulti

Grafana path traversal (CVE-2021-43798)

WebMulti

Jenkins CLI file read (CVE-2024-23897)

WebMulti

LFI to RCE via phpinfo() Race Condition

WebMulti

Local File Inclusion (LFI) & Path Traversal

WebMulti

Log Poisoning (LFI to RCE)

WebMulti

Null Byte Injection (%00) in LFI

WebMulti

Path traversal in aiohttp (CVE-2024-23334)

WebMulti

Path traversal in php-spx (CVE-2024-42007)

WebMulti

PHAR Deserialization (LFI to RCE)

WebMulti

PHP Filter Wrapper (Source Disclosure)

WebMulti

PHP zip:// Wrapper RCE

WebMulti

Remote File Inclusion (RFI) to RCE

WebMulti

WordPress plugin LFI

WebMulti

File upload to RCE11

Cacti RCE (CVE-2024-25641)

WebMulti

File Upload Bypass (Content-Type)

WebMulti

File Upload Bypass (Magic Bytes)

WebMulti

File Upload to RCE

WebMulti

File Upload via WebDAV (PUT + MOVE)

WebWindows

IIS 6.0 WebDAV (CVE-2017-7269)

WebWindows

Pluck CMS: module RCE (CVE-2023-50564)

WebMulti

RCE in LimeSurvey via plugin upload

WebMulti

Subrion CMS: file upload to RCE (CVE-2018-19422)

WebMulti

web.config RCE on IIS

WebWindows

WordPress theme editor RCE

WebMulti

Command injection3

Command injection in PRTG Network Monitor (CVE-2018-9276)

WebWindows

OS Command Injection

WebMulti

ShellShock (CVE-2014-6271)

WebLinux

Template injection (SSTI)6

BoxBilling authenticated RCE (CVE-2022-3552)

WebMulti

changedetection.io SSTI (CVE-2024-32651)

WebMulti

Confluence OGNL (CVE-2022-26134)

WebMulti

Grav CMS Admin RCE (CVE-2021-21425)

WebMulti

PHP Template Injection (CMS)

WebMulti

Server-Side Template Injection (SSTI)

WebMulti

Insecure deserialization6

Node.js Insecure Deserialization

WebMulti

PHP Object Injection (Deserialization)

WebMulti

Python Pickle Deserialization

WebMulti

Python YAML Deserialization

WebMulti

Ruby Marshal Cookie RCE

WebMulti

SmarterMail .NET deserialization (CVE-2019-7214)

InfrastructureWindows

Code injection / eval()6

Laravel Ignition RCE (CVE-2021-3129)

WebMulti

LaTeX Injection

WebMulti

Moodle calculated-question RCE (CVE-2018-1133)

WebMulti

PHP preg_replace() /e RCE

WebMulti

PHP Tag Filter Bypass

WebMulti

Python eval() Injection

InfrastructureLinux

XSS8

Blind XSS (Bot & Exfiltration)

WebMulti

Client-Side Template Injection (CSTI)

WebMulti

CSS Injection (CSSI)

WebMulti

DOM-based XSS

WebMulti

HTML / Script Injection

WebMulti

PrestaShop XSS to RCE (CVE-2024-34716)

WebMulti

Server-Side XSS in Dynamic PDF

WebMulti

WonderCMS XSS to RCE (CVE-2023-41425)

WebMulti

SSRF (Server-Side Request Forgery)1

Server-Side Request Forgery (SSRF)

WebMulti

XXE (XML External Entity)1

XML External Entity (XXE) Injection

WebMulti

NoSQL injection1

NoSQL Injection

WebMulti

LDAP injection1

LDAP Injection

WebMulti

XPath injection1

XPath Injection

WebMulti

JWT and tokens3

JWT Attacks

WebMulti

JWT Forgery (Embedded JWK, Weak RSA)

WebMulti

JWT Forgery (Leaked Secret)

WebMulti

Access control / IDOR12

Access-Control Bypass (X-Forwarded-For)

WebMulti

GraphQL Abuse

WebMulti

Host Header Injection

WebMulti

HTTP Request Smuggling

WebMulti

HTTP Verb Tampering

WebMulti

IDOR / Broken Access Control

WebMulti

Mass Assignment

WebMulti

OAuth / SAML Abuse

WebMulti

Padding Oracle Attack

WebMulti

PHP Type Juggling

WebMulti

Prototype Pollution

WebMulti

Race Condition (TOCTOU)

WebMulti

Client-side attacks (CSRF, CORS, session)8

Clickjacking

WebMulti

CORS Misconfiguration

WebMulti

CRLF Injection / HTTP Response Splitting

WebMulti

Cross-Site Request Forgery (CSRF)

WebMulti

Cross-Site WebSocket Hijacking

WebMulti

Open Redirect

WebMulti

Session Fixation

WebMulti

Web Cache Poisoning

WebMulti

Source & secret exposure4

Credentials in source code

WebMulti

Exposed .git directory

WebMulti

Information disclosure in REST APIs

WebMulti

Secrets in git history

WebMulti

RCE in apps & services11

Chrome remote debugger abuse

InfrastructureMulti

Drupalgeddon (Drupal RCE)

WebMulti

Duplicati login bypass

InfrastructureMulti

Exhibitor unauthenticated RCE (CVE-2019-5029)

WebMulti

GlassFish 4.x directory traversal (CVE-2017-1000028)

WebMulti

H2 Database RCE via JNI

InfrastructureMulti

LibreNMS: add-device RCE

WebMulti

Log4Shell (CVE-2021-44228)

WebMulti

Openfire auth bypass (CVE-2023-32315)

WebMulti

RCE in HashiCorp Consul (service registration)

InfrastructureMulti

Splunk Universal Forwarder (RCE)

InfrastructureMulti

RCE in Git, CI/CD & deploy6

Gitea git hook RCE (CVE-2019-11229)

WebMulti

GitLab ExifTool RCE (CVE-2021-22205)

WebMulti

Jenkins Script Console (Groovy RCE)

WebMulti

RCE in JetBrains TeamCity (CVE-2023-42793)

WebMulti

RCE in recursive git clone (CVE-2024-32002)

WebMulti

WAR deploy in Tomcat/GlassFish/Jenkins

WebMulti

Web enumeration & brute force8

Brute Force

WebMulti

IIS 8.3 short-name enumeration (tilde)

WebWindows

Internal port discovery via Squid

InfrastructureMulti

Support portal abuse (osTicket)

WebMulti

Targeted password bruteforce (cewl, custom wordlists)

WebMulti

Username enumeration

WebMulti

Virtual Host Fuzzing

WebMulti

Web Content Discovery (Directory Fuzzing)

WebMulti

AD ACL abuse16

Account Operators group abuse

Active DirectoryWindows

ACL Abuse (DACL)

Active DirectoryWindows

AD Recycle Bin group abuse

Active DirectoryWindows

ADCS ESC1 (Arbitrary SAN)

Active DirectoryWindows

ADCS ESC8 (NTLM relay to AD CS)

Active DirectoryWindows

ADCS ESC9 (No Security Extension)

Active DirectoryWindows

DnsAdmins Abuse (ServerLevelPluginDll)

Active DirectoryWindows

ForceChangePassword

Active DirectoryWindows

GenericAll

Active DirectoryWindows

GenericWrite

Active DirectoryWindows

GPO abuse (SharpGPOAbuse, Restricted Groups)

Active DirectoryWindows

LAPS (Local Administrator Password Solution)

Active DirectoryWindows

RBCD (Resource-Based Constrained Delegation)

Active DirectoryWindows

Shadow Credentials

Active DirectoryWindows

WriteDACL

Active DirectoryWindows

WriteOwner

Active DirectoryWindows

Kerberos attacks13

AS-REP Roasting

Active DirectoryWindows

Constrained Delegation

Active DirectoryWindows

Golden Ticket

Active DirectoryWindows

Kerberoasting

Active DirectoryWindows

Kerberos Double Hop

Active DirectoryWindows

Kerberos user enumeration

Active DirectoryWindows

Overpass-the-Hash

Active DirectoryWindows

Pass-the-Ticket

Active DirectoryWindows

sAMAccountName Spoofing (noPac)

Active DirectoryWindows

SID History Abuse

Active DirectoryWindows

Silver Ticket

Active DirectoryWindows

Targeted Kerberoasting (forged SPN)

Active DirectoryWindows

Unconstrained Delegation

Active DirectoryWindows

AD enumeration5

BloodHound

Active DirectoryWindows

LDAP Enumeration

Active DirectoryWindows

RID cycling

Active DirectoryWindows

Share hunting

Active DirectoryMulti

SMB enumeration with a guest/null session

Active DirectoryWindows

AD credentials & post-exploitation16

Authentication Coercion (PetitPotam / PrinterBug)

Active DirectoryWindows

Credential leak in PowerShell history

Active DirectoryWindows

DCSync

Active DirectoryWindows

DPAPI Secrets

Active DirectoryWindows

Dumping credentials from LSASS (Mimikatz)

Active DirectoryWindows

Event Log Readers: credentials in the security log

InfrastructureWindows

gMSA Password Read

Active DirectoryWindows

GPP cpassword (MS14-025)

Active DirectoryWindows

LLMNR / NBT-NS Poisoning

Active DirectoryWindows

NTDS.dit Dump

Active DirectoryWindows

NTLM Relay

Active DirectoryWindows

NTLMv2 coercion with SCF/URL (IconFile UNC)

Active DirectoryWindows

Pass-the-Hash

Active DirectoryWindows

SAM & LSA Secrets Dump

Active DirectoryWindows

Saved Credentials on Windows (cmdkey and runas)

InfrastructureWindows

WMI lateral movement

Active DirectoryWindows

Tokens & Potato (Windows)8

churrasco (token kidnapping)

InfrastructureWindows

FullPowers (restore token privileges)

InfrastructureWindows

GodPotato

InfrastructureWindows

PrintSpoofer

InfrastructureWindows

RDP Session Hijacking (tscon) and Pass-the-Hash

InfrastructureWindows

RunasCs

InfrastructureWindows

SeImpersonate and Potato attacks

InfrastructureWindows

SeLoadDriverPrivilege (Print Operators) to SYSTEM

InfrastructureWindows

Services, tasks & privileges (Windows)11

AlwaysInstallElevated abuse

InfrastructureWindows

AutoLogon credentials

InfrastructureWindows

DLL Hijacking

InfrastructureWindows

GUI privesc (Save As / File Open) in elevated apps

InfrastructureWindows

icacls: rewriting NTFS permissions to read a file

InfrastructureWindows

Insecure service permissions (Windows)

InfrastructureWindows

Scheduled task hijacking (Windows)

InfrastructureWindows

SeBackupPrivilege

InfrastructureWindows

SeManageVolumePrivilege and DLL hijacking

InfrastructureWindows

Server Operators group abuse

Active DirectoryWindows

Unquoted Service Path

InfrastructureWindows

Local & kernel exploits (Windows)11

Decrypting Solar-PuTTY sessions

InfrastructureMulti

electron-updater signature bypass

InfrastructureWindows

escalation via VSStandardCollectorService150 (CVE-2024-20656)

InfrastructureWindows

Moniker Link in Microsoft Outlook (CVE-2024-21413)

InfrastructureWindows

PortableKanban password decryption

InfrastructureWindows

PrintNightmare

Active DirectoryWindows

Reversible password storage

InfrastructureMulti

SMBv2 srv2.sys (CVE-2009-3103 / MS09-050)

InfrastructureWindows

Stack buffer overflow (stack BOF)

InfrastructureWindows

UAC Bypass

InfrastructureWindows

Windows kernel exploit

InfrastructureWindows

sudo, SUID & capabilities15

Abusing SUID binaries

InfrastructureLinux

Abusing SUID screen

InfrastructureLinux

Arbitrary read with 7-Zip @listfile

InfrastructureLinux

cap_setuid capability abuse

InfrastructureLinux

cap_sys_ptrace capability abuse

InfrastructureLinux

dosbox SUID abuse

InfrastructureLinux

Escalation via sudo mosh-server

InfrastructureLinux

Local privilege escalation in sudo via chroot (CVE-2025-32463)

InfrastructureLinux

rsync privilege escalation via sudo

InfrastructureLinux

setfacl abuse via sudo

InfrastructureLinux

sudo escape with GTFOBins

InfrastructureLinux

sudo make: Makefile injection

InfrastructureLinux

sudo over a writable script (or directory)

InfrastructureLinux

Symlink abuse in a sudo script

InfrastructureLinux

Unrestricted sudo (ALL : ALL) ALL

InfrastructureLinux

Cron & scheduled tasks5

Cron abuse with symlink (chmod -R)

InfrastructureLinux

Cron running a script in a writable path

InfrastructureLinux

fail2ban privesc (actionban)

InfrastructureLinux

Logrotate abuse (logrotten)

InfrastructureLinux

RCE via a cron-deployed Git repo

InfrastructureLinux

Groups & containers6

Cleartext credential capture (pcap group)

InfrastructureLinux

Container escape

InfrastructureLinux

disk group abuse

InfrastructureLinux

Docker group abuse

InfrastructureLinux

Pivoting into Docker containers

InfrastructureLinux

Sudo group abuse

InfrastructureLinux

Library, PATH & systemd hijacking6

LD_LIBRARY_PATH hijacking

InfrastructureLinux

PATH hijacking

InfrastructureLinux

Python Library Hijacking

InfrastructureLinux

RCE via a group-writable directory in a root service

InfrastructureLinux

Shared library injection

InfrastructureLinux

Writable systemd service + reboot

InfrastructureLinux

Writable files & other vectors5

Abusing an SSH Certificate Authority

InfrastructureLinux

NFS UID-mapping abuse

InfrastructureLinux

SSH Key Injection (authorized_keys)

InfrastructureLinux

Writable /etc/passwd

InfrastructureLinux

X11 abuse (.Xauthority)

InfrastructureLinux

Kernel exploits & shell escape (Linux)4

Linux kernel exploit

InfrastructureLinux

Restricted shell escape

InfrastructureLinux

systemctl pager escape (!sh)

InfrastructureLinux

tar wildcard injection

InfrastructureLinux

Local enumeration & spying6

Enumeration via /proc/<PID>/cmdline

InfrastructureLinux

mlocate database enumeration

InfrastructureLinux

Process memory dump with gcore

InfrastructureLinux

pspy: spy on processes without root

InfrastructureLinux

RCE via git hooks

InfrastructureLinux

RCE with Mercurial (hg) hooks

InfrastructureLinux

Databases11

Adminer + LOAD DATA LOCAL INFILE

WebMulti

Command execution in MSSQL (xp_cmdshell)

InfrastructureWindows

IMPERSONATE in MSSQL (EXECUTE AS LOGIN)

InfrastructureMulti

MSSQL Linked Servers

InfrastructureMulti

MySQL UDF abuse (raptor_udf2)

InfrastructureLinux

Oracle TNS (enumeration and RCE)

InfrastructureMulti

PostgreSQL RCE via COPY ... PROGRAM (CVE-2019-9193)

InfrastructureLinux

Redis enumeration

InfrastructureMulti

Redis RCE via MODULE LOAD

InfrastructureLinux

Redis RCE via rogue server (replication)

InfrastructureLinux

Rogue MySQL server (LOAD DATA LOCAL INFILE)

InfrastructureMulti

Network & service enumeration14

Anonymous FTP

InfrastructureMulti

DNS zone transfer (AXFR)

InfrastructureMulti

From version to exploit

InfrastructureMulti

Ident user enumeration

InfrastructureLinux

IKE Aggressive Mode + PSK cracking

InfrastructureMulti

IMAP / POP3 Enumeration

InfrastructureMulti

IPMI Hash Dump (CVE-2013-4786)

InfrastructureMulti

Port Scanning (Nmap)

InfrastructureMulti

R-Services Abuse (rlogin, rsh, rexec)

InfrastructureLinux

rsync Enumeration

InfrastructureLinux

SMTP open relay

InfrastructureMulti

SMTP user enumeration (VRFY/EXPN/RCPT)

InfrastructureMulti

SNMP enumeration

InfrastructureMulti

SSH user enumeration (CVE-2018-15473)

InfrastructureLinux

Hash & file cracking8

Cisco Type 7 Password Decode

InfrastructureMulti

Cracking /etc/shadow

InfrastructureLinux

Cracking a password-protected PDF

InfrastructureMulti

Cracking protected files (.zip, .pfx, .kdbx)

InfrastructureMulti

Hash Cracking

InfrastructureMulti

KeePass Cracking

InfrastructureMulti

Password Mutation & Custom Wordlists

Active DirectoryMulti

VNC Password Decryption

InfrastructureWindows

Credential access (spray, reuse, hunting)4

Credential Hunting

InfrastructureMulti

Credential reuse

WebMulti

Password Spraying

Active DirectoryMulti

Secret leakage via print jobs

InfrastructureLinux

Steganography & file analysis7

.NET Reversing

InfrastructureWindows

APK analysis (reversing Android apps)

WebMulti

Code execution in LibreOffice via floating frames (CVE-2023-2255)

InfrastructureMulti

Data hidden in images (strings/steganography)

InfrastructureMulti

Decompiling a .jar (secrets in bytecode)

InfrastructureMulti

Depix: reversing pixelation

InfrastructureMulti

RCE via LibreOffice macros (ODT)

WebMulti

Vulnerable file parsers3

ExifTool: RCE via DjVu (CVE-2021-22204)

InfrastructureMulti

PrusaSlicer post_process (CVE-2023-47268)

InfrastructureLinux

RCE in pymatgen via CIF parser (CVE-2024-23346)

WebMulti

Network service exploits7

clamav-milter black-hole-mode RCE (CVE-2007-4560)

InfrastructureLinux

CUPS chain (CVE-2024-47176)

InfrastructureLinux

EternalBlue (MS17-010)

InfrastructureWindows

OpenSMTPD RCE (CVE-2020-7247)

InfrastructureLinux

ProFTPD mod_copy (CVE-2015-3306)

InfrastructureLinux

RCE on an exposed gdbserver

InfrastructureLinux

WinRM over SSL/TLS with certificate authentication

Active DirectoryWindows

Tunneling & pivoting11

Chisel Pivoting (SOCKS5 tunnel)

InfrastructureMulti

DNS Tunneling

InfrastructureMulti

Dynamic Port Forwarding (SOCKS)

InfrastructureMulti

ICMP Tunneling

InfrastructureMulti

Local port forwarding (SSH tunnel)

InfrastructureMulti

Pivoting with Ligolo-ng

InfrastructureMulti

Pivoting with sshuttle

InfrastructureLinux

Port Forwarding with netsh (portproxy)

InfrastructureWindows

Port Relay with socat

InfrastructureMulti

Remote Port Forwarding

InfrastructureMulti

SocksOverRDP Pivoting (double hop over RDP)

InfrastructureWindows

Payload obfuscation & evasion1

Payload Obfuscation & Evasion

WebMulti

General4

Abusing a Kubernetes cluster

InfrastructureLinux

Privilege escalation through the lxd group

InfrastructureLinux

Privileged groups on Linux

InfrastructureLinux

Wildcard abuse (wildcard injection)

InfrastructureLinux