SUMMARY.md

Table of contents

• 🏠 /home/kabaneridev/.pt-notes

🏆 Certification Preparation

• ✅ CPTS - Completed

  • 🌐 Infrastructure Enumeration
  • 🛡️ Firewall Evasion
  • 🔍 Vulnerability Assessment
  • 📂 File Transfer Methods
    • 📂 Windows File Transfer Methods
    • 🐧 Linux File Transfer Methods
    • ⚡ Code File Transfer Methods
    • 🔀 Miscellaneous File Transfer Methods
    • 🔒 Protected File Transfer Methods
    • 🎭 Living off The Land File Transfers
    • 👁️ File Transfer Detection
  • 🐚 Shells & Payloads
    • 🔧 Shell Basics
    • 💥 Payloads
    • 🪟 Windows Shells
    • 🐧 NIX Shells
    • 🌐 Web Shells
  • 🗄️ Database Services
    • MySQL Enumeration
    • MSSQL Enumeration
    • Oracle TNS Enumeration
    • SQL Basics
    • SQL Injection Cheatsheet
  • 📁 Network Services
    • FTP Enumeration
    • SMB Enumeration
    • NFS Enumeration
    • SMTP Enumeration
    • Email Services (IMAP/POP3)
    • SNMP Enumeration
    • IPMI Enumeration
  • ⚔️ Attacking Common Services
    • 📁 FTP Attacks
    • 🔗 SMB Attacks
    • 🗄️ SQL Database Attacks
    • 🌐 DNS Attacks
    • 🖥️ RDP Attacks
    • 📧 Email Services Attacks
    • 🎯 Skills Assessment Scenarios
  • 🔀 Pivoting, Tunneling & Port Forwarding
    • 📋 Module Overview
    • 🔧 SSH Tunneling Complete Guide
    • 🌐 Dynamic Port Forwarding
    • 🔄 Remote Port Forwarding
    • ⚡ Chisel SOCKS5 Tunneling
    • 🛡️ SSHuttle Pivoting
    • 🎯 Meterpreter Tunneling
    • 🔗 Socat Redirection
    • 🪟 Plink Windows Pivoting
    • ⚙️ Netsh Port Forwarding
    • 🔌 SocksOverRDP
    • 🕸️ Rpivot Web Pivoting
    • 🌐 DNS Tunneling with dnscat2
    • 📡 ICMP Tunneling with ptunnel-ng
    • 🏆 Complete Skills Assessment
  • 🏰 Active Directory Enumeration & Attacks
    • 🔍 Initial Domain Enumeration
    • ☣️ LLMNR/NBT-NS Poisoning from Linux
    • 🪟 LLMNR/NBT-NS Poisoning from Windows
    • 🔐 Password Policy Enumeration
    • 👥 Password Spraying - Target User Lists
    • 🐧 Password Spraying from Linux
    • 🪟 Password Spraying from Windows
    • 🛡️ Security Controls Enumeration
    • 🐧 Credentialed Enumeration from Linux
    • 🪟 Credentialed Enumeration from Windows
    • 🏴‍☠️ Living Off the Land
    • 🎫 Kerberoasting from Linux
    • 🎫 Kerberoasting from Windows
    • 🔑 ACL Enumeration
    • 🎯 ACL Abuse Tactics
    • 💎 DCSync Attack
    • 🔐 Privileged Access
    • 🎭 Kerberos "Double Hop" Problem
    • ⚡ Bleeding Edge Vulnerabilities
    • 🔧 Miscellaneous Misconfigurations
    • 🔗 Domain Trusts Primer
    • ⬆️ Child → Parent Trust Attacks
    • 🐧 Child → Parent Trust Attacks - from Linux
    • 🌲 Cross-Forest Trust Abuse - from Windows
    • 🐧 Cross-Forest Trust Abuse - from Linux
    • 🎯 Skills Assessment Part I - Complete Walkthrough
    • 🚀 Skills Assessment Part II - Advanced Professional Methodology
  • 🖥️ Remote Management
    • Remote Management Overview
    • Linux Remote Protocols
    • Windows Remote Protocols
  • 🕷️ Web Enumeration
    • Web Information Gathering
    • Subdomain Enumeration
    • Web Application Enumeration
  • 🌐 Web Application Attacks
    • 🔥 Cross-Site Scripting (XSS)
    • 📁 File Inclusion
      • Basic LFI Techniques
      • Advanced Bypasses & PHP Filters
      • PHP Wrappers for RCE
      • Remote File Inclusion (RFI)
      • File Upload + LFI
      • Log Poisoning Techniques
      • Automated Scanning & Tools
      • Prevention & Hardening
      • Skills Assessment Walkthrough
    • 📤 File Upload Attacks
      • Upload Exploitation
      • Client-Side Validation
      • Blacklist Filters
      • Basic Bypass Techniques
      • Type Filters
      • Limited File Uploads
      • Advanced Bypass Methods
      • Other Upload Attacks
      • Prevention & Hardening
      • 🎯 Skills Assessment
    • ⚡ Command Injection
      • Detection Methods
      • Basic Exploitation
      • Advanced Operators
      • Filter Identification
      • Bypassing Space Filters
      • Bypassing Character Filters
      • Bypassing Blacklisted Commands
      • Advanced Command Obfuscation
      • Evasion Tools
      • 🎯 Skills Assessment
    • 🌐 Web Attacks
      • HTTP Verb Tampering
      • Insecure Direct Object References (IDOR)
      • XML External Entity (XXE) Injection
      • 🎯 Skills Assessment
    • ⚔️ Attacking Common Applications
      • WordPress Discovery & Enumeration
      • WordPress Attacks & Exploitation
      • Joomla Discovery & Enumeration
      • Joomla Attacks & Exploitation
      • Drupal Discovery & Enumeration
      • Drupal Attacks & Exploitation
      • Tomcat Discovery & Enumeration
      • Tomcat Attacks & Exploitation
      • Jenkins Discovery & Enumeration
      • Jenkins Attacks & Exploitation
      • Splunk Discovery & Enumeration
      • Splunk Attacks & Exploitation
      • GitLab Discovery & Enumeration
      • ColdFusion Discovery & Enumeration
      • IIS Tilde Enumeration
      • CGI Shellshock Attacks
      • LDAP Injection Attacks
      • osTicket Attacks
      • PRTG Attacks
      • Binary Reverse Engineering
      • Other Notable Applications
  • 🔐 Password Attacks & Lateral Movement
    • 📋 Complete Assessment Workflows
      • 🎯 Skills Assessment - Complete Password Attacks Workflow
    • 🎯 Active Directory Attacks
      • NTDS.dit Extraction & Analysis
      • Active Directory Attacks
    • ⚔️ Lateral Movement Techniques
      • Pass the Hash (PtH) Attacks
      • Pass the Ticket (PtT) Attacks
      • 📜 Pass the Certificate (ESC8 & ADCS)
      • Pass the Ticket from Linux
    • 🪟 Windows Password Attacks
      • Windows Password Techniques
      • Credential Hunting in Windows
    • 🐧 Linux Password Attacks
      • Credential Hunting in Linux
    • 🌐 Network & Service Attacks
      • Network Services Brute Force
      • Network Traffic Credential Hunting
      • Network Shares Credential Hunting
    • 🔨 Hash Cracking & Tools
      • Hashcat Techniques
      • John the Ripper
      • Custom Wordlists & Rules
      • Cracking Protected Files
  • 🪟 Windows Privilege Escalation
    • 📋 Module Overview
    • 🔍 Situational Awareness
    • 📊 Initial Enumeration
    • 🔄 Communication with Processes
    • 🥔 SeImpersonate & SeAssignPrimaryToken
    • 🔍 SeDebugPrivilege
    • 🏠 SeTakeOwnershipPrivilege
    • 🏛️ Windows Built-in Groups
    • 📋 Event Log Readers
    • 🌐 DnsAdmins
    • 💻 Hyper-V Administrators
    • 🖨️ Print Operators
    • 🖥️ Server Operators
    • 🛡️ UAC Bypass
    • 🔐 Weak Permissions
    • 💣 Kernel Exploits
    • ⚡ Vulnerable Services
    • 🔑 Credential Hunting
    • 📁 Other Files
    • 🕵️ Further Credential Theft
    • 🚪 Citrix Breakout
    • 👥 Interacting with Users
    • 🎯 Pillaging
    • 🔧 Miscellaneous Techniques
    • 🖥️ Windows Server 2008
    • 💻 Windows 7 Exploitation
  • 🐧 Linux Privilege Escalation
    • 📋 Module Overview
    • 🔍 Environment Enumeration
    • 🔧 Services & Internals Enumeration
    • 🔍 Credential Hunting
    • 🛤️ PATH Abuse
    • 🌟 Wildcard Abuse
    • 🚪 Escaping Restricted Shells
    • 🔐 Special Permissions
    • ⚡ Sudo Rights Abuse
    • 👑 Privileged Groups
    • 🎭 Capabilities
    • ⚙️ Vulnerable Services
    • ⏰ Cron Job Abuse
    • 🐳 LXD Container Escape
    • 🐋 Docker Container Escape
    • 📜 Logrotate Exploitation
    • 🔧 Miscellaneous Techniques
    • 📚 Shared Libraries
    • 🎯 Shared Object Hijacking
    • 🐍 Python Library Hijacking
    • 🚨 Sudo CVE Exploits
    • 🔐 Polkit/Pwnkit
    • 💧 Dirty Pipe
    • 🌐 Netfilter Kernel Exploits
    • 🛡️ Linux Hardening
  • 📋 Documentation & Reporting
    • 📝 Notetaking & Organization
    • 📊 Types of Reports
    • 📋 Components of a Report
    • 🔍 How to Write Up a Finding
    • 🛠️ Reporting Tips and Tricks
    • 📁 HTB Academy Example
  • 🌐 Attacking Enterprise Networks
    • 🔍 External Information Gathering
    • ⚔️ Service Enumeration & Exploitation
    • 🌐 Web Enumeration & Exploitation
    • 🚀 Initial Access
    • 🔒 Post-Exploitation Persistence
    • 🔍 Internal Information Gathering
    • ⚔️ Exploitation & Privilege Escalation
    • 🔄 Lateral Movement
    • 👑 Active Directory Compromise
    • 🏆 Post-Exploitation

• 📘 CWEE Preparation

  • Injection Attacks
    • Introduction
    • XPath Injection
      • Authentication Bypass
      • Data Exfiltration
      • Advanced Data Exfiltration
      • Blind Exploitation
      • Prevention & Tools
    • LDAP Injection
      • Authentication Bypass
      • Data Exfiltration & Blind Exploitation
      • Prevention
    • HTML Injection in PDF Generators
      • Exploitation
      • Prevention
    • NoSQL Injection
      • Bypassing Authentication
      • In-Band Data Extraction
      • Blind Data Extraction
      • Automating Blind Extraction
      • Server-Side JavaScript Injection
  • Attacking Authentication Mechanisms
    • JWT
      • Attacking Signature Verification
      • Attacking the Signing Secret
      • Algorithm Confusion
      • Further JWT Attacks
      • JWT Tools & Prevention
    • OAuth
      • Stealing Access Tokens
      • Improper CSRF Protection
      • Additional OAuth Vulnerabilities
      • Prevention
    • SAML
      • Signature Exclusion Attack
      • Signature Wrapping Attack
      • Additional SAML Vulnerabilities
      • SAML Tools & Prevention
  • Advanced XSS and CSRF Exploitation
    • Lab Environment
    • [CSRF Exploitation]
      • Same-Origin Policy & CORS
      • CORS Misconfigurations
      • Bypassing CSRF Tokens via CORS
      • Misc CSRF Exploitation
      • CSRF Prevention
    • [XSS Exploitation]
      • Introduction
      • Launching Attacks from Victim's Session
      • Enumerating Internal APIs
      • Exploiting Internal Web Apps I
      • Exploiting Internal Web Apps II
      • Content-Security Policy (CSP)
      • Bypassing Weak CSPs
      • XSS Filter Bypasses
      • XSS Prevention
    • Skills Assessment
  • Abusing HTTP Misconfigurations
    • [Host Header Attacks]
      • Introduction
      • Bypassing Flawed Validation
      • Password Reset Poisoning
      • Web Cache Poisoning
      • Web Cache Deception
      • Prevention
    • [Web Cache Poisoning]
      • Introduction
      • Identifying Unkeyed Parameters
      • Web Cache Poisoning Attacks
      • Advanced Techniques
      • Tools & Prevention
    • [Session Puzzling]
      • Introduction
      • Weak Session IDs
      • Common Session Variables - Auth Bypass
      • Common Session Variables - Account Takeover
      • Premature Session Population
      • Prevention
      • Skills Assessment
    • Skills Assessment
  • HTTP Attacks
    • [CRLF Injection]
      • Introduction
      • Log Injection
      • HTTP Response Splitting
      • SMTP Header Injection
      • Prevention
    • [HTTP Request Smuggling]
      • Introduction
      • CL.TE Vulnerabilities
      • TE.CL Vulnerabilities
      • TE.TE Vulnerabilities
      • Vulnerable Software
      • Exploitation Techniques
      • Prevention
    • [HTTP/2 Downgrading]
      • Introduction
      • Downgrading Attacks
      • Advanced H2 Vulnerabilities
      • Tools & Prevention
    • Skills Assessment
  • HTTPS/TLS Attacks
    • [Introduction to HTTPS/TLS]
      • Public Key Infrastructure
      • TLS 1.2 Handshake
      • TLS 1.3
    • [Padding Oracle Attacks]
      • Padding Oracles
      • POODLE & BEAST
      • Bleichenbacher & DROWN
    • [Misc Attacks & Misconfigurations]
      • Heartbleed Bug
    • [Further Attacks]
      • SSL Stripping
      • Cryptographic Attacks
      • Downgrade Attacks
    • Testing TLS Configuration
    • Skills Assessment
  • Blind SQL Injection
    • Introduction to Blind SQLi
    • [Boolean-based SQLi]
      • Identifying Boolean-based
      • Designing the Oracle
      • Extracting Data
      • Optimizing
    • [Time-based SQLi]
      • Identifying Time-based
      • Designing Time Oracle
      • Data Extraction
      • OOB DNS Exfiltration
    • [MSSQL-specific Attacks]
      • Remote Code Execution
      • Leaking NetNTLM Hashes
      • File Read
    • Prevention
    • Skills Assessment
  • Whitebox Pentesting
    • [Process]
      • Overview
      • Code Review
      • Local Testing
      • Proof of Concept
      • Patching & Remediation
    • [Code Review Case Study]
      • Authentication
      • Services
    • [Local Testing Case Study]
      • Planning
      • Eval Injection
      • Target Function
      • Code Injection
    • [PoC Case Study]
      • Command Execution
      • HTTP Response Injection
      • Blind Exploitation
      • Exploit Development
    • Applied Patching
  • Modern Web Exploitation
    • [DNS Rebinding]
      • Introduction
      • SSRF Filter Bypasses
      • DNS Rebinding SSRF Bypass
      • SOP Bypass
      • Tools & Prevention
    • [Second-Order Attacks]
      • Introduction
      • Second-Order IDOR (Whitebox)
      • Second-Order IDOR (Blackbox)
      • Second-Order LFI
      • Second-Order Command Injection
    • [WebSocket Attacks]
      • Introduction
      • Burp Analysis
      • XSS via WebSockets
      • SQLi via WebSockets
      • CSWH
      • Tools & Prevention
    • Skills Assessment
  • [Deserialization Attacks]
    • Introduction to Serialization
    • Introduction to Deserialization Attacks
    • [PHP Deserialization]
      • Identifying Vulnerability

• ✅ PJPT - Completed

  • 🎯 Quick Reference
  • ✅ Master Checklist
  • 📊 Mind Maps & Attack Flows
    • Attack Flow Diagram
    • Techniques Mind Map
  • 🎯 Active Directory Techniques
    • LLMNR Poisoning
    • Kerberoasting
    • GPP/cPassword Attacks
    • Pass Attacks (PTH/PTT)
    • Domain Enumeration
    • Golden Ticket Attacks
    • IPv6 Attacks
    • SMB Relay Attacks
    • Token Impersonation
    • NTDS.dit Extraction
    • Windows Persistence
    • Post-Compromise Strategy
  • 🌐 Web & Wireless
    • SQL Injection Techniques
    • WPA2 PSK Cracking

---

🔧 Core Knowledge Areas

• 🔍 Information Gathering

  • 📋 OSCP Tools Restrictions

• 🐧 Linux Privilege Escalation

  • Enumeration
  • Programs, Jobs and Services
  • Environment Variables Abuse
  • Capabilities Abuse
  • Persistence
  • Security Bypass
  • Privilege Escalation Checklist

• 🪟 Windows Privilege Escalation

  • Enumeration
  • Credential Hunting
  • Service Exploitation
  • Registry Exploits
  • Scheduled Tasks
  • Token Impersonation
  • Kernel Exploits
  • Privilege Escalation Checklist

• 🛠️ Tools & Utilities

  • Nmap
  • Gobuster
  • John the Ripper
  • Hydra
  • Linux Commands Cheatsheet
  • Windows Commands Cheatsheet
  • File Transfer Techniques