ServMon easy windows ✓ ▶ AV and EDR evasion (root) LFI / path traversal Public CVE exploitation Password spraying and valid users Credentials in files Internal services and port forwarding AV and EDR evasion
Giddy medium windows ✓ ▶ AV and EDR evasion (root) Directory brute forcing SQL injection NTLM capture and relay Hash cracking Misconfigured services AppLocker and Constrained Language Mode AV and EDR evasion
Acute hard windows ✓ ▶ AV and EDR evasion (foothold) Password spraying and valid users Remote execution (WinRM, PsExec, WMI) AV and EDR evasion Password reuse SAM/LSA/LSASS dumping AppLocker and Constrained Language Mode Hash cracking Scheduled tasks and admin scripts ACL abuse (BloodHound)
Breadcrumbs hard windows ✓ ▶ AV and EDR evasion (foothold) JWT attacks LFI / path traversal Malicious file upload AV and EDR evasion Cookie or session forging Credentials in the registry and history Credentials in files SQL injection Internal services and port forwarding Reverse engineering Weak or homemade cryptography
Control hard windows ✓ ▶ AV and EDR evasion (foothold) Directory brute forcing Authentication bypass SQL injection AV and EDR evasion Credentials in the registry and history Hash cracking Misconfigured services
Freelancer hard windows ✓ ▶ AV and EDR evasion (foothold) IDOR MSSQL abuse AV and EDR evasion Password spraying and valid users Credentials in files SAM/LSA/LSASS dumping Memory dumps SeBackup / SeRestore Deleted AD objects Kerberos delegation (RBCD)
Helpline hard windows ✓ ▶ AV and EDR evasion (root) Authentication bypass Default credentials Public CVE exploitation Saved credentials / DPAPI Credentials in files SAM/LSA/LSASS dumping AV and EDR evasion Log analysis
RE hard windows ✓ ▶ AV and EDR evasion (foothold) SMB/NFS enumeration Phishing and malicious documents AV and EDR evasion Public CVE exploitation XXE Misconfigured services NTLM capture and relay Hash cracking
Search hard windows ✓ ▶ AV and EDR evasion (root) Password spraying and valid users Credentials in files SMB/NFS enumeration Kerberoasting Hash cracking ACL abuse (BloodHound) gMSA accounts AV and EDR evasion
Tally hard windows ✓ ▶ AV and EDR evasion (root) CMS exploitation Credentials in files Hash cracking SMB/NFS enumeration MSSQL abuse Scheduled tasks and admin scripts SeImpersonate / Potatoes Windows exploits AV and EDR evasion
APT insane windows ✓ ▶ AV and EDR evasion (user) SMB/NFS enumeration Pass-the-hash / ticket Password spraying and valid users SAM/LSA/LSASS dumping Backups and archives Credentials in the registry and history AV and EDR evasion NTLM capture and relay Hash cracking
Coder insane windows ✓ ▶ AV and EDR evasion (foothold) SMB/NFS enumeration CI/CD and build abuse AV and EDR evasion Reverse engineering Weak or homemade cryptography Credentials in files ADCS (certificates)
Ghost insane windows ✓ ▶ AV and EDR evasion (root) Vhost and subdomain fuzzing LDAP injection LFI / path traversal gMSA accounts NTLM capture and relay Pass-the-hash / ticket SeImpersonate / Potatoes Domain and forest trusts MSSQL abuse AV and EDR evasion
HackBack insane windows ✓ ▶ AV and EDR evasion (user) Command injection Default credentials Internal services and port forwarding Remote execution (WinRM, PsExec, WMI) Other token privileges Scheduled tasks and admin scripts AV and EDR evasion Misconfigured services
Mist insane windows ✓ ▶ AV and EDR evasion (foothold) LFI / path traversal Public CVE exploitation AV and EDR evasion Hash cracking Phishing and malicious documents ADCS (certificates) DCSync gMSA accounts Kerberos delegation (RBCD) NTLM capture and relay Shadow Credentials SAM/LSA/LSASS dumping
Multimaster insane windows ✓ ▶ AV and EDR evasion (user) API enumeration Domain LDAP/RPC enumeration SQL injection Remote execution (WinRM, PsExec, WMI) Hash cracking ACL abuse (BloodHound) AS-REP roasting Credentials in files AV and EDR evasion Misconfigured services Windows exploits
PivotAPI insane windows ✓ ▶ AV and EDR evasion (root) Metadata and OSINT SMB/NFS enumeration AS-REP roasting Hash cracking Internal services and port forwarding MSSQL abuse Reverse engineering ACL abuse (BloodHound) Kerberos delegation (RBCD) Reading LAPS passwords AV and EDR evasion