Technique guides
Practical cheat sheets for when you are in front of a box: what to try, which commands to run and why. Every guide ends with real machines to practise it, linked to the exact minute of the video.
Reconnaissance
- Web fuzzing: directories, extensions, subdomains and vhosts with ffuf, gobuster and feroxbuster Find hidden paths, backups, vhosts and exposed .git repos with ffuf and gobuster: which wordlist to use and how to filter out false positives. 3 min read
- SMB and NFS enumeration: shares, null sessions and files full of passwords Enumerate SMB and NFS with NetExec, smbclient, smbmap and enum4linux-ng, with or without credentials: null sessions, files with passwords and no_root_squash. 4 min read
Web
- SQL injection: from a single quote to dumping the database How to detect SQLi, extract data with UNION, blind or time-based, read files and when to reach for sqlmap. With a per-engine cheat sheet (MySQL, PostgreSQL, MSSQL, SQLite). 4 min read
- SSTI: fingerprinting the template engine and getting RCE Detect server-side template injection, work out whether it is Jinja2, Twig, FreeMarker, ERB or Mako, and the payloads to run commands on each one. 3 min read
- LFI: from reading /etc/passwd to running commands Local file inclusion step by step: path traversal and its bypasses, PHP wrappers, which files to read on Linux and Windows, and the routes to turn an LFI into RCE. 4 min read
- Malicious file upload: bypassing upload filters to get a web shell Upload filter bypass step by step: alternative extensions, Content-Type, magic bytes, .htaccess and web.config, and finding where the file lands to run it. 4 min read
- OS command injection: detection, blind injection and filter bypasses How to find OS command injection on Linux and Windows, confirm it blind (time, DNS, HTTP) and bypass the most common space, keyword and character filters. 4 min read
- SSRF: using the server to reach internal services and the cloud SSRF step by step: detect it, scan internal ports, bypass localhost filters with redirects and alternative IPs, read AWS metadata and attack Redis with gopher. 4 min read
- XXE: reading server files with XML external entities What XXE is, how to find it in APIs, SVG and Office documents, read files with php://filter, blind XXE with an external DTD, and chaining it into SSRF. 4 min read
- JWT attacks: alg none, weak secrets, algorithm confusion and kid injection How to read a JSON Web Token, crack its secret with hashcat, abuse alg none and RS256 to HS256 confusion, and inject into the kid and jku headers to sign your own tokens. 4 min read
- IDOR, mass assignment and APIs: the access control flaws scanners miss Enumerate an API (Swagger, hidden routes, versions), find IDORs by changing IDs, become admin with mass assignment and test access control with two users. 3 min read
- Exploiting a public CVE: finding, reading and fixing exploits from searchsploit and GitHub From a version number to a shell: identify the software, search searchsploit, GitHub and nuclei, read the exploit before running it and fix the broken ones. 4 min read
- Insecure deserialization: spotting and exploiting it in Java, .NET, PHP, Python and Node.js Spot serialized data by its first bytes (rO0AB, AAEAAAD, O:, gASV), understand gadget chains and get RCE with ysoserial, ysoserial.net, phpggc and pickle. 4 min read
Linux privilege escalation
- Linux privilege escalation: sudo, SUID and capabilities The three checks that give the most roots on Hack The Box: what sudo lets you run, which binaries are SUID and which capabilities they carry, with the usual abuse for each case. 4 min read
- Port forwarding and pivoting: SSH, chisel and socat How to reach a service that only listens on 127.0.0.1 or sits on another internal network: local, remote and dynamic SSH tunnels, chisel when there is no SSH, socat and proxychains. 3 min read
- Linux privilege escalation: cron jobs, PATH hijacking, wildcards and the docker or lxd groups When sudo and SUID give nothing: cron jobs with pspy, PATH hijacking, tar and rsync wildcards, and root from the docker, lxd, disk or adm groups. 4 min read
Windows privilege escalation
- SeImpersonatePrivilege and Potatoes: from service account to SYSTEM on Windows What SeImpersonate means, why IIS and MSSQL service accounts have it, and which Potato fits each Windows version: PrintSpoofer, GodPotato, JuicyPotatoNG. 4 min read
- Windows privilege escalation: services, unquoted paths, DLL hijacking and AlwaysInstallElevated Find and abuse Windows services with weak permissions, unquoted paths, DLL hijacking, scheduled tasks and AlwaysInstallElevated, by hand or with winPEAS. 4 min read
Active Directory
- Active Directory enumeration: users, LDAP, BloodHound and password spraying What to do when you find a domain controller: enumerate without credentials, get valid users, spray passwords safely and collect BloodHound data. 4 min read
- Kerberoasting and AS-REP Roasting: crackable hashes from Active Directory What makes an account vulnerable, how to request the tickets with Impacket, NetExec or Rubeus, how to crack them with hashcat, and the usual errors (clock, etype, usernames). 3 min read
- Active Directory ACL abuse: GenericAll, WriteDacl, Shadow Credentials and DCSync What to do with each BloodHound edge: reset passwords, add yourself to groups, Shadow Credentials, grant yourself DCSync with WriteDacl, read LAPS or gMSA. 4 min read
- ADCS with Certipy: from a vulnerable certificate template to Domain Admin (ESC1 to ESC16) Find vulnerable ADCS templates and CAs with Certipy and exploit ESC1, ESC4, ESC7, ESC8, ESC9 and ESC16, with the typical error for each case. 4 min read
- Kerberos delegation: unconstrained, constrained and RBCD explained and exploited The three kinds of Kerberos delegation in AD, how to find them, and how to abuse each with getST, rbcd.py and addcomputer to impersonate the administrator. 4 min read
- NTLM capture and relay: Responder, ntlmrelayx and coercion with PetitPotam Capture NetNTLMv2 hashes with Responder, learn when they can be relayed (SMB signing, LDAP, ADCS), use ntlmrelayx and coerce auth with PetitPotam. 4 min read
Post-exploitation and lateral movement
- Windows lateral movement: pass-the-hash, pass-the-ticket, WinRM, PsExec and WMI Use a password, NT hash or Kerberos ticket to run commands elsewhere: evil-winrm, psexec, wmiexec, RDP, overpass-the-hash and golden and silver tickets. 4 min read
- Windows credential dumping: SAM, LSA, LSASS, DPAPI and NTDS.dit Where Windows keeps credentials and how to get them: SAM and SYSTEM, LSA secrets, LSASS with lsassy or pypykatz, DPAPI, and NTDS.dit with SeBackup. 4 min read
- MSSQL pentesting: xp_cmdshell, impersonation, linked servers and hash theft Attack SQL Server in a domain: connect with mssqlclient, run commands with xp_cmdshell, escalate with EXECUTE AS, abuse linked servers and steal hashes. 3 min read