Search everything

Guides 14

• Linux privilege escalation: sudo, SUID and capabilities The three checks that give the most roots on Hack The Box: what sudo lets you run, which binaries are SUID and which capabilities they carry, with the usual abuse for each case.
• Reverse shell not connecting or dying: how to fix it Why a reverse shell never arrives, drops instantly or dies on Ctrl+C, how to troubleshoot it step by step, and how to turn it into a full terminal on Linux and Windows.
• Linux kernel exploits: PwnKit, Dirty Pipe and OverlayFS When a kernel exploit makes sense, how to get the exact version, which exploits work in each range (PwnKit, Dirty Pipe, Baron Samedit, OverlayFS) and how to compile them.
• Docker container escape: docker.sock and privileged mode How to tell you are inside a container, what to check and how to break out to the host with docker.sock, --privileged, mounted disks, capabilities or a vulnerable Docker.
• Malicious file upload: bypassing upload filters to get a web shell Upload filter bypass step by step: alternative extensions, Content-Type, magic bytes, .htaccess and web.config, and finding where the file lands to run it.
• OS command injection: detection, blind injection and filter bypasses How to find OS command injection on Linux and Windows, confirm it blind (time, DNS, HTTP) and bypass the most common space, keyword and character filters.
• Kerberoasting and AS-REP Roasting: crackable hashes from Active Directory What makes an account vulnerable, how to request the tickets with Impacket, NetExec or Rubeus, how to crack them with hashcat, and the usual errors (clock, etype, usernames).
• NTLM capture and relay: Responder, ntlmrelayx and coercion with PetitPotam Capture NetNTLMv2 hashes with Responder, learn when they can be relayed (SMB signing, LDAP, ADCS), use ntlmrelayx and coerce auth with PetitPotam.
• SMB and NFS enumeration: shares, null sessions and files full of passwords Enumerate SMB and NFS with NetExec, smbclient, smbmap and enum4linux-ng, with or without credentials: null sessions, files with passwords and no_root_squash.
• Active Directory enumeration: users, LDAP, BloodHound and password spraying What to do when you find a domain controller: enumerate without credentials, get valid users, spray passwords safely and collect BloodHound data.
• MSSQL pentesting: xp_cmdshell, impersonation, linked servers and hash theft Attack SQL Server in a domain: connect with mssqlclient, run commands with xp_cmdshell, escalate with EXECUTE AS, abuse linked servers and steal hashes.
• Insecure deserialization: spotting and exploiting it in Java, .NET, PHP, Python and Node.js Spot serialized data by its first bytes (rO0AB, AAEAAAD, O:, gASV), understand gadget chains and get RCE with ysoserial, ysoserial.net, phpggc and pickle.
• Linux privilege escalation: cron jobs, PATH hijacking, wildcards and the docker or lxd groups When sudo and SUID give nothing: cron jobs with pspy, PATH hijacking, tar and rsync wildcards, and root from the docker, lxd, disk or adm groups.
• Web fuzzing: directories, extensions, subdomains and vhosts with ffuf, gobuster and feroxbuster Find hidden paths, backups, vhosts and exposed .git repos with ffuf and gobuster: which wordlist to use and how to filter out false positives.