Search Ctrl K ES

All machines

Filters platform, OS, difficulty, phase and techniques

Platform OS Difficulty Category Phase Hide the ones I have done

Specific techniques (1 selected)

Tick several to find machines that use all of them.

Reconnaissance Anonymous FTP 9 API enumeration 16 Directory brute forcing 62 Domain LDAP/RPC enumeration 19 Exposed .git repository 10 Metadata and OSINT 11 SMB/NFS enumeration 43 SNMP enumeration 6 Vhost and subdomain fuzzing 52 Wi-Fi attacks 3

Web Authentication bypass 25 CI/CD and build abuse 4 CMS exploitation 33 Command injection 51 Cross-Site Scripting (XSS) 16 CSRF 4 Default credentials 19 GraphQL 2 IDOR 7 IIS and ASP.NET 9 Insecure deserialization 22 JWT attacks 9 LDAP injection 2 LFI / path traversal 55 Malicious file upload 54 Mass assignment 5 NoSQL injection 1 Phishing and malicious documents 14 Prototype pollution 1 Public CVE exploitation 131 Remote file inclusion (RFI) 4 Server-Side Template Injection 13 SQL injection 38 SSRF 17 XXE 5

Linux privilege escalation Container escape 23 Cron jobs and processes 45 Kernel or system exploit 8 Library hijacking 8 Linux capabilities 10 PATH hijacking 16 Privileged groups 16 SSH keys 46 Sudo abuse 91 SUID binaries 28 Symlink abuse 8 Wildcard injection 5

Windows privilege escalation AlwaysInstallElevated 1 Credentials in the registry and history 14 DLL hijacking 7 Misconfigured services 9 Other token privileges 8 Privileged Windows groups 4 Saved credentials / DPAPI 12 Scheduled tasks and admin scripts 10 SeBackup / SeRestore 3 SeImpersonate / Potatoes 14 UAC bypass 1 Windows exploits 17

Active Directory ACL abuse (BloodHound) 33 ADCS (certificates) 17 AS-REP roasting 8 BadSuccessor (dMSA) 2 DCSync 9 Deleted AD objects 5 Domain and forest trusts 2 gMSA accounts 13 GPP and GPO abuse 5 Kerberoasting 13 Kerberos delegation (RBCD) 13 NTLM capture and relay 29 Pass-the-hash / ticket 15 Password spraying and valid users 38 Reading LAPS passwords 3 Shadow Credentials 10 WSUS abuse 2

Post-exploitation and lateral movement Credentials in files 118 Internal services and port forwarding 58 MSSQL abuse 17 Password reuse 27 Remote execution (WinRM, PsExec, WMI) 40 SAM/LSA/LSASS dumping 16

Defense evasion AppLocker and Constrained Language Mode 11 AV and EDR evasion 17