My progress
Stored only in this browser, no account needed. If you switch computers, export it and import it again.
0machines done
0Linux
0Windows
0of 97 techniques practised
Techniques you have not touched yet
Mark machines as done (✓ button) and you will see what you are missing here.
- API enumeration
- Directory brute forcing
- Domain LDAP/RPC enumeration
- Exposed .git repository
- Metadata and OSINT
- SMB/NFS enumeration
- SNMP enumeration
- Vhost and subdomain fuzzing
- Wi-Fi attacks
- Authentication bypass
- CI/CD and build abuse
- CMS exploitation
- Command injection
- Cross-Site Scripting (XSS)
- CSRF
- Default credentials
- GraphQL
- IDOR
- IIS and ASP.NET
- Insecure deserialization
- JWT attacks
- LDAP injection
- LFI / path traversal
- Malicious file upload
- Mass assignment
- NoSQL injection
- Phishing and malicious documents
- Public CVE exploitation
- Remote file inclusion (RFI)
- Server-Side Template Injection
- SQL injection
- SSRF
- XXE
- Container escape
- Cron jobs and processes
- Kernel or system exploit
- Library hijacking
- Linux capabilities
- PATH hijacking
- Privileged groups
- SSH keys
- Sudo abuse
- SUID binaries
- Symlink abuse
- Wildcard injection
- AlwaysInstallElevated
- Credentials in the registry and history
- DLL hijacking
- Misconfigured services
- Other token privileges
- Privileged Windows groups
- Saved credentials / DPAPI
- Scheduled tasks and admin scripts
- SeBackup / SeRestore
- SeImpersonate / Potatoes
- UAC bypass
- Windows exploits
- ACL abuse (BloodHound)
- ADCS (certificates)
- AS-REP roasting
- BadSuccessor (dMSA)
- DCSync
- Deleted AD objects
- Domain and forest trusts
- gMSA accounts
- GPP and GPO abuse
- Kerberoasting
- Kerberos delegation (RBCD)
- NTLM capture and relay
- Pass-the-hash / ticket
- Password spraying and valid users
- Reading LAPS passwords
- Shadow Credentials
- WSUS abuse
- Credentials in files
- Internal services and port forwarding
- MSSQL abuse
- Password reuse
- Remote execution (WinRM, PsExec, WMI)
- SAM/LSA/LSASS dumping
- AppLocker and Constrained Language Mode
- AV and EDR evasion
- Format string
- Race condition
- Reverse engineering
- ROP / ret2libc
- Stack buffer overflow
- Cookie or session forging
- Hash cracking
- Padding oracle
- Weak or homemade cryptography
- Backups and archives
- Git history
- Log analysis
- Memory dumps
- Steganography
- Traffic analysis (pcap)
Want to do
Press "I want to do it" on a machine to add it here.
Done
- Cross-Site Scripting (XSS)
- CSRF
- SQL injection
- SSRF
- Saved credentials / DPAPI
- ADCS (certificates)
- NTLM capture and relay
- Pass-the-hash / ticket
- Password spraying and valid users
- Credentials in files
- Internal services and port forwarding
- SAM/LSA/LSASS dumping
- ACL abuse (BloodHound)
- GPP and GPO abuse
- Hash cracking
- Vhost and subdomain fuzzing
- Default credentials
- Insecure deserialization
- Command injection
- Password spraying and valid users
- Credentials in files
- Internal services and port forwarding
- Weak or homemade cryptography
- Backups and archives
- Saved credentials / DPAPI
- AppLocker and Constrained Language Mode