Techniques
Pick a technique to see which machines use it and jump to that minute of the video.
Reconnaissance
- API enumeration Discover the endpoints of a REST API 15 machines
- Directory brute forcing Enumerate web paths with gobuster/ffuf/feroxbuster 42 machines
- Domain LDAP/RPC enumeration Users, groups and descriptions with ldapsearch, rpcclient, netexec or RID brute forcing 18 machines
- Exposed .git repository Download a .git folder published on the website 10 machines
- Metadata and OSINT Users or data taken from file metadata 10 machines
- SMB/NFS enumeration Accessible SMB or NFS shares 34 machines
- SNMP enumeration Extract information with snmpwalk/onesixtyone 6 machines
- Vhost and subdomain fuzzing Discover hidden virtual hosts or subdomains 47 machines
- Wi-Fi attacks Crack WPA/WPS or set up an evil twin 3 machines
Web
- Authentication bypass Get past a login (type juggling or broken logic) 22 machines
- CI/CD and build abuse Run code in pipelines, Jenkins, git hooks or build events 4 machines
- CMS exploitation WordPress/Joomla/Drupal and vulnerable plugins 22 machines
- Command injection Run system commands from a parameter 40 machines
- Cross-Site Scripting (XSS) Inject JavaScript that another user runs 14 machines
- CSRF Force another user to perform an action 4 machines
- Default credentials Panels with factory username/password 17 machines
- GraphQL Introspection and abuse of GraphQL APIs 2 machines
- IDOR Access other users' resources by changing an ID 6 machines
- IIS and ASP.NET Upload .aspx/.config, abuse web.config or ViewState on IIS servers 9 machines
- Insecure deserialization Tampered serialized objects (PHP/Java/Python/.NET) 20 machines
- JWT attacks Tamper with or forge JSON Web Tokens 9 machines
- LDAP injection Bypass a login or extract LDAP data with tampered filters 2 machines
- LFI / path traversal Read local files through inclusion or traversal 50 machines
- Malicious file upload Bypass upload filters to get a webshell 46 machines
- Mass assignment Add extra fields (role/admin) to a request 5 machines
- NoSQL injection Injection in MongoDB and similar databases 1 machine
- Phishing and malicious documents Send an email or document (macro, ODT, HTA, LNK) that another user opens 14 machines
- Public CVE exploitation Use a public exploit for known software 110 machines
- Remote file inclusion (RFI) Include a remote file controlled by the attacker 3 machines
- Server-Side Template Injection Injection in template engines (Jinja2/Twig...) 12 machines
- SQL injection Manual SQL injection or with sqlmap 31 machines
- SSRF Make the server send requests for us 15 machines
- XXE XML external entities to read files 4 machines
Linux privilege escalation
- Container escape Break out of Docker/LXD or abuse the docker/lxd group 16 machines
- Cron jobs and processes Scheduled scripts run by root (pspy) 31 machines
- Kernel or system exploit DirtyCow/DirtyPipe/PwnKit and similar 7 machines
- Library hijacking Python library hijacking/LD_PRELOAD/shared objects 5 machines
- Linux capabilities Binaries with dangerous capabilities 4 machines
- PATH hijacking Hijack commands called by relative path 8 machines
- Privileged groups Abuse groups such as adm/disk/video 10 machines
- SSH keys Steal or write SSH keys (id_rsa/authorized_keys) 33 machines
- Sudo abuse Commands allowed with sudo -l (GTFOBins) 61 machines
- SUID binaries Exploitable binaries with the SUID bit 16 machines
- Symlink abuse Trick privileged scripts with symlinks 8 machines
- Wildcard injection Abuse * in commands such as tar or chown 2 machines
Windows privilege escalation
- AlwaysInstallElevated Install an MSI as SYSTEM 1 machine
- Credentials in the registry and history Autologon, PowerShell history, Unattend.xml or Windows configuration files 14 machines
- DLL hijacking Plant a malicious DLL that a privileged program or service loads 7 machines
- Misconfigured services Weak permissions or unquoted service paths 7 machines
- Other token privileges SeLoadDriver, SeManageVolume, SeDebug, SeTakeOwnership and similar 6 machines
- Privileged Windows groups DnsAdmins, Server/Account/Print Operators, Event Log Readers... 4 machines
- Saved credentials / DPAPI Saved credentials or credentials protected with DPAPI 12 machines
- Scheduled tasks and admin scripts Scripts or tasks run by another user that we can modify 9 machines
- SeBackup / SeRestore Copy SAM/NTDS thanks to backup privileges 3 machines
- SeImpersonate / Potatoes Juicy/Rogue/God Potato with SeImpersonatePrivilege 14 machines
- UAC bypass Elevate from medium to high integrity admin 1 machine
- Windows exploits MS17-010, PrintNightmare, HiveNightmare, kernel exploits and similar 15 machines
Active Directory
- ACL abuse (BloodHound) GenericWrite/GenericAll/WriteDACL found with BloodHound 33 machines
- ADCS (certificates) Vulnerable ESC1-ESC16 templates with Certipy 17 machines
- AS-REP roasting Accounts without Kerberos pre-authentication 8 machines
- BadSuccessor (dMSA) Abuse Windows Server 2025 dMSA accounts to inherit privileges 2 machines
- DCSync Dump the domain hashes with secretsdump 9 machines
- Deleted AD objects Recover users or attributes from the AD recycle bin 5 machines
- Domain and forest trusts Move from a child domain or forest to another (SID history, ExtraSIDs) 2 machines
- gMSA accounts Read the password of a group managed service account (ReadGMSAPassword) 13 machines
- GPP and GPO abuse Passwords in Groups.xml (cpassword) or edit a group policy 5 machines
- Kerberoasting Request TGS for service accounts and crack them 12 machines
- Kerberos delegation (RBCD) Unconstrained, constrained or resource-based delegation (S4U) 13 machines
- NTLM capture and relay Force authentications (Responder, SCF/LNK files, coercion) to capture or relay hashes 28 machines
- Pass-the-hash / ticket Authenticate with an NTLM hash or Kerberos ticket 14 machines
- Password spraying and valid users Try one password against many users; validate users with Kerbrute 37 machines
- Reading LAPS passwords Get the local administrator password from LAPS 3 machines
- Shadow Credentials Write msDS-KeyCredentialLink to authenticate as another user 10 machines
- WSUS abuse Push a malicious update from a WSUS server 2 machines
Post-exploitation and lateral movement
- Credentials in files Passwords in configuration files or databases 99 machines
- Internal services and port forwarding Reach services that only listen on localhost 56 machines
- MSSQL abuse xp_cmdshell, impersonation, linked servers or hash theft with xp_dirtree 17 machines
- Password reuse The same password works for another user or service 24 machines
- Remote execution (WinRM, PsExec, WMI) Connect with credentials through evil-winrm, psexec, wmiexec or RunasCs 39 machines
- SAM/LSA/LSASS dumping Extract hashes and secrets with mimikatz, secretsdump or pypykatz 14 machines
Defense evasion
Binary exploitation (pwn)
- Format string Format string vulnerabilities 1 machine
- Race condition Exploit timing windows (TOCTOU) 4 machines
- Reverse engineering Analyse binaries with Ghidra/IDA/gdb 37 machines
- ROP / ret2libc Return Oriented Programming to bypass NX/ASLR 3 machines
- Stack buffer overflow Classic overflow to control EIP/RIP 10 machines
Cryptography and cracking
Forensics
- Backups and archives Exposed backups or password-protected zips 23 machines
- Git history Secrets in old commits 9 machines
- Log analysis Sensitive information in log files 13 machines
- Memory dumps Analyse memory or process dumps 8 machines
- Steganography Data hidden in images or audio 3 machines
- Traffic analysis (pcap) Credentials or data in network captures 12 machines