IDOR

Access other users' resources by changing an ID. Used in 6 machines, sorted from easiest to hardest. The ▶ link takes you to the minute of the video where it is used.

Hide the ones I have done

Cap

easy linux

▶ IDOR (foothold)

IDOR
Traffic analysis (pcap)
Password reuse
Linux capabilities

Nocturnal

easy linux

▶ IDOR (foothold)

Directory brute forcing
Command injection
IDOR
Hash cracking
Public CVE exploitation
Internal services and port forwarding

Agile

medium linux

▶ IDOR (user)

LFI / path traversal
IDOR
Credentials in files
Internal services and port forwarding
Public CVE exploitation
Sudo abuse

Era

medium linux

▶ IDOR (foothold)

Directory brute forcing
Vhost and subdomain fuzzing
Authentication bypass
IDOR
Backups and archives
Cron jobs and processes
Privileged groups

Freelancer

hard windows

▶ IDOR (foothold)

IDOR
MSSQL abuse
AV and EDR evasion
Password spraying and valid users
Credentials in files
SAM/LSA/LSASS dumping
Memory dumps
SeBackup / SeRestore
Deleted AD objects
Kerberos delegation (RBCD)

Perspective

insane windows

▶ IDOR (foothold)

IDOR
IIS and ASP.NET
Insecure deserialization
Malicious file upload
SSRF
Cookie or session forging
Command injection
SeImpersonate / Potatoes
Internal services and port forwarding
Padding oracle

Often goes with

Internal services and port forwarding
Command injection
Credentials in files
Directory brute forcing
Public CVE exploitation
Authentication bypass
AV and EDR evasion
Backups and archives

Combine this technique with others in the search →