notes
What I know: how things work, plus the cheat sheets I keep open while working.
Password Spraying notes 4 min 01 Aug 2026 Spraying is the inverse of [Brute Forcing Logins](/collections/oscp/brute-forcing-logins): one password tried across many accounts, instead of many passwords against one account. PrivescCheck PowerUp SharpUp notes 2 min 29 Aug 2026 Three Windows privilege escalation enumerators that sit between [winPEAS](/collections/oscp/winpeas) and manual triage. pspy notes 2 min 25 Jul 2026 pspy watches process creation and scheduled jobs on a Linux host without root. Restricted Shells notes 2 min 13 Aug 2026 `rbash` (restricted bash, either the account's login shell or plain bash invoked with `argv[0]` starting with `r`) blocks a fixed set of things for the life of the session: `cd`, changing `PATH`, `SHELL`, `ENV`, or `BASH_ENV`, running any command whose name contains a `/` (so no absolute paths and no `./binary`), `exec`, and output redirection (`>`, `>>`, `<>`, `>&`, `&>`). Reverse Shells notes 15 min 18 Jul 2026 A reverse shell makes the target connect back to a listener on the attacker. Rubeus notes 1 min 01 Aug 2026 Rubeus is the Windows-side Kerberos toolkit: it requests and abuses tickets from a domain-joined host, which is where the OSCP assumed breach starts (RDP as the foothold user). Server-Side Template Injection notes 1 min 08 Sept 2026 Server-side template injection (SSTI) is when input reaches a template engine as template code instead of as data. Sudo notes 14 min 19 Jul 2026 `sudo` runs a program with another user's privileges, root by default. Virtual Hosts notes 1 min 19 Jul 2026 One IP can serve many sites. Windows Token Privileges notes 11 min 22 Jul 2026 Windows assigns privileges to users and groups. winPEAS notes 1 min 22 Jul 2026 winPEAS enumerates a Windows host for privilege escalation vectors and highlights the most promising findings. ImageMagick notes 4 min 07 Aug 2026 ImageMagick picks a coder from a file's contents, not its extension, and it shells out in more places than decoding pixels. Webshells notes 5 min 18 Jul 2026 A webshell is a small script left on a web server that runs commands sent through web requests. Windows Service Exploits notes 5 min 22 Jul 2026 Windows services run in the background, often as SYSTEM. DNS Enumeration notes 1 min 24 Jul 2026 DNS resolves names to addresses and stores other records describing a domain. RPC Enumeration notes 1 min 24 Jul 2026 RPC lets a client call functions on another machine. accesschk notes 1 min 22 Jul 2026 accesschk (Sysinternals) reports the effective access a user or group has to services, files, directories, and registry keys. feroxbuster notes 1 min 13 Sept 2026 Rust directory brute forcer whose distinguishing feature is recursion: hits on found directories are themselves enumerated by default. ffuf notes 1 min 13 Sept 2026 Web fuzzer built around a replaceable `FUZZ` keyword and response filtering. hashcat notes 1 min 13 Sept 2026 Password cracker built for GPUs: each hash format needs an explicit mode number, and the right `-m` comes from the format table in [Password Cracking](/collections/oscp/password-cracking). john notes 1 min 13 Sept 2026 Password cracker for offline cracking from Kali: CPU-based, auto-detects hash formats, and needs no GPU or OpenCL backend, which makes it the default for a single hash on the Kali VM. nc notes 1 min 13 Sept 2026 Netcat, the default listener and raw TCP tool on Kali. Password Cracking notes 4 min 22 Jul 2026 Offline recovery of a password from a captured artifact: a protected file, an encrypted key, or a hash. powercat notes 1 min 29 Aug 2026 Netcat written in PowerShell. tmux notes 3 min 24 Jul 2026 Terminal multiplexer for the working environment.