notes
What I know: how things work, plus the cheat sheets I keep open while working.
Web Content Discovery notes 9 min 18 Jul 2026 Web servers rarely link to everything they host. Windows Remote Access notes 3 min 24 Jul 2026 RDP and WinRM usually become useful after credentials surface. Base64 and Encodings notes 1 min 18 Jul 2026 Encoded data shows up constantly: in files left on web servers, in config values, in tokens. Linux Permissions notes 4 min 19 Jul 2026 Every Linux privilege escalation is an access-control violation, and access control in Linux is built on permissions. Network Services Handbook notes 3 min 24 Jul 2026 Port numbers suggest what may be running, but the banner and protocol response decide what the service actually is. Privilege Escalation (Windows) notes 4 min 22 Jul 2026 Goal: turn a low-privilege shell into one running as Administrator or SYSTEM. Active Directory notes 3 min 01 Aug 2026 Active Directory (AD) is both a directory of an organisation's users, groups, and computers, and the management layer that controls them. Privilege Escalation (Linux) notes 4 min 18 Jul 2026 Goal: turn a low-privilege shell into root. Tunneling and Pivoting notes 7 min 01 Aug 2026 Pivoting uses a compromised host as a path into a network the attacker machine has no route to. Information Gathering notes 6 min 18 Jul 2026 Start automation and manual enumeration together. Active Directory Enumeration notes 10 min 01 Aug 2026 Enumeration is most of the work in an AD assessment. Burp Suite notes 2 min 22 Jul 2026 Intercepting proxy for web testing. Credential Hunting notes 8 min 19 Jul 2026 A password reused by root is one of the cheapest escalations there is. Database Enumeration notes 11 min 21 Jul 2026 Credentials pulled from an app config (`db.php`, `wp-config.php`, `configuration.php`, `.env`) open the database behind the app. icacls notes 2 min 25 Aug 2026 Built-in Windows tool that prints and changes NTFS permissions on files and folders. Impacket notes 3 min 25 Aug 2026 Python collection for AD network protocols: SMB, WMI, Kerberos, LDAP, DRSUAPI, MSSQL. LAPS notes 2 min 03 Aug 2026 LAPS (Local Administrator Password Solution) exists because every machine deployed from one image shares one local Administrator password, so a single dumped hash pass-the-hashes across the whole estate. msfvenom notes 3 min 03 Aug 2026 Metasploit's payload generator, usable entirely on its own. NetExec notes 4 min 01 Aug 2026 NetExec is the maintained successor to CrackMapExec (CME), which was abandoned in 2023; the community forked it and renamed the binary `nxc`. SMTP Enumeration notes 3 min 22 Jul 2026 SMTP on 25 is a mail server, and the useful checks are three: read the banner for the daemon and version, ask the server which users exist with `VRFY`/`EXPN`, and test whether it will relay mail. SNMP Enumeration notes 3 min 22 Jul 2026 SNMP is a management protocol that answers queries about a host: users, running processes, installed software, network interfaces, and listening ports. SQL Injection notes 6 min 18 Jul 2026 SQL injection (SQLi) happens when user input is placed into a database query without being kept separate from the query's code. SUID Binaries notes 12 min 18 Jul 2026 A SUID (SetUID) binary runs with the effective UID of its owner, not the user who launched it. ACL Abuse notes 2 min 01 Aug 2026 Every AD object carries a DACL that lists who can do what to it. AS-REP Roasting notes 1 min 01 Aug 2026 AS-REP roasting targets accounts that have Kerberos pre-authentication disabled (`DONT_REQ_PREAUTH`).