notes
What I know: how things work, plus the cheat sheets I keep open while working.
Command Injection notes 4 min 18 Jul 2026 Command injection (OS command injection) is when user input is passed into a system shell, so the input can append its own OS commands. Kerberos Delegation notes 2 min 01 Aug 2026 Delegation lets a service act on behalf of a user to reach a second service (the Kerberos "double hop"). LibreOffice Macros notes 4 min 29 Aug 2026 An ODT is a ZIP container that can carry a Basic macro library, and LibreOffice runs document macros on events such as the document being opened. LLMNR Poisoning and NTLM Relay notes 3 min 01 Aug 2026 When a Windows host cannot resolve a name over DNS, it falls back to broadcast name resolution (LLMNR, NBT-NS, mDNS) and asks the whole local segment "who is X?". pyGPOAbuse notes 3 min 25 Aug 2026 Partial Python port of SharpGPOAbuse. Silver and Golden Tickets notes 3 min 01 Aug 2026 Forged Kerberos tickets, built offline from a stolen key and injected without the DC ever issuing them. SSH Tunnels notes 2 min 08 Sept 2026 SSH port forwarding carries TCP through an SSH connection, so a port on one end answers on the other. Text4Shell notes 1 min 08 Sept 2026 Apache Commons Text 1.5 through 1.9 (CVE-2022-42889, fixed in 1.10) expands `${prefix:name...}` lookups in any string passed through its default StringSubstitutor, and the `script` lookup hands the expression to the JVM's JavaScript engine, so `${script:javascript:...}` runs arbitrary Java. Windows Autoruns and Scheduled Tasks notes 2 min 22 Jul 2026 A group of misconfigurations that all end the same way: place or modify something a privileged trigger later executes. Windows Credential Hunting notes 5 min 22 Jul 2026 Windows stores passwords in several places, some of them insecurely, and admins reuse them. WPScan notes 2 min 18 Jul 2026 WPScan enumerates WordPress sites for users, plugins, themes, and known vulnerabilities. AD Persistence notes 1 min 01 Aug 2026 Persistence keeps access to a domain after full compromise. DCSync notes 1 min 01 Aug 2026 DCSync abuses the directory replication protocol (MS-DRSR / DRSUAPI). kerbrute notes 1 min 01 Aug 2026 Kerbrute abuses Kerberos pre-authentication to test usernames and passwords against a DC quickly. SearchSploit notes 1 min 18 Jul 2026 SearchSploit searches the local Exploit-DB copy included with Kali. SMB Enumeration notes 3 min 21 Jul 2026 SMB on 139/445 exposes file shares and host information, often without credentials. Service Exploits notes 2 min 19 Jul 2026 A service is a program running in the background, accepting input or doing periodic work. Mass Assignment notes 2 min 07 Aug 2026 A mass assignment bug is a controller that binds a whole request hash onto a model in one call, so every column becomes settable from the request, including ones the form never showed. SSH Key Access notes 7 min 24 Jul 2026 Planting an SSH public key is often faster and more stable than a reverse shell, and it is the only option when a server is publickey-only. WebDAV notes 5 min 03 Aug 2026 WebDAV (RFC 4918) extends HTTP with verbs that turn a web server into a writable filesystem: `PROPFIND` to list, `MKCOL` to create a directory, and `PUT`, `DELETE`, `COPY`, `MOVE`, `LOCK` to manage files. Weak File Permissions notes 2 min 19 Jul 2026 Sensitive system files are protected by their permissions, not by secrecy. NFS no_root_squash notes 1 min 19 Jul 2026 NFS shares are exported from `/etc/exports`. Docker Cheat Sheet notes 1 min 27 May 2026 The Docker commands I keep looking up: running containers, building images, networks, volumes, Compose, and cleanup. Docker Foundations notes 6 min 27 May 2026 What a container is and isn't, why images are layered, and how the Dockerfile, networking, volumes, and registries fit together. Linux Cheat Sheet notes 1 min 27 May 2026 The Linux commands I keep looking up day to day: navigation, search, processes, services, and packages.