notes
What I know: how things work, plus the cheat sheets I keep open while working.
Brute Forcing Logins notes 6 min 04 Aug 2026 Online guessing against a live service: many passwords against one account, until the service answers differently. BloodHound notes 4 min 01 Aug 2026 BloodHound ingests AD data and renders it as a graph of objects and the control relationships between them, then answers attack-path questions like 'shortest path to Domain Admin' directly. Chisel notes 3 min 10 Aug 2026 Chisel is a single Go binary that acts as both client and server, tunneling TCP over one outbound connection the client makes to the server. Cron Jobs notes 9 min 18 Jul 2026 Scheduled jobs run on a timer, often as root. evil-winrm notes 1 min 13 Sept 2026 Interactive PowerShell over WinRM, run from Kali. ExifTool DjVu Injection notes 2 min 25 Jul 2026 ExifTool parses the annotation chunk of a DjVu file and passes its contents through a Perl `eval`, so metadata inside the file becomes code. File Inclusion notes 6 min 21 Jul 2026 A file inclusion bug is a script that builds an `include`/`require` path from user input. File Transfers notes 5 min 22 Jul 2026 Getting tools onto a target after a foothold, and pulling loot back off it. Fixing Public Exploits notes 14 min 22 Jul 2026 Exploits from searchsploit or GitHub rarely run as-is. File Upload notes 6 min 03 Aug 2026 An upload form is a write primitive into the target's filesystem. FTP Enumeration notes 5 min 21 Jul 2026 FTP on 21 is worth three checks: the version banner for a known exploit, anonymous access for readable or writable files, and whether an upload directory doubles as a web root. git-dumper notes 2 min 24 Jul 2026 Rebuilds a git repository from an exposed `.git/` directory over HTTP. Kerberoasting notes 2 min 01 Aug 2026 Kerberoasting targets accounts that have a Service Principal Name (SPN). Kernel Exploits notes 5 min 19 Jul 2026 When the cheaper privilege-escalation vectors (`sudo -l`, SUID, cron, credentials at rest) are exhausted, an old kernel is the fallback. Ligolo-ng notes 8 min 01 Aug 2026 Ligolo-ng creates a TUN-based path through a compromised host. LinEnum notes 1 min 19 Jul 2026 LinEnum is a classic bash privilege-escalation enumeration script. LinPEAS notes 1 min 18 Jul 2026 LinPEAS enumerates a Linux host for privilege escalation vectors and highlights the most promising findings by likelihood. Linux Capabilities notes 3 min 22 Jul 2026 Capabilities split root's power into fine-grained units that can be granted to a single binary. linux-exploit-suggester notes 2 min 05 Aug 2026 `les.sh` maps a kernel version to public local privilege escalation exploits and ranks them. Linux Groups notes 3 min 25 Jul 2026 A supplementary group is an access-control grant that nothing in the user's own home reflects. linux-smart-enumeration notes 1 min 19 Jul 2026 `lse.sh` (linux-smart-enumeration) enumerates a Linux host for privilege-escalation vectors, like [LinPEAS](/collections/oscp/linpeas) but quieter and ranked by verbosity level. Metasploit notes 1 min 08 Sept 2026 The msfconsole workflow: find the module, set the addresses, run it. Mimikatz notes 3 min 01 Aug 2026 Mimikatz extracts secrets from a live Windows host: plaintext passwords, NT hashes, and Kerberos tickets held in memory by LSASS, plus the local SAM and LSA secrets. MySQL Privilege Escalation notes 5 min 18 Jul 2026 A MySQL account with high privileges is a path to the operating system. NTDS.dit Extraction notes 2 min 29 Aug 2026 Offline route to every hash in the domain: copy `ntds.dit` off a running DC and decrypt it on Kali.