0.2 Attack Strategy Map

Main index | Study sequence | Shared concepts | Cheatsheets

Choose an objective, compare the methods by their prerequisites, then open a self-contained entry. Each entry explains how to find its enabling conditions, why it works, how to execute and verify it, how failures change the decision, and which methods its result can unlock.

The map contains 174 documented methods across 15 topic guides, accounting for all 15 speedrun blocks and the eight grouped study units. Counts describe this preparation inventory, not every vulnerability or environment-specific chain that can exist.

For Active Directory, use the numbered AD Notes, including raw-output comparisons, approach selection and unanswered changed-condition cases.

0.2.1 Discover the clue before choosing a method

Follow starting access → investigation location → discovery action → illustrative evidence → recognition → missing-condition checks → method selection. Each entry distinguishes enabled-after-validation, ruled-out and inconclusive examples.

Begin with the topic workflow when you do not yet have a useful clue:

Test discovery and prerequisite reasoning with the unanswered recognition cases before consulting the explanations.

0.2.2 Start from your current capability

0.2.3 All objectives and methods

0.2.3.1 Discover attack surfaces

0.2.3.1.1 Source and reachability

• Validate the source path and discover hosts
• Enumerate reachable endpoints from a Windows source

0.2.3.1.2 Transport coverage and application identity

• Discover TCP ports with SYN or connect scans
• Probe UDP and resolve ambiguous silence
• Identify applications and validate selected NSE checks
• Discriminate unknown listeners and use scanner alternatives

0.2.3.1.3 Evidence and re-enumeration

• Validate uncertain results and rebuild the service queue

0.2.3.2 Extract opportunities from services

0.2.3.2.1 File and shell access

• Use anonymous or authenticated FTP file access
• Enumerate SMB/RPC shares, files and identities
• Inspect RPC/NFS exports and effective file identity
• Inspect rsync modules and retrieve selected artifacts
• Retrieve an evidence-backed file over TFTP
• Use SSH passwords, keys and forwarding-capable access

0.2.3.2.2 Identity and configuration disclosure

• Expand names through DNS records and zone transfers
• Extract configuration and process information through SNMP
• Enumerate SMTP identities and accessible mailbox protocols
• Discover LDAP naming contexts and authenticated search

0.2.3.2.3 Database privileges and primitives

• Use MySQL/MariaDB data and file primitives
• Use SQL Server rights, impersonation and command facilities
• Use PostgreSQL data and privileged program execution
• Inspect Redis access and persistence boundaries
• Triage Oracle listener and database identity

0.2.3.2.4 Remote access and uncommon applications

• Validate RDP, WinRM, VNC and Telnet access contexts
• Investigate SIP/IRC identity and configuration clues

0.2.3.3 Map useful web behavior

0.2.3.3.1 Application identity and hosts

• Establish scheme, host, redirects and request state
• Discover virtual hosts and hostname-selected applications

0.2.3.3.2 Functions, artifacts and content

• Map functions, roles and normal requests manually
• Inspect source, backups, configuration and repository artifacts
• Discover directories and files with controlled response filtering

0.2.3.3.3 Inputs, objects and APIs

• Map parameters, API methods, objects and writable properties

0.2.3.4 Turn application weaknesses into access

0.2.3.4.1 File read and interpreted inclusion

• Read files through directory traversal
• Disclose PHP source through an inclusion wrapper
• Turn controlled local file content into inclusion execution

0.2.3.4.2 File writes and consuming handlers

• Establish upload acceptance, storage and retrieval
• Execute an uploaded file through a compatible handler
• Use upload path control to reach a useful consumer

0.2.3.4.3 Command and database injection

• Prove visible or blind operating-system command injection
• Establish SQL query influence and DBMS context
• Test a SQL-backed authentication bypass
• Extract data through UNION and visible SQL results
• Infer SQL data through boolean or time-based differences
• Convert database rights into a file or operating-system effect
• Conditional: validate an out-of-band SQL request channel

0.2.3.4.4 Application authorization and browser context

• Cross an object-ownership boundary
• Cross role, function or session authorization boundaries
• Modify a protected property through excessive writable fields
• Execute browser code and validate a useful same-origin action

0.2.3.4.5 Product features and server-side requests

• Use WordPress component evidence and authorized administration features
• Use server-side requests to inspect reachable internal behavior

0.2.3.4.6 Conditional parser, template and component paths

• Prove server-side template evaluation and identify its engine
• Use an XML parser's external-entity behavior for bounded file read
• Test structured NoSQL operator injection with identity controls
• Match PHP deserialization gadgets to installed dependencies
• Validate unsafe YAML object construction
• Test Shellshock only through a confirmed CGI-to-Bash chain

0.2.3.5 Recover and use authentication material

0.2.3.5.1 Classification and online use

• Classify the artifact and its identity context
• Validate known passwords and context-specific reuse

0.2.3.5.2 Offline recovery and protected files

• Recover passwords with feasible dictionary, rule and mask attacks
• Recover a protected KeePass database password
• Inspect and recover SSH private-key access
• Recover Linux account passwords from matched records

0.2.3.5.3 Typed Windows/domain material

• Recover or reuse an NT password hash
• Recover a password from a captured NTLM response
• Recover a password from cached domain logon verifiers
• Classify tickets and use a compatible cache

0.2.3.6 Select and adapt public exploits

0.2.3.6.1 Selection and local runtime

• Match a public exploit to the actual component and configuration
• Audit a PoC and reproduce its interpreter/dependency environment

0.2.3.6.2 Native and web adaptation

• Compile and minimally adapt an existing native or memory-corruption PoC
• Repair a web PoC using the real HTTP transaction

0.2.3.7 Establish sessions and move files

0.2.3.7.1 Execution and connection direction

• Verify command execution, host and represented identity
• Connect a Linux reverse shell through an available interpreter
• Use Windows authenticated access or a PowerShell command channel
• Use a bind shell when the target can accept inbound connections

0.2.3.7.2 Payload and terminal compatibility

• Generate a payload matching OS, process, format and handler
• Repair a limited Linux terminal

0.2.3.7.3 File transport and integrity

• Transfer over HTTP using Linux or Windows clients
• Copy files through an authenticated SSH service
• Move Windows files through an authenticated SMB share
• Stream a file over a direct TCP connection
• Move a small artifact through a text-only channel
• Use a temporary FTP transfer as a constrained fallback

0.2.3.8 Escalate privileges on Linux

0.2.3.8.1 Identity, permissions and secret sources

• Establish Linux state and choose an escalation candidate
• Prove effective file, directory, ACL and mount control
• Recover credentials from Linux user, service and process trails

0.2.3.8.2 Delegated and executable privilege

• Use an allowed sudo operation to cross a privilege boundary
• Load a controlled library through a permitted sudo environment
• Use a SUID or SGID program's exposed privileged primitive
• Use a file capability that enables a specific privileged operation

0.2.3.8.3 Privileged consumers and resolution

• Control a script, binary or configuration consumed by a privileged job/service
• Hijack an unqualified helper through controlled PATH resolution
• Turn wildcard-expanded filenames into privileged command options
• Control a privileged program's shared-library resolution
• Change a writable account or privilege-policy file

0.2.3.8.4 Daemon, mount and software routes

• Use privileged group, daemon or container-management control
• Exploit a permission-backed mount, NFS mapping or local service
• Select an evidence-matched Linux software or kernel exploit

0.2.3.8.5 Candidate generation

• Use enumeration tools to generate manually testable candidates

0.2.3.9 Escalate privileges on Windows

0.2.3.9.1 Token, ACL and credential state

• Establish Windows token, host and process context
• Prove effective file, registry and service-object permissions
• Recover Windows application, history and stored-credential artifacts

0.2.3.9.2 Services and privileged consumers

• Change a privileged service's executable configuration
• Replace a privileged service binary or consumed file
• Exploit an unquoted service path with a writable earlier prefix
• Control a privileged DLL, helper or configuration load
• Control scheduled tasks, startup files or autostart consumers

0.2.3.9.3 Installer and token-backed operations

• Validate elevated installer policy and administrative-token context
• Select a privilege-backed impersonation or object-control route
• Use backup privilege to obtain protected local credential material

0.2.3.9.4 Software and candidate generation

• Select a matching application, driver or kernel exploit
• Turn automated Windows findings into manually verified candidates

0.2.3.10 Map Active Directory attack paths

0.2.3.10.1 Domain context and directory objects

• Establish domain identity, DC, DNS, time and route
• Enumerate directory objects with native, LDAP and PowerView approaches

0.2.3.10.2 Artifacts and service identities

• Read domain shares, SYSVOL and NETLOGON for useful artifacts
• Identify service accounts and SPNs worth investigating

0.2.3.10.3 Effective rights, host access and path ranking

• Validate effective directory-object control
• Validate host access and volatile session candidates
• Collect focused BloodHound data and validate an attack path

0.2.3.11 Gain a more useful domain identity

0.2.3.11.1 Host credential sources

• Obtain accessible live logon-session credential material
• Extract local account hashes from matched SAM and SYSTEM
• Extract LSA secrets and cached-domain verifiers
• Use Credential Manager and DPAPI with the protecting context
• Parse an offline domain database or select a justified remote collection path

0.2.3.11.2 Password-derived ticket recovery

• Request AS-REP material for an account without preauthentication
• Request a selected service ticket for offline service-account recovery
• Create a temporary SPN through an effective object right

0.2.3.11.3 Ticket capabilities

• Inventory, convert and import tickets in the correct logon context
• Forge a service-scoped ticket from the correct service key

0.2.3.11.4 Object-backed identity changes and replication

• Reset a target account password through a validated directory right
• Add a controlled identity to a group through effective membership rights
• Convert ownership or DACL control into a narrower useful right
• Use validated directory replication rights for bounded credential proof

0.2.3.11.5 Conditional policy, delegation and certificate paths

• Conditional: trace GPO control to privileged policy consumption
• Conditional: use a validated delegation or RBCD relationship
• Conditional: validate an AD CS enrollment-to-authentication path
• Conditional: understand a realm-wide TGT forgery from KRBTGT material

0.2.3.12 Check which other hosts your current identity can access Move to another host

0.2.3.12.1 Route, authorization and authentication material

• Match route, destination service and effective authorization
• Select password, NT hash, key-to-ticket or ticket authentication

0.2.3.12.2 Service and scheduled-task execution

• Execute through uploaded service creation using PsExec
• Execute commands through service command lines and SMB output
• Execute through remote Task Scheduler

0.2.3.12.3 Management protocol execution

• Execute through WMI or native CIM over DCOM
• Execute through an authorized DCOM application object
• Use WinRM, WinRS or PowerShell remoting

0.2.3.12.4 Interactive access

• Obtain an authorized RDP interactive session

0.2.3.13 Reach internal services

0.2.3.13.1 Network position and fixed relays

• Discover pivot interfaces, routes and internal service context
• Relay a single TCP service through a fixed forward

0.2.3.13.2 SSH listener direction and proxy access

• Forward a selected service through an SSH client-side listener
• Provide SOCKS access through SSH dynamic forwarding
• Expose an SSH-client-side destination through a server-side remote listener
• Expose a server-side SOCKS proxy through remote dynamic SSH forwarding
• Use ProxyChains, native SOCKS clients and SSH jump paths appropriately

0.2.3.13.3 Transparent and Windows forwarding

• Route a selected subnet through sshuttle
• Forward from Windows with OpenSSH, Plink or Netsh

0.2.3.13.4 Alternative carriers and routed agents

• Use a reverse Chisel SOCKS or fixed TCP tunnel
• Use forward Chisel SOCKS and version-supported UDP routing
• Route a selected internal subnet through Ligolo-ng
• Conditional: tunnel through controlled DNS infrastructure

0.2.3.13.5 Names, return paths and multiple hops

• Preserve DNS, Kerberos names and time across a pivot
• Build the callback and delivery routes separately from the attack route
• Compose multiple pivots and validate every connection leg

0.2.3.14 Resolve payload execution obstacles

0.2.3.14.1 Client-side delivery and interaction

• Use a gated Office macro delivery chain
• Use a Windows Library/WebDAV/shortcut chain with explicit interaction

0.2.3.14.2 Format, parser and control boundaries

• Match an artifact to its executable consumer and runtime
• Repair quoting, encoding and command-length boundaries
• Distinguish PowerShell policy, language mode and protected execution layers
• Interpret endpoint-control evidence and select a justified alternative

0.2.3.14.3 Handlers, framework state and callbacks

• Pair staged payloads with the correct handler and session lifecycle
• Use a framework module with explicit target and feature constraints
• Diagnose connection direction, listener and session failures in order

0.2.3.15 Complete attacks and retain reproducible evidence

0.2.3.15.1 State, chain selection and recovery

• Maintain state and select the next evidence-producing test
• Integrate a standalone or assumed-breach AD attack
• Recover from dead ends without repeating disproven paths

0.2.3.15.2 Transition evidence and reporting

• Capture state-transition, proof and exploit-adaptation evidence
• Build and validate the report and submission artifacts

0.2.4 Follow the result into the next method

0.2.4.1 Paper-based chain rehearsal

• Linux standalone: Validate the source path and discover hosts → Discover TCP ports with SYN or connect scans → Establish scheme, host, redirects and request state → Map functions, roles and normal requests manually → Read files through directory traversal → Classify the artifact and its identity context → Validate known passwords and context-specific reuse → Use SSH passwords, keys and forwarding-capable access → Establish Linux state and choose an escalation candidate → Use an allowed sudo operation to cross a privilege boundary → Establish Linux state and choose an escalation candidate.

• Windows standalone: Validate the source path and discover hosts → Discover TCP ports with SYN or connect scans → Establish scheme, host, redirects and request state → Map functions, roles and normal requests manually → Establish upload acceptance, storage and retrieval → Execute an uploaded file through a compatible handler → Verify command execution, host and represented identity → Establish Windows token, host and process context → Change a privileged service's executable configuration → Establish Windows token, host and process context.

• AD roast and movement: Establish domain identity, DC, DNS, time and route → Enumerate directory objects with native, LDAP and PowerView approaches → Request a selected service ticket for offline service-account recovery → Recover passwords with feasible dictionary, rule and mask attacks → Validate known passwords and context-specific reuse → Match route, destination service and effective authorization → Use WinRM, WinRS or PowerShell remoting → Establish Windows token, host and process context → Select a privilege-backed impersonation or object-control route → Obtain accessible live logon-session credential material → Recover or reuse an NT password hash → Select password, NT hash, key-to-ticket or ticket authentication → Execute through uploaded service creation using PsExec.

• AD replication and evidence: Establish domain identity, DC, DNS, time and route → Enumerate directory objects with native, LDAP and PowerView approaches → Validate effective directory-object control → Use validated directory replication rights for bounded credential proof → Capture state-transition, proof and exploit-adaptation evidence → Build and validate the report and submission artifacts.

• Pivoted domain access: Discover pivot interfaces, routes and internal service context → Route a selected internal subnet through Ligolo-ng → Preserve DNS, Kerberos names and time across a pivot → Establish domain identity, DC, DNS, time and route → Enumerate directory objects with native, LDAP and PowerView approaches → Collect focused BloodHound data and validate an attack path → Validate effective directory-object control → Add a controlled identity to a group through effective membership rights → Use WinRM, WinRS or PowerShell remoting.

• Execution and callback repair: Verify command execution, host and represented identity → Connect a Linux reverse shell through an available interpreter → Diagnose connection direction, listener and session failures in order → Pair staged payloads with the correct handler and session lifecycle → Verify command execution, host and represented identity.

At every arrow identify the produced capability and the next method's missing prerequisite. An expected result in these examples is hypothetical, not recorded lab evidence.

0.2.5 Study order and boundaries

Use Units 1–8 in the speedrun study sequence: Blocks 1+2; 3+4; 5; 6+7; 8 then 9; 13 fundamentals then 10→11→12; remaining 14; and 15. Relevant execution diagnostics recur throughout.

Core methods follow the established OSCP preparation route. AD CS, delegation/RBCD, broader GPO/ticket-forging branches and less-common service/tunnel options retain their explicit conditional context. Their prerequisites must be verified before selecting them.

Dedicated buffer-overflow and shellcode development remain excluded by learner choice; selecting, compiling and adapting an existing memory-corruption PoC remains covered. Commercial/mass vulnerability scanners, automatic exploitation and prohibited spoofing workflows are not operational exam paths. Some course topics therefore have recognition-only or conditional treatment. Read the current official exam guide before choosing restricted framework features; the Body of Knowledge describes competencies separately from tool permission.

Concept study includes the worked commands and reasoning here. Practical exploitation and independent retests follow the learner's explicit closure of the concept phase. Study coverage is separate from practical competence.