0.6 Attack-surface maps

Discover attack surfaces

• Validate the source path and discover hosts · Commands
• Discover TCP ports with SYN or connect scans · Commands
• Identify applications and validate selected NSE checks · Commands
• Probe UDP and resolve ambiguous silence · Commands
• Validate uncertain results and rebuild the service queue · Commands
• Enumerate reachable endpoints from a Windows source · Commands
• Discriminate unknown listeners and use scanner alternatives · Commands

Extract opportunities from services

• Use anonymous or authenticated FTP file access · Commands
• Use SSH passwords, keys and forwarding-capable access · Commands
• Enumerate SMTP identities and accessible mailbox protocols · Commands
• Expand names through DNS records and zone transfers · Commands
• Inspect RPC/NFS exports and effective file identity · Commands
• Inspect rsync modules and retrieve selected artifacts · Commands
• Retrieve an evidence-backed file over TFTP · Commands
• Enumerate SMB/RPC shares, files and identities · Commands
• Extract configuration and process information through SNMP · Commands
• Use MySQL/MariaDB data and file primitives · Commands
• Use SQL Server rights, impersonation and command facilities · Commands
• Use PostgreSQL data and privileged program execution · Commands
• Inspect Redis access and persistence boundaries · Commands
• Triage Oracle listener and database identity · Commands
• Validate RDP, WinRM, VNC and Telnet access contexts · Commands
• Discover LDAP naming contexts and authenticated search · Commands
• Investigate SIP/IRC identity and configuration clues · Commands
• Inspect a Java RMI registry before selecting an exploit · Checks
• Classify a Tomcat Manager interface and accepted role · Checks
• Follow an MSSQL linked server as a new SQL identity boundary · Checks

Map useful web behavior

• Establish scheme, host, redirects and request state · Commands
• Map functions, roles and normal requests manually · Commands
• Inspect source, backups, configuration and repository artifacts · Commands
• Discover directories and files with controlled response filtering · Commands
• Discover virtual hosts and hostname-selected applications · Commands
• Map parameters, API methods, objects and writable properties · Commands
• Map an authentication, session or multistep web flow · Checks

Turn application weaknesses into access

• Read files through directory traversal · Commands
• Disclose PHP source through an inclusion wrapper · Commands
• Turn controlled local file content into inclusion execution · Commands
• Establish upload acceptance, storage and retrieval · Commands
• Execute an uploaded file through a compatible handler · Commands
• Use upload path control to reach a useful consumer · Commands
• Prove visible or blind operating-system command injection · Commands
• Establish SQL query influence and DBMS context · Commands
• Test a SQL-backed authentication bypass · Commands
• Extract data through UNION and visible SQL results · Commands
• Infer SQL data through boolean or time-based differences · Commands
• Convert database rights into a file or operating-system effect · Commands
• Cross an object-ownership boundary · Commands
• Cross role, function or session authorization boundaries · Commands
• Modify a protected property through excessive writable fields · Commands
• Execute browser code and validate a useful same-origin action · Commands
• Use WordPress component evidence and authorized administration features · Commands
• Use server-side requests to inspect reachable internal behavior · Commands
• Prove server-side template evaluation and identify its engine · Commands
• Use an XML parser's external-entity behavior for bounded file read · Commands
• Test structured NoSQL operator injection with identity controls · Commands
• Match PHP deserialization gadgets to installed dependencies · Commands
• Validate unsafe YAML object construction · Commands
• Test Shellshock only through a confirmed CGI-to-Bash chain · Commands
• Conditional: validate an out-of-band SQL request channel · Commands

Select and adapt public exploits

• Match a public exploit to the actual component and configuration · Commands
• Audit a PoC and reproduce its interpreter/dependency environment · Commands
• Compile and minimally adapt an existing native or memory-corruption PoC · Commands
• Repair a web PoC using the real HTTP transaction · Commands

Recover and use authentication material

• Classify the artifact and its identity context · Commands
• Validate known passwords and context-specific reuse · Commands
• Recover passwords with feasible dictionary, rule and mask attacks · Commands
• Recover a protected KeePass database password · Commands
• Inspect and recover SSH private-key access · Commands
• Recover Linux account passwords from matched records · Commands
• Recover or reuse an NT password hash · Commands
• Recover a password from a captured NTLM response · Commands
• Recover a password from cached domain logon verifiers · Commands
• Classify tickets and use a compatible cache · Commands

Establish sessions and move files

• Verify command execution, host and represented identity · Commands
• Connect a Linux reverse shell through an available interpreter · Commands
• Use Windows authenticated access or a PowerShell command channel · Commands
• Use a bind shell when the target can accept inbound connections · Commands
• Generate a payload matching OS, process, format and handler · Commands
• Repair a limited Linux terminal · Commands
• Transfer over HTTP using Linux or Windows clients · Commands
• Copy files through an authenticated SSH service · Commands
• Move Windows files through an authenticated SMB share · Commands
• Stream a file over a direct TCP connection · Commands
• Move a small artifact through a text-only channel · Commands
• Use a temporary FTP transfer as a constrained fallback · Commands

Escalate privileges on Linux

• Establish Linux state and choose an escalation candidate · Commands
• Prove effective file, directory, ACL and mount control · Commands
• Recover credentials from Linux user, service and process trails · Commands
• Use an allowed sudo operation to cross a privilege boundary · Commands
• Load a controlled library through a permitted sudo environment · Commands
• Use a SUID or SGID program's exposed privileged primitive · Commands
• Use a file capability that enables a specific privileged operation · Commands
• Control a script, binary or configuration consumed by a privileged job/service · Commands
• Hijack an unqualified helper through controlled PATH resolution · Commands
• Turn wildcard-expanded filenames into privileged command options · Commands
• Change a writable account or privilege-policy file · Commands
• Use privileged group, daemon or container-management control · Commands
• Exploit a permission-backed mount, NFS mapping or local service · Commands
• Control a privileged program's shared-library resolution · Commands
• Select an evidence-matched Linux software or kernel exploit · Commands
• Use enumeration tools to generate manually testable candidates · Commands

Escalate privileges on Windows

• Establish Windows token, host and process context · Commands
• Prove effective file, registry and service-object permissions · Commands
• Recover Windows application, history and stored-credential artifacts · Commands
• Change a privileged service's executable configuration · Commands
• Replace a privileged service binary or consumed file · Commands
• Exploit an unquoted service path with a writable earlier prefix · Commands
• Control a privileged DLL, helper or configuration load · Commands
• Control scheduled tasks, startup files or autostart consumers · Commands
• Validate elevated installer policy and administrative-token context · Commands
• Select a privilege-backed impersonation or object-control route · Commands
• Use backup privilege to obtain protected local credential material · Commands
• Select a matching application, driver or kernel exploit · Commands
• Turn automated Windows findings into manually verified candidates · Commands
• Inspect host-side RDP enablement and logon policy · Checks

Map Active Directory attack paths

• Establish domain identity, DC, DNS, time and route · Commands
• Enumerate directory objects with native, LDAP and PowerView approaches · Commands
• Read domain shares, SYSVOL and NETLOGON for useful artifacts · Commands
• Identify service accounts and SPNs worth investigating · Commands
• Validate effective directory-object control · Commands
• Validate host access and volatile session candidates · Commands
• Collect focused BloodHound data and validate an attack path · Commands
• Interpret an AD trust as a boundary, not a privilege transition · Checks
• Inspect AD-integrated DNS record control · Checks

Gain a more useful domain identity

• Obtain accessible live logon-session credential material · Commands
• Extract local account hashes from matched SAM and SYSTEM · Commands
• Extract LSA secrets and cached-domain verifiers · Commands
• Use Credential Manager and DPAPI with the protecting context · Commands
• Parse an offline domain database or select a justified remote collection path · Commands
• Request AS-REP material for an account without preauthentication · Commands
• Request a selected service ticket for offline service-account recovery · Commands
• Create a temporary SPN through an effective object right · Commands
• Inventory, convert and import tickets in the correct logon context · Commands
• Forge a service-scoped ticket from the correct service key · Commands
• Reset a target account password through a validated directory right · Commands
• Add a controlled identity to a group through effective membership rights · Commands
• Convert ownership or DACL control into a narrower useful right · Commands
• Use validated directory replication rights for bounded credential proof · Commands
• Conditional: trace GPO control to privileged policy consumption · Commands
• Conditional: use a validated delegation or RBCD relationship · Commands
• Conditional: validate an AD CS enrollment-to-authentication path · Commands
• Conditional: understand a realm-wide TGT forgery from KRBTGT material · Commands
• Read a classic LAPS password for one computer · Checks
• Read or decrypt a Windows LAPS password · Checks
• Recover and classify gMSA material · Checks
• Use a validated shadow-credential path · Checks
• Authenticate to LDAP with a mapped certificate · Checks
• Create a controlled machine account only for a selected AD path · Checks
• Evaluate DNSAdmins without assuming immediate execution · Checks
• Map WSUS client policy to a server-side authorization question · Checks
• Recognize SCCM client context and locate the management boundary · Checks
• Inspect VSS/shadow-copy credential-source conditions · Checks
• Separate an unconstrained-delegation flag from tickets actually present · Checks

Move to another host

• Match route, destination service and effective authorization · Commands
• Execute through uploaded service creation using PsExec · Commands
• Execute commands through service command lines and SMB output · Commands
• Execute through remote Task Scheduler · Commands
• Execute through WMI or native CIM over DCOM · Commands
• Execute through an authorized DCOM application object · Commands
• Use WinRM, WinRS or PowerShell remoting · Commands
• Obtain an authorized RDP interactive session · Commands
• Select password, NT hash, key-to-ticket or ticket authentication · Commands
• Evaluate a direct Net-NTLMv2 relay path without spoofing · Checks

Reach internal services

• Discover pivot interfaces, routes and internal service context · Commands
• Relay a single TCP service through a fixed forward · Commands
• Forward a selected service through an SSH client-side listener · Commands
• Provide SOCKS access through SSH dynamic forwarding · Commands
• Expose an SSH-client-side destination through a server-side remote listener · Commands
• Expose a server-side SOCKS proxy through remote dynamic SSH forwarding · Commands
• Use ProxyChains, native SOCKS clients and SSH jump paths appropriately · Commands
• Route a selected subnet through sshuttle · Commands
• Forward from Windows with OpenSSH, Plink or Netsh · Commands
• Use a reverse Chisel SOCKS or fixed TCP tunnel · Commands
• Use forward Chisel SOCKS and version-supported UDP routing · Commands
• Route a selected internal subnet through Ligolo-ng · Commands
• Preserve DNS, Kerberos names and time across a pivot · Commands
• Build the callback and delivery routes separately from the attack route · Commands
• Compose multiple pivots and validate every connection leg · Commands
• Conditional: tunnel through controlled DNS infrastructure · Commands

Resolve payload execution obstacles

• Use a gated Office macro delivery chain · Commands
• Use a Windows Library/WebDAV/shortcut chain with explicit interaction · Commands
• Match an artifact to its executable consumer and runtime · Commands
• Repair quoting, encoding and command-length boundaries · Commands
• Distinguish PowerShell policy, language mode and protected execution layers · Commands
• Interpret endpoint-control evidence and select a justified alternative · Commands
• Pair staged payloads with the correct handler and session lifecycle · Commands
• Use a framework module with explicit target and feature constraints · Commands
• Diagnose connection direction, listener and session failures in order · Commands

Complete attacks and retain reproducible evidence

• Maintain state and select the next evidence-producing test · Commands
• Integrate a standalone or assumed-breach AD attack · Commands
• Recover from dead ends without repeating disproven paths · Commands
• Capture state-transition, proof and exploit-adaptation evidence · Commands
• Build and validate the report and submission artifacts · Commands