9.0 Complete operational task index

Main index | Cheatsheet index

Search this page for a service, tool, technique or failure. Every populated operational procedure and its task headings is indexed below. Applications can use nonstandard ports.

9.0.1 Path and Host Discovery

Open procedure

• 1. Check the path
  • Identify reachable hosts within the assigned scope

9.0.2 TCP Scanning

Open procedure

• 2. Get initial TCP results
  • Find common TCP listeners for an initial service map
  • Selected ports or a range
• 3. Discover listeners across the full TCP port range
  • Discover listeners across the full TCP port range
  • Discovery skips a running target
  • Timing and progress
  • Discover TCP services through an established SOCKS route

9.0.3 Service Identification

Open procedure

• 4. Identify discovered applications
  • Identify applications on discovered ports
  • Select a named script
  • OS fingerprinting and bundled probing

9.0.4 UDP Scanning

Open procedure

• 5. Check UDP separately
  • Common-port samples
  • Selected ports
  • Full UDP coverage when the objective justifies the cost
  • Combined TCP/UDP selection

9.0.5 Scan Results and Next Actions

Open procedure

• 6. Resolve a result that changes your next action
  • Netcat connection check
  • Output and diagnostics
• 7. Build the service queue
• 8. Prioritize and know when to rescan

9.0.6 Windows Network Checks

Open procedure

• Scan a low-port range
• Check a selected port list

9.0.7 Scanner Alternatives and Web Baseline Checks

Open procedure

• RustScan: fast TCP discovery, Nmap interpretation
• Masscan: raw-packet discovery, then validation
• Unknown-port discrimination
• NSE candidate checks
• Nikto: bounded web-server candidate generation
• Sources

9.0.8 Find accessible files and usable access through FTP FTP Enumeration

Open procedure

• Baseline: anonymous access

9.0.9 Validate SSH identity and available access SSH Enumeration and Access Validation

Open procedure

• Baseline: validate one known identity

9.0.10 Identify mail-service identities and supported interactions SMTP Enumeration

Open procedure

• Baseline: banner and capabilities
• POP3 and IMAP handoff

9.0.11 Expand the host map through DNS records and zone transfers DNS Enumeration

Open procedure

• Baseline: query the target DNS server directly

9.0.12 Find accessible exports and validate their permission mappings NFS and Unix RPC Enumeration

Open procedure

• Baseline: list RPC services and exports
• Rsync daemon — list modules before copying
• TFTP — known-name retrieval only
• Sources

9.0.13 Find shares, identities and rights through SMB and RPC SMB and MS-RPC Enumeration

Open procedure

• Baseline: list shares without credentials
• NetBIOS names before SMB enumeration
• SMB/RPC RID lookups when a normal user listing is denied

9.0.14 Find configuration and process leads through readable SNMP objects SNMP Enumeration

Open procedure

• Baseline: find a read community, then walk

9.0.15 Determine which database data and operations your identity can access Database Enumeration and Privilege Boundaries

Open procedure

• Inspect MySQL identity, readable data and file-operation rights
• Inspect SQL Server identity, grants and available operations
  • MSSQL linked-server and login-context mapping
• Inspect PostgreSQL identity, data and server-side operation rights
• Inspect Redis access, data and enabled operations
• Oracle TNS/SID triage
• MongoDB — inspect readable databases with mongosh
• SQLite — inspect a recovered application database

9.0.16 Validate the remote services your Windows identity can access Windows Remote-Access Validation

Open procedure

• RDP baseline: authentication-only check
• RDP host-side inspection: local administrative context
  • 1. Listener, service and configured port
  • 2. NLA, transport security and policy precedence
  • 3. Candidate membership and effective logon rights
  • 4. Source-relative validation and decision
• WinRM baseline: interactive session
• Validate access to an exposed VNC desktop
• Identify the Telnet service and validate available access
• GNU Inetutils telnetd — conditional authentication-bypass check

9.0.17 HTTP and Web Application Mapping

Open procedure

• Baseline the application identity
• Map the application's features, roles and working requests
• Inspect exposed artifacts
• Discover files and directories
• Discover virtual hosts
• Discover parameters and object values
• Map API methods, schema and authorization
• Continue with the capability your result enables
• wfuzz alternative for paths and form values
• HTTP proxy variables — control which client request goes through Burp
• Extract candidate paths from a downloaded JavaScript file
• Sources

9.0.18 Find domain identities and validate directory access LDAP and Kerberos Enumeration

Open procedure

• Baseline: discover naming contexts
• Check which directory objects are readable without credentials
• Query directory objects with your accepted identity
• Kerberos prerequisites before an attack
• Continue with the capability your result enables
• Sources

9.0.19 SIP and IRC Triage

Open procedure

• Find SIP identity and configuration clues
• Find IRC identity and configuration clues
• Sources

9.0.20 Memcached and WebDAV

Open procedure

• Memcached — inspect cache data through TCP
• WebDAV — list, retrieve and test the actual write boundary

9.0.21 Obtain an authorized interactive desktop session RDP Access

Open procedure

• Baseline: prompt for the password

9.0.22 Web File Read, Inclusion and Upload Paths

Open procedure

• Directory traversal: prove file read
• PHP inclusion: retrieve source
• LFI to command execution through a writable/readable log
• Upload: establish the primitive
• Upload: verify executable handling
• Upload with path control
• Continue with the capability your result enables
• PHP include control — generate a filter chain when uploads are unavailable
• Image/PDF upload plus inclusion — verify the consumer
• Sources

9.0.23 Command and Manual SQL Injection

Open procedure

• Prove whether an input can execute an operating-system command
  • Prove command execution through independently recognizable output
  • Check command execution through repeated control and timing comparisons
  • After command execution
• Validate SQL query influence and select an extraction method
  • 1. Establish query influence
  • 2. Test whether query influence changes authentication decisions
  • 3. Find the column count and types needed for a UNION result
  • 4. Extract only after fingerprinting the DBMS
  • 5. Infer selected database values through stable response differences
• Check whether database rights enable useful file or OS operations
• Validate a controlled callback when in-band extraction is unavailable
• Failure-guided decisions
• Continue with the capability your result enables
• Prove server-side template evaluation and identify its engine
• Check whether XML entity processing enables useful file read
• Check whether structured operators alter NoSQL query behavior
• Check whether unsafe deserialization reaches a usable installed gadget
• Check whether YAML loading constructs attacker-controlled objects
• Check whether account normalization crosses an identity boundary
• Check a confirmed CGI-to-Bash path for Shellshock command execution
• Sources

9.0.24 Web Access Control, API Logic and XSS

Open procedure

• Check whether your session can access another user's object
• Check whether your role can invoke a restricted function
• Check whether writable request properties enable protected changes
• XSS: prove browser execution in the right context
• Turn XSS into useful application privilege
• Failure cues
• Continue with the capability your result enables
• Sources

9.0.25 WordPress and SSRF Paths

Open procedure

• WordPress: establish the deployment first
• WordPress authentication and post-authentication mapping
• SSRF: prove server-side fetching safely
• Choose the next check from the failure you observed
• Sources

9.0.26 Public Exploit Selection and Adaptation

Open procedure

• Record the candidate
• Search narrowly
• Audit untrusted code before execution
• Establish the runtime before changing code
• Run a reviewed Python exploit in a compatible environment
• Compile reviewed source
• Make the smallest supported edit
• Repair a web exploit from the real transaction
• Adapt an existing memory-corruption PoC only as required
• Prove effects in increasing order
• Choose the next check from the failure you observed
• Handoff and evidence
• Component/CVE lookup from the source cheatsheet
• Sources

9.0.27 File Transfer

Open procedure

• Linux target: pull LinPEAS from Kali over HTTP
  • Serve a fixed directory without changing folders
  • Linux target with curl
  • Windows target with PowerShell
  • Windows alternatives
• Verify the transfer
  • Kali to a Linux target
  • Linux target to Kali
  • SSH key or nonstandard port
  • Start an authenticated SMB share on Kali
  • Connect and download from Windows
  • Upload evidence from Windows to Kali
  • Retrieve a file from the target to Kali
  • Send a file from Kali to the target
  • Encode on Linux
  • Decode on Linux
  • Decode in PowerShell
• PHP HTTP file server when Python is unavailable

9.0.28 Shells, Payloads and Session Repair

Open procedure

• Keep four states separate
• Choose the access form
• Map the callback before generating anything
• Start a listener that matches the expected callback
• Prove command execution before requesting a shell
• Obtain a Linux shell through a supported reverse connection
• Obtain a Windows command session through a supported channel
• Connect to a shell listening on the reachable target
• Generate payloads after selecting context
  • Staged versus stageless
  • Existing-PoC payload constraints
• Diagnose quoting and encoding by layer
• Diagnose a missing callback in order
• Handle security-control evidence proportionately
• Stabilize a Linux TTY
• Verify every new session
• Choose the next check from the failure you observed
• Exam boundary
• Powercat — Windows PowerShell shell transport
• Penelope or pwncat-cs — handle an existing shell and move files
• Keep listeners and long-running checks in tmux
• ASPX handler check before generating a Windows payload
• Shell alternatives when the installed runtime changes
• OpenSSL transport when a TLS callback is useful
• Sources

9.0.29 Credential Classification, Cracking and Reuse

Open procedure

• Record the artifact type, identity and access context
• Classify before acting
• Validate one known password
• Estimate feasibility
• Recover a password with a format-matched Hashcat job
• Recover a password from a supported verifier with John
• Recover access to a protected KeePass database
• Recover a passphrase for an accessible SSH private key
• Recover passwords from accessible Linux password verifiers
• Use or recover a password from an identified NT hash
• Recover a password from a captured Net-NTLMv2 response
• Recover a password from a cached-domain verifier
• Inspect available tickets and determine where they can authenticate
• Credential Guard boundary
• Choose the next check from the failure you observed
• Re-enumerate after success
• Build a small site-specific wordlist with CeWL
• Generate usernames from observed naming conventions
• Targeted candidates — Crunch, CUPP and rules
• Password-protected ZIP — direct test or extracted verifier
• HTTP Basic authentication — validate the challenge and failure signal
• Change an account’s own expired/known SMB password
• Generate a bounded numeric list for an observed identifier pattern
• An application authenticates to your explicit SMB endpoint
• Sources

9.0.30 File and Repository Hunting

Open procedure

• Determine whether exposed repository metadata reveals source
• Find useful configuration and credential leads in repository history
• Find useful files within accessible Linux locations
• Find useful files within accessible Windows locations
• Exposed .git — recover source and old configuration
• Sources

9.0.31 Python Tool Environments

Open procedure

• Isolate the Python dependencies required by the reviewed tool
• Run the procedure from a Windows PowerShell environment
• Record the runtime and dependencies needed to repeat the procedure
• uv alternative for a Python PoC with missing dependencies
• Sources

9.0.32 Payload Execution Obstacles

Open procedure

• 1. Preserve the execution chain
• 2. Establish the current state and choose your first useful check
• 3. Client-side attacks are gated chains
  • 3.1 Check the conditions required for a document macro to execute
  • 3.2 Validate each delivery and execution step in the Library-file chain
• 4. Match artifact to its consumer
  • 4.1 Check whether the artifact can execute in the Linux environment
  • 4.2 Check whether the artifact matches the Windows execution environment
• 5. Parser, command-line and length failures
• 6. PowerShell control layers
• 7. Interpret control evidence
• 8. Generate only after selecting the context
• 9. Pair the payload with its expected handler and verify the session lifecycle
• 10. Validate module prerequisites and observe the current exam limits
• 11. Worked diagnostic paths
  • A. Document delivered, no callback
  • B. Executable disappears after transfer
  • C. PowerShell says scripts are disabled
  • D. Connection reaches Netcat but there is no shell
  • E. Binary exists but returns “not found” on Linux
  • F. Metasploit module reports completion, no session
• 12. Verify the outcome, preserve evidence and remove your changes
• Tooling for this section
• Sources

9.0.33 Linux Privilege Escalation

Open procedure

• 1. Establish current state
• 2. Prove permissions, including parents and mounts
• 3. Hunt credentials and service trails
• 4. Check whether your sudo rights enable higher privileges
• 5. Find privileged executables you can use
• 6. Find privileged execution that consumes something you control
• 7. Check whether you can redirect a privileged command lookup
• 8. Check whether controlled filenames become privileged command options
• 9. Check whether writable account or policy files enable higher privileges
• 10. Check whether group or socket access gives you higher privileges
• 11. Find escalation paths through mounts and local services
• 12. Check whether a privileged program loads a library you control
• 13. Assess matching software or kernel exploits after permission checks
• 14. Investigate remaining gaps with a focused automated survey
• 15. Choose the next check from the failure you observed
• 16. Verify and re-enumerate
• Restricted shell — escape the restriction without claiming root
• Kernel candidates — Linux Exploit Suggester as a second view
• Logrotate race — only with a controlled log path and privileged rotation
• Sources

9.0.34 Windows Privilege Escalation

Open procedure

• 1. Establish token and host state
• 2. Interpret effective access
• 3. Hunt credentials and configuration
  • Find usable credentials in accessible Windows artifacts
• 4. Check whether you control a privileged service or its executable
  • Inventory and inspect
  • Modifiable service configuration
• 5. Check whether an unquoted service path reaches a location you can write
• 6. Check whether privileged software loads a file you control
• 7. Find privileged tasks or startup consumers you can influence
  • Find privileged tasks or startup consumers you can influence
• 8. Check installer policy and the elevation limits of your token
• 9. Check whether your token privileges support an escalation route
• 10. Assess software and driver candidates against the exact host build
• 11. Investigate remaining gaps with a focused automated survey
• 12. Choose the next check from the failure you observed
• 13. Verify, re-enumerate and preserve evidence
• JAWS — PowerShell enumeration when the compiled helper is unsuitable
• Legacy impersonation helpers — select by OS build and trigger
• AccessChk — verify the exact service, file or registry permission
• Sources

9.0.35 Active Directory Domain Mapping

Open procedure

• AD capability transitions
• 1. Keep four maps, not one tool output
• 2. Establish identity, domain, DC, DNS and time
  • Domain-joined Windows source
  • Kali/off-domain source
• 3. Find domain identities and relationships with built-in utilities
• 4. Query domain objects when the RSAT module is unavailable
• 5. Find useful directory objects using your domain credentials
  • Discover the naming context
  • Identify domain principals and their memberships
  • LDAP failure router
• 6. Investigate domain objects and rights with PowerView
• 7. Find readable domain files and configuration leads
  • Inventory, then test the object
• 8. Find service identities worth investigating
• 9. Identify directory objects you can control
• 10. Find hosts where your identity may have useful rights
• 11. Identify useful logged-on identities and verify the session evidence
• 12. Find and validate a useful domain attack path
  • Current SharpHound CE
  • Noninteractive Kali first pass
  • Analyze in this order
• 13. Rank candidate paths by evidence and missing prerequisites
• 14. Choose the next check from the failure you observed
• 15. Continue with the capability your result enables
• Tooling for this section
• Kerbrute — confirm candidate names before password testing
• RustHound-CE — a cross-platform BloodHound collector
• GPP cpassword — recover a candidate from readable SYSVOL XML
• Kerberos clock skew — compare UTC and use a working time source
• Sources

9.0.36 Windows and Domain Credential Access

Open procedure

• 1. Select the source before the tool
• 2. Establish privilege and protection state
• 3. Inspect tickets before invasive collection
• 4. Obtain accessible credential material from live logon sessions
  • Read accessible logon-session material with Mimikatz
  • Collect an authorized memory artifact for offline parsing
• 5. Recover local account hashes from matched registry hives
• 6. Recover accessible LSA secrets and cached-domain verifiers
• 7. Recover accessible stored application credentials
• 8. Select a justified path to domain credential material
  • Parse a matched domain database and SYSTEM hive offline
  • Shadow-copy boundary: inspect before creating anything
  • Remote collection
• Choose a supported use for the credential material you obtained
• 9. Classify before choosing the transition
  • Net-NTLMv2 relay is a live authentication path, not hash reuse
• 10. Choose the next check from the failure you observed
• Tooling for this section
• DonPAPI — remote DPAPI/application-secret collection with host rights
• Sources

9.0.37 Kerberos and Identity Transitions

Open procedure

• 1. Kerberos model and prerequisites
• 2. Password policy and bounded validation
• 3. Check for accounts whose AS-REP responses support offline password recovery
  • Why AS-REP roasting works
  • Request an AS-REP for a known user without preauthentication
  • Check supplied account names for AS-REP recovery conditions
  • Find AS-REP candidates through authenticated directory queries
  • Request selected Kerberos material from Windows with Rubeus
  • Interpret before cracking
• 4. Request selected service tickets for offline password recovery
  • Why Kerberoasting works
  • Enumerate without requesting tickets
  • Request one selected user
  • Select the recovery format that matches the returned Kerberos artifact
  • Common failures
• 5. Check whether SPN-write rights enable targeted ticket recovery
• 6. Identify and convert the tickets available to your current context
• 7. Use an available key or ticket in the correct identity context
• 8. Forge a service ticket when you possess the correct service key
• 9. Re-enumerate every new identity
• 10. Choose the next check from the failure you observed
• Tooling for this section
• Timeroast — offline recovery of weak computer-account passwords via MS-SNTP
• Sources

9.0.38 Object Control, AD CS and Domain Compromise

Open procedure

• Turn a verified directory right into a useful identity change
  • Reset a target password through a verified directory right
  • Add your identity through verified group-membership rights
  • Check whether SPN-write rights enable targeted ticket recovery
  • Convert ownership or DACL control into a useful narrower right
• Trace writable policy to a privileged consumer and trigger
• Check whether delegation rights enable access as another identity
  • Validate and use a resource-based delegation relationship
• Check whether certificate enrollment can enable another identity
• Request and use a certificate through a validated enrollment path
• Check whether template-write rights enable a usable certificate path
• Retrieve domain credential material through verified replication rights
• Understand the access enabled by compromised domain ticket keys
• bloodyAD — Linux-side LDAP reads and permission-backed writes
• Read managed credentials only where your identity has delegated access
• Shadow credentials — object-key write, PKINIT, then cleanup
• PassTheCert — Schannel/LDAP when the certificate is usable there
• Powermad — create an account only when the chosen AD path needs it
• gMSA — obtain a decoded hash only with managed-password read rights
• Sources

9.0.39 Check which other hosts your current identity can access Lateral Movement

Open procedure

• 1. Choose by credential and service
• 2. Verify the remote service is reachable from your actual source
• 3. Validate authentication separately from execution
• 4. Execute on a reachable host through verified SMB and service rights
  • Execute through a reachable service-control interface with administrative rights
  • Execute through a reachable service-control interface with administrative rights
  • Execute through service creation with a supported output channel
  • Execute through the remote Task Scheduler interface with sufficient rights
• 5. Execute on a reachable host through WMI or DCOM rights
  • Execute through WMI with accepted credentials and DCOM access
  • Execute through CIM when the remote WMI permissions permit it
  • Execute through a supported remote MMC activation path
• 6. Check remote session access with the available identity
  • Open a remote command session through verified WinRM rights
  • Open a remote command session through verified WinRM rights
  • Open a remote command session through verified WinRM rights
• 7. Obtain an authorized interactive desktop session
• 8. Pass-the-Hash, Overpass-the-Hash and Pass-the-Ticket
  • Authenticate with an NT hash where the service supports it
  • Obtain a Kerberos ticket using an available account key
  • Authenticate with an available ticket in the correct logon context
• 9. Resolve account scope and remote token restrictions
• 10. Diagnose remote execution without visible output or onward access
• 11. Choose the next check from the failure you observed
• 12. Verify the new host and identity, then re-enumerate
• Tooling for this section
• winexe — Samba-side service execution alternative
• Sources

9.0.40 Conditional AD infrastructure and trust checks

Open procedure

• DNSAdmins: distinguish DNS configuration from a service trigger
• WSUS: identify the update authority from the current client
• Configuration Manager / SCCM: recognize the client before choosing a server-side path
• Trusts: inspect the boundary before treating another domain as reachable privilege
• Sources

9.0.41 Tunneling and Port Forwarding

Open procedure

• 1. Draw the route before choosing a command
• 2. Discover the pivot's network position
• 3. Choose the smallest compatible route
• 4. Relay one TCP service through a fixed forward
• 5. Reach a service or network through an SSH forward
  • 5.1 Expose a remote-side service on the SSH client
  • 5.2 Provide SOCKS access through the SSH client
  • 5.3 Expose a client-side destination on the SSH server
  • 5.4 Provide server-side SOCKS access through the SSH client
  • 5.5 Reach an SSH destination through a verified intermediate host
• 6. Send compatible TCP client connections through a SOCKS proxy
• 7. Route a selected subnet through an SSH-accessible pivot
• 8. Forward traffic from a Windows pivot with available utilities
  • 8.1 Forward a selected TCP service from Windows
  • 8.2 Forward a selected TCP service from Windows
  • 8.3 Forward a selected TCP service from Windows
• 9. Reach internal services through an HTTP-based Chisel tunnel
  • 9.1 Reach pivot-side services through an outward-initiated SOCKS tunnel
  • 9.2 Expose one pivot-side service through a reverse tunnel
  • 9.3 Forward SOCKS when the client is on the tool side
  • 9.4 Forward UDP only with compatible tunnel peers
  • 9.5 Chisel failure cues
• 10. Route an internal subnet through a Ligolo-ng agent
  • 10.1 Establish the Ligolo proxy-agent connection
  • 10.2 Create the interface and selected route needed by the pivot
  • 10.3 Reach a service bound to the pivot host's loopback interface
  • 10.4 Callback or file-server listener on the agent
• 11. Preserve name resolution and Kerberos prerequisites through the pivot
• 12. Verify payload delivery and callback paths separately
• 13. Compose multiple pivots and verify every connection leg
• 14. Reach a controlled endpoint through a permitted DNS tunnel
• 15. Choose the next check from the failure you observed
• 16. Verify the outcome, preserve evidence and remove your changes
• Tooling for this section
• Exam restriction
• Sources

9.0.42 Integrated Attack Tracking and Evidence

Open procedure

• Establish the operating contract
• Maintain a live state map
• Run the attack as a state machine
  • Keep two queues
• Rank candidate paths
• Complete a standalone-host attack from discovery to verified privilege
• Build an AD attack path from the supplied starting identity
• Capture every state transition
• Save tool output deliberately
• Capture identity, host and proof at each access change
• Record exploit prerequisites, modifications and verified effects
• Document the steps needed to reproduce the complete access path
• Return to the last working boundary and choose a new test
• Build the report from transitions
• Validate the final report package and its required files
• Verify the report and evidence are complete before export
• Tooling for this section
• Sources