Classify the artifact and its identity context

Client commands / example output

Copy# Baseline
SOURCE -> MATERIAL/FORMAT -> LOCAL/DOMAIN/APPLICATION IDENTITY
-> POSSIBLE USE -> SERVICE/PROTOCOL -> AUTHENTICATION
-> AUTHORIZATION -> NEW ACCESS -> RE-ENUMERATION

Preserve the source and identity context, then identify the format

Record source, claimed identity, format evidence, possible uses, tested service, result and resulting rights together.

Material	Recognition	Compatible use
Cleartext password	Text tied to an identity/source	Normal protocol/application login
SSH private key	OpenSSH/PEM private-key block	SSH public-key authentication; recover passphrase offline if protected
Linux password record	USER:$id$salt$digest:...	Offline recovery with complete record/format
Application/file verifier	Tool-specific $...$ or documented digest	Offline recovery with matching mode/parser
NT hash	Usually 32 hex from SAM/LSASS/NTDS context	Offline recovery; PtH where NTLM and the client support it
Net-NTLMv2 response	USER::DOMAIN:challenge:proof:blob	Offline recovery or live relay under specific conditions; not PtH material
DCC2/MSCache v2	Username-dependent cached-domain verifier	Offline recovery; not ordinary PtH material
Kerberos ticket	.kirbi, ccache or in-memory cache	Ticket-specific access subject to realm, SPN, validity, clock and route
Kerberos roast material	$krb5asrep$... or $krb5tgs$...	Offline recovery with matching enctype/mode
Session/API token	Cookie, bearer/JWT or application token	Issuing application and authorization context only

Do not feed unknown strings into random modes. Preserve the source and identity context, then identify the format:

Copy# Preserve the source and identity context, then identify the format
hashid HASH_OR_FILE
john --list=formats | grep -i KEYWORD
hashcat -hh | grep -i KEYWORD
hashcat --example-hashes | less

Output	Type	Immediate compatible possibilities	Not valid as
Cleartext password	Reusable secret	Password authentication, key derivation, DPAPI where applicable	Proof of authorization
NT hash	NTLM key	Offline crack; PTH where NTLM/service policy allows; Kerberos RC4 transition where supported	Net-NTLM response or DCC2
AES128/AES256 key	Kerberos long-term key	Request Kerberos material using compatible tooling	Direct NTLM authentication
.kirbi / ccache	Kerberos ticket container	Use while valid for its client/realm/SPN scope	Password/hash
DCC2/MSCache v2	Offline verifier	Offline cracking	PTH
DPAPI key/blob	Protected-data material	Decrypt only with matching context/keys	General logon credential
Machine-account key	Computer identity	Map the computer account's rights and Kerberos/NTLM paths	Human/domain-admin identity

Net-NTLMv2 relay is a live authentication path, not hash reuse

A captured Net-NTLMv2 response is suitable for offline recovery, but cannot be passed as an NT hash. A relay path instead needs a fresh inbound NTLM authentication event, a different reachable target that accepts the relayed protocol, target protections that permit the exchange, and useful authorization for the relayed identity.

For an explicitly selected SMB destination, inspect signing behavior before considering it a relay receiver:

Copy# Net-NTLMv2 relay is a live authentication path, not hash reuse
nmap -p 445 --script smb2-security-mode TARGET

Every newly usable identity returns to Block 10 before movement

Interpret: signing required closes the ordinary SMB-to-SMB relay receiver path. Signing enabled but not required is only one prerequisite; it does not supply an authentication source, bypass EPA/channel binding on another protocol, or grant the relayed identity useful rights.

The current OSCP+ exam guide prohibits poisoning/spoofing. Do not use Responder-style name-resolution poisoning in the exam workflow. A direct, already-existing authentication source still needs a separately reviewed, scope-compliant relay procedure and an action-specific verification; the incomplete procedure is tracked as RW09.

Every newly usable identity returns to Block 10 before movement:

Copy# Every newly usable identity returns to Block 10 before movement
VERIFY MATERIAL -> AUTHENTICATE SAFELY -> CONFIRM IDENTITY
                -> MAP GROUPS/RIGHTS/SHARES/HOSTS/ROUTES