A living collection of commands & tools I use most. Heavy reconnaissance leading to an initial foothold, privilege escalation and full AD takeover, alongside useful external links.
Full TCP/UDP sweeps, then content and virtual-host discovery, then the classic infrastructure ports, SMB, LDAP, RPC, NFS and SNMP, that hand over users, naming contexts and password policy for free before you touch anything.
read cheatsheet →The web-bug foothold toolkit, sqlmap for injection, quick LFI probes, SSRF pivots, blind-XSS exfil, and CMS enumeration when the box runs WordPress.
read cheatsheet →Catching the first shell and turning a fragile netcat catch into a real PTY where sudo, su and job control behave.
read cheatsheet →Getting linpeas, a static nc or a privesc binary onto the box, HTTP down by default, SMB and certutil for the cases where curl or wget are missing.
read cheatsheet →Picking the right hashcat mode for the hash in front of you, and spraying or brute-forcing a live service when you only have a username list.
read cheatsheet →Reaching the hosts you cannot route to, a tunnel through the foothold, then run the AD tooling as if you were on the internal network.
read cheatsheet →The first three questions on every shell, who am I, what can I run as root, what is SUID, then the automated sweeps for everything I would miss by hand.
read cheatsheet →Token privileges first, then the winPEAS/PowerUp sweep and the potato attack when SeImpersonate is on the table.
read cheatsheet →Turning one valid credential into a full map of the domain, netexec for the sweep, BloodHound for the shortest path to Domain Admin.
read cheatsheet →Turning enumeration into tickets, hashes and eventually a DCSync, AS-REP roast, Kerberoast, pass-the-hash, ADCS abuse and the domain dump.
The full AD CS escalation catalogue, every ESC from requester-supplied SAN to issuance-policy group links, with the one abuse that matters for each and the certipy command to spot it.
read cheatsheet →The external references I keep open in a pinned tab on every engagement, methodology, living-off-the-land binaries, payload collections and the wordlists behind every fuzz on this site.
read cheatsheet →
