Skip to main content

Recently Updated Pages

Windows File Downloads

File Transfers and Data Exfiltration

PowerShell .NET Reflection [System.Net.WebClient]::new().DownLoadFile('http://somesite.com/file.t...

Updated 2 days ago by 0xBEN

Using Faketime for Ad-Hoc Kerberos Authentication

Active Directory Post Exploitation: Enumeration

Installing Faketime sudo apt install faketime faketime -h This will run the specified 'program' w...

Updated 5 days ago by 0xBEN

PowerShell: Grep Alternative

Windows Administration PowerShell

Set  Recurse = $false when required (e.g. an extensive amount of subdirectories or files). $searc...

Updated 6 days ago by 0xBEN

Exfiltrate Docker Runner Environment Variables

CI/CD

Scenario You've exploited a misconfiguration in the GitLab / GitHub runner configuration, or expl...

Updated 6 days ago by 0xBEN

HTTP

File Transfers and Data Exfiltration File Transfer Techniques

HTTP POST (Upload to Attack Box) Server Side (Attack Box) Python Server Python HTTP(S) Upload Ser...

Updated 6 days ago by 0xBEN

qpdf: Encrypt a PDF with Linux

Certificates and Encryption

If you are running on Windows, you can use Windows Subsystem for Linux (WSL) to achieve the same ...

Updated 1 week ago by 0xBEN

Alternative Network Scans

Network Pivoting

Generate Target List Linux ip="10.9.9.0"; cidr=24; IFS=. read -r i1 i2 i3 i4 <<< "$ip"; raw=$(( (...

Updated 1 week ago by 0xBEN

Kerberos Authentication from Kali

Active Directory Post Exploitation: Enumeration

NetExec nxc smb DC01.domain.tld -d 'domain.tld' -u 'username' -p 'P@$$word123!' -k Use a username...

Updated 2 weeks ago by 0xBEN

Remote Bloodhound

Active Directory Post Exploitation: Enumeration

Nmap LDAP Enumeration Acquire DC DNS Name sudo nmap -Pn -T4 -p 389,636 --script ldap-rootdse <dom...

Updated 1 month ago by 0xBEN

BloodHound

Active Directory Post Exploitation: Enumeration

Install and Initial Setup Kali Linux When changing the neo4j user password at initial setup, I w...

Updated 1 month ago by 0xBEN

Hashcat Help Tricks

Hash Cracking hashcat

Find Hash Format Modules Find supported hash types hashcat -hh | grep -i <hash_type> Show info ab...

Updated 1 month ago by 0xBEN

procfs Enumeration Pretty Output

Linux

Outputs in procfs are separated by null bytes, thus we use  tr to translate to new line. find /pr...

Updated 1 month ago by 0xBEN

Port Forwarding with SSH

Network Pivoting Port Forwarding and Proxying

Security Considerations Reverse Tunneling This will require you to establish a SSH connection fro...

Updated 1 month ago by 0xBEN

Output Response Headers Only

Web curl

curl -sD - -o /dev/null https://domain.tld

Updated 1 month ago by 0xBEN

zsteg

Steganography Image Steganalysis

Installation gem install zsteg for dir in $(find "$HOME/.local/share/gem/ruby" -maxdepth 2 -type ...

Updated 2 months ago by 0xBEN

Change Default User Account

Kali Optimizations

Running this on a fresh Kali installation.  Login as kali user and run these commands to add a n...

Updated 2 months ago by 0xBEN

SOCAT

File Transfers and Data Exfiltration File Transfer Techniques

Cleartext File Transfer Listener on Attack Box # Start a listener on the attack box and create a ...

Updated 2 months ago by 0xBEN

Allow Multicast Traffic Across VLANs

Computer Networking

Scenario You have multiple VLANs firewalled to segment your network. One such VLAN is an IOT VLAN...

Updated 2 months ago by 0xBEN

Export a Proxmox VM to VirtualBox

Proxmox VM Management

Example VM I want to export the pfsense-deleteme VM and import it into VirtualBox. The procedure ...

Updated 2 months ago by 0xBEN

Impacket-Addcomputer

Active Directory Post Exploitation: Attacks

When to Use Could be used post-compromise upon enumerating the  ms-DS-MachineAccountQuota policy....

Updated 2 months ago by 0xBEN