Recently Updated Pages
Windows File Downloads
PowerShell .NET Reflection [System.Net.WebClient]::new().DownLoadFile('http://somesite.com/file.t...
Using Faketime for Ad-Hoc Kerberos Authentication
Installing Faketime sudo apt install faketime faketime -h This will run the specified 'program' w...
PowerShell: Grep Alternative
Set Recurse = $false when required (e.g. an extensive amount of subdirectories or files). $searc...
Exfiltrate Docker Runner Environment Variables
Scenario You've exploited a misconfiguration in the GitLab / GitHub runner configuration, or expl...
HTTP
HTTP POST (Upload to Attack Box) Server Side (Attack Box) Python Server Python HTTP(S) Upload Ser...
qpdf: Encrypt a PDF with Linux
If you are running on Windows, you can use Windows Subsystem for Linux (WSL) to achieve the same ...
Alternative Network Scans
Generate Target List Linux ip="10.9.9.0"; cidr=24; IFS=. read -r i1 i2 i3 i4 <<< "$ip"; raw=$(( (...
Kerberos Authentication from Kali
NetExec nxc smb DC01.domain.tld -d 'domain.tld' -u 'username' -p 'P@$$word123!' -k Use a username...
Remote Bloodhound
Nmap LDAP Enumeration Acquire DC DNS Name sudo nmap -Pn -T4 -p 389,636 --script ldap-rootdse <dom...
BloodHound
Install and Initial Setup Kali Linux When changing the neo4j user password at initial setup, I w...
Hashcat Help Tricks
Find Hash Format Modules Find supported hash types hashcat -hh | grep -i <hash_type> Show info ab...
procfs Enumeration Pretty Output
Outputs in procfs are separated by null bytes, thus we use tr to translate to new line. find /pr...
Port Forwarding with SSH
Security Considerations Reverse Tunneling This will require you to establish a SSH connection fro...
Output Response Headers Only
curl -sD - -o /dev/null https://domain.tld
zsteg
Installation gem install zsteg for dir in $(find "$HOME/.local/share/gem/ruby" -maxdepth 2 -type ...
Change Default User Account
Running this on a fresh Kali installation. Login as kali user and run these commands to add a n...
SOCAT
Cleartext File Transfer Listener on Attack Box # Start a listener on the attack box and create a ...
Allow Multicast Traffic Across VLANs
Scenario You have multiple VLANs firewalled to segment your network. One such VLAN is an IOT VLAN...
Export a Proxmox VM to VirtualBox
Example VM I want to export the pfsense-deleteme VM and import it into VirtualBox. The procedure ...
Impacket-Addcomputer
When to Use Could be used post-compromise upon enumerating the ms-DS-MachineAccountQuota policy....