Skip to main content

Recently Updated Pages

Windows File Downloads

File Transfers and Data Exfiltration

PowerShell .NET Reflection [System.Net.WebClient]::new().DownLoadFile('http://somesite.com/file...

Updated 6 months ago by 0xBEN

Enumerating Hosts and Identifying the Domain Controllers

Active Directory Initial Attack Vectors: Multipurpose

Fingerprinting Domain Controllers PORT STATE SERVICE 53/tcp open domain 88/tcp open...

Updated 6 months ago by 0xBEN

Finding Build Manifests

Web Next.js

Assuming you have some means of reading server-side files, these are some examples of places you ...

Updated 6 months ago by 0xBEN

Architecture

Red Teaming AdaptixC2 Notes

[10.6.6.0/24] [10.9.9.0/24] [10.80.80.0/24] ...

Updated 6 months ago by 0xBEN

Kerberos Authentication from Kali

Active Directory Post Exploitation: Enumeration

NetExec nxc smb DC01.domain.tld -d 'domain.tld' -u 'username' -p 'P@$$word123!' -k Use a user...

Updated 6 months ago by 0xBEN

LdapSearch

Active Directory Post Exploitation: Enumeration

When to Use You'll know when you've found a domain controller, because it will have several port...

Updated 6 months ago by 0xBEN

Get User Input (Shell Agnostic)

Linux Administration Command Line Tricks

function getUserInput () { if [ $# -gt 1 ] ; then echo "Usage example: $0" ...

Updated 6 months ago by 0xBEN

Manual Enumeration with Nmap

Web WordPress

Find WordPress NSE Scripts find /usr/share/nmap/scripts -name '*wordpress*' Enumerate WordPre...

Updated 6 months ago by 0xBEN

jq

Web JSON

Selecting JSON Properties Property Name Contains Dashes { "first-name": "john", "last-nam...

Updated 6 months ago by 0xBEN

Kerberoasting

Active Directory Post Exploitation: Attacks

Overview The attacker uses a known username and password of a user on a domain. A typical Kerbe...

Updated 7 months ago by 0xBEN

Installing FleetDM Management Server

Fleet DM FleetDM On Debian 11

Official Documentation https://fleetdm.com/docs/deploy/reference-architectures#infrastructur...

Updated 7 months ago by 0xBEN

Zeek: Add GeoIP Data to Logs

Packet Capture

Virtual Environments sudo apt install -y pipx pipx install zkg echo 'export PATH=$PATH:/opt/ze...

Updated 7 months ago by 0xBEN

Installing Wine and Wine Dependencies

Kali Optimizations

Considerations I urge you to consider taking a snapshot of your Kali instance at its current sta...

Updated 8 months ago by 0xBEN

Cookie Theft

Web Cross Site Scripting (XSS)

Stored / Hosted XSS If there is a vulnerability where you can store or submit HTML and have it r...

Updated 8 months ago by 0xBEN

Installing Native WinRM Client

Kali Optimizations

Linux Host Connecting to Windows Host Users may be able to get WSMan remoting to work using th...

Updated 8 months ago by 0xBEN

Pass the Certificate

Active Directory Post Exploitation: Attacks

Cracking PFX Archives A .pfx archive is a way to bundle the certificate, key, and metadata in on...

Updated 8 months ago by 0xBEN

Automating with AWS Secrets Manager

Ansible Automation with Ansible

Use Case In this scenario the following is true: You have an Ansible server in AWS You have ...

Updated 8 months ago by 0xBEN

PowerShell: Find File Owned by User

Windows Administration PowerShell

$searchPath = 'C:\Program Files' $userName = 'john.doe' Get-ChildItem -ErrorAction 'SilentlyCon...

Updated 8 months ago by 0xBEN

Spawn Processes as Other Users

Active Directory Post Exploitation: Attacks

RunasCs.exe Project GitHub https://github.com/antonioCoco/RunasCs/releases Example Usage Spaw...

Updated 8 months ago by 0xBEN

Dumping Passwords from Windows Credential Manager

Active Directory Post Exploitation: Attacks

Credential Enumeration cmdkey /list In reverse shells, I have noticed that it's impossible to s...

Updated 8 months ago by 0xBEN