Recently Updated Pages
Zeek: Add GeoIP Data to Logs
Virtual Environments sudo apt install -y pipx pipx install zkg echo 'export PATH=$PATH:/opt/ze...
Installing Wine and Wine Dependencies
Considerations I urge you to consider taking a snapshot of your Kali instance at its current sta...
Cookie Theft
Stored / Hosted XSS If there is a vulnerability where you can store or submit HTML and have it r...
Installing Native WinRM Client
Linux Host Connecting to Windows Host Users may be able to get WSMan remoting to work using th...
Pass the Certificate
Cracking PFX Archives A .pfx archive is a way to bundle the certificate, key, and metadata in on...
Automating with AWS Secrets Manager
Use Case In this scenario the following is true: You have an Ansible server in AWS You have ...
PowerShell: Find File Owned by User
$searchPath = 'C:\Program Files' $userName = 'john.doe' Get-ChildItem -ErrorAction 'SilentlyCon...
Spawn Processes as Other Users
RunasCs.exe Project GitHub https://github.com/antonioCoco/RunasCs/releases Example Usage Spaw...
Dumping Passwords from Windows Credential Manager
Credential Enumeration cmdkey /list In reverse shells, I have noticed that it's impossible to s...
IPv6 DNS Spoofing
Note: Network Environment This spoofing attack works by sending a router announcement to multica...
Common Bash Pitfalls
https://mywiki.wooledge.org/BashPitfalls/ also on Archive.org Command execution via unquoted v...
paste
apple banana pear mango grapes fruit.txt cat fruit.txt | paste -s -d ',' - Using piped i...
Data Exfiltration
Stored / Hosted XSS If the target page has a loose content security policy / cross-origin policy...
Pass the Hash
Overview Dumped the SAM or LSA and now have hashes for domain or a local users. Use the hash and...
NetExec
When to Use Useful post-compromise if you've dumped hashes from SAM or LSASS or obtained clearte...
xargs
Pipe HEREDOC to xargs When creating a HEREDOC, you can use any keyword to denote the start and e...
Pass the Password
Overview Cracked a hash or discovered a password for a domain user. Use the password and nxc to ...
SMB
SMB Server on Attack Box For this, we can use Impacket's smbserver.py script to run an ad-hoc SM...
Dumping Hashes without Mimikatz
Post-Compromise on Target Lsass Process Dump Sysinternals ProcDump Download ProcDump here # D...
Manual Enumeration
Linux LdapSearch ldapsearch -x -H ldap://DC01.ad.lab -D 'john.doe@ad.lab' -W -b 'DC=ad,DC=lab' ...