enumerate → lead → prove preconditions → access → re-enumerate

Entry points

• linux shell → Linux first pass
• windows shell → Windows first pass
• domain creds → AD baseline
• no progress → Methodology and stuck checklist
• proof / report → Exam documentation checklist

01 · Recon

• scan Nmap TCP/UDP, vhosts · Port → service map
• services SMB / RPC · FTP · NFS · DNS / AXFR · SNMP · SMTP / IMAP / POP3 · SSH, Telnet, Finger, rsync, TFTP · LDAP, VNC, Oracle, Mongo, Elasticsearch, memcached, IPMI, AJP, Docker API
• db MySQL / PostgreSQL / Redis, incl. RCE paths · MSSQL: impersonation, links, xp_cmdshell
• auth RDP / WinRM / SSH

02 · Foothold

• web Enumeration · Fingerprinting · Path normalization, known apps · Tomcat, Jenkins, WordPress, Joomla/Drupal, .git, WebDAV, Shellshock, CVE patterns
• inject SQLi: login bypass, MySQL, MSSQL, PostgreSQL, Oracle, SQLite · NoSQL · SSTI · Command injection (Linux/Windows), upload bypasses, traversal
• fetch LFI → RCE · RFI · SSRF · XXE
• authz IDOR, mass assignment, OAuth/SAML, JWT · GraphQL · ViewState deserialization · XSS
• exploit Public PoCs: search, adapt, compile · Client-side: SMTP, VBA macro, WebDAV .lnk
• post Reverse shells, bind shells, encoded PowerShell, TTY, ConPtyShell, msfvenom · File transfer: both directions, no-curl, base64

03 · Linux privesc

• enum First pass, linPEAS, pspy
• sudo sudo -l, GTFOBins table, version bugs, LD_PRELOAD, module hijack · SUID / SGID / capabilities
• root-run Cron, timers, services, wildcard injection, PATH · Symlink and archive writes
• groups docker / lxd, NFS no_root_squash
• misc rbash escapes · Kernel and CVE patterns: PwnKit, Dirty Pipe/COW, Baron Samedit · SSH keys, agents, authorized_keys · Process secrets, writable hooks, doas, tmux

04 · Windows privesc

• enum First pass, winPEAS, PowerUp
• tokens Se* privileges incl. Restore, TakeOwnership, LoadDriver, ManageVolume, Debug · UAC · Blocked scripts: execution policy, AppLocker, Defender, AMSI · Potatoes: Sigma, God, PrintSpoofer, EFS, Juicy, Rogue
• services AlwaysInstallElevated · Binary hijack · Weak service ACL / binPath · Unquoted paths · DLL hijack
• tasks Scheduled tasks, autoruns
• creds Hunting, runas, DPAPI · KeePass, browsers, WinSCP, VNC, Sticky Notes, WSL · SAM / LSA / LSASS, Mimikatz
• ntlm NT vs NetNTLMv2 · Coercion files, ntlm_theft

05 · Active Directory

• enum Baseline · PowerView · LDAP, sessions · BloodHound queries
• kerberos AS-REP / Kerberoast · Tickets: PtT, Silver, Golden, ExtraSID · Delegation: KCD, RBCD, unconstrained · KRB error fixes, clock sync, krb5.conf
• acl GenericAll/Write, WriteDACL/Owner, targeted roast · Shares and SYSVOL · GPO edges
• groups DnsAdmins, Server/Backup/Account Operators
• adcs ESC1, ESC4, ESC8, PKINIT
• secrets LAPS / gMSA · DCSync / NTDS.dit
• relay ntlmrelayx: SMB, LDAP, ESC8
• lateral PtH, PtT, PsExec, WMI, WinRM

06 · Pivoting

• ssh -L / -R / -D, -J jump hosts, socat, sshuttle
• tunnel Chisel SOCKS, Ligolo-ng, second hop
• windows Port relays, proxychains checks

07 · Passwords

• offline Hash ID, NT vs NetNTLMv2 · hashcat, john, *2john, shadow, rules
• online Spraying, brute force

Documentation

• proof Proof screenshots, report content, submission
• setup Screenshot hotkey, folders, terminal logging

---

scripts/: executable-reference finder (PowerShell), VBA payload chunker, screenshot hotkey (shot.sh). REFERENCES.md: external links by topic.

<IP> target   <KALI> tun0   <SUBNET>   <PORT>
<DOMAIN> NetBIOS   <DOMAIN.TLD>   <DC-IP>   <DC-FQDN>   <FQDN> non-DC host
<USER>   <PW>   <NT>   <HOSTNAME>   <COMPUTER>   <TARGET>   <SERVICE>   <SVC>   <GMSA>   <GROUP>   <SHARE>
<TARGETS> IP/CIDR/file   <COMPANY>   <SET>   <OCTET>   <SUBNET-PREFIX> first 3 octets   <DEVICE> block device   <OSID>   <PATH>   <IMPERSONATE>   <LOCAL-USER>   <AES256-KEY>   <PFX>   <CA-FQDN>   <DLL-PATH>   <CONSOLE-PORT>   <SOURCE-IP>   <AUTH-PASS>   <PRIV-PASS> SNMPv3 passphrases
<TARGET-DN> object DN   <DEVICE-ID>   <DMSA-NAME>   <GPO-DISPLAY-NAME>   <TASK>   <CCACHE-FILE>   <KEY-SHA256>
<JWT>   <SECRET>   <TOKEN>   <KALI-DOMAIN> domain resolving to <KALI>   <PW1> / <PW2> spray candidates
<EDB-ID>   <FILE>   <MODE> hashcat/hash mode   <MODULE>   <NAME>   <REPO-URL>   <REPO-DIR>   <SSH-PUBKEY>   <TOPIC> MQTT   <MESSAGE> MQTT
<CA-NAME>   <TEMPLATE>   <AGENT-TEMPLATE>   <TARGET-TEMPLATE>   <AGENT> enrollment-agent cert   <LM>   <REQUEST-ID>   <UNIT> systemd

[!IMPORTANT] Read the current OffSec exam guide before the exam.