Pentesting Methodology

Run AutoRecon

Broad automated recon with tuned nmap rate.

Attempt DNS Zone Transfer

Try DNS AXFR; also try knock for port knocking targets.

Nmap Full TCP Scan

Scan all ports; try fingerprint with -nvv or connect scan if filtered.

Nmap Top UDP Scan

Run against discovered subdomains as well.

Directory Brute Force with Feroxbuster

If 302 found, ask why — scan for default creds. Try Feroxbuster.

Gobuster Directory Scan

Different busters expose different endpoints.

Run Nikto on HTTP

Scan HTTP for misconfigurations, dangerous files, and outdated software.

Check Page Source and Response Headers

Ctrl+U, check JS files.

Subdomain and Vhost Enumeration

Fuzz Host headers to find virtual hosts and subdomains.

Check robots.txt

Fetch disallowed paths the site owner tried to hide from crawlers.

Check README Files

Look for deployment notes, version info, or default credentials.

Analyze Requests with Burp Suite

Test every function: LFI, SQLi, IDOR, mass assignment, business logic.

Test LFI and Path Traversal

Look for users and try .ssh under /home/<USER>/.ssh/

Inspect TLS/SSL Certificates

Good for grabbing usernames from cert fields.

CVE and Exploit Enumeration

searchsploit is easier than exploit-db web.

Hunt for Version Number Leaks

Check error pages; Google any errors found.

Research Third-Party Kit Vulnerabilities

Google specific kits or packages used by the website.

Map Website Functionality

Understand function and identify plugins.

Fuzz Hidden Parameters

Fuzz params; check for LFI.

Build Custom Wordlist with CeWL

Generate a site-specific wordlist from crawled page text.

Use PHP Wrappers

php://filter and data:// wrappers help when curl shows missing page sections or LFI is suspected.

Directory & API Brute Force with Gobuster

Brute force web directories and API endpoints with Gobuster; use -k for HTTPS and a pattern file to fuzz versioned API paths.

Directory & File Fuzzing with ffuf

Fuzzes a web server for directories and files with ffuf, appending common extensions and filtering out 404 responses.

Directory Brute-Force with dirb

Brute-forces web directories and files with dirb using a wordlist to discover hidden content.

Dump Exposed .git with git-dumper

Reconstruct a web-exposed .git directory locally with git-dumper, then read the history and grep for leaked secrets.

If Stuck, Scan Again From a Pivot

An internal vantage point may expose ports that were filtered from the outside.

Read File Metadata with exiftool

Reads embedded metadata (author, software, GPS, timestamps) from a file, which can leak usernames or other useful recon details.

Recursive Content Discovery with feroxbuster

Recursively brute-forces web directories and files with feroxbuster, appending extensions to surface scripts, configs and other hidden content.

Subdomain Discovery with Sublist3r

Passively enumerates subdomains for a domain using public search engines and OSINT sources.

Virtual Host Enumeration with ffuf

Discovers virtual hosts / subdomains by fuzzing the Host header with ffuf and using auto-calibration to filter default responses.

Check Web Server Virtual Hosts

Vhost configs reveal hidden sites, internal apps, and document roots.

Enumerate Listening Ports

Local-only ports are prime pivot targets not visible from an external scan.

Check Running Processes

Note services running as root and any process started from a writable path.

Check Active Services

Fingerprint each listening service to find a foothold or pivot.

Check Installed Packages

Outdated or unusual packages may have known exploits.

Examine Binary Content and Metadata

Hardcoded passwords and useful metadata often hide inside files and binaries.

Reuse Passwords and Usernames Everywhere

Spray every recovered credential across all services and users — reuse is extremely common.

Check Python Availability

Knowing if Python exists helps with shell upgrades and exploit delivery.

Process Enumeration via /proc

Especially useful via LFI to read process environment and command lines.

Identify Web Framework

Check debug endpoints, error pages, and framework-specific paths to fingerprint the stack.

Check Key Root Directories

Manually browse /var/www, /home, and /root for configs, keys, and notes.

Check Absolute vs Relative Paths

Missing quotes or relative paths in service/script definitions enable path hijacking (unquoted service paths on Windows).

SMB Enumeration

List shares with null/guest sessions before trying recovered credentials.

LDAP Enumeration

Anonymous LDAP binds can leak users, groups, and naming contexts.

Check Config Files and Environment

Application config files and environment variables frequently store secrets.

Check Installed Program Files

Look for third-party applications and their config/.ini files (Program Files on Windows) that may hold credentials or be vulnerable.

Check for Database Config Files

Web app config files (conf.php, defines.php) usually hold DB credentials.

Check Who Can SSH

AllowUsers/AllowGroups and auth settings show which accounts can log in over SSH.

Check for Firewall or Blocking Device

If egress is filtered, try common service ports or tools like busybox to get traffic out.

Username and Hostname

Confirm the current account and machine name before deeper Windows enumeration.

Group Memberships of the Current User

Group memberships reveal admin rights, impersonation tokens, and paths to privilege escalation.

Existing Users and Groups

Map local accounts and group membership to find privileged or custom admin groups.

Operating System Version and Architecture

OS build and patch level guide kernel exploit selection and Mimikatz compatibility checks.

Network Information

Interfaces and listening ports reveal internal subnets, dual-homed hosts, and local services to pivot against.

Installed Applications

Check both the x64 and x86 uninstall registry hives so 32-bit apps are not missed.

Running Processes and File Hunting

Also review Event Viewer for script block logging events and check default PowerShell transcripts.

Checking Services for Privesc

Sample adduser.c (cross-compile with mingw) creates a local admin: it calls system("net user dave2 password123! /add") then system("net localgroup administrators dave2 /add"). Replace a writable service binary with it, restart the service, and also check PowerShell history.

Access S3 Buckets with Leaked AWS Credentials

Configure the AWS CLI with discovered access keys, then list S3 buckets against a custom endpoint (e.g. a self-hosted/MinIO service).

Always Ask Why It Exists

Sketch a tiny mindmap of each service and asset, and always ask yourself why it exists.

Connect to a Redis Server with redis-cli

Connects to an exposed Redis instance (default port 6379) with redis-cli so you can enumerate keys and configuration.

Connect to SSH with Legacy Algorithms

Re-enable deprecated key-exchange and host-key algorithms so a modern SSH client can connect to an old/legacy SSH server.

CrackMapExec / NetExec

Spray creds and enumerate SMB/WinRM/LDAP/MSSQL across hosts. "Pwn3d!" means the account has admin/exec rights on that protocol.

Fast Full Port Scan with nmap

Scans all 65535 TCP ports quickly with a high minimum packet rate to find services missed by a default scan.

FTP (21)

Always test anonymous login, then mirror readable files. Note the banner (vsftpd/ProFTPD versions) for known CVEs, and watch for upload rights into a webroot.

List Login Users from /etc/passwd

Extract accounts with an interactive shell from /etc/passwd to build a list of real login users.

Metasploit Redis Scanner Module

Load the Metasploit Redis scanner auxiliary module to fingerprint and probe an exposed Redis service.

MSSQL (1433)

Connect with impacket-mssqlclient, then go for xp_cmdshell (code exec), xp_dirtree (hash coercion), or EXECUTE AS to impersonate a privileged login.

MySQL (3306)

Connect with looted DB creds, dump user tables for hashes, and check app tables for credentials you can reuse or overwrite. Use \G for readable wide rows.

Nmap Useful Switches

Handy Nmap switches for OSCP-style scans: -sn sweep, -sS SYN, -Pn no ping, -p- all ports, -sV versions, -A aggressive.

OpenSSL — Inspect TLS Service

Pull certificates from TLS services to leak hostnames, domain names, and internal CN/SAN values useful for AD enumeration.

Port Knocking to Open a Filtered Port

Send a sequence of connection attempts to the secret knock ports to unlock a firewalled service (e.g. SSH), then connect normally.

Re-enumerate From the Internal Machine

Ports invisible externally may expose vulnerable internal web apps once you are on the box.

Search Local Nmap NSE Scripts

List the installed Nmap NSE scripts and filter by service prefix to find relevant checks before scanning.

SMB (445/139)

Always try null and guest sessions first. List shares, connect to readable ones, then spider for configs, scripts, and GPP passwords. Map share ACLs with smbmap.

SMB Enumeration with rpcclient

Connects to a target over MS-RPC with a null session and enumerates domain users via querydispinfo.

SNMP (161/UDP)

SNMP is UDP/161 — easy to miss. The community string "public" is the common default. The gold is in running-process command lines, which often contain cleartext passwords.

SSH (22)

SSH itself rarely has a direct exploit on OSCP — it's a place to spray recovered creds and to reconnect with looted private keys. Note the banner for the OS/version.

Top UDP Ports Scan (Nmap)

Quickly scans the 100 most common UDP ports with a high packet rate, since full UDP scans are otherwise very slow.

Upgrade to a Full TTY (Linux)

Turn a dumb reverse shell into a fully interactive TTY so job control, arrow keys, and tab completion work.

Username Enumeration with ffuf

Enumerates valid usernames through a signup form by matching the "username already exists" response with ffuf.

Vhost & Parameter Fuzzing with Wfuzz

Uses Wfuzz for virtual host discovery (FUZZ in the Host header) and parameter fuzzing (FUZZ in the query string), hiding noise responses by character count with --hh.

Bash /dev/tcp Reverse Shell

Spawns an interactive Bash reverse shell back to the attacker using Bash's built-in /dev/tcp socket.

Brute Force HTTP Login Forms with Hydra

Brute force web login forms with Hydra's http-post-form module; the syntax is "path:POSTDATA:CONDITION" using F= for a failure string or S= for success.

Brute Force phpMyAdmin Login with Hydra

Example Hydra http(s)-post-form attack against a phpMyAdmin login, matching the "Incorrect password" failure string.

Bypass Whitespace Filters in Command Injection

Techniques to inject commands when spaces are filtered, using Bash brace expansion or the ${IFS} variable in place of whitespace.

Generate Payloads with msfvenom

Build reverse-shell / meterpreter payloads in various formats (asp, exe) with msfvenom, optionally encoding to evade simple AV.

Linux Bash Reverse Shell Script

Write a small bash reverse-shell script that calls back to a listener, then execute it on the target.

Netcat Reverse Shell

Call back to a Netcat listener with /bin/bash; use the mkfifo variant when the installed nc lacks the -e option.

PHP Reverse Shell One-Liner

Drop a compact PHP payload that base64-decodes and pipes a bash reverse shell; the phar:// wrapper can trigger included PHP from an uploaded archive.

PostgreSQL RCE / Reverse Shell

Use the squid22 PostgreSQL_RCE script to turn authenticated PostgreSQL access (superuser COPY ... PROGRAM) into command execution and a reverse shell.

Python Reverse Shell One-Liner

One-line Python reverse shell that connects back and spawns an interactive /bin/bash PTY via pty.spawn.

Read PHP Source via php://filter LFI

Abuse an LFI with the php://filter base64 wrapper to leak PHP source code, then decode the returned blob locally.

Redis RCE

Achieves remote code execution on an exposed Redis server by loading a malicious module (.so) via a public exploit.

SQL Injection with sqlmap

Automates SQL injection detection and data extraction; feed it a saved request with -r or a URL with -u, then drill from databases to tables to columns.

Windows Library-ms Client-Side Attack

Phish a Windows user with a .Library-ms file pointing at an attacker WebDAV share, chaining a malicious shortcut that downloads powercat for a reverse shell.

Check for SUID Binaries

List SUID binaries and cross-check anything unusual against GTFOBins.

Check Linux Capabilities

Capabilities like cap_setuid on a binary can grant a root shell (check GTFOBins).

Check Writable Files and Directories

Writable scripts, configs, or directories in a root-run path are common escalation vectors.

Check for PATH Hijacking

If a privileged binary calls another program by relative name, hijack it via a writable PATH entry.

Analyze Binary Execution

Watch for shelled-out commands you can break out of with && or ;.

Run LinPEAS

Read the output slowly — crons, SUIDs, users, site config, and timers.

Run LSE (Linux Smart Enumeration)

Level 1 shows more detail than the default summary.

Check Cron Jobs

Writable scripts run by root cron jobs are an easy escalation path.

Search for Passwords in App Directories

Reuse any discovered credentials against other users and services.

Read Proof Files via sudo find

Works when sudo find is allowed; find's -exec runs as root.

Check Firewall Port Rules

Firewall rules can reveal internally bound services worth pivoting to.

Check Unmounted Drives

fstab may store credentials and unmounted volumes can hold sensitive data.

Kernel Exploit (Last Resort)

Consider PwnKit or DirtyPipe only when no other vector exists; kernel exploits can crash the box.

Quick Check sudo -l and env

Always run first — sudo rules and environment variables often reveal an instant win.

Review LinPEAS for Writable Files

Focus on writable files owned or used by root highlighted in the LinPEAS output.

Check Aliases and Process Cmdline

Aliases and command lines can leak credentials or hijackable commands.

Check Bash History

History files frequently contain plaintext passwords typed by mistake.

Look for Reusable Root SSH Key

Test any private keys you find against root over loopback.

Analyze Root Processes

Root-owned services may be vulnerable or call writable files.

Check Loopback Traffic for Credentials

Internal services often pass credentials in cleartext over loopback.

Check Vulnerable Library in Cron Script

If a root cron script imports a library you can write to, modify that library to run your payload.

Add a User to the Local Administrators Group

Adds an existing local user to the built-in Administrators group to gain administrative privileges on a Windows host.

Find SUID Binaries for Privilege Escalation

Enumerates SUID binaries on a Linux host; misconfigured or known-exploitable SUID files (see GTFOBins) can be abused to escalate to root.

PrintNightmare Local Privesc (CVE-2021-1675)

Exploit the Print Spooler (CVE-2021-1675) with Invoke-Nightmare to create a local admin; then optionally dump NTDS and psexec in with the recovered hash.

PrintSpoofer Privesc (Windows Server 2019)

Abuse SeImpersonatePrivilege on Windows Server 2019 with PrintSpoofer to spawn an interactive SYSTEM process; Invoke-TokenManipulation is an alternative.

PwnKit Polkit Privesc (CVE-2021-4034)

Exploit the polkit pkexec vulnerability (CVE-2021-4034) with the ly4k PwnKit one-liner to get an instant root shell on vulnerable Linux hosts.

SeBackupPrivilege — Dump SAM/SYSTEM (or NTDS)

SeBackupPrivilege lets you read any file regardless of ACLs. Use a shadow copy to grab NTDS.dit (on a DC) or save the SAM/SYSTEM hives, then dump hashes offline with secretsdump.

UAC Bypass via Auto-Elevate Binaries

When you are in the Administrators group but running at medium integrity, check whether trusted binaries like fodhelper.exe or eventvwr.exe are flagged autoElevate, which makes them candidates for a UAC bypass.

Wildcard Abuse for PrivEsc (tar/borg)

Abuses a privileged command that uses a shell wildcard (*) by planting files whose names are interpreted as command-line options, achieving code execution.

Windows Exploit Suggester (WES-NG)

Compares a target's systeminfo output against a database of known patches to suggest missing-patch privilege escalation exploits.

Windows PrivEsc Checks with PowerUp.ps1

Run PowerUp's Invoke-AllChecks to find privesc paths; abuse AlwaysInstallElevated with a malicious MSI or weak services with Invoke-ServiceAbuse.

Check Stored Credentials with cmdkey

Saved credentials can be reused with runas /savecred without knowing the password.

Dump SAM Hashes via SMB

Dumped SAM hashes can be cracked or used for pass-the-hash.

Run Mimikatz to Dump Credentials

Requires admin/debug privileges; extracts plaintext passwords, hashes, and tickets from LSASS.

Grab Linux passwd and shadow

If you can read /etc/shadow, unshadow and crack the hashes offline with john or hashcat.

Brute-Force Web Login Forms with ffuf

Brute-forces HTTP POST login forms with ffuf, using single or clustered wordlists and filtering out the failed-login response code.

Crack & Open KeePass Databases

Convert a .kdbx file to a crackable hash for hashcat/john, or recover the master key from a memory dump (CVE-2023-32784), then browse entries with kpcli.

Decode a Base64-Encoded File

Decodes a Base64-encoded file (e.g. an obfuscated password) back to plaintext.

Dump Credentials with Mimikatz

Transfer and run Mimikatz to enable debug privileges, then dump SAM hashes and cached logon credentials from LSASS.

Dump gMSA Passwords with gMSADumper

Retrieve the managed password blob (NT hash) of Group Managed Service Accounts from a domain controller using valid domain credentials.

Extract an SSH Private Key Hash with ssh2john

Converts a passphrase-protected SSH private key into a John-compatible hash so the passphrase can be cracked with john/hashcat.

Login Brute Force with Success Match (Hydra)

Brute-forces a login form using a success condition (S=) instead of a failure string, matching the post-login redirect to /admin.

OpenSSL — Extract Key & Cert from PFX

When you loot a .pfx, split it into a key and certificate with OpenSSL, then use them for certificate-based WinRM auth.

Rails Login Brute Force (Hydra)

Brute-forces a Rails login form with Hydra; the CSRF authenticity_token must be captured and supplied, and F= marks the failure string.

Remote Credential Dumping with NetExec

Use NetExec/nxc to remotely dump LSASS, SAM, LSA, NTDS, and LAPS credentials over SMB/LDAP with admin creds, then crack the recovered hashes.

Spray Hashes Across Hosts

Local admin accounts often share the same password, so a single hash can unlock many hosts.

SSH Login with a Private Key

Authenticates over SSH with a discovered private key; the key file must have 600 permissions, and IdentitiesOnly forces use of the supplied key.

Download Files to Windows with certutil / iwr

Transfers files onto a Windows target from your attacker HTTP server using the built-in certutil (cmd) or Invoke-WebRequest (PowerShell).

File Download with NetExec (SMB)

Pulls a file off a remote SMB share using NetExec credentials, saving it locally with --get-file.

File Transfer with impacket-smbserver

Spins up an authenticated SMB share on the attacker host so a Windows target can map it and copy files in or out.

File Transfer with netcat

Transfers a file over a raw TCP connection: the receiver listens and redirects to a file, the sender pipes the file in; verify integrity with md5sum.

File Transfer with scp

Copies a file to a remote host securely over SSH using valid SSH credentials.

Pivot into Internal Networks with Ligolo-ng

Stand up Ligolo-ng tunneling: bring up the tun interface, run the proxy on Kali, connect the agent from the victim, add a route to the internal subnet, start the session, then forward ports with listener_add.

Pivot with Chisel (Reverse Port Forward & SOCKS)

Uses Chisel to tunnel a single port back over a reverse connection, or to set up a SOCKS5 proxy for routing tools through a compromised host via proxychains.

Pivoting with sshuttle

Routes traffic to an internal subnet through an SSH connection, acting as a transparent VPN without extra setup on the target.

Windows File Transfer (certutil / nc)

Downloads a binary onto a Windows host with certutil, then uses the transferred nc.exe to spawn a reverse shell back to the attacker.

Add SSH persistence

Authorize your SSH public key so you can reconnect without a password after initial access.

/etc/passwd persistence

Append a new line to /etc/passwd with UID 0 using the generated hash for a hidden root-equivalent account.

BloodHound Collection

LAPS Check

Local LAPS install path: C:\Program Files\LAPS

Check Current Privileges

Check if Defender Active

Check AppLocker Policies

Check Certify and ADCS Vulns

Check for NTLMv2 Capture

If the captured hash will not crack, relay it instead.

NTLM Relay Check

Run enum4linux

Check Possible Subdomains

Authenticate With Every Possible Cred

Also try -k (Kerberos), --local-auth, and --generate-krb5-file.

Test for Kerberoasting

Requires valid creds; prioritize accounts in privileged groups.

Test for AS-REP Roasting

Check LDAP/RPC/SMB With Creds

Re-run for every newly discovered user; watch for READ/WRITE shares.

Scan All TCP and UDP (AD)

LDAP Search Info Field

Check SYSVOL

Logon scripts and Groups.xml can contain creds or GPP passwords.

RID Brute After SMB

Check Upload to SMB/FTP

Drop the malicious file in a writable share to coerce NTLM auth.

Bruteforce Different Protocols

Try username-as-password; re-run against every newly found credential.

Find Usernames

Check Environment With PowerView

Check RDP Access (3389)

Add an AD DNS A Record with dnstool.py

Uses dnstool.py (from krbrelayx) to create a DNS A record in an AD-integrated zone, useful for coercion/relay setups where any authenticated user can add records.

Collect BloodHound Data (nxc, bloodhound-python, SharpHound)

Multiple ways to gather BloodHound data — remotely with netexec or bloodhound-python from Kali, or on-host with SharpHound — plus the Neo4j/Java steps needed to view the results.

Install BloodHound and Neo4j on Kali

Installs BloodHound, Neo4j and a compatible JDK on Kali, then sets the initial Neo4j password so you can log in to the database.

LDAP Enumeration with ldapsearch & ldapdomaindump

Query AD over LDAP with ldapsearch/netexec, then dump the whole directory to HTML with ldapdomaindump for offline review.

Query Active Directory with bloodyAD

Connects bloodyAD to a domain controller to read/modify AD objects — point -d at the domain, --host at the DC, and --dns when name resolution is flaky.

Run BloodHound CE in Docker

Runs BloodHound CE in Docker; grab the temp admin password from the startup logs and reset it on first login each time you spin up a fresh container.

Check PowerShell history

Check all installed applications

Check running processes and services

Check quoted and unquoted service paths

Check scheduled tasks

Check for strange exe (service/task/startup)

Check for config and credential files

BloodHound on compromised host

Run winPEAS

Confirm hostname; re-run if you gain admin; also check PowerUp.

Run Windows Exploit Suggester

Dump hashes remotely

Run secretsdump when domain admin

Check Administrator and domain users

Run PowerUp and PrivescCheck

Run whoami /all

Look for easy wins.

Pivot check

Relay tools to a jumpbox; check additional network adapters.

Responder in compromised host context

A writable share may enable hash capture.

Check tasklist verbose