Skip to content

Notes

Field notes

What I actually pull up mid-engagement — consolidated from courses and real work, grouped by domain. Reference material, kept terse.

Recon

Recon & enumeration: from passive OSINT to service attacks

Working an attack surface passive-first: OSINT, DNS, Nmap host/port discovery, then per-service enumeration of SMB, SMTP, SNMP, FTP and PostgreSQL.

Web

Web application attacks: discovery to shell

Content discovery, directory traversal and LFI/RFI, SQL injection to RCE, upload bypasses, exposed .git, and WordPress — with copy-ready payloads.

API

API testing: discovery and abuse

Finding versioned REST endpoints when there is no documentation, then probing auth, object access (BOLA/IDOR), mass assignment and data exposure.

Active Directory

Active Directory: enumeration to domain dominance

From first foothold to Domain Admin — enumeration, credential harvesting, Kerberos roasting, lateral movement, ADCS, and persistence, with the exact commands.

Network

Pivoting & tunnelling: getting traffic through

Port forwards, SOCKS pivots and covert tunnels — SSH/sshuttle, socat, Ligolo-ng, Chisel, and DNS/FTP tunnelling when DPI only lets a little out.

Cloud

AWS cloud attacks: recon to authenticated enumeration

Mapping a cloud footprint from DNS, discovering public S3 buckets with cloud_enum, and authenticated AWS CLI enumeration once you hold a key.

Privilege escalation

Privilege escalation: Windows & Linux

Local escalation on both platforms — enumeration, then service hijacking, token abuse, SeBackup/AlwaysInstallElevated on Windows; sudo, SUID, capabilities, cron and kernel on Linux.

General