Articles | Hackita

# featured article

Kevin Mitnick: Hacker, Social Engineering, Arrest, and Career

Kevin David Mitnick, known as The Condor and The Darkside Hacker, was one of the most famous hackers: social engineering, arrest, career, and death in 2023.

Discover more Discover more All articles All articles

Filters

Categories

Sub-category

Web Hacking

Latest Web Hacking

SQL Injection MySQL: Payload, Cheat Sheet and Techniques — SQL Injection 39 min read
SQL Injection MySQL: Payload, Cheat Sheet and Techniques
SQL injection on MySQL: cheat sheet with UNION payloads, error-based, blind, time-based, DIOS, RCE via UDF, OOB, WAF bypass and sqlmap commands for pentesting.

Command Injection: Payload, Bypass and How to Defend Yourself — command injection 9 min read
Command Injection: Payload, Bypass and How to Defend Yourself
Learn what Command Injection is, how it works, where it is found, and how to test for it with Burp Suite and Commix: blind techniques, OOB, filter bypass, and defense.

OAuth 2.0: Tokens, Scope, and Risks of Third-Party Tools | HackITA — OAuth 4 min read
OAuth 2.0: Tokens, Scope, and Risks of Third-Party Tools | HackITA
How OAuth 2.0 works, what scope and access tokens are, and how to protect your company's social media accounts from token theft in third-party tools.

SVG XSS and XXE: Attack via Image Upload — SVG 4 min read
SVG XSS and XXE: Attack via Image Upload
An uploaded SVG can execute scripts or read local files. A practical guide to XSS and XXE via SVG: real-world payloads, attack vectors, and mitigations for developers.

NoSQL Injection: Guide to MongoDB, Payload, Bypass for Pentest — NoSQL Injection 17 min read
NoSQL Injection: Guide to MongoDB, Payload, Bypass for Pentest
Learn what NoSQL Injection is on MongoDB: payload, authentication bypass, $regex, $where, blind injection, data extraction, and defense techniques.

RCE (Remote Code Execution): What it is, Vectors and Exploits — remote code execution 10 min read
RCE (Remote Code Execution): What it is, Vectors and Exploits
RCE in pentesting: Learn the vectors that lead to Remote Code Execution, how to verify them, get a shell, and initiate post-exploitation.

Recon OSINT: Tool, theHarvester, Shodan and Google Dorks. — OSINT 11 min read
Recon OSINT: Tool, theHarvester, Shodan and Google Dorks.
Passive OSINT reconnaissance for pentesters: Collect emails, subdomains, exposed devices, and metadata with theHarvester, Google Dorks, Shodan, and Metagoofil.

Subdomain Enumeration with subfinder, puredns and httpx — subdomain enumeration 10 min read
Subdomain Enumeration with subfinder, puredns and httpx
Subdomain enumeration pipeline: passive recon with subfinder, brute force with puredns, Alterx permutations, httpx validation and subdomain takeover check.

Wfuzz: Web fuzzing of directories, parameters, headers, and VHosts — WAF bypass 9 min read
Wfuzz: Web fuzzing of directories, parameters, headers, and VHosts
Wfuzz for web fuzzing: directory and parameter commands, VHost discovery, headers, cookies, filters, SecLists, encoders, and WAF bypass techniques.

XXE Injection (XML External Entity): file read, SSRF and RCE — XXE Injection 12 min read
XXE Injection (XML External Entity): file read, SSRF and RCE
XXE (XML External Entity) in pentesting: payload for file read, SSRF, Blind XXE OOB and RCE, testing with Burp Suite and Nuclei, prevention in XML parsers.

Advanced XXE Injection: XML parser, XInclude, SOAP and bypass — XXE Injection 13 min read
Advanced XXE Injection: XML parser, XInclude, SOAP and bypass
Advanced XXE Injection: Identifies XML parsers, compares Java, PHP, Python, and .NET, tests SOAP, XInclude, content-type switching, and targeted bypasses.

HTTP Security Headers: Guide to CSP, HSTS and Bypass — security headers 16 min read
HTTP Security Headers: Guide to CSP, HSTS and Bypass
Learn how to test and configure HTTP security headers: CSP, HSTS, X-Frame-Options, Referrer-Policy and bypass techniques in web pentests.

Recon Pipeline: OSINT Automation for Bug Bounty and Pentesting — recon-pipeline 9 min read
Recon Pipeline: OSINT Automation for Bug Bounty and Pentesting
Automated recon pipeline guide: subdomain enumeration, DNS, port scanning, fingerprinting, Nuclei, and secret scanning for bug bounty and pentesting.

Injection Attack: A Complete Guide to Web Injections — injection attack 12 min read
Injection Attack: A Complete Guide to Web Injections
A complete guide to injection attacks: SQL injection, command injection, SSTI, XXE, LDAP, NoSQL, and other techniques, with examples, testing, and prevention.

Mass Assignment: How to Find and Use It in APIs — mass assignment 7 min read
Mass Assignment: How to Find and Use It in APIs
Learn what mass assignment is, how to identify it, and how to leverage it in REST APIs, with practical examples for Rails, Laravel, Django, Node.js, and Burp Suite.

Password Reset Attack: Techniques, Exploits and Account Takeover — password-reset-attack 8 min read
Password Reset Attack: Techniques, Exploits and Account Takeover
Password Reset Attack Guide: Host header poisoning, weak tokens, race conditions, leaks, and practical account takeover techniques for web pentests.

Broken Authentication: Bypass Login, 2FA and Sessions — broken-authentication 6 min read
Broken Authentication: Bypass Login, 2FA and Sessions
OWASP A07 Broken Authentication Guide: username enumeration, brute force, 2FA bypass, session fixation, password reset and credential stuffing for pentests.

Web Cache Poisoning: Testing, Cache Keys, and Bypass Techniques — web cache 19 min read
Web Cache Poisoning: Testing, Cache Keys, and Bypass Techniques
Practical guide to Web Cache Poisoning in pentesting: analyze cache keys and unkeyed inputs, test headers and fat GETs with Burp, and apply useful detection and mitigations.

Broken Access Control: Tests, Examples and Bypass OWASP A01 — broken-access-control 13 min read
Broken Access Control: Tests, Examples and Bypass OWASP A01
Practical guide to Broken Access Control OWASP A01:2025: privilege escalation, IDOR and BOLA, force browsing, HTTP methods, header bypass and testing with Burp Suite.

Twig SSTI and Sandbox Bypass: RCE in Twig, CMS and PHP Filters — ssti 10 min read
Twig SSTI and Sandbox Bypass: RCE in Twig, CMS and PHP Filters
Twig SSTI ,detection, payload and RCE: fingerprint vs Jinja2, payload for Twig 2.x and 3.x, filter/map/reduce bypass, sandbox escape, Drupal/Craft CMS and mitigations

HasSession BloodHound: Session Enumeration and Abuse — HasSession 11 min read
HasSession BloodHound: Session Enumeration and Abuse
HasSession BloodHound: Learn how to enumerate sessions with SharpHound and leverage tokens, credentials, and RDP, with Active Directory detection and mitigations.

SQL Injection MSSQL: UNION, Blind, Stacked, RCE, Payload — sql-injection 13 min read
SQL Injection MSSQL: UNION, Blind, Stacked, RCE, Payload
Pentest SQL Injection MSSQL: identify quotes, exploit UNION/blind/time-based/stacked/error-based, bypass WAF, RCE via xp_cmdshell, NTLM hash, linked server.

2FA Bypass: Techniques, Payloads, and OTP Attacks for Pentesters — MFA bypass 19 min read
2FA Bypass: Techniques, Payloads, and OTP Attacks for Pentesters
2FA bypass: response manipulation, OTP brute force, direct post-login link, SIM swapping, MFA phishing, backup code abuse. Payload for ethical pentesters and hackers

Deserialization Attack: What It Is, How to Find It, and How It Leads to RCE — deserialization attack 12 min read
Deserialization Attack: What It Is, How to Find It, and How It Leads to RCE
Deserialization attack explained from the beginning: what serialization is, why it's dangerous, and how to exploit it in PHP, Java, Python, and .NET with ysoserial and phpggc. A step-by-step guide for beginners and pentesters.

Windows Privilege Escalation 2026: A Complete Guide to Privilege Tokens (SE*) — windows-privilege-escalation 5 min read
Windows Privilege Escalation 2026: A Complete Guide to Privilege Tokens (SE*)
A comprehensive map of exploitable Windows privilege tokens in a pentest. From whoami /priv to SYSTEM: cheat sheets, tables, workflows, and links to how-to guides.

SeSystemEnvironmentPrivilege: PATH Hijacking and UEFI Persistence — sesystemenvironmentprivilege 5 min read
SeSystemEnvironmentPrivilege: PATH Hijacking and UEFI Persistence
Leverages SeSystemEnvironmentPrivilege for PATH hijacking and SYSTEM shell. UEFI persistence that survives disk wipes. Red Team guidance with registry, Process Monitor, and Chipsec.

SeTrustedCredManAccessPrivilege: RDP Dump and Vault with Mimikatz — setrustedcredmanaccessprivilege 4 min read
SeTrustedCredManAccessPrivilege: RDP Dump and Vault with Mimikatz
Extract RDP passwords and credentials from Credential Manager with SeTrustedCredManAccessPrivilege. Use cmdkey, mimikatz, and SharpDPAPI. Step-by-step Red Team guide.

Evilginx 3: AiTM Phishing and MFA Bypass for Red Teams — session hijacking 13 min read
Evilginx 3: AiTM Phishing and MFA Bypass for Red Teams
Learn how Evilginx 3 enables AiTM phishing, captures post-MFA cookies, and helps red teams understand MFA-bypass risks in Microsoft 365.

SeDelegateSessionUserImpersonatePrivilege: Cross-Session Token Stealing on RDS and Citrix — seldegatesessionuserimpersonateprivilege 4 min read
SeDelegateSessionUserImpersonatePrivilege: Cross-Session Token Stealing on RDS and Citrix
How to exploit SeDelegateSessionUserImpersonatePrivilege to impersonate users in active RDS sessions. Cross-session token stealing with NtObjectManager. Privesc and Red Team techniques.

Account Takeover: Offensive Techniques for Pentesters (2026) — MFA Bypass 8 min read
Account Takeover: Offensive Techniques for Pentesters (2026)
Learn Account Takeover (ATO) techniques for pentesters and red teams. Discover how to bypass MFA, steal tokens, and compromise accounts. Complete guide 2026.

IDOR: What It Is, How to Find It, and How to Use It — A Complete Guide — insecure direct object reference 7 min read
IDOR: What It Is, How to Find It, and How to Use It — A Complete Guide
IDOR (Insecure Direct Object Reference) explained from a pentester's perspective: how to identify it, how to enumerate it, and how to scale it to account takeovers and data breaches. With real-world examples and a practical checklist.

Injection Attack: A Complete Guide to All Types of Injection — injection attack 12 min read
Injection Attack: A Complete Guide to All Types of Injection
A complete guide to injection attacks: SQL injection, command injection, LDAP, XPath, SSTI, XXE, CRLF, log injection, EL, NoSQL, and GraphQL. What injection is, how it works, how to find it, and how to exploit it. A hub with links to all the specific guides.

Web Cache Poisoning: What It Is, How It Works, and How to Exploit It — web cache poisoning 11 min read
Web Cache Poisoning: What It Is, How It Works, and How to Exploit It
A complete guide to web cache poisoning: discover what it is, how cache poisoning works, exploitation techniques (unkeyed inputs, CPDoS), and how to turn it into account takeover. Practical and CDN-specific examples.

SeDebugPrivilege: Privilege Escalation with Dump LSASS with LOLBins — sedebugprivilege 5 min read
SeDebugPrivilege: Privilege Escalation with Dump LSASS with LOLBins
SeDebugPrivilege Enabled? Two commands to dump LSASS and get NTLM hashes. All with Windows' built-in comsvcs.dll, no disk mimikatz. Red Team technical guide.

SeImpersonatePrivilege: Privesc and Potato Attack up to SYSTEM — seimpersonateprivilege 5 min read
SeImpersonatePrivilege: Privesc and Potato Attack up to SYSTEM
SeImpersonatePrivilege explained with Potato attacks: from IIS or SQL Server to SYSTEM, privilege escalation windows with modern tools used in labs.

CSP Bypass: How to bypass Content Security Policy in XSS tests — XSS 4 min read
CSP Bypass: How to bypass Content Security Policy in XSS tests
A practical guide to CSP bypass: unsafe-inline, weak nonces, base-uri, object-src, JSONP, AngularJS, dangling markup, and real-world techniques for bypassing Content Security Policy.

XSS Payload List: Complete cheat sheet for context, bypass and blind XSS — XSS 3 min read
XSS Payload List: Complete cheat sheet for context, bypass and blind XSS
Complete list of XSS payloads for HTML, attributes, JavaScript, DOM, Blind XSS and filter bypass: a practical cheat sheet for pentesters and bug bounties.

XSS WAF Bypass: How to bypass Cloudflare, AWS WAF and ModSecurity — XSS 4 min read
XSS WAF Bypass: How to bypass Cloudflare, AWS WAF and ModSecurity
Practical guide to XSS bypass against real WAFs: Cloudflare, AWS WAF, ModSecurity CRS, encoding evasion, mutated payloads, origin bypass, and techniques used in pentests.

DOM XSS: What It Is and How to Find Hidden Sources and Sinks in JavaScript — XSS 3 min read
DOM XSS: What It Is and How to Find Hidden Sources and Sinks in JavaScript
Practical guide to DOM

Reflected XSS: How to Find It, Exploit It, and Execute the Payload — XSS 3 min read
Reflected XSS: How to Find It, Exploit It, and Execute the Payload
A complete guide to Reflected XSS: reflection points, context analysis, HTML and JavaScript payloads, link delivery, cookie stealing, dalfox, and real-world exploit techniques.

XSS Filter Bypass: Payloads and Techniques for Bypassing Server-Side Filters — XSS 4 min read
XSS Filter Bypass: Payloads and Techniques for Bypassing Server-Side Filters
A practical guide to XSS bypasses: alternative tags, keyword obfuscation, encoding, regex bypass, HTML and JavaScript contexts, and real-world techniques for bypassing server-side filters.

Stored XSS (Persistent XSS): Exploits, Cookie Theft and Web Worms — XSS 6 min read
Stored XSS (Persistent XSS): Exploits, Cookie Theft and Web Worms
Stored XSS Explained: What It Is Cross-site scripting, persistent payloads stored in the database, cookie theft, account takeover, and self-replicating worms in web applications.

Zip Slip Vulnerability: Path Traversal in ZIP/TAR and RCE via Archive Extraction — file-upload-attack 11 min read
Zip Slip Vulnerability: Path Traversal in ZIP/TAR and RCE via Archive Extraction
Zip Slip Explained: Path Traversal in ZIP and TAR Archives Leads to RCE, Web Shell, and Persistence During File Extraction

WebSocket Hijacking (CSWSH): Cross-Site WebSocket Hijacking and Real-Time Data Theft — api 5 min read
WebSocket Hijacking (CSWSH): Cross-Site WebSocket Hijacking and Real-Time Data Theft
WebSocket Hijacking Explained: CSWSH, Vulnerable Handshake, Missing Origin Check, and Real-Time Data Theft from Chats, Notifications, and Dashboards.

XPath Injection: Payload, Login Bypass and Blind Attack on XML — XPath Injection 14 min read
XPath Injection: Payload, Login Bypass and Blind Attack on XML
XPath Injection Guide: What it is, Pentesting, login bypass payloads, XML data extraction, and blind testing. Discover techniques, tools, secrets, and mitigations.

Session Hijacking: Cookie Theft, XSS and Session Fixation in Web Apps — session hijacking 7 min read
Session Hijacking: Cookie Theft, XSS and Session Fixation in Web Apps
Session Hijacking in web pentesting: cookie theft via XSS, session fixation, HTTP sniffing and account takeover. HttpOnly, Secure and SameSite flag analysis.

Source Code Disclosure: .git Exposed, Commit Credentials, and Git-Dumper — source-code-disclosure 7 min read
Source Code Disclosure: .git Exposed, Commit Credentials, and Git-Dumper
Source Code Disclosure in Pentesting: Exposed .git, git-dumper, credentials in git history, and trufflehog for secrets. From repository dump to cloud takeover.

SSRF Attack: Server-Side Request Forgery, Cloud Metadata and AWS Credential Theft — ssrf 5 min read
SSRF Attack: Server-Side Request Forgery, Cloud Metadata and AWS Credential Theft
The Complete Guide to SSRF: How to Find Server-Side Request Forgery, Bypass IP Filters, Read AWS Metadata, and Get Cloud Credentials.

Subdomain Takeover: CNAME Dangling, DNS Misconfiguration, and Account Takeover — dns 3 min read
Subdomain Takeover: CNAME Dangling, DNS Misconfiguration, and Account Takeover
The Complete Guide to Subdomain Takeover: CNAME Dangling, Defunct Cloud Services, and Subdomain Takeovers on AWS, Heroku, GitHub Pages, and Azure.

Web Shell PHP: Upload Exploit, Reverse Shell and Persistence on the Server — file-upload-attack 11 min read
Web Shell PHP: Upload Exploit, Reverse Shell and Persistence on the Server
Complete guide to Web Shells in pentesting: PHP shell upload, reverse shell, WAF bypass and persistence after file upload or LFI.

Web Application Attacks: A Complete Guide to Vulnerabilities and Exploits — Web Exploitation 11 min read
Web Application Attacks: A Complete Guide to Vulnerabilities and Exploits
Discover the main web application attacks: SQL Injection, XSS, SSRF, IDOR, CSRF, SSTI, and API abuse. A complete guide for pentesters and red teams.

Path Traversal: What it is, Payload, WAF Bypass and File Read in Pentesting — path traversal 8 min read
Path Traversal: What it is, Payload, WAF Bypass and File Read in Pentesting
Path traversal in web pentesting: payload, WAF bypass, reading /etc/passwd, .env, and cloud credentials. A practical guide with fuzzing and exploitation.

Web Privilege Escalation: Vertical, Horizontal, and Mass Assignment — privesc-web 6 min read
Web Privilege Escalation: Vertical, Horizontal, and Mass Assignment
Privilege escalation in web apps: mass assignment, role=admin, JWT manipulation, and multi-tenant bypass. Practical pentesting techniques for user-to-admin escalation.

Race Condition Web: Double Spending, Coupon Abuse, and Parallel Request Attacks — race condition 5 min read
Race Condition Web: Double Spending, Coupon Abuse, and Parallel Request Attacks
Race Conditions in web apps: double spending, coupon abuse, and limit bypassing with parallel requests. Detection techniques with Turbo Intruder and real-world exploits.

Remote File Inclusion (RFI): RCE via URL, Wrapper Bypass and SMB Attack — remote-file-inclusion 9 min read
Remote File Inclusion (RFI): RCE via URL, Wrapper Bypass and SMB Attack
Remote File Inclusion (RFI): RCE via URL, Wrapper Bypass and SMB Attack

Misc & Infrastructure Attacks: Subdomain Takeover, Race Condition, Request Smuggling — web shell 12 min read
Misc & Infrastructure Attacks: Subdomain Takeover, Race Condition, Request Smuggling
A comprehensive guide to the most underestimated vulnerabilities in web pentesting: Subdomain Takeover, HTTP Request Smuggling, Race Conditions, Deserialization, and Cache Poisoning. Real-world techniques, payloads, and enterprise attack chains.

OAuth Attack: OAuth Vulnerabilities, Token Theft and Account Takeover — csrf 7 min read
OAuth Attack: OAuth Vulnerabilities, Token Theft and Account Takeover
Learn how to exploit OAuth vulnerabilities: redirect_uri manipulation, stateless CSRF, referer token leak, and account takeover in web pentesting.

Open Redirect: What It Is, How to Use It, and Chain with OAuth and SSRF — ssrf 4 min read
Open Redirect: What It Is, How to Use It, and Chain with OAuth and SSRF
Open Redirect in Web Pentesting: Detection, URL and Chain Validation Bypass with OAuth Token Theft, SSRF Bypass, and Credible Phishing. A Practical Guide.

OS Command Injection: What is it, Argument Injection and RCE on Linux and Windows — command injection 3 min read
OS Command Injection: What is it, Argument Injection and RCE on Linux and Windows
OS Command Injection in pentesting: separators, argument injection, exploits on Linux and Windows (curl, tar, ffmpeg, Git, ImageMagick) and post-exploitation.

LDAP Injection: Bypassing Active Directory Authentication and User Enumeration — ldap 5 min read
LDAP Injection: Bypassing Active Directory Authentication and User Enumeration
Learn how to exploit an LDAP injection in enterprise portals: bypass Active Directory authentication, enumerate users, and extract sensitive attributes from the corporate directory.

Log Injection: Log Forging, Log Poisoning and RCE via LFI — log 5 min read
Log Injection: Log Forging, Log Poisoning and RCE via LFI
Learn how to exploit a log injection in web pentesting: log forging for anti-forensics, log poisoning combined with LFI to achieve remote code execution, and the historical Log4Shell case study.

File Upload Attack: Bypass, Polyglot and Web Shell — web shell 11 min read
File Upload Attack: Bypass, Polyglot and Web Shell
Learn how to exploit a file upload attack in web pentesting: extension bypass, Content-Type, magic bytes, polyglot, and RCE via web shell.

GraphQL Attacks: Introspection, Batching and Data Breach — api 7 min read
GraphQL Attacks: Introspection, Batching and Data Breach
Find out how to test GraphQL in web pentesting: introspection, batching, authorization bypass, IDOR, brute force and data leak via query.

HTTP Header Injection: Host Poisoning and X-Forwarded-For — HTTP injection 3 min read
HTTP Header Injection: Host Poisoning and X-Forwarded-For
Find out how to exploit HTTP Header Injection in web pentesting: Host Header Poisoning, X-Forwarded-For bypass, cache poisoning and reset password takeover.

HTTP Request Smuggling: Desync, Cache Poisoning and Cookie Theft — HTTP injection 5 min read
HTTP Request Smuggling: Desync, Cache Poisoning and Cookie Theft
Learn how to test HTTP Request Smuggling in web pentesting: CL.TE, TE.CL, proxy-backend desync, cache poisoning, and cookie theft.

Local File Inclusion (LFI): Attacks, Payloads, RCE & Bypass — Local File Inclusion 12 min read
Local File Inclusion (LFI): Attacks, Payloads, RCE & Bypass
Learn how the LFI vulnerability works: file reading, PHP wrapper, filter chain, and log poisoning, with exploitation techniques and countermeasures in the pentest.

SSTI (Server-Side Template Injection): Detection, Payload, Twig, Jinja2 and RCE — ssti 11 min read
SSTI (Server-Side Template Injection): Detection, Payload, Twig, Jinja2 and RCE
A practical guide to SSTI: detection, template engine fingerprinting, real payloads, Jinja2, Twig, FreeMarker, sandbox bypass, and RCE.

CORS Misconfiguration: Complete Guide to Exploit, Bypass and Data Theft in APIs — api 5 min read
CORS Misconfiguration: Complete Guide to Exploit, Bypass and Data Theft in APIs
CORS Misconfiguration in APIs: Learn how to identify, exploit, and demonstrate data theft with origin reflection, null origin, common bypasses, and real-world PoCs with curl and JavaScript.

CRLF Injection: Header Injection, XSS and Cache Poisoning — cache poisoning 4 min read
CRLF Injection: Header Injection, XSS and Cache Poisoning
Find out how to exploit a CRLF injection in web pentesting: header injection, HTTP response splitting, session fixation and cache poisoning.

CSRF Attack: Real Token, SameSite and Bypass — csrf 7 min read
CSRF Attack: Real Token, SameSite and Bypass
Learn how to detect and test a CSRF attack in web pentesting: HTML PoC, token bypass, SameSite, JSON API, and account takeover.

Expression Language Injection (EL): SpEL, OGNL, MVEL and RCE Java — el 7 min read
Expression Language Injection (EL): SpEL, OGNL, MVEL and RCE Java
Learn what Expression Language Injection is and how to leverage it in Java apps: SpEL, OGNL, Spring, Struts2, RCE, and real-world cases like Equifax.

File & Path Attacks: LFI, Upload and Path Traversal — web shell 13 min read
File & Path Attacks: LFI, Upload and Path Traversal
Guide to file & path attacks in web pentesting: path traversal, LFI, file upload, web shell, Zip Slip, backup exposure and file read.

Auth & Access Control: A Complete Guide to Pentesting — web scanning 15 min read
Auth & Access Control: A Complete Guide to Pentesting
A complete guide to authentication and access control in web pentesting: IDOR, JWT attacks, CSRF, 2FA bypass, password reset, and privilege escalation.

Backup Exposure: SQL, .env and ZIP Dumps Exposed — web scanning 7 min read
Backup Exposure: SQL, .env and ZIP Dumps Exposed
Learn how to find exposed backup files in web pentesting: SQL dumps, .env, ZIP, and config.bak with feroxbuster, ffuf, and real-world techniques.

Business Logic Flaw: What It Is and How to Find It — business logic 7 min read
Business Logic Flaw: What It Is and How to Find It
Learn what a business logic flaw is and how to spot it in web pentesting: negative pricing, coupon abuse, step bypass, and workflow flaws.

Clickjacking: What It Is and How to Find It in Web Pentesting — clickjacking 5 min read
Clickjacking: What It Is and How to Find It in Web Pentesting
Learn what clickjacking (UI Redressing) is and how to spot it in web pentesting: invisible iframes, X-Frame-Options, CSP frame-ancestors and real PoCs.

Arbitrary File Read: Exploit, WAF Bypass and Cloud Takeover (2026 Pentesting Guide) — lfi 10 min read
Arbitrary File Read: Exploit, WAF Bypass and Cloud Takeover (2026 Pentesting Guide)
Arbitrary File Read exploit in pentesting: Read sensitive Linux and Windows files, bypass WAF, /proc/self/environ, cloud credentials, and escalate to cloud takeover.

Brute Force Attack: Meaning, Techniques, Tools, Bypass — brute-force 8 min read
Brute Force Attack: Meaning, Techniques, Tools, Bypass
Brute Force attacks in penetration testing: password cracking, credential stuffing, wordlist, Hydra, Burp Intruder and bypass rate limit in systems with auth.

API Rate Limit Bypass: Pentesting Techniques to Bypass Throttling (2026) — api 9 min read
API Rate Limit Bypass: Pentesting Techniques to Bypass Throttling (2026)
Rate Limit Bypass API explained operationally: header rotation with X-Forwarded-For, endpoint switching, HTTP method tampering, Unicode bypass, race conditions and GraphQL batching.

API Security: A Complete Guide to API Attacks and Pentesting (SSRF, GraphQL, BOLA, CORS) — api 14 min read
API Security: A Complete Guide to API Attacks and Pentesting (SSRF, GraphQL, BOLA, CORS)
API security and penetration testing of modern APIs: SSRF, GraphQL attacks, BOLA/IDOR, CORS misconfiguration, mass assignment, and rate limit bypass. A comprehensive guide with real-world payloads and techniques.

API Versioning Attack: Exploiting Forgotten v1 Endpoints in API Pentesting (2026) — api 4 min read
API Versioning Attack: Exploiting Forgotten v1 Endpoints in API Pentesting (2026)
API Versioning Attack Operationally Explained: How to find legacy v1 API endpoints, bypass rate limits and authentication, and exploit deprecated APIs during a penetration test.

SQL Injection on REST API and GraphQL: JSON Body, Header Injection and SQLMap (2026 Guide) — sql 5 min read
SQL Injection on REST API and GraphQL: JSON Body, Header Injection and SQLMap (2026 Guide)
SQL Injection on REST API: JSON body injection, GraphQL SQLi, header injection and WAF bypass. Practical guide with SQLMap, API fuzzing and real exploitation.

SQL Injection on ORM: Django, Laravel, Hibernate and Sequelize — sql 7 min read
SQL Injection on ORM: Django, Laravel, Hibernate and Sequelize
SQL Injection on ORM: Vulnerabilities in Django, Laravel, Hibernate, and Sequelize. Raw queries, extra(), orderByRaw, and real-world exploitation with practical examples.

Time-Based SQL Injection: How to Extract Data Without Output — sql 7 min read
Time-Based SQL Injection: How to Extract Data Without Output
Time-Based SQL Injection explained with real payloads: SLEEP, pg_sleep, WAITFOR DELAY, heavy query, Python script and SQLMap. Complete exploitation guide 2026.

Blind SQL Injection: Boolean-Based Extraction with SQLMap (2026 Guide) — sql 8 min read
Blind SQL Injection: Boolean-Based Extraction with SQLMap (2026 Guide)
Blind SQL Injection: boolean-based detection, extraction with SUBSTRING and ASCII, binary search and full automation with SQLMap for database dumps, credentials and escalation.

Classic SQL Injection: UNION SELECT and Error-Based (2026 Operational Guide) — sql 6 min read
Classic SQL Injection: UNION SELECT and Error-Based (2026 Operational Guide)
Classic SQL Injection (In-Band): practical guide to UNION SELECT and Error-Based with ORDER BY, data extraction, WAF bypass, SQLMap and complete step-by-step database dump.

Phishing: Techniques, Types, and Defenses in 2026 — social engineering 7 min read
Phishing: Techniques, Types, and Defenses in 2026
Phishing explained technically: spear phishing, credential harvesting, OAuth phishing, MFA bypass, and practical defenses for businesses and users.

S3Scanner: Enumeration and Misconfiguration Detection on Amazon S3 — aws 10 min read
S3Scanner: Enumeration and Misconfiguration Detection on Amazon S3
S3Scanner: Enumeration and Misconfiguration Detection on Amazon S3

Recon-ng: Modular OSINT Framework for Advanced Reconnaissance — osint 11 min read
Recon-ng: Modular OSINT Framework for Advanced Reconnaissance
Recon-ng is a modular OSINT framework with a Metasploit-like interface. Ideal for automated collection of domains, emails, and external assets.

ReconSpider for Kali: Web Recon and Automated OSINT — osint 12 min read
ReconSpider for Kali: Web Recon and Automated OSINT
ReconSpider is an OSINT tool for automating web reconnaissance and intelligence gathering on domains, IPs, emails, metadata, and other public sources.

Nuclei: High-Speed Template-Based Vulnerability Scanner — template-scanning 6 min read
Nuclei: High-Speed Template-Based Vulnerability Scanner
Nuclei: High-Speed Template-Based Vulnerability Scanner

Nikto: Web Server Vulnerability and Misconfiguration Scanner — web scanning 6 min read
Nikto: Web Server Vulnerability and Misconfiguration Scanner
Nikto is a web scanner for finding known vulnerabilities, sensitive files, misconfigurations, and outdated software on HTTP/HTTPS servers.

Eyewitness: Visual Recon and Screenshot Automation for Large-Scale Web Triage — surface mapping 5 min read
Eyewitness: Visual Recon and Screenshot Automation for Large-Scale Web Triage
Eyewitness automates screenshots and analysis of web and RDP services. Rapid visual recon identifies admin panels and exposed attack surfaces.

Feroxbuster: Fast and Recursive Directory Bruteforcing for Web Hacking — directory-enumeration 12 min read
Feroxbuster: Fast and Recursive Directory Bruteforcing for Web Hacking
Feroxbuster is a high-performance directory and content discovery tool. It features recursive bruteforce, multi-threading, and proxy support for advanced web testing.

FOCA: Metadata Extraction and OSINT on Documents for Information Gathering — metadata analysis 11 min read
FOCA: Metadata Extraction and OSINT on Documents for Information Gathering
FOCA is an OSINT tool for extracting metadata from public documents, mapping internal infrastructure, and identifying exposed users, servers, and paths.

Gitrob: OSINT and Secret Discovery on GitHub Repository — github-enumeration 11 min read
Gitrob: OSINT and Secret Discovery on GitHub Repository
Gitrob scans GitHub repositories to identify sensitive files and exposed credentials. A useful tool for reconnaissance and secret hunting.

Gophish: Phishing Framework for Simulation and Red Team — phising 5 min read
Gophish: Phishing Framework for Simulation and Red Team
Gophish is an open-source platform for phishing simulation and red team engagement. It offers centralized campaign management, tracking, and reporting.

Amass: Advanced Subdomain Enumeration for Reconnaissance and Attack Surface Mapping — osint 4 min read
Amass: Advanced Subdomain Enumeration for Reconnaissance and Attack Surface Mapping
Amass is an OSINT and active reconnaissance tool for enumerating subdomains, mapping external assets, and analyzing DNS relationships. A practical guide to its use during attack surface discovery during a penetration test.

Aquatone: Visual Recon and Automatic Screenshots for Subdomain Enumeration — subdomain-enumeration 4 min read
Aquatone: Visual Recon and Automatic Screenshots for Subdomain Enumeration
Aquatone is a visual reconnaissance tool that automatically captures screenshots of hosts and subdomains discovered during the recon phase. It's ideal for quickly mapping web surfaces in penetration tests.

Dirsearch: Directory and File Enumeration for Web Application Testing — directory-enumeration 7 min read
Dirsearch: Directory and File Enumeration for Web Application Testing
Dirsearch is a tool for enumerating hidden directories and files on web applications using custom wordlists. A practical guide to its use during web reconnaissance during a penetration test.

Gobuster: Directory, DNS and Virtual Host Bruteforcing for Web Enumeration — directory-enumeration 7 min read
Gobuster: Directory, DNS and Virtual Host Bruteforcing for Web Enumeration
Gobuster is a fast tool for brute-forcing directories, DNS, and virtual hosts. A practical guide to using it for web enumeration during a penetration test.

BeEF: Complete Guide to the Browser Exploitation Framework — Browser Exploitation 4 min read
BeEF: Complete Guide to the Browser Exploitation Framework
BeEF's practical guide to browser exploitation: victim hooks, compromised browser control, and client-side post-exploitation. Transform XSS into persistent access.

Burp Suite: Guide to Web Application Penetration Testing — burp suite 10 min read
Burp Suite: Guide to Web Application Penetration Testing
Burp Suite: How to use it in web penetration testing: discover Proxy, Repeater, Intruder and Scanner and how to test SQLi, XSS, CSRF, API, authentication and secrets.

SQLMap: Complete Guide to SQL Injection Automation and Database Exploitation — sqlmap 11 min read
SQLMap: Complete Guide to SQL Injection Automation and Database Exploitation
Complete guide to SQLMap for SQL injection automation: detection, exploitation, database enumeration, WAF bypass and UNION, boolean and time-based techniques.

XSS (Cross-Site Scripting): Exploits, Payloads and Bypasses — XSS 7 min read
XSS (Cross-Site Scripting): Exploits, Payloads and Bypasses
XSS (Cross-Site Scripting): complete guide to reflected, stored and DOM-based XSS, payloads, advanced filter bypasses, exploitation and defense of web applications.

JWT Attacks: 10 Pentests, Vulnerabilities, and How to Defend Yourself — jwt attacks 16 min read
JWT Attacks: 10 Pentests, Vulnerabilities, and How to Defend Yourself
Practical guide to JWT attacks: alg none, weak HMAC keys, algorithm confusion, kid, jku and jwk, claim, refresh token, terminal tools and mitigations.

WordPress xmlrpc.php: Attacks & Exploits for Pentest (2026) — wordpress 16 min read
WordPress xmlrpc.php: Attacks & Exploits for Pentest (2026)
Learn how to verify xmlrpc.php in WordPress, analyze brute force and pingbacks, assess SSRF risks, and secure your endpoint during a pentest.

Linux

Latest Linux

Linux Persistence: Post-Exploitation Persistence Techniques — Linux Persistence 23 min read
Linux Persistence: Post-Exploitation Persistence Techniques
A Guide to Linux Post-Exploitation Persistence: Systemd, Cron, SSH, Udev, LKM, Capabilities, and Other Persistence Mechanisms on Linux.

Kubernetes Pentesting: RBAC, Secrets, PrivEsc and Kubectl — kubernetes-privilege-escalation 15 min read
Kubernetes Pentesting: RBAC, Secrets, PrivEsc and Kubectl
Kubernetes pentest: How a stolen token in a Pod leads, via RBAC and nodes/proxies, to privilege escalation and root shell on the node, with kubectl and cheatsheet.

Bash: A Complete Guide to Linux, Commands, and Scripting — bash 7 min read
Bash: A Complete Guide to Linux, Commands, and Scripting
What is Bash and how does it work? Learn Bash commands, variables, pipes, permissions, and scripting with a practical, groundbreaking guide designed for Linux and cybersecurity.

SSH Hardening on Linux: sshd_config, Ed25519 and Fail2Ban — SSH Hardening 9 min read
SSH Hardening on Linux: sshd_config, Ed25519 and Fail2Ban
SSH hardening on Linux: Configure sshd_config, Ed25519, Fail2Ban, UFW, and 2FA keys; verify algorithms and logins with ssh-audit; and create a jump host.

Linux Enumeration: commands and tools for Privilege Escalation — Linux Enumeration 13 min read
Linux Enumeration: commands and tools for Privilege Escalation
Linux enumeration step-by-step: Use manual commands, SUID, sudo, capabilities, cron, LinPEAS, LinEnum, and LSE to detect privilege escalation vectors.

Linux Groups for Privilege Escalation: Docker, LXD, and Disk — Linux privilege escalation 20 min read
Linux Groups for Privilege Escalation: Docker, LXD, and Disk
Linux privilege escalation via 40+ Linux groups: disk, Docker, LXD, Incus, MicroK8s, libvirt, shadow, video, adm, input, ssl-cert, KVM, sudo/wheel, lpadmin.

LinPEAS: Automated Linux Privilege Escalation and Enumeration — linpeas 7 min read
LinPEAS: Automated Linux Privilege Escalation and Enumeration
Learn how to use LinPEAS for Linux privilege escalation enumeration: SUID, sudo, cron, capabilities, kernel exploits, PATH hijacking, and CTF scenarios with real command examples.

Fail2Ban Privilege Escalation: Linux Exploit to Gain Root — fail2ban 3 min read
Fail2Ban Privilege Escalation: Linux Exploit to Gain Root
Learn how to exploit a Fail2Ban misconfiguration, what it is, and how to gain root on Linux: enumeration, exploit, ban triggers, detection, and hardening.

Top 100 Linux Commands: Essential Hacking List — Linux commands 9 min read
Top 100 Linux Commands: Essential Hacking List
Top 100 Linux commands: a comprehensive and practical list for pentesters and sysadmins. Essential for enumeration, exploits, and post-exploitation.

privesc-linux 5 min read

Linux PrivEsc: Real root escalation techniques

Linux PrivEsc: Real-world privilege escalation techniques for gaining root. Practical workflow from real-world CTFs and pentests.

Container Escape: Privilege Escalation Docker and Kubernetes — kubernetes 19 min read
Container Escape: Privilege Escalation Docker and Kubernetes
Container Escape: Docker sockets, privileged containers, Linux capabilities, Kubernetes, kernel exploits, and IMDS. Privilege escape techniques, detection, and defense.

Kernel Exploits: Real Privesc on Linux and Windows — kernel 5 min read
Kernel Exploits: Real Privesc on Linux and Windows
Kernel exploits: real-world privilege escalation techniques on Linux and Windows. From theory to practical lab exploits.

Pspy: Monitor Linux Processes Without Root Privileges — privesc-linux 14 min read
Pspy: Monitor Linux Processes Without Root Privileges
Pspy is a tool for observing processes and cron jobs running on Linux without root privileges. It's ideal for identifying privilege escalation vectors.

Lynis: Linux Security Auditing and Hardening Tool — system hardening 3 min read
Lynis: Linux Security Auditing and Hardening Tool
Lynis is an auditing tool for Unix/Linux systems that analyzes configurations, permissions, patches, and hardening. Ideal for penetration testers and blue teams.

Mimipenguin: Dump Linux Credentials from Memory (Post-Exploitation) — credential dumping 5 min read
Mimipenguin: Dump Linux Credentials from Memory (Post-Exploitation)
Mimipenguin is a post-exploitation script for Linux that extracts cleartext passwords from the memory of processes such as SSH, sudo, and display managers.

LinEnum: Linux Enumeration Script for Privilege Escalation — privesc-linux 18 min read
LinEnum: Linux Enumeration Script for Privilege Escalation
LinEnum is a Bash script for automatic enumeration on Linux systems, useful for identifying privilege escalation vectors post-exploitation.

LinPEAS: Linux Privilege Escalation Enumeration Script — privesc-linux 13 min read
LinPEAS: Linux Privilege Escalation Enumeration Script
LinPEAS is an automatic enumeration script for Linux that identifies SUIDs, capabilities, exposed credentials, and privilege escalation vectors.

GTFOBins: Linux Binary Abuse for Privilege Escalation — LOLBins 11 min read
GTFOBins: Linux Binary Abuse for Privilege Escalation
GTFOBins is the definitive database for exploiting legitimate Linux binaries to escalate privilege, bypass sudo, and escape shells in authorized labs.

Getcap: Linux Capabilities for Privilege Escalation — linux-capabilities 4 min read
Getcap: Linux Capabilities for Privilege Escalation
Getcap allows you to detect files with Linux capabilities to identify privilege escalation vectors without SUID. This is a key post-exploitation technique.

Chkrootkit: Rootkit Detection on Linux for Incident Response and Post-Exploitation Analysis — linux-persistence 2 min read
Chkrootkit: Rootkit Detection on Linux for Incident Response and Post-Exploitation Analysis
Chkrootkit is a Linux tool for detecting rootkits and indicators of compromise on Unix-like systems. It is used in incident response and post-exploitation analysis to verify persistence and backdoors.

Crontab Backdoor: Linux Persistence with Cron Jobs in Penetration Testing — persistence 7 min read
Crontab Backdoor: Linux Persistence with Cron Jobs in Penetration Testing
Crontab Backdoor: A practical guide to creating Linux persistence with cron jobs in penetration testing. Complete setup, evasion, and cleanup.

Windows

Latest Windows

CredNinja: Validate SMB Credentials with NTLM Passwords and Hashes — CredNinja 6 min read
CredNinja: Validate SMB Credentials with NTLM Passwords and Hashes
Use CredNinja to validate passwords and NTLM hashes via SMB, find local admin, perform Pass-the-Hash and user hunting, and reduce lockouts with stripe and delay.

Windows Filesystem: NTFS, Folders, and Registry for Pentesting — NTFS 23 min read
Windows Filesystem: NTFS, Folders, and Registry for Pentesting
A practical guide to the Windows file system for pentesting: NTFS, system folders, the registry, ACLs, enumeration commands, privilege escalation, and detection.

ESC17 ADCS: MITM attack on WSUS clients over HTTPS — ESC17 7 min read
ESC17 ADCS: MITM attack on WSUS clients over HTTPS
ESC17 ADCS uses controllable SANs to impersonate WSUS over HTTPS. Learn about certificate request with Certipy, MITM with wsuks, privesc, and detection.

TGS Kerberos: Kerberoasting, Silver Ticket and Service Ticket — TGS Kerberos 15 min read
TGS Kerberos: Kerberoasting, Silver Ticket and Service Ticket
Offensive Guide to Ticket-Granting Service (TGS) Kerberos: SPN, Kerberoasting with Rubeus and Impacket, Offline Crack, Pass-the-Ticket and Silver Ticket Windows AD

Kerberos TGT: What It Is, How It Works, and How to Use It — TGT Kerberos 8 min read
Kerberos TGT: What It Is, How It Works, and How to Use It
Learn how Kerberos Ticket-Granting Ticket (TGT) works in Active Directory: Dumps with Rubeus, Pass-the-Ticket, Overpass-the-Hash, and Golden Ticket.

Password Spraying: A Complete Guide to AD, AD FS, and Entra ID — password spraying 8 min read
Password Spraying: A Complete Guide to AD, AD FS, and Entra ID
Learn about Active Directory password spraying: techniques, authorized pentesting tools, detection, and defenses against weak password access.

Windows Privilege Escalation: Techniques and Tools to Obtain SYSTEM — privilege escalation 15 min read
Windows Privilege Escalation: Techniques and Tools to Obtain SYSTEM
A guide to privilege escalation on Windows: enumeration, vulnerable services, token impersonation, DLL hijacking, UAC bypass, detection, and mitigations.

SeEnableDelegationPrivilege: Privisce AD, S4U and delegation — delegation 12 min read
SeEnableDelegationPrivilege: Privisce AD, S4U and delegation
What is SeEnableDelegationPrivilege, privilege escalation, unconstrained/constrained/RBCD variants, S4U2Self-S4U2Proxy, errors, detection and defense.

Lateral Movement in Active Directory: Techniques, Tools and OPSEC — lateral movement 9 min read
Lateral Movement in Active Directory: Techniques, Tools and OPSEC
A guide to lateral movement in Active Directory: Pass-the-Hash, Kerberos, SMB, WMI, WinRM, and RDP with prerequisites, artifacts, detection, and mitigations.

ACL Abuse Active Directory: GenericAll, WriteDACL and DCSync — privilege escalation 8 min read
ACL Abuse Active Directory: GenericAll, WriteDACL and DCSync
Guide to ACL abuse in Active Directory: GenericAll, WriteDACL, reset password, RBCD and DCSync with BloodHound, PowerView, bloodyAD and Impacket.

AS-REP Roasting: Cracking Kerberos Hashes Without Credentials — kerberos 6 min read
AS-REP Roasting: Cracking Kerberos Hashes Without Credentials
AS-REP Roasting in Active Directory: Extract Kerberos hashes without credentials and crack them offline with Impacket, Rubeus, and Hashcat. A complete technical guide.

RBCD Attack : Resource-Based Constrained Delegation PrivEsc — rbcd 8 min read
RBCD Attack : Resource-Based Constrained Delegation PrivEsc
RBCD leverages write access on msDS-AllowedToActOnBehalfOfOtherIdentity for privilege escalation on active directory. Drive with Impacket, Rubeus and NTLM relay.

Shadow Credentials AD: PrivEsc msDS-KeyCredentialLink — msds-keycredentiallink 5 min read
Shadow Credentials AD: PrivEsc msDS-KeyCredentialLink
Shadow Credentials: Leverage msDS-KeyCredentialLink for passwordless AD account takeover. A practical guide with Whisker, pyWhisker, and Certipy for AD pentesting.

Golden Ticket Attack: What It Is, How It Works, and How to Defend Yourself in Active Directory — golden ticket 15 min read
Golden Ticket Attack: What It Is, How It Works, and How to Defend Yourself in Active Directory
The Golden Ticket is the most dangerous attack on Active Directory. Learn how it works, how to forge a TGT with the krbtgt hash, how to detect it, and how to defend yourself with double reset. A complete guide.

Sapphire Ticket: Kerberos Stealth S4U2Self+U2U Ticket — sapphire-ticket 12 min read
Sapphire Ticket: Kerberos Stealth S4U2Self+U2U Ticket
Sapphire Ticket: The stealthiest Kerberos ticket. Combines S4U2Self + U2U for the authentic KDC PAC. Impacket impersonation guide, differences from Golden/Diamond, detection, and mitigation.

Silver Ticket Attack: What It Is, How It Works, and How to Defend Yourself in AD — active directory 18 min read
Silver Ticket Attack: What It Is, How It Works, and How to Defend Yourself in AD
The Silver Ticket forges a Kerberos TGS using a service account hash, completely bypassing the KDC. A complete guide: how to obtain it, forge it with Mimikatz, Rubeus, and Impacket, scenarios for CIFS, LDAP, MSSQL, HTTP, and how to detect it.

Diamond Ticket Attack: The Stealth Evolution of the Golden Ticket — active directory 15 min read
Diamond Ticket Attack: The Stealth Evolution of the Golden Ticket
Diamond Ticket: A stealth variant of the Golden Ticket with a real TGT to bypass MDI. Rubeus /ldap /opsec guide, Impacket, detection, and KRBTGT reset.

Logon Type Windows: Guide for Pentester, Red Teamer and SOC Analyst — windows-authentication 13 min read
Logon Type Windows: Guide for Pentester, Red Teamer and SOC Analyst
Windows Logon Type: A practical guide to the 13 logon types, from Interactive to CachedUnlock. Real-world examples and relevance for penetration testing and security audits.

EKU OID in ADCS: A Complete Guide to Active Directory Penetration Testing — adcs 7 min read
EKU OID in ADCS: A Complete Guide to Active Directory Penetration Testing
All Active Directory certificate EKU OIDs explained from an offensive perspective: which ones to exploit in ESC1–ESC16, PKINIT attack flow, Event ID detection, FAQ and complete table with offensive relevance.

SeMachineAccountQuota and RBCD: Privilege a Domain Admin in 5 Commands — machineaccountquota 5 min read
SeMachineAccountQuota and RBCD: Privilege a Domain Admin in 5 Commands
From standard domain user to Domain Admin using MachineAccountQuota=10 and RBCD. Create computer account, S4U tickets, DCSync. Red Team AD guidance and privilege escalation.

SeRelabelPrivilege: Bypass MIC and Write to File SYSTEM — serelabelprivilege 4 min read
SeRelabelPrivilege: Bypass MIC and Write to File SYSTEM
Learn how to use SeRelabelPrivilege to lower the integrity level of files and directories, bypass Mandatory Integrity Control, and gain a SYSTEM shell.

SeSecurityPrivilege: Clear Logs, SACLs, and SIEM Evasion — sesecurityprivilege 5 min read
SeSecurityPrivilege: Clear Logs, SACLs, and SIEM Evasion
How to use SeSecurityPrivilege to read and delete the Security Log, remove SACLs, and operate invisibly on Windows. Red Team OpSec guide with SIEM verification.

Kerberoasting: Complete Guide — SPN, TGS Cracking and Domain Admin in 2026 — ysoserial spn 4 min read
Kerberoasting: Complete Guide — SPN, TGS Cracking and Domain Admin in 2026
Kerberoasting in Active Directory: SPN enumeration with GetUserSPNs and Rubeus, RC4 downgrade, hashcat, targeted kerberoasting, and real OPSEC. From domain user to privileged credentials.

SeTcbPrivilege: Arbitrary LSA Logon Session to SYSTEM — setcbprivilege 4 min read
SeTcbPrivilege: Arbitrary LSA Logon Session to SYSTEM
Found SeTcbPrivilege on a non-system account? Create LSA sessions with SID Domain Admins and get SYSTEM without external conditions. Red Team Technique.

NTLM: Protocol, Hash Capture, Pass-the-Hash and Relay on Active Directory — ntlm 4 min read
NTLM: Protocol, Hash Capture, Pass-the-Hash and Relay on Active Directory
NTLM explained from top to bottom: handshake, capture, NetNTLMv2 with Responder, Pass-the-Hash, coercion, and CVE 2026 enabled. NTLM vs. Kerberos decision point in the enterprise pentest.

SeCreateTokenPrivilege: Token Forgery from Zero to SYSTEM — secreatetokenprivilege 4 min read
SeCreateTokenPrivilege: Token Forgery from Zero to SYSTEM
Found SeCreateTokenPrivilege on a non-system account? Create tokens with SID SYSTEM and Domain Admins from scratch. NtCreateToken for SYSTEM shell. Red Team technique.

SeManageVolumePrivilege: Raw Disk for SAM and NTDS.dit without lock — semanagevolumeprivilege 4 min read
SeManageVolumePrivilege: Raw Disk for SAM and NTDS.dit without lock
How to use SeManageVolumePrivilege and RawCopy to extract SAM, SYSTEM, and NTDS.dit from the physical disk, bypassing locks and ACLs. Red Team technique with raw device access.

SeCreateSymbolicLinkPrivilege: Symlink Attack on Windows from Shell — SeCreateSymbolicLinkPrivilege 4 min read
SeCreateSymbolicLinkPrivilege: Symlink Attack on Windows from Shell
From simple user to SYSTEM by replacing system files with a symlink: what you can do with SeCreateSymbolicLinkPrivilege and mklink. Privilege escalation and the Red Team technique.

SeTakeOwnershipPrivilege: From Admin to SYSTEM with 3 Commands — setakeownershipprivilege 4 min read
SeTakeOwnershipPrivilege: From Admin to SYSTEM with 3 Commands
How to abuse SeTakeOwnershipPrivilege to take ownership of system binaries and gain the SYSTEM shell. takeown + icacls + binary replacement. Red Team technique.

SeRestorePrivilege: From Backup Operator to SYSTEM in 3 Steps — serestoreprivilege 5 min read
SeRestorePrivilege: From Backup Operator to SYSTEM in 3 Steps
How to abuse SeRestorePrivilege to overwrite system binaries and gain SYSTEM shell. ImagePath hijacking, DLL sideloading, persistent backdoor. Red Team technique.

SeBackupPrivilege: Hash dump and full domain with SAM, SYSTEM and NTDS.dit — SeBackupPrivilege 5 min read
SeBackupPrivilege: Hash dump and full domain with SAM, SYSTEM and NTDS.dit
PrivEsc with SeBackupPrivilege on Windows and Active Directory: SAM, SYSTEM, and SECURITY extraction, offline dump with secretsdump, access to NTDS.dit, and real-world impact on compromised domains.

SeAssignPrimaryTokenPrivilege: Bypassing Potato Attacks Even Without SeImpersonatePrivilege — SeAssignPrimaryTokenPrivilege 4 min read
SeAssignPrimaryTokenPrivilege: Bypassing Potato Attacks Even Without SeImpersonatePrivilege
Privilege escalation with SeAssignPrimaryTokenPrivilege and potato attack bypass on Windows: privilege verification, exploits with GodPotato, JuicyPotato, and SweetPotato, real-world scenarios, common pitfalls, and mitigations.

SeLoadDriverPrivilege: Kernel Ring-0 with BYOVD in 3 Steps — seloaddriverprivilege 5 min read
SeLoadDriverPrivilege: Kernel Ring-0 with BYOVD in 3 Steps
SeLoadDriverPrivilege Enabled? Loads a vulnerable driver into the kernel, executes ring-0 code, disables EDR, and bypasses LSASS PPL. Help BYOVD with Capcom.sys and EDRSandBlast.

NTLM Information Disclosure: Enumerate Domain, Hostname, and OS Without Credentials — ntlm 8 min read
NTLM Information Disclosure: Enumerate Domain, Hostname, and OS Without Credentials
NTLM authentication over HTTP reveals AD domain, NetBIOS name, hostname, and OS version with a single GET, without credentials. This is an essential recon technique for Exchange and IIS red teams. Learn curl, Nmap, Burp, and defenses.

RARP What is it: Reverse ARP that reveals legacy and OT networks — rarp-spoofing 8 min read
RARP What is it: Reverse ARP that reveals legacy and OT networks
RARP: what it is, how it works, and why it still matters in pentests on legacy networks, OT/ICS, and PXE boot: request/reply, spoofing, boot hijacking, and the differences with ARP and DHCP.

DPAPI Attack in Active Directory: Extract Encrypted Passwords and Masterkeys — domain-backup-key 10 min read
DPAPI Attack in Active Directory: Extract Encrypted Passwords and Masterkeys
Complete guide on DPAPI in an Active Directory pentest: masterkey, credential files, Chrome/Edge offline with pypykatz, LSASS dump LOLBin, DSInternals and DonPAPI.

ESC15 ADCS (CVE-2024-49019): EKUwu ,PrivEsc & Injection — ESC15 6 min read
ESC15 ADCS (CVE-2024-49019): EKUwu ,PrivEsc & Injection
ESC15 allows privilege escalation in Active Directory via CVE-2024-49019: Application Policy injection in V1 templates alters certificate usages.

ESC16 ADCS: CA Without SID Security Extension, Exploit and Fix — ESC16 8 min read
ESC16 ADCS: CA Without SID Security Extension, Exploit and Fix
ESC16 in AD CS: The CA doesn't include the SID in the certificates. Learn about identification with Certipy, privesc, the ESC16+ESC6 chain, and the mitigation updated to 2026.

ESC10 AD CS: PrivEsc, Weak Certificate Mapping in Schannel — ad 6 min read
ESC10 AD CS: PrivEsc, Weak Certificate Mapping in Schannel
ESC10 AD CS leverages Schannel's weak certificate mapping for privilege escalation via LDAPS. Guide with Certipy, UPN manipulation, detection, and mitigations.

ESC11 AD CS: NTLM Relay RPC, Certipy & Privilege Escalation — ESC11 7 min read
ESC11 AD CS: NTLM Relay RPC, Certipy & Privilege Escalation
A CA vulnerable to ESC11 can accept NTLM relay via RPC. How to recognize the configuration, privesc, assess the impact on certificates, and prevent abuse.

ESC12 AD CS: Privesc via YubiHSM2 and Golden Certificates — ESC12 6 min read
ESC12 AD CS: Privesc via YubiHSM2 and Golden Certificates
ESC12 in AD CS is about YubiHSM2 KSP abuse on Windows CA: privilege escalation in Active Directory and use of Certipy after local compromise.

ESC13 AD CS: Privesc with Issuance Policy OID and Certipy — ESC13 6 min read
ESC13 AD CS: Privesc with Issuance Policy OID and Certipy
Privilege escalation in Active Directory via ESC13: Certipy detects Issuance Policy OIDs linked to AD groups and explains privilege abuse via Kerberos TGT.

ESC14 AD CS: Privesc with altSecurityIdentities and Certipy — ESC14 8 min read
ESC14 AD CS: Privesc with altSecurityIdentities and Certipy
Privilege escalation in Active Directory: ESC14 exploits weak X.509 mappings in altSecurityIdentities to impersonate Windows accounts via certificates.

ESC8 AD CS: PrivEsc, NTLM Relay Attack with Certipy and PKINIT — ESC8 11 min read
ESC8 AD CS: PrivEsc, NTLM Relay Attack with Certipy and PKINIT
ESC8 privilege escalation, leverages NTLM Relay against AD CS /certsrv/ endpoints to obtain privileged certificates. Guide to Certipy and NTLM coercion.

ESC9 ADCS: Privilege Escalation via Template without SID Security Extension — adcs 10 min read
ESC9 ADCS: Privilege Escalation via Template without SID Security Extension
ESC9 uses AD CS templates without the SID Security Extension to impersonate privileged users. A practical guide with Certipy and UPN manipulation.

ESC3 AD CS: Enrollment Agent and Active Directory Privesc — ESC3 AD CS 6 min read
ESC3 AD CS: Enrollment Agent and Active Directory Privesc
A practical guide to ESC3 in AD CS: Enumerate templates with Certipy, analyze Enrollment Agent certificates, and dive into privilege escalation in Windows AD.

ESC4 AD CS PrivEsc: Template Hijacking with Certipy — ESC4 ADCS 9 min read
ESC4 AD CS PrivEsc: Template Hijacking with Certipy
ESC4 ADCS Privilege Escalation: Detect weak ACLs on certificate templates, transform them into ESC1s with Certipy, and analyze the path to Domain Admin.

ESC5 AD CS: ACL PKI, CA Compromise and Golden Certificate — ESC5 8 min read
ESC5 AD CS: ACL PKI, CA Compromise and Golden Certificate
Learn about ESC5 privilege escalation in Windows Active Directory (AD CS): Enumerate PKI ACLs with Certipy and PowerShell, verify NTAuthCertificates, and mitigations.

ESC6 AD CS: SAN Injection with Certipy and Privilege Escalation — ESC6 ADCS 7 min read
ESC6 AD CS: SAN Injection with Certipy and Privilege Escalation
PrivEsc ESC6 in AD CS with Certipy: Check EDITF_ATTRIBUTESUBJECTALTNAME2, SAN injection, and differences between ESC9 and ESC16, with practical checks and mitigations.

ESC7 AD CS: Certipy, Manage CA and Privilege Escalation — ESC7 6 min read
ESC7 AD CS: Certipy, Manage CA and Privilege Escalation
Discover ESC7 in AD CS: Leverage Manage CA permissions with Certipy and privesc, verify the SubCA path, and apply detection and mitigations in AD environments.

AD CS Privilege Escalation: All ESC1–ESC16 Techniques with Certipy (Active Directory Attack Guide) — ad 8 min read
AD CS Privilege Escalation: All ESC1–ESC16 Techniques with Certipy (Active Directory Attack Guide)
AD CS Privilege Escalation on Active Directory: A Complete Guide to ESC1–ESC16 Techniques with Certipy. Learn how to gain Domain Admin by exploiting misconfigured certificate templates and CAs.

ESC1 AD CS: Exploit and Privilege Escalation with Certipy — ESC1 7 min read
ESC1 AD CS: Exploit and Privilege Escalation with Certipy
A practical guide to ESC1 in Active Directory: analyzing vulnerable templates with Certipy, Kerberos authentication, detection, privesc, and security mitigations.

ESC2 AD CS: Any Purpose EKU, Enrollment Agent and Certipy — ESC2 7 min read
ESC2 AD CS: Any Purpose EKU, Enrollment Agent and Certipy
ESC2 in Active Directory Certificate Services: Windows privilege escalation with Any Purpose EKU template, exploits with Certipy and mitigations for secure AD CS.

Active Directory Pentesting 2026: Complete Guide to Kerberos, NTLM and Privilege Escalation — ad 11 min read
Active Directory Pentesting 2026: Complete Guide to Kerberos, NTLM and Privilege Escalation
Active Directory Pentesting operationally explained: AD architecture, Kerberos vs NTLM, BloodHound, Kerberoasting, AS-REP Roasting, NTLM Relay, ACL abuse, AD CS, DCSync, Golden Ticket, Shadow Credentials and real defenses.

Kerberos Active Directory Attacks: Kerberoasting, AS-REP, Golden Ticket — kerberoasting 8 min read
Kerberos Active Directory Attacks: Kerberoasting, AS-REP, Golden Ticket
Port 88 Kerberos: Complete guide to Active Directory penetration testing. Learn about Kerberoasting, AS-REP Roasting, Golden Ticket, Silver Ticket and Pass-the-Ticket for privilege escalation and lateral movement.

Mimikatz: Complete Guide to Credential Dumping and Active Directory Attack — privesc-windows 7 min read
Mimikatz: Complete Guide to Credential Dumping and Active Directory Attack
Mimikatz explained for pentesters: LSASS credential extraction, DCSync, Golden Ticket, pass-the-hash, and Active Directory attacks with practical examples.

Smbexec: SMB Remote Execution and Lateral Movement in Active Directory — windows-enumeration 5 min read
Smbexec: SMB Remote Execution and Lateral Movement in Active Directory
SMBExec: A Practical Guide to Windows Remote Execution: Stealthy Lateral Movement via SMB Without Disk Files. A Fileless Alternative to PsExec for AD Pentesting.

Seatbelt: Windows Enumeration for Post-Exploitation and Situational Awareness — windows-enumeration 5 min read
Seatbelt: Windows Enumeration for Post-Exploitation and Situational Awareness
Seatbelt is a Windows enumeration tool that collects system, user, privilege, and configuration information useful for privilege escalation.

SharpChrome: Dump Browser Credentials from Windows (DPAPI Abuse) — dpapi 7 min read
SharpChrome: Dump Browser Credentials from Windows (DPAPI Abuse)
SharpChrome: Dump Browser Credentials from Windows (DPAPI Abuse)

SharpDPAPI: DPAPI Abuse to Decrypt Credentials on Windows — dpapi 11 min read
SharpDPAPI: DPAPI Abuse to Decrypt Credentials on Windows
SharpDPAPI allows you to extract and decrypt DPAPI-protected credentials on Windows. This advanced tool is for credential access and lateral movement.

SharpUp: Commands and Checks for Windows Privilege Escalation — misconfiguration 7 min read
SharpUp: Commands and Checks for Windows Privilege Escalation
SharpUp (GhostPack) Guide: Commands, real-world checks (ModifiableServices, AlwaysInstallElevated, DLL hijacking), and how to exploit them for privilege escalation on Windows.

Sherlock: Automated Windows Privilege Escalation Checker — windows-enumeration 5 min read
Sherlock: Automated Windows Privilege Escalation Checker
Sherlock identifies privilege escalation vulnerabilities on Windows by comparing installed patches and known CVEs. A quick tool for local privilege discovery.

Rubeus: Kerberos Attacks in Active Directory (2026) — kerberoasting 21 min read
Rubeus: Kerberos Attacks in Active Directory (2026)
Rubeus is the reference C# tool for attacking Kerberos in AD. Discover Kerberoasting, AS-REP Roasting, Pass-the-Ticket, and S4U with real-world detection.

Windows Pass-the-Hash: Attack, Operation, and Passwordless Access — privesc-windows 7 min read
Windows Pass-the-Hash: Attack, Operation, and Passwordless Access
Learn Pass-the-Hash (PtH) on Windows: how it works, how to leverage NTLM hashes to gain passwordless access, and real-world lateral movement techniques.

PsExec: Remote Command Execution via SMB in Windows Environments — smb 11 min read
PsExec: Remote Command Execution via SMB in Windows Environments
PsExec allows remote command execution on Windows systems via SMB. A key tool for lateral movement and remote administration.

JAWS: Windows Post-Exploitation Enumeration for Privilege Escalation — privesc-windows 5 min read
JAWS: Windows Post-Exploitation Enumeration for Privilege Escalation
JAWS is a PowerShell script for automatic enumeration on compromised Windows hosts, useful for identifying misconfigurations and privilege escalation vectors.

DCSync: Active Directory Credential Dump via Replication Abuse — credential dumping 10 min read
DCSync: Active Directory Credential Dump via Replication Abuse
DCSync is an Active Directory technique that allows credential hash extraction by abusing the domain replication mechanism. It is used post-exploitation to obtain NTLM hashes of privileged users without direct access to the domain controller.

Adfind: Advanced Active Directory Enumeration in Penetration Testing — enum 3 min read
Adfind: Advanced Active Directory Enumeration in Penetration Testing
AdFind is a tool for enumerating Active Directory objects via command-line LDAP queries. A practical guide to using it during domain enumeration during a penetration test.

Scheduled Task Backdoor: Windows Persistence with Scheduled Tasks in Pentest — scheduled windows 8 min read
Scheduled Task Backdoor: Windows Persistence with Scheduled Tasks in Pentest
Scheduled Task Backdoor: Persistence on Windows via Task Scheduler with schtasks and PowerShell. Stealth techniques, EDR evasion, log detection, and real-world Red Team scenarios.

Certutil.exe: Download and Encoding for Living Off The Land on Windows — LOLBins 5 min read
Certutil.exe: Download and Encoding for Living Off The Land on Windows
Practical guide Certutil.exe for Windows penetration testing: file download, Base64 encoding, hash verification and AV bypass. Living off the Land with native tool.

MSSQL Pentesting: Port 1433, Enumeration, Attack, and Payload — French windows 15 min read
MSSQL Pentesting: Port 1433, Enumeration, Attack, and Payload
Learn how to enumerate and join MSSQL (port 1433): pentest for weak credentials, xp_dirtree for NTLM hashes, xp_cmdshell for RCE, and pivoting on linked servers

LDAP Port 389: Enumeration and Pentesting in Active Directory — LDAP 11 min read
LDAP Port 389: Enumeration and Pentesting in Active Directory
LDAP 389 PORT: Null bind, users, groups and SPNs, exposed credentials, LDAP relay and injection: enumeration techniques and misconfigurations in Active Directory.

SMB Port 445: Enumeration and Attacks in a Pentest — SMB 11 min read
SMB Port 445: Enumeration and Attacks in a Pentest
SMB Port 445 on Windows Servers: Share enumeration, exploits, NTLM relay, Pass-the-Hash, remote execution, and lateral movement in Active Directory.

Networking

Latest Networking

TFTP (Port 69/UDP): Enumeration, Exploitation, and Security — Tftp 4 min read
TFTP (Port 69/UDP): Enumeration, Exploitation, and Security
TFTP over UDP 69: A Practical Guide to Enumeration, Files, Configurations, Vulnerabilities, Cleartext Traffic, and Risks in Internal Networks.

DDoS: What it is, how it works, and how to test your defenses — ddos 8 min read
DDoS: What it is, how it works, and how to test your defenses
What is a DDoS attack and how does it work? Learn about DDoS types, attack techniques, authorized testing, and how to verify the effectiveness of your defenses.

WAN Penetration Testing: VPN, IPsec, MPLS and SD-WAN — VPN-Pentesting 12 min read
WAN Penetration Testing: VPN, IPsec, MPLS and SD-WAN
WAN penetration testing guide: Analyze VPN, IPsec, MPLS, and SD-WAN, identify tunnel vulnerabilities, and verify WAN infrastructure security.

MS08-067: what is it, RCE Windows and Metasploit exploits — ms08-067 4 min read
MS08-067: what is it, RCE Windows and Metasploit exploits
MS08-067: What it is, how it works, and why it's one of the most notorious Windows RCEs. Learn about Server Service, NetAPI, SMB, Metasploit, detection, and mitigations.

FTP Bounce Attack: What It Is, How It Works, and How to Prevent It — ftp-bounce 5 min read
FTP Bounce Attack: What It Is, How It Works, and How to Prevent It
FTP Bounce Attack: What it is, how the PORT command works, why it can enable indirect port scanning, and how to detect and prevent it.

Scapy Python: Packet Crafting, Sniffing, and ARP Spoofing — scapey 15 min read
Scapy Python: Packet Crafting, Sniffing, and ARP Spoofing
Learn Scapy with Python to create and parse TCP, UDP, ICMP, and ARP packets, perform SYN scans, sniffing, ARP spoofing, and test firewalls and IDSs.

Port 2375 Docker API: Enumeration, RCE, and Hardening — Docker 7 min read
Port 2375 Docker API: Enumeration, RCE, and Hardening
Port 2375 Docker API pentest: Test unauthenticated access, get RCE and root on the host, and apply detection, TLS, firewall, and hardening.

SIP and RTP Pentesting: VoIP Security, Attacks, and Tools — sip 10 min read
SIP and RTP Pentesting: VoIP Security, Attacks, and Tools
A practical guide to SIP and RTP pentesting: VoIP enumeration, authentication, traffic analysis, RTP injection, operational tools, and defenses with TLS and SRTP.

HTTP Port 80: Operational Guide (Ports/Protocols) in Pentesting — http 8 min read
HTTP Port 80: Operational Guide (Ports/Protocols) in Pentesting
Port 80 in pentest lab: scan, HTTP fingerprint, vhost enum, directory brute force, misconfig and detection. Workflow with Nmap/ffuf/curl.

SSH Pentesting Guide: Tunneling, Pivoting, and Offensive Operations — SSH 6 min read
SSH Pentesting Guide: Tunneling, Pivoting, and Offensive Operations
Learn how to pentest SSH from an offensive perspective: enumeration, brute force, port forwarding, SOCKS pivoting, file transfer, and agent hijacking for authorized red team engagements.

ntlmrelayx: NTLM Relay Attack - Setup and Bypass 2026 — ntlmrelayx 15 min read
ntlmrelayx: NTLM Relay Attack - Setup and Bypass 2026
Complete guide to the NTLM Relay Attack with ntlmrelayx: coercion (PetitPotam, PrinterBug), SMB/LDAP/ADCS relay (ESC8), RBCD, Shadow Credentials, and DCSync. Internal network to Domain Admin workflow.

Splunk Pentesting: CVE-2024-36991, RCE and SYSTEM on 8089 — splunk 7 min read
Splunk Pentesting: CVE-2024-36991, RCE and SYSTEM on 8089
Complete guide to Splunk pentesting: Exploit CVE-2024-36991, recover credentials via splunk.secret, obtain RCE via malicious app, and scale to SYSTEM or root.

TCP/UDP Ports in Penetration Testing: A Complete Guide from Recon to Exploit — Penetration testing 9 min read
TCP/UDP Ports in Penetration Testing: A Complete Guide from Recon to Exploit
All TCP and UDP ports in penetration testing, organized by attack scenario: Active Directory, web, database, mail, DevOps. Attack vectors and complete technical guides for OSCP and red teams.

ICS/OT Pentesting: A Complete Guide to SCADA, PLC, and Industrial Protocols — ics-pentesting 15 min read
ICS/OT Pentesting: A Complete Guide to SCADA, PLC, and Industrial Protocols
Complete guide to ICS/OT penetration testing: Modbus, S7, DNP3, BACnet, EtherNet/IP protocols. GRASSMARLIN tools, pymodbus, python-snap7, ISF, IndustrialXPL-Forge. CVE 2024-2025 and real attacks.

Port 137 NetBIOS: Responder, NTLM Relay, and Credential Theft on AD — reply 9 min read
Port 137 NetBIOS: Responder, NTLM Relay, and Credential Theft on AD
NetBIOS on port 137 enabled? Responder captures NTLMv2 hashes in minutes, ntlmrelayx executes commands without cracking. Chain from NBT-NS poisoning to Domain Admin for pentest.

Port 138 NetBIOS Datagram: Windows Broadcast Service Penetration Testing Guide — netbios 6 min read
Port 138 NetBIOS Datagram: Windows Broadcast Service Penetration Testing Guide
Port 138 open? The attack surface is minimal in 2026, but it indicates NetBIOS is enabled. Focus on port 137 with Responder and 445 with SMB—those are the real vectors.

RPCbind Port 111: NFS Mount, UID Bypass and NIS Credential Dump — rpcinfo 8 min read
RPCbind Port 111: NFS Mount, UID Bypass and NIS Credential Dump
RPCbind on 111? Enumerate NFS and NIS with rpcinfo, mount anonymous shares, bypass root_squash with UID matching, and steal SSH keys or password hashes. Chain to root in minutes.

Door 113 Ident: What It Is and What to Do if You Find It Open in 2026 — recon 4 min read
Door 113 Ident: What It Is and What to Do if You Find It Open in 2026
Port 113 open? Ident is nearly defunct, but it reveals usernames and points to vulnerable legacy systems. Learn how to enumerate and what to look for next.

NNTP Port 119: A Guide to Penetration Testing the Network News Transfer Protocol — nnyp 6 min read
NNTP Port 119: A Guide to Penetration Testing the Network News Transfer Protocol
Port 119 open? NNTP is nearly defunct, but it can expose newsgroups with cleartext credentials, usernames, and confidential data. Learn how to enumerate and exploit it.

Windows RPC Port 135: Null Session, WMI Exec, and Lateral Movement AD — rpcclient 9 min read
Windows RPC Port 135: Null Session, WMI Exec, and Lateral Movement AD
Port 135 open? Enumerate users with null sessions and RID cycling, run commands via WMI/DCOM with Impacket, and reach Domain Admin in 42 minutes. Complete AD pentest guide.

Port 139 NetBIOS Session: Null Session, EternalBlue, and SMB Relay on AD — smb 10 min read
Port 139 NetBIOS Session: Null Session, EternalBlue, and SMB Relay on AD
Port 139 open? Enumerate users with null sessions, exploit MS17-010 over SMBv1, and use ntlmrelayx if signing is disabled. Chain a Domain Admin in 27 minutes.

DHCP Port 67: Rogue Server, Starvation, and MITM on the Internal Network — dhcp-spoofing 9 min read
DHCP Port 67: Rogue Server, Starvation, and MITM on the Internal Network
Port 67 without DHCP snooping? Deploy a rogue server with dnsmasq, poison gateways and DNS, capture NTLMv2 hashes with Responder, and get to Domain Admin in 90 minutes.

Port 95 SUPDUP: Remote Terminal Protocol Deprecated (Historical Relevance) — supdup 3 min read
Port 95 SUPDUP: Remote Terminal Protocol Deprecated (Historical Relevance)
Port 95 open during a scan? SUPDUP has been defunct since the 90s. Learn how to identify the real service: hidden web server, custom app, or honeypot.

Port 49 TACACS+: Shared Secret Crack and Network Takeover Cisco — networking 9 min read
Port 49 TACACS+: Shared Secret Crack and Network Takeover Cisco
TACACS+ on Route 49 with a weak shared secret? Bruteforce the key, decrypt the traffic with Wireshark, and take control of every router, switch, and firewall in the Cisco infrastructure.

PointCast Gate 90: What It Is and What to Do If You Find It Open in 2026 — pointcast 3 min read
PointCast Gate 90: What It Is and What to Do If You Find It Open in 2026
Port 90 open during a scan? PointCast has been dead since 2001. Learn how to identify the real service, whether it's a hidden web server, proxy, or custom app.

Port 37 Time Protocol: OS Fingerprinting and Recon on Legacy Systems — fingerprinting 8 min read
Port 37 Time Protocol: OS Fingerprinting and Recon on Legacy Systems
Port 37 open? Time Protocol reveals OS (Windows Server 2003/2008, Cisco IOS), timestamp, and uptime. Immediate red flag for legacy technology—chain to EternalBlue in 15 minutes.

WINS Port 42: Complete Map of Windows Network Without Authentication — windows 8 min read
WINS Port 42: Complete Map of Windows Network Without Authentication
WINS on port 42 without authentication: enumerates domain controllers, file servers, and logged-in users via NetBIOS. Instant red flag for legacy Windows—chain to AD in 20 minutes.

Port 27018 MongoDB Cluster: Accessing Internal Nodes and Oplog Dump — mongodb 5 min read
Port 27018 MongoDB Cluster: Accessing Internal Nodes and Oplog Dump
Port 27018 exposed? Connect directly to the replica set secondaries, read the oplog with cleartext password, bypass the keyfile, and pivot into cluster nodes.

Port 28017 MongoDB HTTP: Information Disclosure and REST API Without Auth — information disclosure 4 min read
Port 28017 MongoDB HTTP: Information Disclosure and REST API Without Auth
Port 28017 open? Read version, hostname, and logs without credentials, dump data via REST API, and pivot to 27017. Only on legacy MongoDB ≤ 3.4, often unpatched.

RDP Port 33389: Finding and Exploiting RDP on Non-Standard Ports — rdp 6 min read
RDP Port 33389: Finding and Exploiting RDP on Non-Standard Ports
RDP moved to 33389? nmap -sV finds it in seconds. BlueKeep, Pass-the-Hash, and brute force work identically. Changing ports isn't security—it's a placebo.

Port 50000 SAP NetWeaver: from SAP* Default to RCE on ERP Enterprise — active directory 8 min read
Port 50000 SAP NetWeaver: from SAP* Default to RCE on ERP Enterprise
SAP Management Console on 50000 without auth: Enumerate versions, exploit RECON (CVSS 10), abuse RFC with SAP*/06071992 and get OS command execution on all ERP data.

Port 50070 Hadoop NameNode: Download Petabytes of Data and RCE via YARN — Big Data 7 min read
Port 50070 Hadoop NameNode: Download Petabytes of Data and RCE via YARN
HDFS without Kerberos on 50070? Browse the filesystem, download CDRs and PIIs via WebHDFS with user.name=hdfs, then get a shell to the cluster via the YARN REST API.

ActiveMQ Port 61616: CVE-2023-46604 RCE Pre-Auth and admin Credentials:admin — ActiveMQ 6 min read
ActiveMQ Port 61616: CVE-2023-46604 RCE Pre-Auth and admin Credentials:admin
Unpatched ActiveMQ on 61616? CVE-2023-46604 gives root shell in 8 seconds via OpenWire. Web console with admin:admin, messages with JDBC credentials, and lateral movement to Oracle.

Memcached Port 11211: Pentest and Data Dump 2026 — Memcached 6 min read
Memcached Port 11211: Pentest and Data Dump 2026
Memcached opened without authentication: dump session token, credentials, and JWT with nc. 51.000x UDP amplification, cache poisoning, and hardening explained.

Port 15672 RabbitMQ: guest:guest to RCE with Erlang Cookie — message broker 6 min read
Port 15672 RabbitMQ: guest:guest to RCE with Erlang Cookie
RabbitMQ management exposed on 15672? With guest:guest, read every message in the queue, dump hashes, and get RCE via Erlang cookies. Practical offensive guide.

Port 16010 HBase: Dump Billions of Records Without Authentication — hadoop 5 min read
Port 16010 HBase: Dump Billions of Records Without Authentication
HBase Master UI on 16010 without authentication: enumerate tables, dump data via REST API and Thrift, read tokens and CDRs. Full pentest with scan, Hadoop lateral movement.

MongoDB Port 27017: Passwordless Access, NoSQL Injection, and Data Dumps — nosql-injection 7 min read
MongoDB Port 27017: Passwordless Access, NoSQL Injection, and Data Dumps
MongoDB exposed on 27017? Login without authentication, bypass $ne login, dump credentials and MFA secret, and perform privilege escalation. Complete pentest with live payloads.

Webmin Port 10000: RCE Backdoor and Instant Root — webmin-pentest 5 min read
Webmin Port 10000: RCE Backdoor and Instant Root
Port 10000 Webmin: CVE-2019-15107 pre-auth RCE root backdoor, CVE-2022-0824 file manager, CVE-2024-12828 CVSS 9.9, Metasploit modules, and post-exploitation with full root access.

Elasticsearch Port 9200: Dump Indexes, Credentials, and Groovy RCE — elasticsearch-pentest 5 min read
Elasticsearch Port 9200: Dump Indexes, Credentials, and Groovy RCE
Port 9200 Elasticsearch without authentication: Index dumps with credentials and PII, password lookup in logs, Groovy script RCE, CVE-2015-1427, elasticdump, and lateral movement from ELK stack.

Port 9000 Pentest: PHP-FPM RCE, SonarQube, and Portainer — door-9000 5 min read
Port 9000 Pentest: PHP-FPM RCE, SonarQube, and Portainer
Port 9000: Direct RCE via PHP-FPM FastCGI exposed, SonarQube admin:admin with hardcoded source code and credentials, Portainer without initial setup and container escape.

Port 9090 Pentest: Prometheus, Cockpit Linux and JBoss RCE — door-9090 5 min read
Port 9090 Pentest: Prometheus, Cockpit Linux and JBoss RCE
Port 9090: Authless Prometheus exposes entire infrastructure and credentials, Cockpit provides a Linux shell in the browser, and JBoss WAR deploys for RCE. Operational cheat sheet included.

Kafka Pentest Port 9092: Message Interception and Message Injection — door-9092 8 min read
Kafka Pentest Port 9092: Message Interception and Message Injection
Port 9092 Apache Kafka without authentication: topic list, real-time message interception, message injection, Kafka Connect credentials JDBC and full offensive chain.

Port 9300 Elasticsearch Transport: Cluster Join and Java RCE — door-9300 4 min read
Port 9300 Elasticsearch Transport: Cluster Join and Java RCE
Elasticsearch transport port 9300: Unauthorized cluster join, data replication to malicious node, Java deserialization RCE CVE-2015-5377, and operational differences from port 9200.

Port 9418 Git Daemon: Pentest, Clone Repository and Secret Extraction — door-9418 5 min read
Port 9418 Git Daemon: Pentest, Clone Repository and Secret Extraction
Port 9418: Authenticationless git daemon: Repository clone, credential extraction from commit history, truffleHog, gitleaks, web-exposed .git, and lateral movement from source code.

Port 9999 Pentest: Abyss, Icecast CVE-2004-1561, and Dev Server — door-9999 4 min read
Port 9999 Pentest: Abyss, Icecast CVE-2004-1561, and Dev Server
Port 9999: Abyss Web Server directory traversal and admin bypass, Icecast buffer overflow RCE CVE-2004-1561, Varnish admin exposed, unprotected server staging and backdoor detection.

Oracle EBS Pentest: Port 7777, OHS and CVE 2026 — oracle-http-server 4 min read
Oracle EBS Pentest: Port 7777, OHS and CVE 2026
Offensive guidance on Oracle HTTP Server port 7777: OHS enumeration, EBS and PeopleSoft default credentials, CVE-2022-21587, PL/SQL gateway injection, SSRF, and lateral movement.

Port 8000 Pentest: Django Debug, Python http.server and RCE — door-8000 5 min read
Port 8000 Pentest: Django Debug, Python http.server and RCE
Port 8000 offensive guide: Django DEBUG=True, Python http.server directory listing, Flask Werkzeug console, PHP built-in server and credential extraction. With cheat sheets.

HTTP-alt Port 8008: Grafana, Splunk, and Internal Pentest APIs — door-8008 4 min read
HTTP-alt Port 8008: Grafana, Splunk, and Internal Pentest APIs
Alternative HTTP port 8008: Grafana and Splunk default credentials, CVE-2021-43798 path traversalSpring Boot Actuator heapdump, internal REST APIs and credential extraction.

Port 8081 Pentest: Nexus Repository, Traefik and OWASP API — door-8081 5 min read
Port 8081 Pentest: Nexus Repository, Traefik and OWASP API
Port 8081: Nexus Repository default credentials, CVE-2019-7238 RCE, Traefik dashboard without auth, OWASP API Security Top 10 with operational payloads and supply chain attacks.

Port 8443 HTTPS Pentest: vCenter, pfSense, UniFi and CVE — door-8443 5 min read
Port 8443 HTTPS Pentest: vCenter, pfSense, UniFi and CVE
Alternative HTTPS port 8443: VMware vCenter CVE-2021-21972, pfSense RCE, UniFi Log4Shell, Cisco ASDM default credentials, certificate intelligence, and TLS hardening.

Port 8888 Jupyter Notebook: Direct RCE and Credential Extraction — door-8888 7 min read
Port 8888 Jupyter Notebook: Direct RCE and Credential Extraction
Port 8888 Authentication-free Jupyter Notebook: Direct code execution, token leak, integrated terminal, hardcoded credentials in notebooks, and real-world step-by-step attack chain.

Neo4j Pentest: Cypher Injection, APOC RCE and Port 7474 — neo4j 5 min read
Neo4j Pentest: Cypher Injection, APOC RCE and Port 7474
Neo4j port 7474/7687 pentest: enumeration, default credentials, cypher injection, APOC RCE, hash dump, and API key. Complete guide 2026.

Port 7070 Pentest: RealServer, Helix and AnyDesk — rtsp-exploit 4 min read
Port 7070 Pentest: RealServer, Helix and AnyDesk
Port 7070 open? 2026 Pentest Guide: What is it, Helix/RealServer enumeration, RTSP exploits, directory traversal, AnyDesk, and Java app server.

Port 5601 Kibana: Dev Tools, Log Leak and Elasticsearch — kibana 5 min read
Port 5601 Kibana: Dev Tools, Log Leak and Elasticsearch
Kibana Port 5601 in Pentest: Dev Tools Console, Elasticsearch Queries, Log Exposure, Internal Hosts, and Sensitive Credentials in Indexed Data

VNC Port 5900: No Auth, Brute Force, and Remote Desktop — VNC 5 min read
VNC Port 5900: No Auth, Brute Force, and Remote Desktop
Port 5900 VNC in the pentest: remote desktop access, unauthenticated instances, password brute force, screenshots, and session hijacking.

Port 5986 WinRM HTTPS: Certificates, ADCS, and Evil-WinRM — WinRM HTTPS 4 min read
Port 5986 WinRM HTTPS: Certificates, ADCS, and Evil-WinRM
WinRM HTTPS port 5986 in the pentest: client certificates, Evil-WinRM over TLS, ADCS abuse, and remote access via certificate-based authentication.

Port 6000 X11: Screenshots, Keylogging and Desktop Hijack — MIT-MAGIC-COOKIE 4 min read
Port 6000 X11: Screenshots, Keylogging and Desktop Hijack
Port 6000 X11 in the pentest: exposed remote display, desktop screenshots, keylogging, input injection and session hijacking on Linux and Unix systems.

Port 6379 Redis: No Auth, RCE and Credential Dump — Redis 5 min read
Port 6379 Redis: No Auth, RCE and Credential Dump
Redis port 6379 in pentest: unauthenticated login, key and session dumps, SSH key injection, malicious modules, and RCE.

Port 6443 Kubernetes API: Tokens, Secrets, and Cluster Admin — Kubernetes API 5 min read
Port 6443 Kubernetes API: Tokens, Secrets, and Cluster Admin
Port 6443 Kubernetes APIs in the pentest: ServiceAccount token, secret extraction, pod access, escalation to cluster-admin, and cluster compromise.

Port 6667 IRC: UnrealIRCd, C2 and Information Gathering — IRC 6 min read
Port 6667 IRC: UnrealIRCd, C2 and Information Gathering
IRC port 6667 in the pentest: server and channel enumeration, user and hostname info leak, C2 botnet, UnrealIRCd, and hijacking risks.

WebLogic Port 7001: T3, Admin Console, and RCE — WebLogic RCE 5 min read
WebLogic Port 7001: T3, Admin Console, and RCE
WebLogic port 7001 in pentest: T3 protocol, admin console, CVE RCE pre-auth, SSRF, and Oracle WebLogic Server access exposed.

WebLogic SSL port 7002: HTTPS, T3S and RCE — WebLogic SSL 3 min read
WebLogic SSL port 7002: HTTPS, T3S and RCE
WebLogic SSL Port 7002 in Pentest: HTTPS Console, T3S, TLS Certificates, Pre-Auth CVEs, and Attacks on Encrypted Oracle WebLogic Server.

SVN Port 3690: Exposed Repositories and Secret Leakage — Subversion 4 min read
SVN Port 3690: Exposed Repositories and Secret Leakage
Bring 3690 SVN to the pentest: exposed repositories, anonymous checkout, commit history, source code disclosure, and recoverable credentials.

Spark UI Port 4040: Pentest, Credentials, and Cluster Map — Spark Web UI 3 min read
Spark UI Port 4040: Pentest, Credentials, and Cluster Map
Bring 4040 Spark UI to pentest: environment leak, worker discovery, exposed credentials, and pivot to 6066 REST API and big data cluster.

Port 4500 IPsec NAT-T: VPN, IKE and PSK Cracking — IPsec NAT-T 3 min read
Port 4500 IPsec NAT-T: VPN, IKE and PSK Cracking
Port 4500 IPsec NAT-T in the pentest: IKE, NAT traversal, aggressive mode, PSK cracking and exposed VPN surface analysis.

Port 5000 Docker Registry and Flask: Debug, RCE and Secret Leak — Docker Registry 6 min read
Port 5000 Docker Registry and Flask: Debug, RCE and Secret Leak
Port 5000 in pentest: Docker Registry exposed with downloadable images and secrets, or Flask debug with console tool and RCE from the browser.

Port 5672 RabbitMQ: AMQP, Code and Management API — Rabbit MQ 5 min read
Port 5672 RabbitMQ: AMQP, Code and Management API
RabbitMQ port 5672 to the pentest: AMQP queues and messages, exposed credentials, Management API 15672, injection and Erlang cookie risk.

Port 2082 cPanel: Pentest, Credential Reuse and Webshell — cPanel 5 min read
Port 2082 cPanel: Pentest, Credential Reuse and Webshell
Port 2082 cPanel in the pentest: unencrypted HTTP login, credential reuse, upload via File Manager, database access, email, and backups.

Port 2083 cPanel SSL: Pentest, API and HTTPS Login — cPanel API 4 min read
Port 2083 cPanel SSL: Pentest, API and HTTPS Login
Port 2083 cPanel SSL in pentest: HTTPS login, TLS enumeration, cPanel API, file upload, post-auth automation, and cPHulk checks.

Port 2181 ZooKeeper: Pentest, Dump, and Four-Letter Commands — ZooKeeper 7 min read
Port 2181 ZooKeeper: Pentest, Dump, and Four-Letter Commands
Port 2181 ZooKeeper into the pentest: four-letter commands, dump configurations, cluster enumeration, and sensitive metadata.

Port 2376 Docker TLS API: Pentest and mTLS — Docker TLS API 5 min read
Port 2376 Docker TLS API: Pentest and mTLS
Port 2376 Docker TLS API in pentest: TLS enumeration, mutual TLS, client certificate theft, misconfigurations, and remote daemon access

Port 2483 Oracle DB: TNS Listener, SID and Pentest — Oracle TNS 5 min read
Port 2483 Oracle DB: TNS Listener, SID and Pentest
Oracle DB Port 2483 in Pentest: TNS Listener, SID and Service Name Enumeration, Credential Brute Force, DBA Escalation, and System Access Techniques

Port 2484 Oracle TCPS: Wallet, TLS and Pentest — Oracle TCPS 4 min read
Port 2484 Oracle TCPS: Wallet, TLS and Pentest
Oracle TCPS port 2484 in pentest: Encrypted TNS Listener, certificates and Oracle Wallet, TLS enumeration and differences with 2483.

Port 2701 TVersity: Web UI and Information Disclosure — TVersity 2 min read
Port 2701 TVersity: Web UI and Information Disclosure
Port 2701 TVersity in the pentest: media server with exposed web UI, shared file disclosure and access surface analysis.

3260 iSCSI port: Pentest, Target, LUN and CHAP — iSCSI Target 4 min read
3260 iSCSI port: Pentest, Target, LUN and CHAP
Bringing the 3260 iSCSI to the pentest: target and LUN discovery, storage volume access, CHAP, remote disk mounts, and exposed data analysis.

Port 3478 STUN/TURN: NAT Traversal, Relay Abuse, and Pentest — STUN 3 min read
Port 3478 STUN/TURN: NAT Traversal, Relay Abuse, and Pentest
Port 3478 STUN/TURN in pentest: NAT traversal, IP leak, NAT type, TURN relay abuse and misconfigurations in WebRTC and VoIP infrastructures.

Port 3632 DistCC: Direct RCE and CVE-2004-2687 — DistCC 4 min read
Port 3632 DistCC: Direct RCE and CVE-2004-2687
DistCC Port 3632 in Pentest: distccd exposed, RCE without authentication via CVE-2004-2687, Nmap NSE verification, and immediate impact

Port 1991 cPanel and WHM: Pentesting, Enumeration, and Hardening — cPanel 4 min read
Port 1991 cPanel and WHM: Pentesting, Enumeration, and Hardening
cPanel and WHM Pentest Guide: 2083, 2087, and Webmail 2096 Panels, Account Enumeration, APIs, Hosting Exposure, and Critical Misconfigurations

Port 1434 MSSQL: SQL Server Browser and Instance Discovery — SQL Server Browser 5 min read
Port 1434 MSSQL: SQL Server Browser and Instance Discovery
MSSQL Pentest on port 1434/UDP: SQL Server Browser enumeration, named instance, version, dynamic ports, and SQL instance discovery in lab.

Citrix ICA Port 1604: ICA Browser, Published Apps, and StoreFront — Citrix ICA 4 min read
Citrix ICA Port 1604: ICA Browser, Published Apps, and StoreFront
Citrix Pentest on port 1604/UDP: ICA Browser enumeration, published apps, StoreFront, 1494/2598 services, and access to Citrix Virtual Apps environments in lab.

PPTP Port 1723: MS-CHAPv2 and VPN Credentials — PPTP 3 min read
PPTP Port 1723: MS-CHAPv2 and VPN Credentials
PPTP Pentest on Port 1723: What it is, Control Channel Fingerprinting, MS-CHAPv2 Analysis, Legacy VPN Credentials, GRE, and Internal Network Access Risk.

RADIUS Port 1812: Shared Secret, EAP, and Network Access — RADIUS 4 min read
RADIUS Port 1812: Shared Secret, EAP, and Network Access
RADIUS Pentest on Port 1812/UDP: Test Shared Secret, EAP Authentication, AD/LDAP Backend, RADIUS Accounting, and Network Access Control in the Lab.

Port 1813 RADIUS Accounting: Sessions, Assigned IPs, and RADIUS 1812 — RADIUS Accounting 2 min read
Port 1813 RADIUS Accounting: Sessions, Assigned IPs, and RADIUS 1812
Pentest RADIUS Accounting on port 1813/UDP: session tracking, Framed-IP, Accounting-Request, correlation with 1812 and visibility into network sessions in the lab.

Port 1883 MQTT: Pentest, Topic Enumeration and Injection — MQTT 6 min read
Port 1883 MQTT: Pentest, Topic Enumeration and Injection
Port 1883 MQTT in IoT pentest: topic enumeration, anonymous subscription, message injection, and clear text credentials on exposed brokers.

SSDP/UPnP Port 1900: Pentest, Port Mapping, and SSRF — SSDP 5 min read
SSDP/UPnP Port 1900: Pentest, Port Mapping, and SSRF
Port 1900 SSDP/UPnP in pentest: device discovery, port mapping abuse, SSRF via CallStranger, and exposed services analysis.

HASP Port 1947: Pentest and Sentinel Admin Control Center — Sentinel LDK 3 min read
HASP Port 1947: Pentest and Sentinel Admin Control Center
Port 1947 HASP in the pentest: Sentinel Admin Control Center, dongle enumeration and active licenses, version check and License Manager RCE risks.

Port 1984 Xymon/BigBrother: Recon and Info Disclosure — Xymon 3 min read
Port 1984 Xymon/BigBrother: Recon and Info Disclosure
Brings 1984 Xymon and BigBrother to the pentest: agent monitoring, host data disclosure, exposed services, and infrastructure dashboard accessible without adequate controls.

UPnP Port 1990: SOAP, Port Mapping and Device Control — UPnP 2 min read
UPnP Port 1990: SOAP, Port Mapping and Device Control
Port 1990 UPnP in the pentest: SOAP action, port mapping abuse, device control and analysis of IGD services exposed on the router.

SNMP Port 1993: Inform, Trap and Monitoring — SNMP Inform 3 min read
SNMP Port 1993: Inform, Trap and Monitoring
Bring 1993 SNMP into the pentest: SNMP Inform, trap correlation, community string, alternative collectors and information disclosure on monitoring servers.

NFS port 2049: Pentest, no_root_squash, and Lateral Movement — no_root_squash 6 min read
NFS port 2049: Pentest, no_root_squash, and Lateral Movement
Port 2049 NFS in the pentest: export enumeration, remote mount, UID spoofing, no_root_squash, SSH key injection, and privesc Linux.

PostgreSQL port 5432: Payload, pg_shadow, COPY PROGRAM and RCE — PostgreSQL 5 min read
PostgreSQL port 5432: Payload, pg_shadow, COPY PROGRAM and RCE
PostgreSQL pentest on port 5432: enumeration, brute force, pg_shadow, file read/write, COPY PROGRAM, RCE and privilege escalation in lab.

POP3 Port 110: Brute Force, Credential Sniffing, and Mailbox Access — pop3-sniffing 9 min read
POP3 Port 110: Brute Force, Credential Sniffing, and Mailbox Access
Port 110 exposes POP3, the protocol used to download email from the server to the client. A practical guide to enumeration, brute force, cleartext credential sniffing, message downloading, and mail server hardening.

OpenVPN Port 1194: .ovpn Files, VPN Credentials, and Internal Access — openvpn 5 min read
OpenVPN Port 1194: .ovpn Files, VPN Credentials, and Internal Access
OpenVPN pentest on port 1194: UDP/TCP fingerprinting, .ovpn file analysis, credential testing, client certificates, and internal network access in the lab.

Port 1352 Lotus Notes/Domino: NRPC, names.nsf and WebAdmin — IBM Domino 4 min read
Port 1352 Lotus Notes/Domino: NRPC, names.nsf and WebAdmin
Lotus Notes/Domino pentest on port 1352: NRPC enums, names.nsf, Domino Directory, NSF databases, WebAdmin, and weak logins in legacy environments.

IMAP Port 143: Mailbox Access, Brute Force, and Mail Server Enumeration — 10 min read
IMAP Port 143: Mailbox Access, Brute Force, and Mail Server Enumeration
Port 143 exposes IMAP, the protocol used to access and synchronize email and folders directly on the server. A practical guide to enumeration, login testing, mailbox discovery, and mail server hardening.

Port 1521 Oracle DB: TNS Listener, SID and Privilege Escalation — oracle 8 min read
Port 1521 Oracle DB: TNS Listener, SID and Privilege Escalation
Oracle Pentest 1521: TNS Listener enumeration, payload, SID, and service name, weak credential testing, SQL injection, escalation to DBA, and lateral movement in the lab.

SMTP Port 25: User Enumeration, Open Relay, and SMTP AUTH — smtp-user-enum 10 min read
SMTP Port 25: User Enumeration, Open Relay, and SMTP AUTH
SMTP port 25 can expose user enumeration via VRFY and RCPT TO, open relay, email spoofing, and brute force on SMTP AUTH. A practical guide to mail server enumeration, exploits, detection, and hardening.

Port 43 WHOIS: OSINT on Domains, IPs and Name Servers — osint 8 min read
Port 43 WHOIS: OSINT on Domains, IPs and Name Servers
WHOIS port 43 allows passive queries on domains, IPs, and ASNs to gather registrars, name servers, contacts, and expiration dates for reconnaissance and OSINT.

Port 5000: Docker Registry, Flask Debug, and UPnP — Docker Registry 4 min read
Port 5000: Docker Registry, Flask Debug, and UPnP
Bring 5000 into the pentest: recognize Docker Registry, Flask debug, UPnP or Synology DSM. Enumeration, image pull, RCE Werkzeug and SOAP abuse in lab.

Port 1026 MS RPC: Windows dynamic endpoints, port 135 and remoting. — endpoint-mapper 1 min read
Port 1026 MS RPC: Windows dynamic endpoints, port 135 and remoting.
Learn what port 1026 is in MS RPC, why it correlates with the endpoint mapper on 135, and how dynamic RPC ports change between legacy and modern Windows systems, impacting enumeration, firewalling, and lateral movement.

TCP Port 1080: SOCKS Proxy and Pivoting in the Internal Network — socks5 6 min read
TCP Port 1080: SOCKS Proxy and Pivoting in the Internal Network
Port 1080 can expose an open SOCKS proxy that can be used for pivoting, tunneling, and internal network access. Learn how to identify, test, and exploit it in authorized pentests.

Port 21 FTP: Anonymous Login, Brute Force and Exploits — ftp-anonymous 12 min read
Port 21 FTP: Anonymous Login, Brute Force and Exploits
FTP port 21 remains a key pentest target: discover enumeration, anonymous login, brute force, file uploads, vsftpd and ProFTPD exploits, detection, and practical hardening.

Telnet Port 23: Clear Text Credentials, Sniffing, and Brute Force — telnet-sniffing 12 min read
Telnet Port 23: Clear Text Credentials, Sniffing, and Brute Force
Telnet port 23 is an immediate critical finding: it transmits credentials in clear text, facilitating brute force, sniffing, and insecure remote access. Learn how to enumerate, attack, and secure it.

Port 1025 MS RPC: Windows dynamic endpoints, port 135 and lateral movement. — rpc-endpoint-mapper 3 min read
Port 1025 MS RPC: Windows dynamic endpoints, port 135 and lateral movement.
Learn what port 1025 is in MS RPC, why it correlates with the endpoint mapper on 135, and how dynamic RPC ports depend on the Windows version: 1025-5000 on legacy systems, 49152-65535 from Windows Vista/Server 2008 onwards.

Port 912 Apex Mesh / MeshCentral: RMM servers, remote agents, and centralized compromise. — meshcentral 1 min read
Port 912 Apex Mesh / MeshCentral: RMM servers, remote agents, and centralized compromise.
Learn what port 912 is associated with apex-mesh and why it might indicate a remote management platform like MeshCentral: centralized access to endpoints, remote agents, and high-impact surface area for the entire managed network.

Port 990 FTPS: Anonymous login, brute force, and file exfiltration over encrypted FTP. — anonymous-login 1 min read
Port 990 FTPS: Anonymous login, brute force, and file exfiltration over encrypted FTP.
Learn what port 990 ftps is, how it relates to port 989 ftps-data, and why anonymous logins, weak credentials, and exposed backups remain the primary risks of TLS-protected file transfers.

POP3S Port 995: Brute force, mailbox dump, and credential reuse on encrypted emails. — credential reuse 1 min read
POP3S Port 995: Brute force, mailbox dump, and credential reuse on encrypted emails.
Learn what POP3S port 995 is, why POP3 over TLS uses implicit encryption on the email channel, and how weak credentials, mailbox access, and sensitive content still make POP3S a relevant target.

Port 880 Kerberos Admin: KDC kadmin, kpasswd and password policy. — cadmin 1 min read
Port 880 Kerberos Admin: KDC kadmin, kpasswd and password policy.
Learn what port 880 is associated with legacy or custom Kerberos admin services, how it relates to kadmin and kpasswd, and why password policies, principals, and KDC configuration are valuable for Kerberos enumeration.

Port 902 VMware ESXi: vCenter, vmware-authd, and hypervisor risk. — esx-admins 1 min read
Port 902 VMware ESXi: vCenter, vmware-authd, and hypervisor risk.
Learn what VMware port 902 is, used in core communications between vCenter Server and ESXi, and why identifying a host with vmware-authd is a high-impact surface for your entire virtual infrastructure.

Port 989 FTPS-Data: Encrypted data channel, implicit TLS and file transfer security. — tls-inspection 1 min read
Port 989 FTPS-Data: Encrypted data channel, implicit TLS and file transfer security.
Learn what ftps-data port 989 is, how it relates to port 990 in implicit FTPS, and why certificates, TLS, and access permissions remain crucial to evaluating file transfer security.

LDAPS port 636: Active Directory enumeration, TLS certificates, and AD CS abuse. — ad-cs 1 min read
LDAPS port 636: Active Directory enumeration, TLS certificates, and AD CS abuse.
Learn what LDAPS port 636 is, how LDAP over SSL can reveal your hostname, domain, and enterprise CA, and why LDAP signing and channel binding remain crucial for reducing Active Directory relay and exposure.

Port 513 Rlogin: .rhosts trust, root access and legacy Unix lateral movement — rhosts 9 min read
Port 513 Rlogin: .rhosts trust, root access and legacy Unix lateral movement
Learn what Rlogin port 513 is, how .rhosts and hosts.equiv work, why trust can open passwordless logins, and how to identify trust chains and lateral movement on legacy Unix systems.

Port 554 RTSP: default credentials, vendor path, and IP camera video feeds. — IP camera 7 min read
Port 554 RTSP: default credentials, vendor path, and IP camera video feeds.
Learn what RTSP port 554 is, how to detect paths from Hikvision, Dahua, and other vendors, and why CCTV, DVR, and NVR streams with weak or no authentication pose a real risk to video surveillance.

Port 587 SMTP Submission: user enumeration, STARTTLS and email credentials. — starttls 8 min read
Port 587 SMTP Submission: user enumeration, STARTTLS and email credentials.
Find out what SMTP Submission port 587 is, how authenticated email sending works according to RFC 6409, and why STARTTLS and SMTP AUTH are crucial for evaluating the security of your email service.

Port 593 RPC over HTTP: IOXIDResolver, endpoint enumeration and DCOM stealth. — ioxidresolver 7 min read
Port 593 RPC over HTTP: IOXIDResolver, endpoint enumeration and DCOM stealth.
Learn what http-rpc-epmap port 593 is, how ncacn_http works in a Microsoft environment, and why RPC over HTTP can expose endpoints, DCOM services, and useful information about the enterprise RPC surface.

IPMI port 623: RAKP hash disclosure, cipher 0 and out-of-band BMC risk. — rakp-hash 1 min read
IPMI port 623: RAKP hash disclosure, cipher 0 and out-of-band BMC risk.
Learn what port 623/UDP asf-rmcp is, how IPMI 2.0 works with RAKP, and why CVE-2013-4786 allows hash recovery from BMC responses, while cipher suite 0 support can drastically reduce remote management security.

Port 631 IPP/CUPS: RCE chain, cups-browsed and Linux print server compromise. — cups-browsed 1 min read
Port 631 IPP/CUPS: RCE chain, cups-browsed and Linux print server compromise.
Learn what IPP/CUPS port 631 is, how the Internet Printing Protocol over TCP and UDP 631 works, and why the 2024 cups-browsed vulnerability chain brought RCE, printer discovery, and Linux print server security back to the forefront.

HTTPS Port 443: What It Is, How It Works, and the Security Risks of TLS and Web Apps — https 11 min read
HTTPS Port 443: What It Is, How It Works, and the Security Risks of TLS and Web Apps
Learn what HTTPS port 443 is for, how TLS, certificates, and virtual hosts work, and the risks it introduces, including exposed hostnames in SANs, TLS misconfigurations, sensitive files, admin panels, and web attack surfaces.

SMTPS Port 465: What it is, how it works, and the security risks of TLS mail submission. — smtps 11 min read
SMTPS Port 465: What it is, how it works, and the security risks of TLS mail submission.
Learn what SMTPS port 465 is used for, how SMTP Submission over TLS works, and what risks it introduces, including user enumeration, open relay, brute force SMTP AUTH, and internal phishing with valid credentials.

ISAKMP Port 500: IPsec VPN, IKEv1 Aggressive Mode and PSK Crack — isakmp 9 min read
ISAKMP Port 500: IPsec VPN, IKEv1 Aggressive Mode and PSK Crack
ISAKMP port 500 in pentest: IPsec VPN enumeration, IKE fingerprinting, Aggressive Mode, PSK hash extraction, offline cracking, and tunneling to internal network.

Rexec Port 512: What It Is, Vulnerability, and a Complete Pentest Guide — rexec 8 min read
Rexec Port 512: What It Is, Vulnerability, and a Complete Pentest Guide
Rexec Port 512: What it is, how it works, and how to test it in a pentest. Enumeration, cleartext credential sniffing, credential spraying, command execution, and risks of legacy Unix systems.

Syslog Port 514: Cleartext Logs, Syslog Injection, and UDP Collector Risk — syslog injection 9 min read
Syslog Port 514: Cleartext Logs, Syslog Injection, and UDP Collector Risk
Learn what syslog port 514/UDP is, how to identify collectors and logging streams, what data can travel in the clear, and why syslog over TLS on 6514 reduces eavesdropping and spoofing.

LPD Port 515: File read, queue enumeration, and legacy print server risks — price 9 min read
LPD Port 515: File read, queue enumeration, and legacy print server risks
Learn what LPD port 515 is, how the Line Printer Daemon defined in RFC 1179 works, and why print queues, Unix/Linux print servers, and legacy services can expose sensitive information and overlooked attack surfaces.

RIP Port 520: Route Sniffing, Route Injection, and MitM Risk on Legacy Networks — route poisoning 5 min read
RIP Port 520: Route Sniffing, Route Injection, and MitM Risk on Legacy Networks
Learn what port 520/UDP used by RIP is, how RIPv1 and RIPv2 work, and why route advertisements can expose network topology and increase the risk of route poisoning, traffic redirection, and path manipulation.

IRC Port 194: What It Is, How It Works, and Differences Between Ports 6667 and 6697 — irc 11 min read
IRC Port 194: What It Is, How It Works, and Differences Between Ports 6667 and 6697
Learn what IRC port 194 is for, why many servers use 6667 or 6697, how the protocol works, and the risks it introduces, including user enumeration, channels, internal hostname leaks, and vulnerable daemons.

SMUX Port 199: What It Is, How It Works, and SNMP Security Risks — smux 11 min read
SMUX Port 199: What It Is, How It Works, and SNMP Security Risks
Learn what SMUX port 199 does, how it connects SNMP subagents and master agents, what risks it introduces when exposed to the network, and how to analyze registrations, OIDs, and misconfigurations in legacy systems.

FTP Ports 20 and 21: What the Protocol Is, How It Works, and Where It Actually Attacks — ftp-data 10 min read
FTP Ports 20 and 21: What the Protocol Is, How It Works, and Where It Actually Attacks
A practical guide to FTP (File Transfer Protocol) ports 20 and 21: the difference between control and data channels, active/passive mode, sniffing risks, FTP bounces, and common vulnerabilities in legacy servers and labs.

Port 162 SNMP Trap: What It Is, How It Works, and How It Differs from Port 161 — snmp-trap 10 min read
Port 162 SNMP Trap: What It Is, How It Works, and How It Differs from Port 161
Learn what the SNMP Trap port 162 is used for, how the notification channel works compared to port 161, what risks it introduces with SNMPv1/v2c, and how to exploit it for reconnaissance, sniffing, and passive intelligence gathering.

BGP Port 179: What It Is, How It Works, and Routing Security Risks — bgp 10 min read
BGP Port 179: What It Is, How It Works, and Routing Security Risks
Learn what BGP port 179 is used for, how Autonomous System peering works, what risks a misconfigured session introduces, and how to analyze enumeration, route injection, and hijacking in an authorized pentest/CTF.

Squid Proxy Port 3128: What It Is, How It Works, and Security Risks — squid-proxy 3 min read
Squid Proxy Port 3128: What It Is, How It Works, and Security Risks
Learn what Squid port 3128 is used for, how an HTTP/HTTPS forward proxy works, the risks a misconfigured open proxy introduces, and how to exploit or defend against it in pivoting, access to internal services, and ACL control.

RDP Port 3389: What is Remote Desktop, How it Works, and Security Risks — rdp 6 min read
RDP Port 3389: What is Remote Desktop, How it Works, and Security Risks
Learn what RDP port 3389 is used for, how Remote Desktop, NLA, and CredSSP work, what risks service exposure introduces, and how to attack or defend against brute force, BlueKeep, and lateral movement.

Network Sniffing: How to Capture Traffic, Credentials, and Packet Data in Pentests — packet sniffing 10 min read
Network Sniffing: How to Capture Traffic, Credentials, and Packet Data in Pentests
Network Sniffing: How to Capture Traffic, Credentials, and Packet Data in Pentests

VPN: Protocols, Security, and Vulnerabilities (WireGuard, OpenVPN, IPSec) — wire guard 10 min read
VPN: Protocols, Security, and Vulnerabilities (WireGuard, OpenVPN, IPSec)
How VPNs work and what they are at a technical level: IPSec, OpenVPN, WireGuard, L2TP, and PPTP. Tunnel architecture, real-world attacks, misconfigurations, and pentest analysis.

Blind XSS: What It Is and How to Detect It with Out-of-Band Callbacks and XSS Hunter — XSS 4 min read
Blind XSS: What It Is and How to Detect It with Out-of-Band Callbacks and XSS Hunter
Complete guide to Blind XSS: out-of-band detection, server callbacks, XSS Hunter, stealth payloads, admin injection points, and internal panel trigger analysis.

STP and RSTP Under Attack: Root Bridge, BPDUs, and Network Takeover — bpdu-guard 8 min read
STP and RSTP Under Attack: Root Bridge, BPDUs, and Network Takeover
Learn how STP and RSTP work, what the Root Bridge, Spanning Tree Protocol, and how BPDU election occurs, and what real risks exist in pentesting: takeover, TCN floods, and layer 2 attacks.

TCP (Transmission Control Protocol): What it is, how it works, and how to use it in a pentest — three-way handshake 8 min read
TCP (Transmission Control Protocol): What it is, how it works, and how to use it in a pentest
Complete guide to TCP: three-way handshake, flags, sequence number, windowing, port scanning with Nmap, session hijacking, SYN flood and traffic analysis.

TLS/SSL Pentesting: Handshake, Cipher Suite and Vulnerabilities — heartbeat 15 min read
TLS/SSL Pentesting: Handshake, Cipher Suite and Vulnerabilities
TLS/SSL Pentesting Guide 2026: Handshakes, Weak Cipher Suites, ECH, Post-Quantum, Heartbleed, POODLE, and 15+ Vulnerabilities to Test with testssl.sh.

VLANs and 802.1Q: Network Segmentation, Trunks, and VLAN Hopping in a Pentest — 802-1q 8 min read
VLANs and 802.1Q: Network Segmentation, Trunks, and VLAN Hopping in a Pentest
Learn how VLANs and 802.1Q work, the difference between access and trunk, native VLANs, inter-VLAN routing, DTP, double tagging, and VLAN hopping techniques in pentests.

VRRP, HSRP and CARP: gateway takeover, failover and MITM attacks — hsrp-coup 8 min read
VRRP, HSRP and CARP: gateway takeover, failover and MITM attacks
Learn how VRRP, HSRP, and CARP work, how gateway failover occurs, and why takeover, priority abuse, and MITM are real risks in network pentesting.

Wi-Fi 802.11: Frame, WPA2/WPA3, Deauth, and the Evil Twin — The Complete Guide to Wireless Attacks — deauth attack 9 min read
Wi-Fi 802.11: Frame, WPA2/WPA3, Deauth, and the Evil Twin — The Complete Guide to Wireless Attacks
The Complete Guide to 802.11 Wi-Fi: Wireless Frames, Monitor Mode, WPA2/WPA3, Four-Way Handshake, PMKID, Deauthentication, Evil Twin, and Real-World Pentesting Risks.

PPP, PPPoE, and PPTP: A Guide to Real-World Risks for Pentesters — pppoe 7 min read
PPP, PPPoE, and PPTP: A Guide to Real-World Risks for Pentesters
PPP Explained Well: How the Point-to-Point Protocol Works, the Differences Between PAP and CHAP, PPPoE, PPTP, MS-CHAPv2, Real-World Attacks, and Their Impact on Modern Pentesting.

QUIC What is HTTP/3, 0-RTT and blind spot in pentesting — 0-rtt 7 min read
QUIC What is HTTP/3, 0-RTT and blind spot in pentesting
QUIC explained clearly: what it is, how it works with HTTP/3, 0-RTT risks, UDP 443 inspection gap, logging bypass, and real-world implications for pentesting.

SCTP in the telco pentest: multi-streaming, multi-homing, and attack surfaces — sigtran 6 min read
SCTP in the telco pentest: multi-streaming, multi-homing, and attack surfaces
SCTP What is it: how it works, four-way handshake, multi-streaming, multi-homing, scanning with Nmap, risks on SIGTRAN, Diameter and 4G/5G networks.

SNMP and Community Strings: How to Read Half the Network in a Pentest — Snmpwalk 7 min read
SNMP and Community Strings: How to Read Half the Network in a Pentest
SNMP: what it is, how it works, OID, public/private community string, snmpwalk, brute force, write access, and real risks in an enterprise pentest.

UDP (User Datagram Protocol): What it is, how it works, and how to exploit it in a pentest. — udp-scan 7 min read
UDP (User Datagram Protocol): What it is, how it works, and how to exploit it in a pentest.
UDP explained clearly: headers, differences with TCP, UDP scanning with Nmap, critical services like DNS, SNMP and NTP, amplification attacks and real risks in pentesting.

GRE (Generic Routing Encapsulation): What it is, how it works, and how to use it in pentesting — protocol 47 8 min read
GRE (Generic Routing Encapsulation): What it is, how it works, and how to use it in pentesting
Learn what GRE is, how Generic Routing Encapsulation tunneling works, why it's risky in enterprise environments, and how to exploit or defend against it in a pentest.

IPSec: Enterprise VPN, IKE, ESP, and Misconfigurations to Exploit — ipsec 8 min read
IPSec: Enterprise VPN, IKE, ESP, and Misconfigurations to Exploit
Learn how IPSec works and why it is crucial in enterprise VPN pentesting: IKEv1/IKEv2, ESP, tunnel mode, aggressive mode, weak PSK, ike-scan, and defenses.

IPv4 vs. IPv6: Differences, Security, and Attacks in Network Pentesting — ipv4 8 min read
IPv4 vs. IPv6: Differences, Security, and Attacks in Network Pentesting
Learn the differences between IPv4 and IPv6 and why they matter in pentesting: SLAAC, NDP, RA spoofing, IPv6 scanning, dual-stack, control bypass, and defenses.

LLDP: The Protocol That Reveals Switches, VLANs, and Network Topology — lldp 7 min read
LLDP: The Protocol That Reveals Switches, VLANs, and Network Topology
Learn what LLDP is, how it works, and why it's useful in pentesting: passive discovery, neighbor tables, VLANs, IP management, LLDP-MED, spoofing, and defenses.

NTP: How It Works, How to Exploit It, and Why It Can Take Down an Entire Network — Ntp 7 min read
NTP: How It Works, How to Exploit It, and Why It Can Take Down an Entire Network
Learn what NTP is, how it works, and why it's critical in pentesting: monlists, DDoS amplification, rogue NTP servers, time skew, Kerberos, TLS, logs, and defenses.

OSPF, EIGRP, BGP, and RIP: How They Work and How to Use Them in Pentests — route injection 9 min read
OSPF, EIGRP, BGP, and RIP: How They Work and How to Use Them in Pentests
A complete guide to OSPF, EIGRP, BGP, and RIP: how they work, their differences, route injection, BGP hijacking, fake LSAs, MITMs, and defenses for dynamic routing protocols.

Ethernet (IEEE 802.3): What It Is, How It Works, and How to Use It in a Pentest — Ethernet 7 min read
Ethernet (IEEE 802.3): What It Is, How It Works, and How to Use It in a Pentest
Learn what Ethernet is, how an 802.3 frame works, and why it's essential in pentesting: MAC address, switches, CAM table overflow, sniffing, spoofing, and defenses.

HTTP and HTTPS: What They Are, How They Work, and How to Use Them in a Pentest — https 7 min read
HTTP and HTTPS: What They Are, How They Work, and How to Use Them in a Pentest
Learn what HTTP is, how HTTPS works, and why it's essential in web pentesting: methods, headers, cookies, status codes, fingerprinting, enumeration, and real-world attacks.

ICMP: What It Is, How It Works, and How to Use It in a Pentest — etc 8 min read
ICMP: What It Is, How It Works, and How to Use It in a Pentest
Learn what ICMP is, how ping and traceroute work, and why it's crucial in pentesting: host discovery, ICMP tunneling, redirection, fingerprinting, detection, and defenses.

IGMP (Multicast): What It Is, How It Works, and Why It Matters in Network Pentesting — igmp 8 min read
IGMP (Multicast): What It Is, How It Works, and Why It Matters in Network Pentesting
Learn what IGMP is, how multicast works, and why it's useful in pentesting: host discovery, membership reporting, IGMP snooping, reconnaissance, DoS, and security.

IP (Internet Protocol): What It Is, How It Works, and Why It Matters in Pentesting — ip 7 min read
IP (Internet Protocol): What It Is, How It Works, and Why It Matters in Pentesting
Learn what IP is, how headers, TTLs, routing, and fragmentation work, and why it's essential in pentesting: IP spoofing, evasion, reconnaissance, and defenses.

ARP (Address Resolution Protocol): What It Is, How It Works, and How to Use It in a Pentest — arp-spoofing 8 min read
ARP (Address Resolution Protocol): What It Is, How It Works, and How to Use It in a Pentest
Learn what ARP is, how it actually works, and how it's exploited in pentesting: ARP cache, gratuitous ARP, spoofing, MITM, detection, defenses, and practical tools.

DHCP: What It Is, How It Works, and How to Use It in a Pentest — dhcp-spoofing 8 min read
DHCP: What It Is, How It Works, and How to Use It in a Pentest
Learn what DHCP is, how the DORA process works, and how to exploit it in a pentest: starvation, rogue DHCP servers, WPAD injection, option 121, and real-world defenses.

DNS: What It Is, How It Works, and How to Use It in a Pentest — dns 9 min read
DNS: What It Is, How It Works, and How to Use It in a Pentest
Learn what DNS is, how name resolution works, and how to leverage it in a pentest: zone transfer, subdomain enumeration, cache poisoning, tunneling, and defenses.

SSH Port 22: Enumeration, Brute Force, Tunneling, and Hardening — openssh 12 min read
SSH Port 22: Enumeration, Brute Force, Tunneling, and Hardening
Learn about SSH port 22, one of the most common pentest targets: discover enumeration, brute force, user enumeration, stolen keys, SSH tunneling, and effective hardening of the Secure Shell protocol.

TCP Port 8080: Tomcat, Jenkins, and High-Impact Web Vulnerabilities — tomcat-manager 7 min read
TCP Port 8080: Tomcat, Jenkins, and High-Impact Web Vulnerabilities
Port 8080 often hosts Apache Tomcat and Jenkins, two key targets in web pentesting. Learn about enumeration, Tomcat Manager, Jenkins RCE, and the most useful tests for the most critical web vulnerabilities.

Port 5985 WinRM: Evil-WinRM, Pass-the-Hash, and PowerShell Remoting — evil-winrm 5 min read
Port 5985 WinRM: Evil-WinRM, Pass-the-Hash, and PowerShell Remoting
Port 5985 exposes WinRM over HTTP, the Microsoft service used by PowerShell Remoting. Learn about enumeration, access with Evil-WinRM, Pass-the-Hash, lateral movement, and hardening in Active Directory environments.

MySQL Port 3306: Dump Database, LOAD_FILE and Webshell via INTO OUTFILE — web portal 6 min read
MySQL Port 3306: Dump Database, LOAD_FILE and Webshell via INTO OUTFILE
MySQL port 3306: a practical pentest guide with brute force credentials, database dumps, LOAD_FILE, webshell via INTO OUTFILE, UDF for RCE, and escalation techniques.

Socat: The Swiss Army Knife of Networking for Pentesting and Pivoting — tunneling 4 min read
Socat: The Swiss Army Knife of Networking for Pentesting and Pivoting
Socat for advanced networking: relay, port forwarding, reverse shell, and encrypted tunnels. The Swiss Army Knife for network connections in pentesting.

Shodan: A Guide to Dork, Advanced Queries and Filters (2026) — osint 10 min read
Shodan: A Guide to Dork, Advanced Queries and Filters (2026)
Shodan: Practical dorks for MongoDB, IoT, ICS and CVE, advanced filters, CLI, API, InternetDB and complete cheat sheet for passive reconnaissance and pentesting (2026).

RSH: Clear Text Remote Shell on Unix Systems — unix 3 min read
RSH: Clear Text Remote Shell on Unix Systems
RSH: Clear Text Remote Shell on Unix Systems

RevSocks: Reverse SOCKS Proxy for Pivoting and Internal Access — pivoting 5 min read
RevSocks: Reverse SOCKS Proxy for Pivoting and Internal Access
RevSocks creates a reverse SOCKS proxy between the attacker and the compromised target, allowing pivoting and access to internal networks in authorized pentests.

NBTSscan: Fast NetBIOS Enumeration on Windows Networks — netbios 2 min read
NBTSscan: Fast NetBIOS Enumeration on Windows Networks
NBTSscan is a lightweight NetBIOS enumeration tool for Windows networks. It identifies hostnames, domains, and MAC addresses via NetBIOS queries.

ProxyChains: Chaining Proxies for Anonymity and Pivoting in Pentesting — pivoting 7 min read
ProxyChains: Chaining Proxies for Anonymity and Pivoting in Pentesting
ProxyChains: A practical guide to anonymizing traffic and chaining proxies in penetration testing. Configuration, SOCKS5, and tool integration.

SSHuttle: VPN over SSH for Pivoting in Penetration Testing — pivoting 7 min read
SSHuttle: VPN over SSH for Pivoting in Penetration Testing
SSHuttle: A complete guide to creating VPNs over SSH for penetration testing. Pivoting, tunneling, and accessing internal networks without configuration.

Rsync Port 873: Enumeration, Anonymous Access and Exploitation — Rsync 5 min read
Rsync Port 873: Enumeration, Anonymous Access and Exploitation
Pentest Rsync on port 873: enumerates rsyncd and modules, verifies anonymous and write access, analyzes exposed files and possible attack paths.

Telnet Door 23: Exploitation, Credential Abuse and Pivoting — telnet 6 min read
Telnet Door 23: Exploitation, Credential Abuse and Pivoting
Learn how to exploit Telnet on port 23 during a pentest: enumeration, banner grabbing, credentials, privilege escalation, pivoting, and lateral movement.

CVE

Latest CVE

CVE-2026-20079: Cisco FMC Auth Bypass, KEV Active — cve-2026-20079 6 min read
CVE-2026-20079: Cisco FMC Auth Bypass, KEV Active
CVE-2026-20079: Critical authentication bypass (CVSS 10.0) in Cisco Secure FMC, KEV CISA, and exploited by Sandworm and Qilin. Root cause, IOC, remediation.

CVE-2026-82329: PoC Authentication Bypass in JFrog Artifactory — cve-2026-82329 10 min read
CVE-2026-82329: PoC Authentication Bypass in JFrog Artifactory
CVE-2026-82329: Authentication bypass in JFrog Artifactory via empty join key. Root cause, exploit chain, working PoC, detection, and remediation.

CVE-2026-31431 (Copy Fail): Root on Any Linux in 732 Bytes — Linux Privilege Escalation 7 min read
CVE-2026-31431 (Copy Fail): Root on Any Linux in 732 Bytes
CVE-2026-31431 Technical Analysis: How the algif_aead bug works, AF_ALG + splice() chain, practical step-by-step PoC. Every Linux since 2017 is vulnerable.

noPac Active Directory: Standard user to Domain Admin exploit — CVE Windows 4 min read
noPac Active Directory: Standard user to Domain Admin exploit
noPac on Active Directory: Exploits CVE-2021-42278 and CVE-2021-42287 to impersonate a Domain Controller, perform DCSync, and gain Domain Admin

Walkthroughs

Latest Walkthroughs

HTB Monitors Walkthrough: Cacti SQLi and Container Escape — hackthebox 7 min read
HTB Monitors Walkthrough: Cacti SQLi and Container Escape
Walkthrough of Hack The Box Monitors: SQLi in Cacti (CVE-2020-14295), deserialization in OFBiz (CVE-2020-9496), and container escape via kernel module.

HTB Sink Walkthrough: HTTP Request Smuggling and AWS Privesc — HTB Sink 15 min read
HTB Sink Walkthrough: HTTP Request Smuggling and AWS Privesc
Hack The Box Sink write-up: HTTP Request Smuggling, CVE-2019-18277, HAProxy, Gunicorn, Gitea, Ligolo-ng, AWS LocalStack, KMS, and Secrets Manager.

HTB Schooled: Stored XSS on Moodle at Root on FreeBSD — hackthebox 8 min read
HTB Schooled: Stored XSS on Moodle at Root on FreeBSD
Hack The Box Schooled Write-Up: from Stored XSS on Moodle to webshell, MySQL credentials and privilege escalation to root on FreeBSD via pkg.

HTB Mango Walkthrough: NoSQL Injection and Privilege Escalation — nosql-injection 8 min read
HTB Mango Walkthrough: NoSQL Injection and Privilege Escalation
Full HTB Mango walkthrough: NoSQL injection login bypass on MongoDB, credential extraction with $regex, and privilege escalation via SUID on jjs.

HTB Unattended Walkthrough: NGINX Alias Bug and Root via LUKS — nginx-alias-bug 21 min read
HTB Unattended Walkthrough: NGINX Alias Bug and Root via LUKS
Hack The Box Unattended full writeup: NGINX alias bug, double SQL injection, LFI, session poisoning, cron poisoning and privilege escalation to root.

TryHackMe Bolt: Complete Walkthrough (RCE on Bolt CMS) — bolt-cms 4 min read
TryHackMe Bolt: Complete Walkthrough (RCE on Bolt CMS)
Write-Up of TryHackMe's Bolt machine: enumeration, credential discovery, RCE authenticated to Bolt CMS via session hijacking and privesc to root.

HTB Help Walkthrough: GraphQL and File Upload HelpDeskZ — api 8 min read
HTB Help Walkthrough: GraphQL and File Upload HelpDeskZ
Complete Hack The Box: Help write-up. GraphQL enumeration, bypass file upload to HelpDeskZ with vulnerable PHP code analysis, privesc kernel to root.

HTB Falafel Walkthrough: SQLi, PHP Type Juggling and Privesc — type-juggling 7 min read
HTB Falafel Walkthrough: SQLi, PHP Type Juggling and Privesc
Hack The Box's Falafel Machine Write-Up: User Enumeration, Blind SQL Injection, PHP Login Bypass, RCE Upload, and Linux Privilege Escalation.

HTB Shibuya Walkthrough: WIM, RemotePotato0 and ADCS ESC1 — HTB Shibuya 6 min read
HTB Shibuya Walkthrough: WIM, RemotePotato0 and ADCS ESC1
Hack The Box Shibuya Write-up: Enumerate users via Kerberos, extract NTLM hashes from WIM backups, and leverage RemotePotato0 and ADCS ESC1 up to Domain Admin.

HTB Redelegate Walkthrough: SeEnableDelegationPrivilege — hack the box 5 min read
HTB Redelegate Walkthrough: SeEnableDelegationPrivilege
Complete WriteUp of Hack The Box Redelegate: Anonymous FTP, KeePass, MSSQL, ForceChangePassword, SeEnableDelegationPrivilege, S4U, DCSync and Domain Admin.

HTB Giddy Walkthrough: SQL Injection and CVE-2016-6914 — Hack The Box 5 min read
HTB Giddy Walkthrough: SQL Injection and CVE-2016-6914
Hack The Box Giddy full write-up: SQL Injection, NTLMv2 hash capture, WinRM access, AV Bypass and privilege escalation to SYSTEM via CVE-2016-6914.

HTB Love Walkthrough: SSRF, SQLi Time-Based and Privesc — AlwaysInstallElevated 6 min read
HTB Love Walkthrough: SSRF, SQLi Time-Based and Privesc
Write-Up HTB Love, Easy VM: SQLi time-based, NTLM attempt on Responder, SSRF towards 5000, and privesc with AlwaysInstallElevated. Every dead end explained.

HTB Eighteen Walkthrough: MSSQL and private BadSuccessor(dMSA) — BadSuccessor 9 min read
HTB Eighteen Walkthrough: MSSQL and private BadSuccessor(dMSA)
WriteUp Hack The Bpx Eighteen: MSSQL impersonation, cracking hash Werkzeug PBKDF2, privilege escalation with BadSuccessor (CVE-2025-53779) on Windows Server 2025

Voleur HTB: Writeup with Kerberoasting, DPAPI and WSL Privesc — active directory 6 min read
Voleur HTB: Writeup with Kerberoasting, DPAPI and WSL Privesc
Voleur's full walkthrough of Hack The Box: targeted Kerberoasting, AD Recycle Bin abuse, DPAPI chaining, and privilege escalation via WSL to Administrator.

HTB Scepter Walkthrough: NFS, ESC9, ESC14 and DCSync — hackthebox 5 min read
HTB Scepter Walkthrough: NFS, ESC9, ESC14 and DCSync
Complete WriteUp at Hack The Box Scepter: NFS, PFX/PEM certificates, ADCS ESC9, ESC14, altSecurityIdentities and final DCSync.

HTB Anubis Walkthrough — ASP SSTI, Jamovi RCE and ADCS ESC4 — walkthrough 6 min read
HTB Anubis Walkthrough — ASP SSTI, Jamovi RCE and ADCS ESC4
Complete walkthrough of Hack The Box Anubis (Insane, Windows): ASP SSTI for shell in Docker, CVE-2021-28079 on Jamovi for foothold on host, and privilege escalation via ADCS ESC4 with GenericAll on certificate template.

HTB Haze Walkthrough: Splunk RCE and AD Attack Chain — hackthebox 7 min read
HTB Haze Walkthrough: Splunk RCE and AD Attack Chain
HTB Haze Writeup: CVE-2024-36991 on Splunk, credential decryption with splunksecrets, GMSA abuse, Shadow Credentials on AD and RCE up to SYSTEM.

HTB Search Walkthrough – GMSA, Kerberoast and AD Certificate — targeted-kerberoast 5 min read
HTB Search Walkthrough – GMSA, Kerberoast and AD Certificate
Complete writeup of HTB Search: foothold via credentials in an image, Kerberoasting, GMSA abuse, and two distinct paths to Domain Admin.

HTB Scrambled Walkthrough: Silver Ticket and .NET Deserialization — htb-scrambled 10 min read
HTB Scrambled Walkthrough: Silver Ticket and .NET Deserialization
HTB Scrambled Writeup: Kerberoasting, Silver Ticket on MSSQL and RCE via BinaryFormatter insecure deserialization. Static analysis with dnSpy and ysoserial.net

HTB Sekhmet Walkthrough: Node.js Deserialization, WAF Bypass and DPAPI — active directory 10 min read
HTB Sekhmet Walkthrough: Node.js Deserialization, WAF Bypass and DPAPI
HTB Sekhmet Insane,WriteUp Complete: insecure deserialization in node-serialize, bypass ModSecurity with Unicode encoding, ZipCrypto, Kerberos on Linux and DPAPI on Active Directory.

HTB ProLab Dante: Full Review 2026 – Is It Worth It? — prolabs 6 min read
HTB ProLab Dante: Full Review 2026 – Is It Worth It?
HTB ProLab Dante review: lab structure, strengths of pivoting, real-world issues with older OSes and unintended CVEs. Who really needs it and when to skip it.

HTB Hathor Walkthrough ITA: AppLocker Bypass, DLL Hijacking and DCSync on Windows Insane — hackthebox 6 min read
HTB Hathor Walkthrough ITA: AppLocker Bypass, DLL Hijacking and DCSync on Windows Insane
HTB Hathor Walkthrough: AppLocker Bypass, DLL Hijacking over SMB, Code Signing with a Stolen Certificate, and DCSync Without NTLM. Insane Windows Machine

Osaka Walkthrough – OffSec PG | BOF, ROP Chain & DEP Bypass — Proving Grounds Practice 8 min read
Osaka Walkthrough – OffSec PG | BOF, ROP Chain & DEP Bypass
Walkthrough Osaka – OffSec Proving Grounds: format string → ASLR bypass, ROP chain with VirtualAlloc → DEP bypass, shellcode and SeDebugPrivilege → SYSTEM.

Tools

Latest Tools

OpenSSL: Tools for TLS, Certificates, and Encryption — OpenSSL 13 min read
OpenSSL: Tools for TLS, Certificates, and Encryption
OpenSSL for TLS, X.509, RSA, and ECDSA certificates, PKI, s_client, and encryption. Practical commands for Linux, Windows, troubleshooting, and pentesting.

Dradis Framework: Reporting, Findings, and Pentest Automation — Dradis 5 min read
Dradis Framework: Reporting, Findings, and Pentest Automation
Discover Dradis Framework: import findings from Nessus, Nmap, and Burp, organize evidence, and generate consistent pentest reports. A practical guide.

JTAG: What It Is, How It Works, and How to Use It in Hardware Pentesting — JTAG 8 min read
JTAG: What It Is, How It Works, and How to Use It in Hardware Pentesting
What is JTAG and how does it work? Learn about pins, JTAGulator, OpenOCD, firmware dumps, and the risks of an exposed JTAG interface in hardware pentesting.

Nessus: Complete Guide to Scanning, Installation, and Vulnerabilities — Nessus 13 min read
Nessus: Complete Guide to Scanning, Installation, and Vulnerabilities
Nessus Guide: Installation, Nessus Essentials, vulnerability scans, credentialed scans, policies, tuning, and reporting. The complete vulnerability assessment workflow.

Sliver C2: Guide to Listeners, Beacons, Implants and Armory — Sliver C2 17 min read
Sliver C2: Guide to Listeners, Beacons, Implants and Armory
Configure Sliver C2 for Red Team: installation, mTLS/HTTP/DNS listener, implant, beacons and sessions, Armory, BOF, pivoting, OPSEC, detection and cleanup.

Cobalt Strike: What It Is, How It Works, Beacon, and Malleable C2 — Cobalt Strike 10 min read
Cobalt Strike: What It Is, How It Works, Beacon, and Malleable C2
Learn how Cobalt Strike works in the Red Team: Team Server architecture, Beacon, listener, Malleable C2, post-exploitation and main detection techniques.

DirBuster on Kali: brute force directory with GUI and wordlist — brute force directory, 7 min read
DirBuster on Kali: brute force directory with GUI and wordlist
Use DirBuster on Kali to find hidden directories and files: GUI and headless configuration, wordlist, recursion, soft-404, and comparison with ffuf and feroxbuster.

ngrok Reverse Shell: TCP tunnels and Metasploit in the Pentest — tunneling 7 min read
ngrok Reverse Shell: TCP tunnels and Metasploit in the Pentest
Use ngrok in penetration testing to create TCP/HTTPS tunnels behind NATs and firewalls, receive reverse shells with Netcat or Metasploit, and evaluate OPSEC limits.

XSSer: XSS Scanner, Payload, Fuzzing and WAF Bypass — xsser 9 min read
XSSer: XSS Scanner, Payload, Fuzzing and WAF Bypass
Practical guide to XSSer for testing XSS vulnerabilities: installation, GET/POST scanning, payload, fuzzing, encoding, WAF bypass and results reporting.

WPScan: WordPress Pentest, Enumeration and Vulnerabilities — WordPress pentest 8 min read
WPScan: WordPress Pentest, Enumeration and Vulnerabilities
A practical guide to WPScan for WordPress pentesting: installation, scanning, plugin, theme, and user enumeration, vulnerabilities, API tokens, and brute force.

renameMachine.py: NoPac and sAMAccountName Spoofing — package 5 min read
renameMachine.py: NoPac and sAMAccountName Spoofing
Guide to impacket-renameMachine to change the sAMAccountName of account computers and understand the NoPac chain with CVE-2021-42278 and CVE-2021-42287.

ticketer.py: Golden and Silver Ticket Kerberos with Impacket — package 5 min read
ticketer.py: Golden and Silver Ticket Kerberos with Impacket
Impacket-ticketer guide to forge Golden and Silver Kerberos Tickets with NTLM hashes or AES keys, customize PAC, and save ticket ccache.

smbserver.py: SMB Server for File Transfer and NTLM — package 13 min read
smbserver.py: SMB Server for File Transfer and NTLM
A guide to impacket-smbserver for creating an SMB share on Kali, transferring files, registering NTLM authentication, and managing SMB2, logins, and logging.

GetUserSPNs.py: Kerberoasting and TGS with Impacket — package 5 min read
GetUserSPNs.py: Kerberoasting and TGS with Impacket
How to use impacket-GetUserSPNs to enumerate accounts with SPNs and request Kerberos TGS with passwords, NTLM hashes, caches, or AES keys for Windows Active Directory

getTGT.py: Getting a Kerberos TGT with Hash or AES — package 4 min read
getTGT.py: Getting a Kerberos TGT with Hash or AES
How to use impacket-getTGT to request a Kerberos TGT and save it in ccache format using a password, NTLM hash, or AES key in Active Directory.

GetADComputers.py — Enumerate Active Directory Computers with Impacket — package 14 min read
GetADComputers.py — Enumerate Active Directory Computers with Impacket
How to use impacket-GetADComputers to enumerate Active Directory computers via LDAP, -resolveIP ,auth with password, NTLM hash, Kerberos, ccache or AES keys.

GetLAPSPassword.py: Recover LAPS Passwords with Impacket — getlapspassword 7 min read
GetLAPSPassword.py: Recover LAPS Passwords with Impacket
Impacket's GetLAPSPassword.py guide for recovering encrypted Legacy LAPS and Windows LAPS passwords from Active Directory with passwords, NTLM hashes, or Kerberos.

addcomputer.py Impacket: Create Computer Account for RBCD — active directory 7 min read
addcomputer.py Impacket: Create Computer Account for RBCD
Impacket's addcomputer.py guide for creating Active Directory computer accounts via SAMR or LDAPS, verifying MachineAccountQuota, and using them in RBCD chains.

lookupsid.py: Enumerate Users and SIDs via RID Cycling SMB — package 4 min read
lookupsid.py: Enumerate Users and SIDs via RID Cycling SMB
Guide to impacket-lookupsid to enumerate users, groups, and SIDs via MS-LSAT over SMB, using passwords, NTLM hashes, Kerberos, or anonymous sessions when allowed.

GetNPUsers.py: AS-REP Roasting with Impacket — as-rep-roasting 7 min read
GetNPUsers.py: AS-REP Roasting with Impacket
Impacket's GetNPUsers.py guide for finding accounts without Kerberos pre-authentication, extracting AS-REP hashes, and cracking them offline with Hashcat.

samrdump.py Impacket: Enumerate Windows Users via SAMR — samrdump 6 min read
samrdump.py Impacket: Enumerate Windows Users via SAMR
Impacket's samrdump.py guide to enumerate Windows users via MS-SAMR over SMB, get RID and account attributes with passwords, NTLM or Kerberos hashes.

GetADUsers.py Inpacket: Enumerate Active Directory Users — user-enumeration 6 min read
GetADUsers.py Inpacket: Enumerate Active Directory Users
Impacket's GetADUsers.py guide to enumerate Active Directory users via LDAP with password, NTLM hash, AES or Kerberos key and parse pwdLastSet and lastLogon.

getST.py Impacket: S4U, RBCD and Constrained Delegation — constrained delegation 8 min read
getST.py Impacket: S4U, RBCD and Constrained Delegation
Impacket's getST.py guide for obtaining Kerberos Service Tickets with S4U2Self, S4U2Proxy, RBCD, and constrained delegation. Payload and errors for AD pentests.

rpcdump.py Inpacket: RPC Endpoint, UUID and Named Pipe — rpcdump 8 min read
rpcdump.py Inpacket: RPC Endpoint, UUID and Named Pipe
A guide to Impacket's rpcdump.py for enumerating Windows RPC endpoints, UUIDs, named pipes, and dynamic ports. Practical commands and analysis for pentesting.

dcomexec.py - Lateral Movement via DCOM with Impacket — package 7 min read
dcomexec.py - Lateral Movement via DCOM with Impacket
impacket-dcomexec How-To Guide: Remote Windows Execution via DCOM with ShellWindows, ShellBrowserWindow, and MMC20 Using NTLM Passwords or Hashes.

Impacket aexec: Remote Execution via Task Scheduler — package 5 min read
Impacket aexec: Remote Execution via Task Scheduler
A Guide to Impacket-atexec: Remote Execution on Windows via Task Scheduler RPC with Password, Pass-the-Hash, Kerberos, and Lateral Movement over SMB.

pth-net: Guide to Pass-the-Hash with Samba over SMB/RPC — pth-net 12 min read
pth-net: Guide to Pass-the-Hash with Samba over SMB/RPC
Use pth-net with NTLM hash to enumerate users, payloads, groups and shares via SMB/RPC in pentests, compare it with NetExec and Impacket and analyze PtH detection.

impacket-secretsdump: Dump Windows Hashes and Credentials — Packet 5 min read
impacket-secretsdump: Dump Windows Hashes and Credentials
How to impacket-secretsdump: Remote and offline dump of NTLM hashes, SAM, LSA secrets, Kerberos keys, and NTDS.dit in Windows and Active Directory.

PowerView: Active Directory Enumeration with Commands and Examples — PowerView 8 min read
PowerView: Active Directory Enumeration with Commands and Examples
PowerView guide to enumerate Windows Active Directory: users, groups, computers, ACLs, sessions, GPOs, and trusts with PowerShell commands and practical examples.

PowerShell for Penetration Testing: The Complete Offensive Guide — powershell 7 min read
PowerShell for Penetration Testing: The Complete Offensive Guide
PowerShell for Windows Pentesters: Commands, Downloads, Remoting, Active Directory Enumeration, Logging, AMSI, CLM, and Post-Exploitation Techniques.

SharpHound for BloodHound CE: AD Data Collection Guide — sharphound 6 min read
SharpHound for BloodHound CE: AD Data Collection Guide
SharpHound for BloodHound CE: Active Directory data collection, key flags, stealth options, and import to map escalation paths.

BloodyAD: Privilege Escalation in Active Directory (2026 Guide) — ACE-abuse 21 min read
BloodyAD: Privilege Escalation in Active Directory (2026 Guide)
BloodyAD: PTH/PTT authentication, ACE abuse (GenericAll, WriteDACL, RBCD), Shadow Credentials, Bad Successor 2025 and autobloody.Pentest, payload, detection and bypass

reg.py: All Registry Keys for Pentesting and Active Directory — Windows Registry 25 min read
reg.py: All Registry Keys for Pentesting and Active Directory
Impacket reg.py: Query, add, delete, save, and backup the remote Windows registry via SMB/MS-RRP. SAM, LSA, WDigest, RDP, and WinRM keys for pentesting and hardening.

Certipy: A Complete Guide to AD CS Enumeration and Abuse — certificate-services 41 min read
Certipy: A Complete Guide to AD CS Enumeration and Abuse
Complete guide to Certipy 5.1 to enumerate AD CS, locate ESC1-ESC17, request certificates, use PKINIT, relay, Shadow Credentials and Golden Certificate.

Tool Penetration Testing: A Complete Guide to the Attack Phase" — Hacking Tools 9 min read
Tool Penetration Testing: A Complete Guide to the Attack Phase"
All offensive penetration testing tools organized by attack phase: recon, exploitation, post-exploitation, pivoting, AD. With real attack chains for CTF, OSCP, OSEP, and red teams.

Certify: Enumerate and Abuse AD CS from Windows with C# — certificate-services 13 min read
Certify: Enumerate and Abuse AD CS from Windows with C#
Certify is GhostPack's C# tool for enumerating and exploiting AD CS from Windows without Python dependencies. Learn how to use it to find vulnerable templates and request certificates for escalation to Domain Admin.

John the Ripper: Complete Guide to Password Cracking — password-cracking 19 min read
John the Ripper: Complete Guide to Password Cracking
Complete guide to John the Ripper (Jumbo): Extract hashes from ZIP, SSH, KeePass, PDF, and Office with *2john; crack with wordlist and rules. Comparison with hashcat and final cheat sheet.

OWASP ZAP: Complete guide to proxies, spiders, active scan and fuzzing — zaproxy 5 min read
OWASP ZAP: Complete guide to proxies, spiders, active scan and fuzzing
Learn how to use OWASP ZAP to intercept HTTP/HTTPS traffic, map web applications with spiders and AJAX Spiders, perform active scans, fuzzing, and authenticated tests, even in CI/CD with Docker and APIs.

WMIExec: Complete guide to lateral movement stealth with wmiexec.py — package 6 min read
WMIExec: Complete guide to lateral movement stealth with wmiexec.py
Learn how to use Impacket's WMIExec and wmiexec.py for lateral movement on Windows with passwords, Pass-the-Hash, and Kerberos, reducing artifacts compared to PsExec and improving OPSEC.

Unix-PrivEsc-Check: privilege escalation auditing on Linux and legacy Unix — unix-privesc 19 min read
Unix-PrivEsc-Check: privilege escalation auditing on Linux and legacy Unix
Learn how to use Unix-PrivEsc-Check to detect misconfigurations, weak permissions, sudo abuse, and privilege escalation vectors on Unix/Linux systems, including legacy environments where modern tools fail.

Wappalyzer: How to Identify a Website's CMS, Framework, and Technologies — tech-fingerprinting 5 min read
Wappalyzer: How to Identify a Website's CMS, Framework, and Technologies
A guide to Wappalyzer for detecting CMS, framework, CDN, analytics, and website versioning clues to guide targeted reconnaissance, fingerprinting, and scanning in pentesting.

Wayback URLs: How to Find Historical URLs, Hidden Endpoints, and Sensitive Files — historical-urls 5 min read
Wayback URLs: How to Find Historical URLs, Hidden Endpoints, and Sensitive Files
Learn how to use Waybackurls to extract a domain's historical URLs from the Wayback Machine, find forgotten paths, exposed backups, and old endpoints useful for passive reconnaissance.

WhatWeb: A Complete Guide to Stealth and Aggressive Web Fingerprinting — web fingerprinting 5 min read
WhatWeb: A Complete Guide to Stealth and Aggressive Web Fingerprinting
Learn how to use WhatWeb to identify a website's CMS, framework, web server, JavaScript libraries, and technologies to guide reconnaissance, fingerprinting, and targeted vulnerability scanning.

WinEnum: Windows enumeration for privilege escalation and comparison with WinPEAS — privesc-windows 10 min read
WinEnum: Windows enumeration for privilege escalation and comparison with WinPEAS
Complete guide to WinEnum for post-exploitation enumeration on Windows: PowerShell and Batch variants, privilege escalation checks, OPSEC, differences with WinPEAS, PowerUp, SharpUp, and Seatbelt.

WinPEAS: Commands and Privilege Escalation on Windows — winpeas 6 min read
WinPEAS: Commands and Privilege Escalation on Windows
WinPEAS for Windows privesc: Commands, enumeration, and output to detect vulnerable services, exposed credentials, and misconfigured privilege escalation.

WMIC: Offensive Commands, Lateral Movement, and Persistence on Windows — WMIC 10 min read
WMIC: Offensive Commands, Lateral Movement, and Persistence on Windows
Learn how to use WMIC for enumeration, remote execution, lateral movement, and WMI persistence on Windows. This includes the current status of the tool, practical commands, detection, hardening, and a comparison with PowerShell, CIM, and WinRM.

Ssh-audit: How to Analyze Weak Ciphers, CVEs, and SSH Misconfigurations — openssh 3 min read
Ssh-audit: How to Analyze Weak Ciphers, CVEs, and SSH Misconfigurations
Learn how to use ssh-audit to verify SSH server and client configurations, identify weak algorithms, outdated ciphers, vulnerable versions, and find useful findings for authorized hardening or penetration testing.

SSH-KeyHunter: Find Private SSH Keys and Pivot on Linux — ssh-keys 6 min read
SSH-KeyHunter: Find Private SSH Keys and Pivot on Linux
SSH-KeyHunter automates the search for private SSH keys on Linux, detects unprotected files, owners, fingerprints, and targets from known_hosts: an ideal tool for post-exploitation and lateral movement in authorized pentests.

Sshuttle: Transparent Pivoting and Tunneling via SSH to Internal Networks — pivoting 4 min read
Sshuttle: Transparent Pivoting and Tunneling via SSH to Internal Networks
A guide to Sshuttle for creating a transparent tunnel over SSH, reaching internal subnets, routing DNS, and using a compromised host as a pivot during lateral movement and post-exploitation in authorized pentests.

Subfinder: Complete guide to passive subdomain enumeration with ProjectDiscovery — subdomain-enumeration 3 min read
Subfinder: Complete guide to passive subdomain enumeration with ProjectDiscovery
Learn how to use Subfinder to find valid subdomains from passive sources, speed up web reconnaissance, and build a more effective recon pipeline with the ProjectDiscovery tool optimized for speed and stealth.

Smbmap: SMB Enumeration and Share Discovery on Windows — windows-enumeration 3 min read
Smbmap: SMB Enumeration and Share Discovery on Windows
smbmap explained for pentests: SMB share enumeration, permissions, file access, and credential testing on Windows and Active Directory systems.

SMBExec: Fileless Remote Execution on Windows via SMB — ad 5 min read
SMBExec: Fileless Remote Execution on Windows via SMB
SMBExec is a remote command execution technique over SMB 445 without dropping persistent binaries. It's a stealthier alternative to PsExec in Active Directory environments.

Social-Engineer Toolkit (SET): A Complete Guide to Social Engineering Attacks — Phishing 5 min read
Social-Engineer Toolkit (SET): A Complete Guide to Social Engineering Attacks
SET is a framework for simulating social engineering in authorized environments: phishing, credential harvester, and client-side attacks.

RouterSploit: Exploit Framework for Routers and IoT — iot 4 min read
RouterSploit: Exploit Framework for Routers and IoT
RouterSploit is a framework for testing vulnerabilities on routers and IoT devices. It includes scanning, exploit, and brute-force modules.

Osquery: SQL-Based Endpoint Monitoring for Linux, macOS and Windows — endpoint monitoring 3 min read
Osquery: SQL-Based Endpoint Monitoring for Linux, macOS and Windows
Osquery allows you to query operating systems with SQL queries to analyze processes, users, files, and configurations for security monitoring purposes.

Patator: A Modular Brute-Force Authentication Testing Framework — bruteforce 4 min read
Patator: A Modular Brute-Force Authentication Testing Framework
Patator: A Modular Brute-Force Authentication Testing Framework

Nmap for Pentesting: Port Scanning, Network Recon and NSE — port scanning 12 min read
Nmap for Pentesting: Port Scanning, Network Recon and NSE
Nmap for penetration testing and network recon: commands, host discovery, TCP/UDP port scanning, service detection, OS fingerprinting, NSE and enumeration.

Ncat.exe on Windows: Download, Commands, and Reverse Shell — ncat.exe 6 min read
Ncat.exe on Windows: Download, Commands, and Reverse Shell
How to download and use ncat.exe on Windows: listeners, connections, file transfer, SSL, reverse shell with -e cmd.exe, antivirus false positives and detection.

MSFvenom Cheat Sheet: Commands, Payload, Shellcode & Bypass — msfvenom 10 min read
MSFvenom Cheat Sheet: Commands, Payload, Shellcode & Bypass
MSFvenom exploit for lab and pentest: syntax, staged and stageless payload, EXE, ELF, PHP, WAR and MSI formats, shellcode with bad characters, handler and detection.

LSE (Linux Smart Enumeration): Automated Linux Privilege Escalation Checklist — linux-enumeration 21 min read
LSE (Linux Smart Enumeration): Automated Linux Privilege Escalation Checklist
LSE (Linux Smart Enumeration): Automated Linux Privilege Escalation Checklist

Medusa: High-Speed Login Brute-Force Tool for Network Services — bruteforce 5 min read
Medusa: High-Speed Login Brute-Force Tool for Network Services
Medusa is a parallel tool for brute-forcing authentication over SSH, FTP, SMB, HTTP, and other services. Fast, scalable, and ideal for authorized password auditing.

Metasploit Framework: Complete Guide to Exploits and Payloads — payload generation 5 min read
Metasploit Framework: Complete Guide to Exploits and Payloads
Metasploit Framework is the most widely used penetration testing platform for exploits, payloads, and post-exploitation. A complete offensive workflow guide.

Mitmproxy: HTTP/HTTPS Traffic Interception and Manipulation — proxy 10 min read
Mitmproxy: HTTP/HTTPS Traffic Interception and Manipulation
mitmproxy is an interactive proxy for analyzing and manipulating HTTP/HTTPS traffic. Ideal for API testing, debugging, and authorized security assessments.

LaZagne: Password Extraction from Browsers and Applications — credential dumping 5 min read
LaZagne: Password Extraction from Browsers and Applications
LaZagne is an open-source tool for recovering saved passwords on Windows and Linux from browsers, email clients, and local software post-exploitation.

Ldapsearch: LDAP and Active Directory Enumeration from Linux — ad 3 min read
Ldapsearch: LDAP and Active Directory Enumeration from Linux
Ldapsearch is a CLI tool for querying LDAP and Active Directory from Linux. It's useful for enumerating users, groups, SPNs, and domain objects.

Httpx: HTTP Probing and Large-Scale Web Analysis in Penetration Testing — recon 5 min read
Httpx: HTTP Probing and Large-Scale Web Analysis in Penetration Testing
httpx is the HTTP probing tool for filtering active hosts, detecting technologies, status codes and screenshots in pipelines with subdomain enumeration.

Hydra: Brute Force Login for Network Services — bruteforce 5 min read
Hydra: Brute Force Login for Network Services
Hydra is a brute force tool for testing credentials over SSH, FTP, RDP, HTTP, and other services during authorized penetration tests.

Impacket: Python Toolkit for SMB, Kerberos and Active Directory Attacks — ad 13 min read
Impacket: Python Toolkit for SMB, Kerberos and Active Directory Attacks
Impacket is a Python suite for interacting with network protocols (SMB, LDAP, Kerberos, RPC) and conducting AD attacks such as DCSync and Pass-the-Hash.

Invoke-Manipulation: PowerShell Obfuscation for Evasion AV — powershell 11 min read
Invoke-Manipulation: PowerShell Obfuscation for Evasion AV
Invoke-Manipulation is a PowerShell module for obfuscating scripts and bypassing static checks during authorized red team operations.

HostRecon: Automatic OSINT Reconnaissance on Single Targets — osint 5 min read
HostRecon: Automatic OSINT Reconnaissance on Single Targets
HostRecon automates single-domain OSINT and reconnaissance: DNS, whois, subdomain, breach data, and exposure mapping in a single command.

Evil-WinRM: Remote Access and Post-Exploitation on Windows via WinRM — winrm 11 min read
Evil-WinRM: Remote Access and Post-Exploitation on Windows via WinRM
Evil-WinRM: Remote PowerShell shell via WinRM for Windows post-exploitation. Pass-the-hash, Kerberos ticket, AMSI bypass, in-memory execution .NET assembly for lateral movement enterprise.

Cloud_enum: Cloud Asset Enumeration for Recon on AWS, Azure, and GCP — cloud-enumeration 5 min read
Cloud_enum: Cloud Asset Enumeration for Recon on AWS, Azure, and GCP
Cloud_enum is an OSINT tool for enumerating publicly exposed cloud resources on AWS, Azure, and GCP. It's useful during reconnaissance to map buckets, storage accounts, and assets related to a target domain.

Empire: post-exploitation C2 framework for red team operations — c2 9 min read
Empire: post-exploitation C2 framework for red team operations
Empire 5.0: A Complete Guide to C2 PowerShell: Stager, AMSI Bypass, Post-Exploitation, Lateral Movement, and Evasion Techniques. Cheat sheet included.

Evilginx2: Bypass 2FA with Phishing Proxy Man-in-the-Middle — phising 5 min read
Evilginx2: Bypass 2FA with Phishing Proxy Man-in-the-Middle
Evilginx2's practical guide to bypassing 2FA authentication: man-in-the-middle phishing, session hijacking, and credential theft. Advanced attacks against MFA.

Arjun: HTTP Parameter Discovery for Advanced Web Application Recon — directory-enumeration 5 min read
Arjun: HTTP Parameter Discovery for Advanced Web Application Recon
Arjun is a tool for discovering hidden HTTP parameters in web applications during penetration testing. It automates the identification of undocumented GET and POST parameters useful for IDOR, XSS, and injection.

Assetfinder: Rapid Subdomain Enumeration for Attack Surface Mapping — subdomain-enumeration 5 min read
Assetfinder: Rapid Subdomain Enumeration for Attack Surface Mapping
Assetfinder is an OSINT tool for enumerating subdomains from public sources during the reconnaissance phase. It's ideal for quickly mapping a domain's attack surface during penetration testing.

Commix: Automated Command Injection Exploitation Tool — command injection 3 min read
Commix: Automated Command Injection Exploitation Tool
Commix is an automated tool for identifying and exploiting command injection vulnerabilities in web applications. It supports blind, time-based, and file-based techniques to obtain RCE during penetration testing.

Plink: Port Forwarding and SSH Tunneling from the Command Line in Windows Environments — pivoting 8 min read
Plink: Port Forwarding and SSH Tunneling from the Command Line in Windows Environments
Plink is the command-line version of PuTTY that allows SSH tunneling, port forwarding, and pivoting from Windows systems. A practical guide to its use in penetration testing and red teams.

Searchsploit: Finding Local Exploits from Exploit-DB in Penetration Testing — exploit-db 11 min read
Searchsploit: Finding Local Exploits from Exploit-DB in Penetration Testing
Searchsploit is a terminal tool for searching for local exploits directly from the Exploit-DB database. A practical guide to identifying exploitable vulnerabilities during penetration testing.

Maltego: What It Is and How to Use It for OSINT and Transform (2026) — osint 9 min read
Maltego: What It Is and How to Use It for OSINT and Transform (2026)
How to Install Maltego for OSINT and Reconnaissance: Use Entity, Transform, Pivot, and Graph Analysis to Correlate Domains, IPs, Emails, People, and Infrastructure.

Masscan: Ultra-Fast Port Scanner for Large-Scale Network Enumeration — port scanning 7 min read
Masscan: Ultra-Fast Port Scanner for Large-Scale Network Enumeration
Masscan is a high-speed port scanner capable of analyzing millions of IP addresses in minutes. A practical guide to its use during reconnaissance and infrastructure mapping during penetration testing.

SpiderFoot: OSINT Automation, Reconnaissance and Attack Surface — Spider Foot 8 min read
SpiderFoot: OSINT Automation, Reconnaissance and Attack Surface
Discover SpiderFoot to automate OSINT and reconnaissance: modules, correlation, subdomain, IP, email, threat intelligence, and attack surface mapping.

TheHarvester: SECRETS to OSINT, Email & Subdomains (2026) — theHarvester 13 min read
TheHarvester: SECRETS to OSINT, Email & Subdomains (2026)
Learn how to use TheHarvester to harvest emails and subdomains: installation, recon, OSINT sources, API keys, JSON/XML output, and verified troubleshooting.

KeeThief: Master Key and Credential Dump from KeePass — credential dumping 6 min read
KeeThief: Master Key and Credential Dump from KeePass
KeeThief: How to extract master keys and credentials from KeePass during an authorized pentest. Memory dumps, .kdbx files, operational limitations, detection, and post-exploitation.

Weevely3: PHP Stealth Web Shell for Post-Exploitation and Pivoting — web shell 7 min read
Weevely3: PHP Stealth Web Shell for Post-Exploitation and Pivoting
Weevely3: A practical guide to generating and managing stealthy PHP web shells in penetration testing. Tunneling, evasion, and post-exploitation.

Chisel: TCP Tunneling over HTTP for Pivoting and Post-Exploitation — pivoting 5 min read
Chisel: TCP Tunneling over HTTP for Pivoting and Post-Exploitation
Chisel's Practical Guide to Tunneling and Pivoting: TCP Tunneling over HTTP, SOCKS Proxy, and Port Forwarding Through Firewalls. Modern Pivoting for Pentesters.

LaZagne: Post-Exploitation Tool for Application Credential Dumping and DPAPI — credential harvesting 11 min read
LaZagne: Post-Exploitation Tool for Application Credential Dumping and DPAPI
LaZagne: password recovery tool for 87+ applications. Browser, WiFi, email, database, sysadmin tools. DPAPI decryption, credential harvesting post-exploitation Windows/Linux/macOS.

SafetyKatz: Mimikatz Memory-Only Wrapper for LSASS Credential Dumping and EDR Evasion — Credential Dumping 10 min read
SafetyKatz: Mimikatz Memory-Only Wrapper for LSASS Credential Dumping and EDR Evasion
SafetyKatz is a Mimikatz wrapper for in-memory credential dumping from LSASS, without writing to disk. It supports EDR evasion, NTLM hash extraction, and integration with Cobalt Strike for post-exploitation in Active Directory.

FFUF: A Guide to Web Fuzzing for Directories, VHosts, and APIs (Pentesting and CTF) — web fuzzing 8 min read
FFUF: A Guide to Web Fuzzing for Directories, VHosts, and APIs (Pentesting and CTF)
FFUF is a fast Go web fuzzer for directory, vhost, and API testing. A practical guide with wordlists, filters, and pentest techniques.

Hashcat: Password Cracking with GPU, Hash, Modes and Rules — bcrypt 12 min read
Hashcat: Password Cracking with GPU, Hash, Modes and Rules
Hashcat: GPU password cracking practical guide for NTLM, MD5, SHA, bcrypt hashes. Attack modes, mask patterns, wordlist rules and real techniques from CTF and pentest.

CrackMapExec vs. NetExec: CME Commands and Migration to NXC — cme 3 min read
CrackMapExec vs. NetExec: CME Commands and Migration to NXC
CrackMapExec (cme) to NetExec (nxc) Migration Guide: Translate CME commands to NXC, manage Kerberos, forms, file transfer, and see what's changing today.

ARP-Scan Kali Linux: ARP Scan and Host Discovery — arp scan 4 min read
ARP-Scan Kali Linux: ARP Scan and Host Discovery
ARP-Scan guide on Kali Linux to discover hosts on your local network: ARP scanning, IP, MAC, vendor, subnet, output, and network reconnaissance workflow.

Netdiscover: Discover Hidden Devices and IPs on Your LAN — Netdiscover 10 min read
Netdiscover: Discover Hidden Devices and IPs on Your LAN
Netdiscover is an essential tool for identifying active devices on the local network. It's ideal for silent recon via ARP in environments without DNS or DHCP.

Ping and ICMP Techniques and Active Scans for Recon — etc 10 min read
Ping and ICMP Techniques and Active Scans for Recon
Analyze network behavior with ping, fping, and hping3. ICMP reconnaissance, host discovery, and firewall testing techniques used in pentests.

Rpcinfo: Enumerating RPC Services in Unix Environments — rpcinfo 10 min read
Rpcinfo: Enumerating RPC Services in Unix Environments
Rpcinfo allows you to identify active RPC services on Unix/Linux hosts. It's essential for reconnaissance and analysis of potential remote attack vectors.

Showmount: Discover exposed NFS shares on the network. — showmount 9 min read
Showmount: Discover exposed NFS shares on the network.
Showmount is the perfect tool for enumerating NFS shares. It's used in recons to identify accessible resources and entry points in Unix/Linux environments.

SnmpCheck: Device and Service Enumeration via SNMP v1/v2 — snmp 9 min read
SnmpCheck: Device and Service Enumeration via SNMP v1/v2
Snmp-check allows you to extract information from network devices using SNMP. Perfect for low-noise attacks, silent enumeration, and footprinting.

Snmpwalk: Massive SNMP Enumeration on Exposed Networks — Snmpwalk 5 min read
Snmpwalk: Massive SNMP Enumeration on Exposed Networks
Snmpwalk is the ideal tool for querying SNMP agents and gathering detailed information about network devices. It's used for low-noise recon and targeted attacks.

enum4linux-ng: SMB and Active Directory enumeration — enum4linux-ng 5 min read
enum4linux-ng: SMB and Active Directory enumeration
Complete guide to enum4linux-ng for SMB and Active Directory enumeration: users, groups, shares, policies, SID/RID, authentication, and practical commands.

NetExec (NXC): Complete Guide to CrackMapExec's Successor — netexec 14 min read
NetExec (NXC): Complete Guide to CrackMapExec's Successor
Complete Operation Guide to NetExec (nxc): SMB, LDAP, WinRM, RDP, advanced modules, credential dumping, vulnerability scan and lateral movement in Active Directory

Smbclient: Accessing and Attacking Windows Shares — smbclient 10 min read
Smbclient: Accessing and Attacking Windows Shares
With smbclient, you can access, read, and write files to SMB shares. Learn how to use it for pentesting, internal attacks, enumeration, and pivoting in AD.

BloodHound Pentest AD: Privilege Escalation and Domain Admin — bloodhound 9 min read
BloodHound Pentest AD: Privilege Escalation and Domain Admin
BloodHound for privilege escalation on Active Directory: SharpHound, edge abuse, Shadow Credentials and ADCS. Italian guide to AD pentest towards Domain Admin.

ldapsearch: LDAP Commands to Enumerate Users, Groups and ADs — LDAP 7 min read
ldapsearch: LDAP Commands to Enumerate Users, Groups and ADs
ldapsearch for pentest: RootDSE, Base DN, LDAP bindings, users, groups, computers, SPN, LDAPS and Active Directory enumeration troubleshooting and cheat sheets

rpcclient Kali Linux: SMB, AD, and SID/RID Enumeration — rpcclient 5 min read
rpcclient Kali Linux: SMB, AD, and SID/RID Enumeration
Guide to rpcclient on Kali Linux to enumerate users, groups, SIDs/RIDs, trusts, password policies, and SMB shares via SAMR, LSARPC, and SRVSVC, with practical commands.

Inveigh: LLMNR, NBNS, and WPAD to Capture NTLM Hashes — inveigh 8 min read
Inveigh: LLMNR, NBNS, and WPAD to Capture NTLM Hashes
What is Inveigh and how does it work? A guide to LLMNR, NBNS, and WPAD for capturing NetNTLM in Windows labs, using PowerShell, relay, troubleshooting, and detection.

Mitmproxy: Intercept and Analyze HTTP/HTTPS Traffic — mitmproxy 9 min read
Mitmproxy: Intercept and Analyze HTTP/HTTPS Traffic
A practical guide to mitmproxy: configure the proxy, intercept HTTPS, install the CA, filter and modify flows, save sessions, and troubleshoot common issues.

NBTScan: NetBIOS Scanning on Linux for the Recon Windows — nbtscan 5 min read
NBTScan: NetBIOS Scanning on Linux for the Recon Windows
NBTScan on Linux: Learn how to scan Windows hosts, identify NetBIOS names, domains, workgroups, and useful information for network reconnaissance.

Netcat (nc): Commands, Port Scanning, and File Transfer — untroubled 10 min read
Netcat (nc): Commands, Port Scanning, and File Transfer
Learn how to use Netcat (nc) on Linux and Windows: practical commands, TCP/UDP listeners, port scanning, banner grabbing, file transfer, and reverse shell.

Responder: Capture NTLM Hash on Linux, LLMNR, NBT-NS and Relay — reply 9 min read
Responder: Capture NTLM Hash on Linux, LLMNR, NBT-NS and Relay
Responder for Linux: How to capture NTLM/NetNTLMv2 hashes with LLMNR, NBT-NS, and WPAD, crack and relay NTLM in penetration tests and secure Windows labs

Bettercap: What It Is, MITM, ARP Spoofing, and Sniffing on Kali Linux — better cap 8 min read
Bettercap: What It Is, MITM, ARP Spoofing, and Sniffing on Kali Linux
What is Bettercap and how does it work? Discover the framework for network hacking and MITM: tutorials on Kali Linux, ARP spoofing, sniffing, network recon, PCAP, and proxies.

Ettercap: MITM Tutorial, ARP Spoofing and Sniffing on Kali Linux — ettercap 6 min read
Ettercap: MITM Tutorial, ARP Spoofing and Sniffing on Kali Linux
What is Ettercap and how does it work? A practical guide to MITM, ARP spoofing, and sniffing on Kali Linux, including installation, filters, packet capture, and commands.

Tcpdump: Network Traffic Sniffing and Analysis Tutorial — tcpdump 5 min read
Tcpdump: Network Traffic Sniffing and Analysis Tutorial
What is tcpdump and how does it work? A guide to terminal network sniffing with packet capture, BPF filters, PCAP analysis, and pentesting commands.

TShark: Network Traffic Sniffing and Analysis Tutorial — TShark 7 min read
TShark: Network Traffic Sniffing and Analysis Tutorial
What is TShark and how is it used? A guide to terminal network sniffing with packet capture, filters, PCAP analysis, statistics, and pentesting commands.

Wireshark for Pentesting: Filters, NTLM, DNS and TCP Stream — Wireshark 8 min read
Wireshark for Pentesting: Filters, NTLM, DNS and TCP Stream
Wireshark for ethical hacking: advanced filters, NTLM, DNS, and TCP Stream. Learn how to isolate traffic, read sessions, and find useful indicators in labs and HTBs.

Guides and Resources

Latest Guides and Resources

Cyber Security: What It Is, Types, Threats, and How to Defend Yourself — Cybersecurity 6 min read
Cyber Security: What It Is, Types, Threats, and How to Defend Yourself
Cybersecurity and information security: what it is, threats and defenses for businesses and individuals, ethical hacking, penetration testing, red teams, blue teams, SOCs, and analysis.

SEO Poisoning: What It Is, How It Works, and How to Protect Yourself — SEO Poisoning 9 min read
SEO Poisoning: What It Is, How It Works, and How to Protect Yourself
SEO poisoning: Malware, cloaking, and Gootloaders push fake pages to the top of Google. Recognize them and check if your site is compromised.

Keylogger: What It Does and How to Find It (Hardware and Software) — keylogger 5 min read
Keylogger: What It Does and How to Find It (Hardware and Software)
How a keylogger works and what it is, hardware and software, how to recognize it on Windows and what the law says, from the FTC case against the SpyFone app.

RAT (Remote Access Trojan): What It Does and How to Recognize It — RAT 6 min read
RAT (Remote Access Trojan): What It Does and How to Recognize It
What is a RAT, how does a remote control Trojan work, how to tell if your PC is infected, how to remove it, and the history of Back Orifice and Blackshades.

Flipper Zero: What is it, what is it for, and is it legal in Italy? — Zero pinball machine 6 min read
Flipper Zero: What is it, what is it for, and is it legal in Italy?
Flipper Zero: what it is, how it works, and what it can do with RFID, NFC, Sub-GHz, and BadUSB. Learn about custom firmware and what's legal and illegal in Italy.

Kali Linux: What It Is, What It's Used For, Tools, and Installation — Kali Linux 5 min read
Kali Linux: What It Is, What It's Used For, Tools, and Installation
Kali Linux: what it is, what it's for, how to install it, how to learn, and the main tools for penetration testing, cybersecurity, forensics, and red teams.

Firewall: Meaning, Types, How It Works, and Basic Rules — Firewall 7 min read
Firewall: Meaning, Types, How It Works, and Basic Rules
Firewall: what it is, meaning, how it works, what it does, types (stateful, NGFW, WAF), basic rules, ufw and Windows commands and how a pentester sees it with Nmap.

Worm: What It Is, How It Works, and How It Spreads — computer worm 7 min read
Worm: What It Is, How It Works, and How It Spreads
Learn what a computer worm is, how it works and spreads, how it differs from viruses and ransomware, famous cases, and how to recognize an infection on the network.

Data Breach: What It Is, Meaning, Examples, and What to Do (2026) — Data Breach 8 min read
Data Breach: What It Is, Meaning, Examples, and What to Do (2026)
Data breach: how it works and what it is, causes, real-world examples, the 72-hour rule, costs in 2026, and what to do if your data is stolen.

Trojan Virus: What It Is, How It Works, and How to Recognize It — trojan 6 min read
Trojan Virus: What It Is, How It Works, and How to Recognize It
Trojans: how they spread, what damage they can cause, and how to recognize them. Comparison with viruses and worms, main types, and examples such as Zeus and Emotet.

Zero-Day: What It Is, How It Works, and How to Defend Yourself (2026) — Zero-Day 7 min read
Zero-Day: What It Is, How It Works, and How to Defend Yourself (2026)
What is a zero-day attack? Learn what zero-day vulnerabilities and exploits mean, the differences between n-day and CVE, real-world examples, and how to defend yourself in 2026.

GDPR: What It Is, Obligations, Rights, Sanctions, and DPO (2026 Guide) — GDPR 9 min read
GDPR: What It Is, Obligations, Rights, Sanctions, and DPO (2026 Guide)
GDPR: meaning, how it works and who it applies to, principles, rights, DPO, data breach in 72 hours and fines up to 20 million euros or 4% of turnover

Anonymous Hacker: Mask, Operations, and Current Events — Anonymous 6 min read
Anonymous Hacker: Mask, Operations, and Current Events
Who are Anonymous, where the Guy Fawkes mask came from, their most famous operations (Chanology, Payback, Tunisia), and what they're still doing today in 2026.

The Deep Web: What It Is, How It Differs from the Dark Web, and How It Works — Dark Web 5 min read
The Deep Web: What It Is, How It Differs from the Dark Web, and How It Works
The deep web explained simply: what it is, how to access it and how it works, examples, differences between the surface web and the dark web, whether Tor is needed, and whether it's legal to browse it.

Kevin Mitnick: Hacker, Social Engineering, Arrest, and Career — kevin mitnick 6 min read
Kevin Mitnick: Hacker, Social Engineering, Arrest, and Career
Kevin David Mitnick, known as The Condor and The Darkside Hacker, was one of the most famous hackers: social engineering, arrest, career, and death in 2023.

Botnets: The Mirai Case and How to Recognize an Active One — Botnet 5 min read
Botnets: The Mirai Case and How to Recognize an Active One
What is a botnet, how a device becomes a remotely controlled zombie, how to recognize it, and the Mirai case that brought half the internet into crisis in 2016.

NIS2: What it is, Obligations, Requirements, and 2026 Deadlines — NIS2 9 min read
NIS2: What it is, Obligations, Requirements, and 2026 Deadlines
NIS2 explained simply: what the NIS 2 directive is, who it applies to, obligations, 24-hour incident reporting, fines up to €10 million, and 2026 deadlines.

Spyware: What It Is, How to Detect It, and the Pegasus Case — spyware 6 min read
Spyware: What It Is, How to Detect It, and the Pegasus Case
Learn how spyware works, the signs you can spot on your phone and PC, how it differs from stalkerware, how to remove it, and what the Pegasus case revealed.

Basilicata Data Center: The Kraken Case and the Hacker Mystery — SEO Poisoning 8 min read
Basilicata Data Center: The Kraken Case and the Hacker Mystery
Were data centers in Basilicata hacked? Russian pages and Kraken indicate a hacker attack: what happened to the Basilicata Region, healthcare system, and hospitals?

The 10 Most Famous and Powerful Hackers in the World (2026 Guide) — Famous Hackers 6 min read
The 10 Most Famous and Powerful Hackers in the World (2026 Guide)
Who are the 10 most famous and powerful hackers in history? From Kevin Mitnick to Anonymous: true stories, famous attacks, secrets and curiosities, and what they do today.

Dark Web: What It Is, How to Access It, and How It Works — Dark web 11 min read
Dark Web: What It Is, How to Access It, and How It Works
What is the dark web, how does it differ from the deep web and Tor, what criminal economy really operates there, and what's true about legends like the Red Rooms.

White Hat, Black Hat, and Grey Hat: Who They Are and What They Risk — white hat 5 min read
White Hat, Black Hat, and Grey Hat: Who They Are and What They Risk
What distinguishes white hat, black hat, and grey hat, the origin of the term hacker/cracker, the legal risks of each, and what responsible disclosure is.

Computer Virus: What It Is and How It's Different from Malware — computer virus 7 min read
Computer Virus: What It Is and How It's Different from Malware
What is a computer virus, how it spreads, the main types, how to recognize and remove it, and how it differs from malware, worms, Trojans, and ransomware.

Ethical Hacker: Who He Is, What He Does, and How Much He Earns — ethical hacker 4 min read
Ethical Hacker: Who He Is, What He Does, and How Much He Earns
Who is an ethical hacker, what they do every day, what skills and tools they use, how much they earn in Italy, and how to become one step by step.

Hacker: Meaning, Types (White Hat, Black Hat), and Cracker — hacker 8 min read
Hacker: Meaning, Types (White Hat, Black Hat), and Cracker
What is a hacker, the difference between a cracker and an ethical hacker, the types (white, black, grey hat), when hacking is a crime, and how to become an ethical hacker.

Revolut hacked? Data breach: passports, IBANs, and Bitcoin — Revolut 14 min read
Revolut hacked? Data breach: passports, IBANs, and Bitcoin
Revolut confirms a data breach: fake government request, passports and Bitcoin histories exposed. Data published online, 10.000 BTC ransom demanded.

Thomson Reuters: SSN breached and files sealed — data breach 7 min read
Thomson Reuters: SSN breached and files sealed
Thomson Reuters: C-Track platform breached in US and Canadian courts. SSNs, health data, and court records sealed in 24 courts.

Vodafone scam: "7415 Gold Starter points will expire today" — Vodafone scam 7415 points 10 min read
Vodafone scam: "7415 Gold Starter points will expire today"
Vodafone 2026 scam: Did you receive the text message "Your 7415 Gold Starter points expire today"? Here's how to spot it, where the link goes, and what to do.

Secret Scanning: Gitleaks, TruffleHog and Pipeline CI/CD — Secret Scanning 12 min read
Secret Scanning: Gitleaks, TruffleHog and Pipeline CI/CD
Automate secret scanning with Gitleaks pre-commit and TruffleHog in CI/CD: lock API keys and tokens, verify leaks, and remove secrets from Git history.

AWS Pentesting: IAM, S3, EC2, IMDS, and Privilege Escalation — AWS Pentesting 11 min read
AWS Pentesting: IAM, S3, EC2, IMDS, and Privilege Escalation
AWS Operational Pentesting: Enumerate IAM, S3, EC2, Lambda, and IMDS with AWS CLI, Pacu, ScoutSuite, and Prowler; find misconfigurations and privilege escalation paths.

Cloud Security Automation: Prowler, Checkov and AWS Config — Cloud Security Automation 6 min read
Cloud Security Automation: Prowler, Checkov and AWS Config
Cloud security automation on AWS: Use Prowler, ScoutSuite, and AWS Config; integrate Checkov and tfsec into CI/CD; and detect drift and misconfiguration with EventBridge.

Wordlists for Pentesting: SecLists, RockYou, CeWL and Crunch — SecLists 9 min read
Wordlists for Pentesting: SecLists, RockYou, CeWL and Crunch
Learn which SecLists wordlists to use for directory fuzzing, password cracking, DNS and API, with paths on Kali Linux and custom lists created with CeWL and Crunch.

Database Security: Hardening, Misconfigurations and Pentests — database security 11 min read
Database Security: Hardening, Misconfigurations and Pentests
Database security for pentesters and defenders: misconfigurations, weak credentials, exposed services, and hardening of MSSQL, MySQL, and PostgreSQL.

Database Privilege Escalation: From DB Access to RCE — database-privilege-escalation 9 min read
Database Privilege Escalation: From DB Access to RCE
Database Privilege Escalation Guide. Pentest for MSSQL, MySQL, PostgreSQL, and Oracle: Enumerate privileges and escalate from database access to RCE.

Cyber Kill Chain: What It Is, 7 Phases, and Pentesting Tools — cyber kill chain 13 min read
Cyber Kill Chain: What It Is, 7 Phases, and Pentesting Tools
Discover what the Cyber Kill Chain is: the 7 phases of an attack, pentesting and red team tools, MITRE ATT&CK mapping, and the Unified Kill Chain.

Credential Stuffing: What It Is, How It Works, and How to Protect Yourself — credential stuffing 9 min read
Credential Stuffing: What It Is, How It Works, and How to Protect Yourself
Credential stuffing: Learn how credential-stolen attacks work, how to detect them, and which defenses to use, including MFA, passkeys, and rate limiting.

Credential Harvesting: Techniques and Tools for Pentesting — credential access 8 min read
Credential Harvesting: Techniques and Tools for Pentesting
Learn how credential harvesting works in pentesting: Responder, Evilginx2, LaZagne, AiTM phishing, browser theft, detection and mitigation.

Credential Dumping on Windows: LSASS, SAM, DPAPI and NTDS.dit — credential dumping 7 min read
Credential Dumping on Windows: LSASS, SAM, DPAPI and NTDS.dit
Credential dumping on Windows: NTLM hash and Kerberos tickets from LSASS, SAM, LSA Secrets, DPAPI and NTDS.dit with Mimikatz, ProcDump and secretsdump on Active Directory

Pivoting in Pentesting: A Complete Guide with Ligolo-ng, Chisel, and SSH — pivoting 9 min read
Pivoting in Pentesting: A Complete Guide with Ligolo-ng, Chisel, and SSH
Practical guide to pivoting and tunneling with SSH, Ligolo-ng, Chisel, sshuttle, and ProxyChains to reach internal networks and configure double pivots.

Post-Exploitation Windows and Active Directory: Complete Guide — persistence 8 min read
Post-Exploitation Windows and Active Directory: Complete Guide
Post-exploitation Windows and Active Directory: enumeration, privilege escalation, credential dumping, persistence, lateral movement and operational cleanup.

LOLBins, GTFOBins and LOOBins: The Complete Guide to Living Off the Land (2026) — lolbins 42 min read
LOLBins, GTFOBins and LOOBins: The Complete Guide to Living Off the Land (2026)
Complete guide to Living Off the Land (LotL), LOLBins, GTFOBins, and LOOBins for Windows, Linux, and macOS in 2026. Commands, EDR evasion techniques, privilege escalation, lateral movement, and post-exploitation with native binaries and LOLBAS

Phishing Attack Vectors: A Red Team Technical Breakdown — Phishing 8 min read
Phishing Attack Vectors: A Red Team Technical Breakdown
Red team phishing techniques for authorized engagements: spear phishing with GoPhish, SET credential harvesting, quishing, HTML smuggling, SMTP infrastructure setup, and AiTM session capture.

Enumeration Penetration Testing: Network, AD & Web Guide — enumeration penetration testing 10 min read
Enumeration Penetration Testing: Network, AD & Web Guide
Offensive Enumeration 2026: host discovery, SMB, LDAP, Kerberos, BloodHound, web fuzzing and post-compromise. From zero to domain admin.

Ransomware 2026: A Complete Guide. What They Are and How to Protect Yourself — cyberattack 17 min read
Ransomware 2026: A Complete Guide. What They Are and How to Protect Yourself
The Complete Guide to Ransomware 2026: What it is, how it works, historical attacks (WannaCry, LockBit), double extortion, RaaS, and best practices for defending against it with backups, MFA, and Zero Trust.

ethical hacking 4 min read

HackIta: The Italian blog for ethical hacking, pentesting, and offensive security

HackIta (not Ackita) is the Italian resource for ethical hacking, penetration testing, and CTF. 277+ technical articles on Windows/Linux privileges, Active Directory, web hacking, and red teams.

Vulnerability Exploitation: A Practical Framework for Moving from CVE to Shell — pentest-methodology 8 min read
Vulnerability Exploitation: A Practical Framework for Moving from CVE to Shell
Discover the right method to transform a vulnerability into real access: discovery, validation, prioritization, exploit selection, weaponization, execution, and post-exploitation in penetration testing.

Man in the Middle: What Is a MITM Attack and How Does It Work? — Man in the Middle 13 min read
Man in the Middle: What Is a MITM Attack and How Does It Work?
The Complete Guide to Man in the Middle: ARP Spoofing, SSL Stripping, Session Hijacking, Rogue DHCP, Evil Twin, and Real-World MITM Techniques on Enterprise Networks and Wi-Fi.

Windows Buffer Overflow Exploit: ASLR and DEP Bypass with ROP Chain — buffer overflow windows 11 min read
Windows Buffer Overflow Exploit: ASLR and DEP Bypass with ROP Chain
Complete Guide to Windows Buffer Overflow Exploit: Format string leak to bypass ASLR, ROP chain to bypass DEP, VirtualAlloc, SEH, egg hunter.

Social Engineering: What It Is, Real Attacks, and Defenses in 2026 — set 12 min read
Social Engineering: What It Is, Real Attacks, and Defenses in 2026
Social Engineering: What it is, its meaning, how it works, and the techniques it uses, including OSINT, pretexting, vishing, phishing, and impersonation.

Exploit-DB: Exploit and PoC Database for Penetration Testing — poc 11 min read
Exploit-DB: Exploit and PoC Database for Penetration Testing
Exploit-DB is a public database of exploits and proofs of concept for vulnerability research and penetration testing. Search by CVE, software, and platform.

AWS Privilege Escalation: 21+ Techniques for Escalating from Low-Priv to Admin in IAM — aws 9 min read
AWS Privilege Escalation: 21+ Techniques for Escalating from Low-Priv to Admin in IAM
AWS Privilege Escalation is a set of techniques for gaining higher privileges by abusing IAM misconfigurations in cloud environments. Policy analysis, role assumption, and abuse of AWS services in authorized penetration testing contexts.