Services Category

blog
9+ Note
Focus
OSCP · Red Team
Structure
Recon → Exploit

Services blog

Filters

  • Networking
    Recon & mapping

    Networking

    Port by port, service by service: what to expect, what to try, and which exploits to remember for each protocol.

    Discover more Discover more
  • TFTP (Port 69/UDP): Enumeration, Exploitation, and Security
    networking

    TFTP (Port 69/UDP): Enumeration, Exploitation, and Security

    TFTP over UDP 69: A Practical Guide to Enumeration, Files, Configurations, Vulnerabilities, Cleartext Traffic, and Risks in Internal Networks.

    Discover more Discover more
  • DDoS: What it is, how it works, and how to test your defenses
    networking

    DDoS: What it is, how it works, and how to test your defenses

    What is a DDoS attack and how does it work? Learn about DDoS types, attack techniques, authorized testing, and how to verify the effectiveness of your defenses.

    Discover more Discover more
  • MS08-067: what is it, RCE Windows and Metasploit exploits
    networking

    MS08-067: what is it, RCE Windows and Metasploit exploits

    MS08-067: What it is, how it works, and why it's one of the most notorious Windows RCEs. Learn about Server Service, NetAPI, SMB, Metasploit, detection, and mitigations.

    Discover more Discover more
  • SSH Pentesting Guide: Tunneling, Pivoting, and Offensive Operations
    networking

    SSH Pentesting Guide: Tunneling, Pivoting, and Offensive Operations

    Learn how to pentest SSH from an offensive perspective: enumeration, brute force, port forwarding, SOCKS pivoting, file transfer, and agent hijacking for authorized red team engagements.

    Discover more Discover more
  • ntlmrelayx: NTLM Relay Attack - Setup and Bypass 2026
    networking

    ntlmrelayx: NTLM Relay Attack - Setup and Bypass 2026

    Complete guide to the NTLM Relay Attack with ntlmrelayx: coercion (PetitPotam, PrinterBug), SMB/LDAP/ADCS relay (ESC8), RBCD, Shadow Credentials, and DCSync. Internal network to Domain Admin workflow.

    Discover more Discover more
  • Splunk Pentesting: CVE-2024-36991, RCE and SYSTEM on 8089
    networking

    Splunk Pentesting: CVE-2024-36991, RCE and SYSTEM on 8089

    Complete guide to Splunk pentesting: Exploit CVE-2024-36991, recover credentials via splunk.secret, obtain RCE via malicious app, and scale to SYSTEM or root.

    Discover more Discover more
  • ICS/OT Pentesting: A Complete Guide to SCADA, PLC, and Industrial Protocols
    networking

    ICS/OT Pentesting: A Complete Guide to SCADA, PLC, and Industrial Protocols

    Complete guide to ICS/OT penetration testing: Modbus, S7, DNP3, BACnet, EtherNet/IP protocols. GRASSMARLIN tools, pymodbus, python-snap7, ISF, IndustrialXPL-Forge. CVE 2024-2025 and real attacks.

    Discover more Discover more
  • Shodan: A Guide to Dork, Advanced Queries and Filters (2026)
    networking

    Shodan: A Guide to Dork, Advanced Queries and Filters (2026)

    Shodan: Practical dorks for MongoDB, IoT, ICS and CVE, advanced filters, CLI, API, InternetDB and complete cheat sheet for passive reconnaissance and pentesting (2026).

    Discover more Discover more