- External recon
- Ports scan
- Bind / reverse shells
- File transfer / exfiltration
- Pivoting
- Passwords cracking
- Recon - Domain Recon
- Recon - AD scanners
- Exploitation - NTLM capture and relay
- Exploitation - Password spraying
- Exploitation - Domain Controllers CVE
- Exploitation - Kerberos AS_REP roasting
- Exploitation - Credentials theft shuffling
- Exploitation - GPP and shares searching
- Exploitation - Kerberos Kerberoasting
- Exploitation - ACL exploiting
- Exploitation - GPO users rights
- Exploitation - Active Directory Certificate Services
- Exploitation - Kerberos tickets usage
- Exploitation - Kerberos silver tickets
- Exploitation - Kerberos delegations
- Exploitation - gMS accounts (gMSAs)
- Exploitation - Azure AD Connect
- Exploitation - Operators to Domain Admins
- Post Exploitation - ntds.dit dumping
- Post Exploitation - Kerberos golden tickets
- Post Exploitation - Trusts hopping
- Post Exploitation - Persistence
- Methodology
- 21 - FTP
- 22 - SSH
- 25 - SMTP
- 53 - DNS
- 111 / 2049 - NFS
- 113 - Ident
- 135 - MSRPC
- 137-139 - NetBIOS
- 161 - SNMP
- 389 / 3268 - LDAP
- 445 - SMB
- 512 / 513 - REXEC / RLOGIN
- 554 - RTSP
- 1099 - JavaRMI
- 1433 - MSSQL
- 1521 - ORACLE_DB
- 3128 - Proxy
- 3306 - MySQL
- 3389 - RDP
- 5985 / 5986 - WSMan
- 8000 - JDWP
- 9100 - Printers
- 11211 - memcached
- 27017 / 27018 - MongoDB
- Shellcode and PE loader
- Bypass PowerShell ConstrainedLanguageMode
- Bypass AppLocker
- Local privilege escalation
- Post exploitation
- Lateral movements
- Phishing - Office Documents
- OpSec Operating Systems environment
- EDR bypass with EDRSandBlast
- Cobalt Strike
- Recon - Server exposure
- Recon - Hostnames discovery
- Recon - Application mapping
- Recon - Attack surface overview
- CMS & softwares
- Exploitation - Overview
- Exploitation - Authentication
- Exploitation - LDAP injections
- Exploitation - Local and remote file inclusions
- Exploitation - File upload
- Exploitation - SQL injections
- Exploitation - NoSQL injections
- Exploitation - GraphQL