Browse / Payloads / Methodology and Resources
Methodology and Resources
36 passages of payloads and techniques.
Active Directory Attack
:warning: Content of this page has been moved to InternalAllTheThings/active-directory
- Active Directory - Certificate Services
- Active Directory - Access Controls ACL/ACE
- Active Directory - Enumeration
- Active Directory - Group Policy Objects
- Active Directory - Groups
- Active Directory - Linux
- Active Directory - NTDS Dumping
- Active Directory - Read Only Domain Controller
- Active Directory - Federation Services
- Active Directory - Integrated DNS - ADIDNS
- Roasting - ASREP Roasting
- Roasting - Kerberoasting
- Roasting - Timeroasting
- Active Directory - Tricks
- Deployment - SCCM
- Deployment - WSUS
- Hash - Capture and Cracking
- Hash - OverPass-the-Hash
- Hash - Pass-the-Hash
- Internal - DCOM
- Internal - MITM and Relay
- Internal - PXE Boot Image
- Internal - Shares
- Kerberos - Bronze Bit
- Kerberos Delegation - Constrained Delegation
- Kerberos Delegation - Resource Based Constrained Delegation
- Kerberos Delegation - Unconstrained Delegation
- Kerberos - Service for User Extension
- Kerberos - Tickets
- Password - AD User Comment
- Password - DSRM Credentials
- Password - Group Policy Preferences
- Password - Pre-Created Computer Account
- Password - GMSA
- Password - LAPS
- Password - Shadow Credentials
- Password - Spraying
- Trust - Privileged Access Management
- Trust - Relationship
- Child Domain to Forest Compromise - SID Hijacking
- Forest to Forest Compromise - Trust Ticket
- CVE
Bind Shell Cheatsheet
:warning: Content of this page has been moved to InternalAllTheThings/cheatsheets/shell-bind
Cloud - AWS Pentest
:warning: Content of this page has been moved to InternalAllTheThings/cloud/aws
Cloud - Azure Pentest
:warning: Content of this page has been moved to InternalAllTheThings/cloud/azure
Cobalt Strike - Cheatsheet
:warning: Content of this page has been moved to InternalAllTheThings/command-control/cobalt-strike
Container - Docker Pentest
:warning: Content of this page has been moved to InternalAllTheThings/containers/docker
Container - Kubernetes Pentest
:warning: Content of this page has been moved to InternalAllTheThings/containers/kubernetes/
Escape Breakout
:warning: Content of this page has been moved to InternalAllTheThings/cheatsheets/escape-breakout
HTML Smuggling
:warning: Content of this page has been moved to InternalAllTheThings/redteam/access/html-smuggling
Hash Cracking
:warning: Content of this page has been moved to InternalAllTheThings/cheatsheets/hash-cracking
Initial Access
:warning: Content of this page has been moved to InternalAllTheThings/redteam/access/initial-access
Linux - Evasion
:warning: Content of this page has been moved to InternalAllTheThings/redteam/access/initial-access
Linux - Persistence
:warning: Content of this page has been moved to InternalAllTheThings/redteam/persistence/linux-persistence
- Basic reverse shell
- Add a root user
- Suid Binary
- Crontab - Reverse shell
- Backdooring a user's bash_rc
- Backdooring a startup service
- Backdooring a user startup file
- Backdooring Message of the Day
- Backdooring a driver
- Backdooring the APT
- Backdooring the SSH
- Backdooring Git
- Additional Linux Persistence Options
- References
Linux - Privilege Escalation
:warning: Content of this page has been moved to InternalAllTheThings/redteam/persistence/linux-persistence
Linux - Privilege Escalation
MSSQL Server - Cheatsheet
:warning: Content of this page has been moved to InternalAllTheThings/cheatsheets/mssql-server-cheatsheet
- Tools
- Identify Instances and Databases
- Identify Sensitive Information
- Linked Database
- Find Trusted Link
- Execute Query Through The Link
- Crawl Links for Instances in the Domain
- Crawl Links for a Specific Instance
- Query Version of Linked Database
- Execute Procedure on Linked Database
- Determine Names of Linked Databases
- Determine All the Tables Names from a Selected Linked Database
- Gather the Top 5 Columns from a Selected Linked Table
- Gather Entries from a Selected Linked Column
- Command Execution via xp_cmdshell
- Extended Stored Procedure
- CLR Assemblies
- OLE Automation
- Agent Jobs
- External Scripts
- Python
- [R](htt
MSSQL Server - Cheatsheet
ps://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mssql-server-cheatsheet/#r)
- Audit Checks
- Find databases that have been configured as trustworthy
- Manual SQL Server Queries
- Query Current User & determine if the user is a sysadmin
- Current Role
- Current DB
- List all tables
- List all databases
- All Logins on Server
- All Database Users for a Database
- List All Sysadmins
- List All Database Roles
- Effective Permissions from the Server
- Effective Permissions from the Database
- Find SQL Server Logins Which can be Impersonated for the Current Database
- Exploiting Impersonation
- Exploiting Nested Impersonation
- MSSQL Accounts and Hashes
- References
Metasploit - Cheatsheet
:warning: Content of this page has been moved to InternalAllTheThings/command-control/metasploit
Methodology and enumeration
:warning: Content of this page has been moved to InternalAllTheThings/methodology/bug-hunting-methodology
Network Discovery
:warning: Content of this page has been moved to InternalAllTheThings/cheatsheets/network-discovery
Network Pivoting Techniques
:warning: Content of this page has been moved to InternalAllTheThings/redteam/pivoting/network-pivoting-techniques
Office - Attacks
:warning: Content of this page has been moved to InternalAllTheThings/redteam/access/office-attacks
- Office Products Features
- Office Default Passwords
- Office Macro execute WinAPI
- Excel
- Word
- DOCM - Metasploit
- DOCM - Download and Execute
- DOCM - Macro Creator
- DOCM - C# converted to Office VBA macro
- DOCM - VBA Wscript
- DOCM - VBA Shell Execute Comment
- DOCM - VBA Spawning via svchost.exe using Scheduled Task
- DCOM - WMI COM functions (VBA AMSI)
- DOCM - winmgmts
- DOCM - Macro Pack - Macro and DDE
- DOCM - BadAssMacros
- DOCM - CACTUSTORCH VBA Module
- DOCM - MMG with Custom DL + Exec
- VBA Obfuscation
- VBA Purging
- VBA AMSI
- VBA - Offensive Security Template
- DOCX - Template Injection
- DOCX - DDE
- References
Powershell - Cheatsheet
:warning: Content of this page has been moved to InternalAllTheThings/cheatsheets/powershell
- Execution Policy
- Encoded Commands
- Constrained Mode
- Encoded Commands
- Download file
- Load Powershell scripts
- Load Chttps://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/powershell-cheatsheet/# assembly reflectively
- Call Win API using delegate functions with Reflection
- Secure String to Plaintext
- References
Reverse Shell Cheatsheet
:warning: Content of this page has been moved to InternalAllTheThings/cheatsheet/shell-reverse
Source Code Management
:warning: Content of this page has been moved to InternalAllTheThings/cheatsheets/source-code-management-ci
Vulnerability Reports
:warning: Content of this page has been moved to InternalAllTheThings/methodology/vulnerability-reports
Web Attack Surface
:warning: Content of this page has been moved to InternalAllTheThings/redteam/access/web-attack-surface
Windows - AMSI Bypass
:warning: Content of this page has been moved to InternalAllTheThings/redteam/evasion/windows-amsi-bypass
- List AMSI Providers
- Which Endpoint Protection is Using AMSI
- Patching amsi.dll AmsiScanBuffer by rasta-mouse
- Dont use net webclient
- Amsi ScanBuffer Patch from -> https://www.contextis.com/de/blog/amsi-bypass
- Forcing an error
- Disable Script Logging
- Amsi Buffer Patch - In memory
- Same as 6 but integer Bytes instead of Base64
- Using Matt Graeber's Reflection method
- Using Matt Graeber's Reflection method with WMF5 autologging bypass
- Using Matt Graeber's second Reflection method
- Using Cornelis de Plaa's DLL hijack method
- Use Powershell Version 2 - No AMSI Support there
- Nishang all in one
- Adam Chesters Patch
- AMSI.fail
Windows - DPAPI
:warning: Content of this page has been moved to InternalAllTheThings/redteam/evasion/windows-dpapi
Windows - Defenses
:warning: Content of this page has been moved to InternalAllTheThings/redteam/evasion/windows-defenses
Windows - Download and Execute
:warning: Content of this page has been moved to InternalAllTheThings/redteam/access/windows-download-execute
Windows - Mimikatz
:warning: Content of this page has been moved to InternalAllTheThings/cheatsheets/mimikatz
Windows - Persistence
:warning: Content of this page has been moved to InternalAllTheThings/redteam/persistence/windows
- Tools
- Hide Your Binary
- Disable Antivirus and Security
- Simple User
- Serviceland
- Elevated
- Domain
- References
Windows - Privilege Escalation
:warning: Content of this page has been moved to InternalAllTheThings/redteam/escalation/windows-privilege-escalation
- Tools
- Windows Version and Configuration
- User Enumeration
- Network Enumeration
- Antivirus Enumeration
- Default Writeable Folders
- EoP - Looting for passwords
- SAM and SYSTEM files
- HiveNightmare
- LAPS Settings
- Search for file contents
- Search for a file with a certain filename
- Search the registry for key names and passwords
- Passwords in unattend.xml
- Wifi passwords
- Sticky Notes passwords
- Passwords stored in services
- Passwords stored in Key Manager
- Powershell History
- Powershell Transcript
- Password in Alternate Data Stream
- EoP - Processes Enumeration and Tasks
- EoP - Incorrect permissions in services
- EoP - Windows Subsystem for Linux (WSL)
- EoP - Unquoted Service Paths
- EoP - $PATH Interception
- EoP - Named Pipes
- EoP - Kernel Exploitation
- EoP - Microsoft Windows Installer
- EoP - Insecure GUI apps
- EoP - Evaluating Vulnerable Drivers
- EoP - Printers
- [EoP - Runas](https://swisskyrepo.github.io/InternalAllTheThings/redteam/escal
Windows - Privilege Escalation
ation/windows-privilege-escalation/#eop---runas)
Windows - Using credentials
:warning: Content of this page has been moved to InternalAllTheThings/redteam/access/windows-using-credentials
From PayloadsAllTheThings by Swissky and contributors, used under the MIT licence. Use it only on systems you are authorised to test.