| Abuzarea grupurilor AD protejate — LPE & RCE | DnsAdmins (WPAD hijack / plugin DLL), Server Operators, Backup Operators, Account Operators, Remote Management Users, Event Log Readers, Schema Admins, GPO Creator Owners, Print Operators — tehnici de escaladare și execuție remote, cu comenzi. |
| DnsAdmins Abuse — RCE prin DNS Plugin DLL | DnsAdmins → dnscmd serverlevelplugindll: DLL one-shot (net user), path ABSOLUT/UNC obligatoriu, de ce crapă dns.exe, cleanup registry |
| AD Enumeration — LDAP & SAMR Anonim | Matrice windapsearch/rpcclient/netexec fără creds: user-desc (parole în description — doar LDAP!), pass-pol, password spray cu lockout check |
| Azure AD Connect (ADSync) Attacks — Credential Decryption Cheatsheet | Azure AD Connect/ADSync: detectare host, datele din baza de sincronizare (mms_server_configuration + mms_management_agent), adconnectdump.py remote vs decrypt on-box cu mcrypt.dll KeyManager, capcane LocalDB vs instanța locală — case study Monteverde. |
| windapsearch.py — LDAP User & Group Enumeration | windapsearch.py (ropnop): enumerare utilizatori/grupuri/calculatoare AD peste LDAP — anonim sau autentificat, grupuri privilegiate (--da, -m), filtre custom pentru SPN/kerberoast. |
| Active Directory Attacks — Quick Reference | Atacuri Active Directory end-to-end: enumerare fără credențiale, LLMNR/NTLMv2 poisoning, Kerberoasting, AS-REP roasting, pass-the-hash, DCSync, ACL abuse și lateral movement. |
| Command Injection — Filter Bypass Cheatsheet | Injecții de comenzi: operatori, bypass de caractere și comenzi blacklist (spații, slash, ;), obfuscare avansată, Bashfuscator, case study skills assessment. |
| File Upload Bypass Cheatsheet | Bypass-uri pentru filtre de upload: extensii, MIME, magic bytes, polyglot, race conditions — până la RCE. |
| Kerberos Attacks Cheatsheet | Atacuri Kerberos: enumerare, Kerberoasting, AS-REP roasting, pass-the-ticket, silver/golden ticket, delegation abuse (unconstrained/constrained). |
| Linux Privilege Escalation Cheatsheet | Escaladare de privilegii Linux: enumerare, SUID/SGID, sudo, capabilities, cron jobs, PATH abuse, kernel exploits — cheatsheet complet. |
| NoSQL Injection — Quick Reference | NoSQL injection: payload-uri MongoDB, operatori ($ne, $gt, $where), bypass de autentificare și exfiltrare de date. |
| Script & Sudo Abuse — Privilege Escalation Quick Reference | Privesc prin script-uri și binare sudo/SUID: variabile de mediu, wildcards, comenzi permisive (find, tar, vi, awk, python...). |
| SMB Enumeration Cheatsheet | Enumerare SMB/Samba: null sessions, anonymous login, enum4linux, smbclient, share hunting, pass-the-hash. |
| Web Exploitation — Quick Reference | Exploatare web: SQLi, XSS, SSTI, LFI/RFI, SSRF, deserializare, auth bypass — tehnici și payload-uri. |
| Windows Security Reconnaissance | Recunoaștere securitate Windows: AV/EDR, firewall, politici, servicii, patch level, credential hunting. |
| Windows Privilege Escalation — Cheatsheet | Initial enumeration (ipconfig/arp/route, whoami, net), Defender & AppLocker (Get-MpComputerStatus, Get-AppLockerPolicy, bypass path %WINDIR%), JuicyPotato/PrintSpoofer, servicii & ImagePath, credential theft (findstr, cmdkey, LaZagne, SessionGopher), certutil/msiexec/schtasks, mount VMDK |