Browse documentation by tag

Search and filter English documentation. Notes have a separate search, so short project notes do not appear among guides and references.

Search documentation titles, descriptions, and tags

Clear filters

All tags196Active Directory64AD ACL8AD CS5AD Recycle Bin3Arbitrary File Read1Authentication14Case Study1Command Injection1Credential Dumping9Credential Exposure8Credentials6Cryptography2DCE/RPC8dMSA Abuse1DNS Zone Transfer1Docker API1Domain Controller1DPAPI6Easy2Enumeration24Exchange1File Inclusion1Freja1gMSA6Hack The Box14Hard2Impacket89Kerberoasting3Kerberos20LDAP9Linux20Local Privilege Escalation20Medium10Memory Forensics1Metasploit45MQTT1MSSQL3NFS1NTLM6NTLM Relay4OPC UA1Packet Sniffing3Password Cracking1RBCD4Remote Code Execution3Remote Execution10Service Accounts2Shadow Credentials2SMB9sudo2systemd2Unix Sockets2Windows99WinRM2WSUS1

Select multiple tags to show articles that have all of them.

196 documents

• Access Token Manipulation

  WindowsLocal Privilege Escalation

• Active Directory / LDAP / Account Management

  WindowsActive DirectoryImpacket

• Active Directory Account Design

  WindowsActive DirectoryAD CS

• Active Directory Recycle Bin

  WindowsActive DirectoryAD Recycle Bin

• AD Access Control and BloodHound Relationships

  WindowsActive DirectoryAD ACL

• AuthBrute

  MetasploitCredentials

• Authentication and Cookies

  Metasploit

• AutoCheck

  Metasploit

• Auxiliary

  Metasploit

• Base Classes and Mixins

  Metasploit

• Basics and the Database

  Metasploit

• Body and Multipart

  Metasploit

• Certificate and Smart Card Authentication

  WindowsActive DirectoryAuthentication

• Checking Security Features and Detection Settings

  WindowsLocal Privilege Escalation

• Choose a Module Type and Location

  Metasploit

• Cleanup

  Metasploit

• CmdStager

  MetasploitRemote Execution

• Computer Accounts and gMSAs

  WindowsActive DirectorygMSA

• Containers and Namespaces

  LinuxEnumeration

• Credentials and Configuration

  LinuxEnumerationCredentialsCredential Exposure

• CredSSP and Credential Delegation

  WindowsActive DirectoryAuthentication

• DCE/RPC and NDR

  ImpacketDCE/RPC

• Domain Controller Operations Design

  WindowsActive DirectoryDomain Controller

• DPAPI / SAM / LSA / NTDS

  WindowsActive DirectoryImpacketDPAPICredential Dumping

• Entry Methods

  Metasploit

• Enumeration with NetExec and WinRM

  WindowsActive DirectoryEnumerationWinRM

• execute_command

  MetasploitRemote Execution

• Exploit

  Metasploit

• Externally Exposed Services

  LinuxEnumeration

• File and Directory Permissions

  LinuxEnumeration

• FileDropper

  Metasploit

• Fully Interactive TTY

  Metasploit

• Handlers and Listeners

  Metasploit

• Helper Functions

  Metasploit

• HMAC-MD5 (HMAC with MD5)

  WindowsCryptography

• HTB Administrator writeup

  Hack The BoxWindowsMediumActive DirectoryAD ACLKerberoastingCredential Dumping

• HTB Certified writeup

  Hack The BoxWindowsMediumActive DirectoryAD ACLShadow CredentialsAD CS

• HTB Checkpoint writeup

  Hack The BoxWindowsMediumActive DirectorydMSA AbuseMemory ForensicsCredential Dumping

• HTB CodePartTwo writeup

  Hack The BoxLinuxEasyRemote Code ExecutionCredential ExposureLocal Privilege EscalationFreja

• HTB DevArea writeup

  Hack The BoxLinuxMediumArbitrary File ReadCommand InjectionLocal Privilege Escalation

• HTB Fries writeup

  Hack The BoxWindowsHardNFSDocker APIActive DirectorygMSAAD CS

• HTB Helix writeup

  Hack The BoxLinuxMediumRemote Code ExecutionOPC UALocal Privilege Escalation

• HTB Logging writeup

  Hack The BoxWindowsMediumActive DirectoryShadow CredentialsAD CSWSUS

• HTB Pirate writeup

  Hack The BoxWindowsHardActive DirectorygMSANTLM RelayRBCDKerberos

• HTB Puppy writeup

  Hack The BoxWindowsMediumActive DirectoryAD ACLDPAPICredential Exposure

• HTB SmartHire writeup

  Hack The BoxLinuxMediumRemote Code ExecutionLocal Privilege Escalation

• HTB TombWatcher writeup

  Hack The BoxWindowsMediumActive DirectoryAD ACLKerberoastinggMSAAD Recycle BinAD CS

• HTB Trick writeup

  Hack The BoxLinuxEasyDNS Zone TransferFile InclusionLocal Privilege Escalation

• HTB Voleur writeup

  Hack The BoxWindowsMediumActive DirectoryKerberoastingAD Recycle BinDPAPICredential Dumping

• HTTP Methods and Parameters

  Metasploit

• HttpClient

  Metasploit

• HttpServer

  Metasploit

• Impacket addcomputer.py

  WindowsActive DirectoryImpacket

• Impacket atexec.py

  WindowsImpacketRemote Execution

• Impacket attrib.py

  ImpacketSMB

• Impacket badsuccessor.py

  WindowsActive DirectoryImpacketService Accounts

• Impacket changepasswd.py

  WindowsActive DirectoryImpacketCredentials

• Impacket CheckLDAPStatus.py

  WindowsActive DirectoryImpacketLDAP

• Impacket checkMSSQLStatus.py

  AuthenticationImpacketMSSQL

• Impacket Commands and Implementation

  Impacket

• Impacket dacledit.py

  WindowsActive DirectoryImpacketLDAPAD ACL

• Impacket dcomexec.py

  WindowsImpacketRemote Execution

• Impacket describeTicket.py

  WindowsActive DirectoryImpacketKerberos

• Impacket dpapi.py

  WindowsImpacketDPAPICredential Dumping

• Impacket dpapidump.py

  WindowsImpacketDPAPICredential Dumping

• Impacket DumpNTLMInfo.py

  ImpacketNTLMEnumeration

• Impacket esentutl.py

  WindowsImpacket

• Impacket exchanger.py

  ImpacketExchange

• Impacket filetime.py

  ImpacketSMB

• Impacket findDelegation.py

  WindowsActive DirectoryImpacketKerberosEnumeration

• Impacket Get-GPPPassword.py

  WindowsActive DirectoryImpacketCredential Exposure

• Impacket GetADComputers.py

  WindowsActive DirectoryImpacketLDAPEnumeration

• Impacket GetADUsers.py

  WindowsActive DirectoryImpacketLDAPEnumeration

• Impacket getArch.py

  ImpacketDCE/RPCEnumeration

• Impacket GetLAPSPassword.py

  WindowsActive DirectoryImpacketLDAPCredential Exposure

• Impacket GetNPUsers.py

  WindowsActive DirectoryImpacketKerberosEnumerationCredential Exposure

• Impacket getPac.py

  WindowsActive DirectoryImpacketKerberos

• Impacket getST.py

  WindowsActive DirectoryImpacketKerberos

• Impacket getTGT.py

  WindowsActive DirectoryImpacketKerberos

• Impacket GetUserSPNs.py

  WindowsActive DirectoryImpacketKerberosEnumerationCredential Exposure

• Impacket goldenPac.py

  WindowsActive DirectoryImpacketKerberos

• Impacket karmaSMB.py

  ImpacketSMB

• Impacket keylistattack.py

  WindowsActive DirectoryImpacketKerberos

• Impacket kintercept.py

  WindowsActive DirectoryImpacketKerberos

• Impacket lookupsid.py

  WindowsActive DirectoryImpacketDCE/RPCEnumeration

• Impacket machine_role.py

  WindowsActive DirectoryImpacketDCE/RPCEnumeration

• Impacket mimikatz.py

  WindowsImpacketRemote Execution

• Impacket mqtt_check.py

  ImpacketMQTT

• Impacket mssqlclient.py

  ImpacketMSSQL

• Impacket mssqlinstance.py

  ImpacketMSSQLEnumeration

• Impacket net.py

  WindowsActive DirectoryImpacketDCE/RPC

• Impacket netview.py

  WindowsActive DirectoryImpacketSMBEnumeration

• Impacket ntfs-read.py

  WindowsImpacket

• Impacket ntlmrelayx.py

  ImpacketNTLMNTLM Relay

• Impacket owneredit.py

  WindowsActive DirectoryImpacketLDAPAD ACL

• Impacket ping.py

  Impacket

• Impacket ping6.py

  Impacket

• Impacket psexec.py

  WindowsImpacketRemote Execution

• Impacket raiseChild.py

  WindowsActive DirectoryImpacketKerberosCredential Dumping

• Impacket rbcd.py

  WindowsActive DirectoryImpacketLDAPRBCD

• Impacket rdp_check.py

  WindowsAuthenticationImpacket

• Impacket reg.py

  WindowsImpacket

• Impacket registry-read.py

  WindowsImpacket

• Impacket regsecrets.py

  WindowsImpacketCredential Dumping

• Impacket rpcdump.py

  ImpacketDCE/RPCEnumeration

• Impacket rpcmap.py

  ImpacketDCE/RPCEnumeration

• Impacket sambaPipe.py

  ImpacketSMB

• Impacket samedit.py

  WindowsImpacketCredentials

• Impacket samrdump.py

  WindowsActive DirectoryImpacketDCE/RPCEnumeration

• Impacket secretsdump.py

  WindowsActive DirectoryImpacketCredential Dumping

• Impacket services.py

  WindowsImpacket

• Impacket smbclient.py

  ImpacketSMB

• Impacket smbexec.py

  WindowsImpacketRemote Execution

• Impacket smbserver.py

  ImpacketSMB

• Impacket sniff.py

  ImpacketPacket Sniffing

• Impacket sniffer.py

  ImpacketPacket Sniffing

• Impacket split.py

  ImpacketPacket Sniffing

• Impacket ticketConverter.py

  WindowsActive DirectoryImpacketKerberos

• Impacket ticketer.py

  WindowsActive DirectoryImpacketKerberos

• Impacket tstool.py

  WindowsImpacket

• Impacket wmiexec.py

  WindowsImpacketRemote Execution

• Impacket wmipersist.py

  WindowsImpacketRemote Execution

• Impacket wmiquery.py

  WindowsImpacket

• Integrated Windows Authentication: Negotiate, SSPI, and SPNEGO

  WindowsActive DirectoryAuthenticationKerberosNTLM

• Investigating Applications, DLLs, and Networks

  WindowsLocal Privilege Escalation

• Investigating Local Windows Credentials

  WindowsLocal Privilege EscalationCredential ExposureDPAPI

• Investigating System Information and Installers

  WindowsLocal Privilege Escalation

• Investigating Users, Processes, and Services

  WindowsLocal Privilege Escalation

• Investigation Tools and References

  WindowsLocal Privilege Escalation

• JuicyPotato and JuicyPotatoNG

  WindowsLocal Privilege Escalation

• Kerberos

  WindowsActive DirectoryAuthenticationImpacketKerberos

• Kerberos / Ticket Handling

  WindowsActive DirectoryImpacketKerberos

• Kerberos Authentication in Active Directory

  WindowsActive DirectoryAuthenticationKerberos

• Kerberos Delegation and SPN Abuse

  WindowsActive DirectoryAuthenticationKerberosRBCD

• LDAP and AD Security Descriptors

  WindowsActive DirectoryImpacketLDAPAD ACL

• LDAP Modify Operations

  WindowsActive DirectoryLDAP

• Linux

  Linux

• Local Privilege Escalation Paths

  WindowsLocal Privilege Escalation

• Localhost Services

  LinuxLocal Privilege Escalation

• Logs and Detection

  Linux

• Metasploit Operations Notes

  Metasploit

• Meterpreter Operations

  Metasploit

• Mixins and APIs

  Metasploit

• MSSQL / Exchange / MQTT

  Impacket

• Netlogon Secure Channel and Schannel

  WindowsActive DirectoryAuthentication

• Network and IPC

  LinuxEnumerationUnix Sockets

• NTHash (NT hash)

  WindowsCryptography

• NTLM / SPNEGO / NEGOEX

  WindowsAuthenticationImpacketNTLM

• NTLM Authentication

  WindowsActive DirectoryAuthenticationNTLM

• NTLM Relay and Authentication Coercion

  WindowsActive DirectoryAuthenticationNTLMNTLM Relay

• Option Reference

  Metasploit

• PAC and Silver / Golden Tickets

  WindowsActive DirectoryAuthenticationKerberos

• Packets / ICMP / Capture

  Impacket

• Packets / Registry / ESE / NTFS

  Impacket

• Password Cracking Rules

  WindowsCredentialsPassword Cracking

• Post

  Metasploit

• Post Mixins

  Metasploit

• Processes and systemd

  LinuxEnumerationsystemd

• Programs Allowed Through sudo

  LinuxLocal Privilege Escalationsudo

• Protocols and Library Modules

  Impacket

• Redirects and Raw Requests

  Metasploit

• register_options

  Metasploit

• Remote Execution / WMI / Services

  WindowsImpacketRemote Execution

• Report

  Metasploit

• Reporting Helpers

  Metasploit

• Resource Scripts

  Metasploit

• Responses and Debugging

  Metasploit

• Responses and fail_with

  Metasploit

• Saving Results

  Metasploit

• Scanner

  MetasploitEnumeration

• Scheduled Execution

  LinuxEnumerationsystemd

• Secrets / DPAPI / Registry / File Analysis

  WindowsImpacket

• send_request_cgi

  Metasploit

• Service Account Design and Operations

  WindowsActive DirectoryService AccountsgMSA

• Shared Command Architecture and Dependencies

  Impacket

• Shared Steps

  Metasploit

• SMB

  MetasploitSMB

• SMB / MSRPC / NTLM

  Impacket

• SMB / NetBIOS

  ImpacketSMB

• SSH

  Metasploit

• SSH / WinRM Login

  CredentialsMetasploitWinRM

• Structure — Binary DSL

  Impacket

• Tcp

  Metasploit

• TDS / MQTT / Exchange

  Impacket

• Troubleshooting

  Metasploit

• Trust Boundaries in Custom Code

  LinuxLocal Privilege Escalation

• Unix Sockets and File Descriptors

  LinuxLocal Privilege EscalationUnix Sockets

• update_info

  Metasploit

• URI Helpers

  Metasploit

• Users and sudo

  LinuxEnumerationsudo

• Windows / Active Directory

  WindowsActive Directory

• Windows and AD Concepts Through Pirate

  WindowsActive DirectoryCase StudygMSANTLM RelayRBCD

• Windows Hello for Business

  WindowsActive DirectoryAuthentication

• Windows Local Privilege Escalation Map

  WindowsLocal Privilege Escalation

• Writable Paths Read by root

  LinuxLocal Privilege Escalation

• Writing Modules

  Metasploit