DOCSEARCHbyAlgolia
Submit Docs

VulnTricks Documentation

website·Indexed 29 days ago

https://vulntricks.com

A comprehensive guide to penetration testing and security enumeration. Covers techniques for HTTP, SMB, FTP, DNS, SMTP, and RPC enumeration, as well as Active Directory attacks (Kerberos, DCSync, Golden/Silver Tickets), password spraying, NTLM hash cracking, Wi-Fi pentesting, and tunneling methods using Chisel and SSH.

Tokens
19.9K
Snippets
156
Records
189
Agent score
50%

What's inside VulnTricks

  1. Overview of Volume Shadow Copy Service (VSS) abuse

    The Volume Shadow Copy Service (VSS) is a Windows feature that creates point-in-time snapshots of files. Attackers with administrative privileges can abuse VSS to bypass file locks on sensitive system files (such as the SAM, SYSTEM, and SECURITY hives) that are normally in use by the OS. This allows for the extraction of NTLM password hashes, DPAPI secrets, and the recovery of deleted files to facilitate privilege escalation and lateral movement.

  2. Introduction to VulnTricks Tips & Tricks

    VulnTricks provides a collection of high-impact, real-world penetration testing tactics, shell tricks, and automation scripts designed for CTF players and security researchers. The resource focuses on enumeration, reconnaissance, and maximizing the utility of security tools to improve efficiency during engagements.

  3. Understand Password Spraying attacks

    Password spraying is a 'hit and try' attack method where a few common or identified usernames and passwords are attempted across all available domain computers or machines. The goal is to find a single valid credential set that is likely reused across multiple services or machines within the domain.

  4. Understand Pass-the-Ticket technique

    Pass-the-Ticket is a post-compromise technique where an attacker imports or reuses an existing Kerberos ticket (such as a TGT obtained via Overpass-the-Hash) from a compromised system or user session to impersonate a user and access network resources.

  5. Collect wireless network information using airodump-ng

    To identify and collect information about nearby Access Points (APs) for wireless penetration testing, use the airodump-ng tool. This allows you to see available networks, their BSSIDs, channels, and connected clients.
    sudo airodump-ng wlan0

  6. Understand how PsExec performs remote command execution

    PsExec is a lateral movement tool that abuses Windows services and the SMB protocol to execute commands on a remote target. The process follows these steps:

    1. Connects to the ADMIN$ share on the target via SMB.
    2. Uploads a temporary service executable (PSEXESVC.exe) to C:\Windows.
    3. Uses the Service Control Manager (SCM) to create and start the PSEXESVC service, which executes the specified command with SYSTEM privileges.
    4. Redirects stdout/stderr back to the attacker's console over SMB.
    5. Deletes the service after execution is complete.

  7. Enumerate Active Directory using the PowerShell ActiveDirectory Module

    The official ActiveDirectory module can be used on domain-joined hosts or management boxes to extract detailed information about users, groups, and computers.
    # Import the module
Import-Module ActiveDirectory

# Get all users
Get-ADUser -Filter * | Select-Object Name,sAMAccountName

# Get all groups
Get-ADGroup -Filter * | Select-Object Name,GroupCategory

# Get all computers
Get-ADComputer -Filter * | Select-Object Name,OperatingSystem,LastLogonDate

  8. Understand the Silver Ticket attack mechanism

    A Silver Ticket is a forged Kerberos service ticket (TGS) designed for a specific service on a single machine. Unlike a Golden Ticket, which forges Ticket Granting Tickets (TGTs) for domain-wide access, a Silver Ticket is more stealthy because it bypasses the Domain Controller (DC) entirely; authentication occurs directly between the attacker and the target service.

  9. Understand the DCSync attack mechanism

    DCSync is an attack where an attacker impersonates a Domain Controller (DC) to request account password data via the Directory Replication Service Remote Protocol (MS-DRSR). By compromising an account with replication rights, an attacker can abuse the protocol—which DCs normally use to replicate with each other—to replicate secrets (hashes) from the legitimate DC.

  10. Enumerate the system kernel version and architecture

    Use the following commands to find the kernel version, machine architecture, and boot image details. These commands check the process filesystem, system utility outputs, and the boot directory.
    cat /proc/version
uname -a
uname -mrs
rpm -q kernel
dmesg | grep Linux
ls /boot | grep vmlinuz-

  11. Automate AD enumeration with ADRecon and Invoke-ADEnum

    For comprehensive automated reconnaissance, use ADRecon (exports to Excel/CSV) or Invoke-ADEnum (lightweight, uses built-in commands).

  12. Enumerate Windows system information for exploit research

    To gather general system information during the enumeration phase of privilege escalation research on Windows, use the systeminfo command. This provides essential details about the OS version, build, and hardware configuration.
    systeminfo