Resources

The tools and references I keep coming back to. Most of them turn up somewhere in the write-ups on this site.

Cheatsheets & references

#

• HackTricks is usually the first place I look for methodology, whether it’s web, network, or AD.
• PayloadsAllTheThings for Web related payloads.
• WADComs, a searchable command reference for Windows and AD attacks.
• GTFOBins lists Unix binaries you can abuse to escalate privileges or break out of a restricted shell.
• LOLBAS is the Windows version, covering signed Microsoft binaries that can be turned against the host.
• LOLGlobs catalogues wildcard and glob tricks for slipping commands past signature-based detection.
• PortSwigger Web Security Academy has the best free labs for learning web exploitation.

Recon & enumeration

#

• Nmap for port scanning, service and version detection, and the occasional NSE script.
• ffuf for fuzzing directories, vhosts, and parameters.
• feroxbuster when I want recursive content discovery.
• dirsearch, another quick option for finding hidden paths.
• enum4linux-ng for SMB and LDAP enumeration against Windows and Samba.
• NetExec is the CrackMapExec successor I use for SMB, WinRM, and LDAP.
• WPScan for anything running WordPress.
• nuclei for fast, template-based scanning that flags known vulnerabilities and misconfigurations.

Web & app exploitation

#

• Burp Suite for intercepting and tampering with HTTP traffic.
• sqlmap once I’ve found a likely injection point.
• jwt_tool for picking apart and forging JWTs.
• Metasploit when a known exploit or a quick handler saves time.

Active Directory & Windows

#

• BloodHound for mapping attack paths once I have a foothold.
• AD Mindmap from Orange Cyberdefense, good for remembering what leads where.
• Impacket covers the usual suspects: secretsdump, psexec, GetUserSPNs.
• bloodyAD for abusing ACLs and object rights to escalate.
• Certipy when ADCS is in play.
• Responder for poisoning LLMNR/NBT-NS and grabbing hashes.
• Evil-WinRM gives you a proper shell over WinRM.
• PrintNightmare PoC, still worth keeping around (CVE-2021-1675 / 34527).

Privilege escalation

#

• PEASS-ng, the LinPEAS and WinPEAS scripts I run early to spot escalation paths.

Credentials & cracking

#

• Hashcat for anything GPU-crackable.
• John the Ripper for quick offline cracking.

Pivoting

#

• Ligolo-ng for tunnelling into internal networks.

Wordlists

#

• SecLists, the wordlists behind most of the fuzzing and brute forcing above.