# Pentesting Notes ## Pentesting Notes - [Home](https://notes.incendium.rocks/pentesting-notes/home.md) - [Content Discovery](https://notes.incendium.rocks/pentesting-notes/web/content-discovery.md): Discovering content on the website is a important step in the reconnaissance phase of web pentesting. - [Subdomain Enumeration](https://notes.incendium.rocks/pentesting-notes/web/subdomain-enumeration.md): We can find subdomains of websites using various techniques. - [Authentication bypass](https://notes.incendium.rocks/pentesting-notes/web/authentication-bypass.md) - [IDOR (Insecure Direct Object Reference)](https://notes.incendium.rocks/pentesting-notes/web/idor-insecure-direct-object-reference.md): Insecure Direct Object Reference - [Git repository](https://notes.incendium.rocks/pentesting-notes/web/git-repository.md): Found a .git folder? Good! - [XSS](https://notes.incendium.rocks/pentesting-notes/web/xss.md) - [SSRF](https://notes.incendium.rocks/pentesting-notes/web/ssrf.md) - [CSRF](https://notes.incendium.rocks/pentesting-notes/web/csrf.md) - [Injection](https://notes.incendium.rocks/pentesting-notes/web/injection.md) - [SQL Injection](https://notes.incendium.rocks/pentesting-notes/web/injection/sql-injection.md) - [Cypher injection](https://notes.incendium.rocks/pentesting-notes/web/injection/cypher-injection.md) - [Command injection](https://notes.incendium.rocks/pentesting-notes/web/injection/command-injection.md) - [Server Side Template Injection](https://notes.incendium.rocks/pentesting-notes/web/injection/server-side-template-injection.md) - [NoSQL injection](https://notes.incendium.rocks/pentesting-notes/web/injection/nosql-injection.md) - [XXE](https://notes.incendium.rocks/pentesting-notes/web/injection/xxe.md) - [FI (File Inclusion)](https://notes.incendium.rocks/pentesting-notes/web/fi-file-inclusion.md) - [File upload](https://notes.incendium.rocks/pentesting-notes/web/file-upload.md) - [OAuth](https://notes.incendium.rocks/pentesting-notes/web/oauth.md) - [JWT](https://notes.incendium.rocks/pentesting-notes/web/jwt.md) - [CORS](https://notes.incendium.rocks/pentesting-notes/web/cors.md) - [Prototype pollution](https://notes.incendium.rocks/pentesting-notes/web/prototype-pollution.md) - [Request Smuggling](https://notes.incendium.rocks/pentesting-notes/web/request-smuggling.md) - [Offensive AI testing](https://notes.incendium.rocks/pentesting-notes/web/offensive-ai-testing.md) - [Reconnaissance](https://notes.incendium.rocks/pentesting-notes/web/offensive-ai-testing/reconnaissance.md) - [Attacking agents](https://notes.incendium.rocks/pentesting-notes/web/offensive-ai-testing/attacking-agents.md) - [Attacking Multi-Agent Systems](https://notes.incendium.rocks/pentesting-notes/web/offensive-ai-testing/attacking-multi-agent-systems.md) - [Attacking RAG-pipelines](https://notes.incendium.rocks/pentesting-notes/web/offensive-ai-testing/attacking-rag-pipelines.md) - [Attacking Embeddings](https://notes.incendium.rocks/pentesting-notes/web/offensive-ai-testing/attacking-embeddings.md) - [Attacking MCP & tools](https://notes.incendium.rocks/pentesting-notes/web/offensive-ai-testing/attacking-mcp-and-tools.md) - [Enumerating users (No credentials)](https://notes.incendium.rocks/pentesting-notes/windows-pentesting/enumerating-users-no-credentials.md): Seeking for a foothold heh? - [Privilege Escalation](https://notes.incendium.rocks/pentesting-notes/windows-pentesting/privilege-escalation.md) - [Post-Exploitation](https://notes.incendium.rocks/pentesting-notes/windows-pentesting/post-exploitation.md) - [Cross-domain enumeration](https://notes.incendium.rocks/pentesting-notes/windows-pentesting/cross-domain-enumeration.md) - [LDAP port (389, 636, 3268, 3269)](https://notes.incendium.rocks/pentesting-notes/windows-pentesting/ldap.md) - [SMB port (139,445)](https://notes.incendium.rocks/pentesting-notes/windows-pentesting/smb.md) - [MSSQL port (1433)](https://notes.incendium.rocks/pentesting-notes/windows-pentesting/mssql-port-1433.md) - [Certificate Authority (CA)](https://notes.incendium.rocks/pentesting-notes/windows-pentesting/certificate-authority-ca.md) - [Delegation attacks](https://notes.incendium.rocks/pentesting-notes/windows-pentesting/delegation-attacks.md) - [Attacking Kerberos](https://notes.incendium.rocks/pentesting-notes/windows-pentesting/attacking-kerberos.md) - [Relay attacks](https://notes.incendium.rocks/pentesting-notes/windows-pentesting/relay-attacks.md) - [Bypassing Security](https://notes.incendium.rocks/pentesting-notes/windows-pentesting/bypassing-security.md) - [File Transfer](https://notes.incendium.rocks/pentesting-notes/windows-pentesting/file-transfer.md) - [GPO (Group Policy Object)](https://notes.incendium.rocks/pentesting-notes/windows-pentesting/gpo-group-policy-object.md) - [Tools](https://notes.incendium.rocks/pentesting-notes/windows-pentesting/tools.md) - [Mimikatz](https://notes.incendium.rocks/pentesting-notes/windows-pentesting/tools/mimikatz.md) - [NetExec](https://notes.incendium.rocks/pentesting-notes/windows-pentesting/tools/netexec.md) - [Crackmapexec (CME)](https://notes.incendium.rocks/pentesting-notes/windows-pentesting/tools/crackmapexec-cme.md) - [Powerview](https://notes.incendium.rocks/pentesting-notes/windows-pentesting/tools/powerview.md) - [Bloodhound](https://notes.incendium.rocks/pentesting-notes/windows-pentesting/tools/bloodhound.md) - [Impacket](https://notes.incendium.rocks/pentesting-notes/windows-pentesting/tools/impacket.md): Impacket is a collection of Python classes for working with network protocols. - [BloodyAD](https://notes.incendium.rocks/pentesting-notes/windows-pentesting/tools/bloodyad.md) - [Sliver C2](https://notes.incendium.rocks/pentesting-notes/windows-pentesting/tools/sliver-c2.md): Sliver is an open source cross-platform adversary emulation/red team framework, it can be used by organizations of all sizes to perform security testing. (Not only for Windows) - [Security internals](https://notes.incendium.rocks/pentesting-notes/windows-pentesting/security-internals.md) - [Kernel](https://notes.incendium.rocks/pentesting-notes/windows-pentesting/security-internals/kernel.md) - [Remote Procedure Call](https://notes.incendium.rocks/pentesting-notes/windows-pentesting/security-internals/remote-procedure-call.md) - [COM/DCOM](https://notes.incendium.rocks/pentesting-notes/windows-pentesting/security-internals/com-dcom.md) - [Linux Privilege Esclation](https://notes.incendium.rocks/pentesting-notes/linux-pentesting/linux-privilege-esclation.md) - [Escape docker](https://notes.incendium.rocks/pentesting-notes/linux-pentesting/escape-docker.md) - [Ansible](https://notes.incendium.rocks/pentesting-notes/linux-pentesting/ansible.md) - [Pivoting](https://notes.incendium.rocks/pentesting-notes/cross-platform-pivoting/pivoting.md) - [Kubernetes](https://notes.incendium.rocks/pentesting-notes/cloud/kubernetes.md) - [Azure](https://notes.incendium.rocks/pentesting-notes/cloud/azure.md) - [Architecture](https://notes.incendium.rocks/pentesting-notes/cloud/azure/architecture.md) - [RBAC & ABAC roles](https://notes.incendium.rocks/pentesting-notes/cloud/azure/architecture/rbac-and-abac-roles.md) - [Entra ID roles](https://notes.incendium.rocks/pentesting-notes/cloud/azure/architecture/entra-id-roles.md) - [Entra ID - Authentication with OAuth and API's](https://notes.incendium.rocks/pentesting-notes/cloud/azure/architecture/entra-id-authentication-with-oauth-and-apis.md) - [Consent and Permissions](https://notes.incendium.rocks/pentesting-notes/cloud/azure/architecture/consent-and-permissions.md) - [Service Discovery, Recon, Enumeration and Initial Access Attacks](https://notes.incendium.rocks/pentesting-notes/cloud/azure/service-discovery-recon-enumeration-and-initial-access-attacks.md) - [Unauthenticated Recon](https://notes.incendium.rocks/pentesting-notes/cloud/azure/service-discovery-recon-enumeration-and-initial-access-attacks/unauthenticated-recon.md) - [Password Spraying](https://notes.incendium.rocks/pentesting-notes/cloud/azure/service-discovery-recon-enumeration-and-initial-access-attacks/password-spraying.md) - [Azure App Service](https://notes.incendium.rocks/pentesting-notes/cloud/azure/service-discovery-recon-enumeration-and-initial-access-attacks/azure-app-service.md) - [Azure Blob Storage](https://notes.incendium.rocks/pentesting-notes/cloud/azure/service-discovery-recon-enumeration-and-initial-access-attacks/azure-blob-storage.md) - [Phishing with Evilginx](https://notes.incendium.rocks/pentesting-notes/cloud/azure/service-discovery-recon-enumeration-and-initial-access-attacks/phishing-with-evilginx.md) - [Conditional Access](https://notes.incendium.rocks/pentesting-notes/cloud/azure/service-discovery-recon-enumeration-and-initial-access-attacks/conditional-access.md) - [Authenticated Enumeration](https://notes.incendium.rocks/pentesting-notes/cloud/azure/authenticated-enumeration.md) - [ROADTools](https://notes.incendium.rocks/pentesting-notes/cloud/azure/authenticated-enumeration/roadtools.md) - [BloodHound & AzureHound](https://notes.incendium.rocks/pentesting-notes/cloud/azure/authenticated-enumeration/bloodhound-and-azurehound.md) - [Storage Accounts (database)](https://notes.incendium.rocks/pentesting-notes/cloud/azure/authenticated-enumeration/storage-accounts-database.md) - [MFASweep](https://notes.incendium.rocks/pentesting-notes/cloud/azure/authenticated-enumeration/mfasweep.md) - [GraphRunner](https://notes.incendium.rocks/pentesting-notes/cloud/azure/authenticated-enumeration/graphrunner.md) - [Azure SQL databases](https://notes.incendium.rocks/pentesting-notes/cloud/azure/authenticated-enumeration/azure-sql-databases.md) - [Privilege Escalation](https://notes.incendium.rocks/pentesting-notes/cloud/azure/privilege-escalation.md) - [Illicit Consent Grant](https://notes.incendium.rocks/pentesting-notes/cloud/azure/privilege-escalation/illicit-consent-grant.md) - [Macro enabled Word-files (Revshell)](https://notes.incendium.rocks/pentesting-notes/cloud/azure/privilege-escalation/macro-enabled-word-files-revshell.md) - [Add secrets to app](https://notes.incendium.rocks/pentesting-notes/cloud/azure/privilege-escalation/add-secrets-to-app.md) - [Automation Accounts & Function Apps](https://notes.incendium.rocks/pentesting-notes/cloud/azure/privilege-escalation/automation-accounts-and-function-apps.md) - [Virtual Machines](https://notes.incendium.rocks/pentesting-notes/cloud/azure/privilege-escalation/virtual-machines.md) - [Key Vault](https://notes.incendium.rocks/pentesting-notes/cloud/azure/privilege-escalation/key-vault.md) - [ARM Deployment History](https://notes.incendium.rocks/pentesting-notes/cloud/azure/privilege-escalation/arm-deployment-history.md) - [Enterprise Application / Service Principal](https://notes.incendium.rocks/pentesting-notes/cloud/azure/privilege-escalation/enterprise-application-service-principal.md) - [Lateral Movement](https://notes.incendium.rocks/pentesting-notes/cloud/azure/lateral-movement.md) - [Entra ID Devices & Primary Refresh Tokens](https://notes.incendium.rocks/pentesting-notes/cloud/azure/lateral-movement/entra-id-devices-and-primary-refresh-tokens.md) - [Dynamic Groups](https://notes.incendium.rocks/pentesting-notes/cloud/azure/lateral-movement/dynamic-groups.md) - [Application Proxy](https://notes.incendium.rocks/pentesting-notes/cloud/azure/lateral-movement/application-proxy.md) - [Hybrid Identity](https://notes.incendium.rocks/pentesting-notes/cloud/azure/lateral-movement/hybrid-identity.md) - [Windows executables and DLL's](https://notes.incendium.rocks/pentesting-notes/reversing/windows-executables-and-dlls.md) - [Linux binaries](https://notes.incendium.rocks/pentesting-notes/reversing/linux-binaries.md) - [Java applications](https://notes.incendium.rocks/pentesting-notes/reversing/java-applications.md) - [Android APK](https://notes.incendium.rocks/pentesting-notes/reversing/android-apk.md) - [WPA/WPA2](https://notes.incendium.rocks/pentesting-notes/wireless-networks/wpa-wpa2.md) - [WPS](https://notes.incendium.rocks/pentesting-notes/wireless-networks/wps.md) - [WEP](https://notes.incendium.rocks/pentesting-notes/wireless-networks/wep.md) - [Capative portal bypass](https://notes.incendium.rocks/pentesting-notes/wireless-networks/capative-portal-bypass.md) - [Setting up a Rogue Access Point](https://notes.incendium.rocks/pentesting-notes/wireless-networks/setting-up-a-rogue-access-point.md) - [WPA Enterpise (WPA-MGT)](https://notes.incendium.rocks/pentesting-notes/wireless-networks/wpa-enterpise-wpa-mgt.md) - [Tips and tricks](https://notes.incendium.rocks/pentesting-notes/tips-and-tricks/tips-and-tricks.md)