- Reconnaissance
- Movement
- Credentials
- MITM and coerced auths
- ARP poisoning
- DNS spoofing
- DHCP poisoning
- DHCPv6 spoofing
- WSUS spoofing
- LLMNR, NBT-NS, mDNS spoofing
- ADIDNS poisoning
- WPAD spoofing
- MS-EFSR abuse (PetitPotam)
- MS-RPRN abuse (PrinterBug)
- MS-FSRVP abuse (ShadowCoerce)
- MS-DFSNM abuse (DFSCoerce)
- PushSubscription abuse
- WebClient abuse (WebDAV)
- 🛠️ NBT Name Overwrite
- 🛠️ ICMP Redirect
- 🛠️ Living off the land
- NTLM
- Kerberos
- DACL abuse
- Group policies
- Trusts
- Netlogon
- Certificate Services (AD-CS)
- SCCM / MECM
- Exchange services
- Print Spooler Service
- Schannel
- Built-ins & settings
- Persistence
- Reconnaissance
- Configuration
- Accounts and sessions
- User inputs
- File inclusion
- Unrestricted file upload
- SQL injection
- XSS (Cross-Site Scripting)
- CSRF (Cross-Site Request Forgery)
- SSRF (Server-Side Request Forgery)
- IDOR (Insecure Direct Object Reference)
- ORED Open redirect
- Content-Type juggling
- XXE injection
- Insecure JSON Web Tokens
- 🛠️ HTTP parameter pollution
- 🛠️ SSTI (Server-Side Template Injection)
- 🛠️ Insecure deserialization
- 🛠️ CRLF injection
- 🛠️ Arbitrary file download
- 🛠️ Directory traversal
- 🛠️ Null-byte injection
- Reconnaissance
- Initial access (protocols)
- Initial access (phishing)
- Privilege escalation
- Pivoting