# Windows

> Windows pentesting reference covering exploitation, privesc, lateral movement via SMB, WMI and RDP, persistence, AD enumeration, and data exfiltration over HTTP, DNS, and FTP

- **URL:** https://hackindex.io/platforms/windows
- **Type:** Platform
- **Tags:** windows, active-directory, privilege-escalation, lateral-movement, enumeration, post-exploitation
- **Published:** 2026-01-19
- **Updated:** 2026-07-15

Windows is the most common operating system on corporate endpoints and servers. Local Windows attacks focus on the host itself, independent of Active Directory: privilege escalation, credential dumping, service exploitation, and persistence on standalone or domain-joined machines. These techniques apply to workstations, member servers, and any Windows host where you have initial access.

Windows privilege escalation targets misconfigured services (unquoted paths, weak permissions, DLL hijacking), token impersonation (SeImpersonatePrivilege, potato attacks), scheduled tasks, registry autoruns, and UAC bypasses. Credential access includes SAM database extraction, LSASS memory dumps with Mimikatz, DPAPI secrets, and cached credentials. Persistence mechanisms range from registry run keys and startup folders to WMI event subscriptions and service creation.

This section covers Windows-specific techniques: local enumeration of users, services, installed software, and network configuration, privilege escalation through service abuse, token manipulation, and kernel exploits, lateral movement via credential reuse, PsExec, and WMI, and post-exploitation including credential harvesting and defensive evasion. Core tooling includes WinPEAS, Mimikatz, Seatbelt, SharpUp, and PowerUp.

## Phases

- [Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation.md): Windows privesc guides covering services, tokens, registry, and more (20 guides)
- [Post-Exploitation](https://hackindex.io/platforms/windows/post-exploitation.md): Windows post-exploitation enum, creds, loot, and file transfer guides (6 guides)
- [Lateral Movement](https://hackindex.io/platforms/windows/lateral-movement.md): Hash, ticket, SMB, WMI, WinRM, RDP, and token lateral moves (6 guides)
- [Persistence](https://hackindex.io/platforms/windows/persistence.md): Registry, tasks, services, web shells, accounts, and ticket forging (6 guides)
- [Data Exfiltration](https://hackindex.io/platforms/windows/data-exfiltration.md): Guides on staging, and exfiltrating data over HTTP, SMB, FTP, and DNS (4 guides)
- [Enumeration](https://hackindex.io/platforms/windows/enumeration.md): Guides covering Windows and AD enumeration for privesc and pivoting (6 guides)
- [Exploitation](https://hackindex.io/platforms/windows/exploitation.md): Get a shell via evil-winrm, web shells, and EternalBlue (1 guides)
- [Vulnerability Discovery](https://hackindex.io/platforms/windows/vulnerability-discovery.md): Find privesc paths via winPEAS, accesschk, tokens, and creds (1 guides)