HackIndex.io
Language
Windows:
Windows post-exploitation enum, creds, loot, and file transfer guides
Covers techniques for moving files between attacker and Windows targets post-compromise, including common transfer methods like SMB, HTTP, and PowerShell.
Techniques for locating and extracting sensitive files, credentials, and user data from compromised Windows systems during post-exploitation reconnaissance.
Enumerate local Windows system info, users, groups, privileges, network config, and running processes to build situational awareness post-compromise.
Covers post-exploitation network reconnaissance on Windows systems, including enumeration of hosts, shares, active sessions, and domain topology using native tools.
Covers key Windows post-exploitation enumeration techniques using tools like WinPEAS, PowerView, and BloodHound to identify privilege escalation paths and lateral movement opportunities.
Covers techniques for extracting Windows access tokens and credentials post-compromise, including token impersonation, LSASS dumping, and privilege escalation.
Windows post-exploitation focuses on credential dumping and situational awareness after gaining elevated access. The SAM database holds local account hashes, LSA secrets store service account credentials and auto-logon passwords, and LSASS process memory contains plaintext passwords, NTLM hashes, and Kerberos tickets for currently logged-in users.
Mimikatz is the standard tool for LSASS dumping (sekurlsa::logonpasswords), but alternatives like nanodump, pypykatz, and comsvcs.dll MiniDump work when Mimikatz is blocked. DPAPI decryption recovers saved browser passwords, RDP credentials, and Wi-Fi keys. Token enumeration reveals impersonation opportunities across the system.
Beyond credentials, this phase covers network inspection (internal routes, DNS, ARP), domain trust enumeration, and gathering the intelligence you need to plan lateral movement and identify high-value targets in the environment.
We use cookies to improve your browsing experience, analyze site traffic, and personalize content. By clicking "Accept All", you consent to our use of cookies. Privacy Policy.