Services

HTTP/HTTPS pentesting covers recon, enum, vuln discovery, and exploitation of web apps via XSS, SQLi, RCE, LFI, SSRF, JWT flaws, file uploads, and more through to exfil and persistence

FTP file transfer service. Attackers check banners, anonymous access, writable dirs, cleartext creds, CVEs, and backdoors, then exploit for shells, brute-force, or data exfiltration

SMB is a Windows file and printer sharing protocol. Attackers enumerate shares, users, and domain info, then exploit misconfigs via relay, PtH, or RCE to move laterally and exfiltrate data

SSH remote access protocol. Attackers target banners, auth methods, weak keys, legacy crypto, misconfigs, and CVEs, then pivot via agent forwarding, tunneling, and key reuse for persistence and exfil

LDAP directory service attacks covering anonymous binds, injection, enumeration of users and groups, relay attacks, credential extraction, and leveraging AD trust paths for lateral movement

WinRM is Windows remote management over HTTP/HTTPS. Attackers probe auth, brute force creds, gain remote shells, bypass CLM, escape JEA, and move laterally across Windows environments

MySQL attack coverage spanning version fingerprinting, user grants, default creds, FILE privilege abuse, UDF exploitation, hash cracking, config harvesting, and data exfiltration via dumps and file output

RDP remote desktop protocol attacks covering NTLM fingerprinting, BlueKeep and DejaBlue CVEs, NLA bypass, Pass-the-Hash, session hijacking via tscon, and sticky keys backdoors

Kerberos is AD's auth protocol. Attackers enumerate users, SPNs, and KDCs, then exploit via AS-REP roasting, Kerberoasting, ticket forging, delegation abuse, and ccache reuse for lateral movement

Redis in-memory store tested for unauth access, version flaws, and keyspace secrets. Exploits include RCE via file writes, SSH key injection, cron abuse, auth bypass, and SSRF for lateral movement

DNS maps domains to IPs. Attackers probe records, zone transfers, and subdomains, then exploit misconfigs for poisoning, takeover, hijacking, tunneling, and covert exfiltration via encoded queries

Hosts covers attacking network systems from recon and port scanning to exploitation, post-exploitation, privilege escalation, lateral movement, persistence, and data exfiltration via ICMP

VNC remote desktop protocol testing covering auth probing, version fingerprinting, brute force, session hijacking, hash decryption, and post-access lateral movement and persistence via reverse callbacks

MSSQL is Microsoft's relational DB server. Attackers enumerate instances, exploit weak creds and xp_cmdshell for RCE, escalate to SYSTEM, pivot via linked servers, and exfiltrate stored data

Memcached is a distributed memory cache. Attackers enumerate keys, dump cached data and session tokens, and test for unauthenticated access and UDP amplification vulnerabilities

MongoDB NoSQL database pentesting covering auth misconfigs, operator injection, unauth data access, CVE exploitation, credential looting, and exfiltration of stored collections and sensitive documents

IKE negotiates IPsec VPN tunnels. Attackers enumerate transform sets, fingerprint vendors, exploit aggressive mode to capture PSKs, and crack weak credentials to gain VPN access

MQTT is a lightweight IoT messaging protocol. Attackers enumerate brokers and topics, probe for missing auth and plaintext transport, then exploit anonymous access to read or inject messages and harvest credentials

NFS file share protocol. Attackers enumerate exports, mount shares, abuse UID trust and no_root_squash to access files, plant SUID binaries, escalate privileges, and exfiltrate data

IIS is Microsoft's web server. Attackers probe for version leaks, short name flaws, WebDAV misconfigs, ASPX shell upload, auth bypass, and post-access token abuse for escalation

PostgreSQL attack reference covering version and role enumeration, weak cred discovery, RCE via COPY TO PROGRAM and UDFs, privesc, lateral movement, persistence, and data exfiltration

Apache Tomcat web server using AJP connector. Attackers fingerprint versions, exploit Ghostcat for file read, discover exposed Manager panels, and deploy malicious WAR files for RCE

Oracle DB attack coverage including TNS listener and SID enumeration, weak credential testing on default accounts, and exploitation for SQL exec, file access, and OS command execution

Telnet is a plaintext remote access protocol. Attackers grab banners, brute force weak creds, intercept traffic via MITM, then pivot internally using gained shell access