Email Verification Issue ResolvedWe would like to inform you that there was a temporary technical glitch affecting the email verification process. The issue has now been resolved, and email verification is working properly.
If your account is still inactive, please complete your email verification now to activate your account.
Thank you for your patience and understanding.
Set your variables — all commands update live
FFUF — Fast Web Fuzzer
FFUF (Fuzz Faster U Fool) — high-speed web fuzzer for directories, parameters, subdomains, and more.
Web Pentest
25 cmds
Directory & File Fuzzing
Basic directory fuzzing
Fuzz with multiple file extensions
Match specific response codes
Filter out 404 responses
Filter by response size
Filter by word count in response
Set 100 concurrent threads
Recursive directory fuzzing
Subdomain & VHost Fuzzing
Subdomain enumeration
Virtual host (vhost) fuzzing
Vhost fuzzing filtering by size
Parameter & Value Fuzzing
Fuzz GET parameter names
Fuzz GET parameter values (IDOR)
POST parameter fuzzing (username enum)
Password brute force via POST
Fuzz with authentication cookie
Authentication & Headers
Fuzz with Bearer token
Fuzz with session cookie
Set cookies via -b flag
Proxy through Burp Suite
Output & Advanced
Save output as JSON
Save output as HTML report
Auto-calibrate filter (smart baseline)
Limit requests per second
Multi-wordlist fuzzing with named positions
NetExec (CrackMapExec) — AD Lateral Movement
NetExec (nxc) — the Swiss Army knife for Windows/AD lateral movement, credential spraying, and post-exploitation.
Active Directory
53 cmds
SMB Enumeration & Auth
Discover SMB hosts on subnet
Test SMB credentials
SMB pass-the-hash
Spray credentials across subnet
Credential spray with lists
Enumerate SMB shares
List active SMB sessions
Enumerate domain users via SMB
Enumerate domain groups
Get password policy
RID brute force to enumerate users/groups
List logged-on users (hunt where admins are sitting)
Authenticate with a LOCAL account instead of domain
Null-session enumeration (no creds)
List domain computer objects
Find hosts with SMB signing OFF (relay target list)
Detect a container + check capabilities for escape
IDOR & Broken Access Control
Insecure Direct Object Reference and broken access control — ID tampering, mass assignment, verb abuse, encoded references, BFLA function-level access and Autorize/Arjun tooling.
Web Pentest
19 cmds
Finding IDOR
Increment/decrement object IDs to reach others' data
Tamper an ID in the query string
Compare the self route with a direct-ID route
Fuzz IDs and flag 200 responses
Parameter & Body Tampering
Swap the user id in a JSON body
Mass assignment — add privileged fields the API trusts
Duplicate parameter — some parsers honour the last (or first)
Wrap the id in an array to bypass type checks
HTTP Verb / Method
Write or modify via an unprotected verb
Smuggle a privileged method past verb-based rules
Indirect / Encoded References
Decode, change, then re-encode object references
Change the subject when the API trusts the token id
Guess hashed identifiers derived from sequential values
GraphQL security testing — endpoint discovery and engine fingerprinting, introspection (and recovery when disabled), IDOR/authz via nodes & mutations, batching rate-limit bypass, DoS and injection.
Web Pentest
17 cmds
Discovery
Confirm a GraphQL endpoint
Hunt the endpoint + any exposed IDE
Fingerprint the GraphQL engine
Introspection
Full introspection — dump the schema
List all queries and mutations
Inspect a specific type's fields
Recover the schema even when introspection is disabled
Authz / IDOR
IDOR via a node argument
Authz bypass / mass assignment via a mutation
Relay global-id IDOR (base64 of type:id)
Rate-Limit Bypass (Batching)
Alias many attempts in ONE request to beat rate limits
Array/JSON batching — send many operations at once
DoS
Deeply nested / circular query to exhaust resources
Server-Side Template Injection — engine detection plus RCE payloads for Jinja2, Twig, Freemarker, Velocity, Spring SpEL, Thymeleaf, Smarty, Mako and ERB.
Web Pentest
24 cmds
Detection
49 → Jinja2 / Twig
49 → Freemarker / Spring SpEL / JSP EL
49 → Ruby (Slim) / Thymeleaf
49 → ERB (Ruby) / EJS
7777777 → Jinja2; 49 → Twig (disambiguate the two)
Polyglot — fire everywhere and watch which errors
Jinja2 (Python)
Dump the Flask config (frequently contains secrets)
RCE via cycler globals (modern, reliable)
RCE via the lipsum global
RCE via request globals
RCE via self/builtins
Twig (PHP)
RCE via the undefined-filter callback
RCE via the filter() function
RCE via the sort() callback
Java — Freemarker / Velocity
Freemarker RCE via Execute
Freemarker one-liner RCE
Velocity RCE chain
Java — Spring SpEL / Thymeleaf
Spring SpEL RCE
Thymeleaf preprocessing RCE
Thymeleaf expression RCE
Smarty / Mako / ERB
Smarty (PHP) direct command exec
Smarty {php} tag (older versions)
Mako (Python) RCE
ERB (Ruby) command exec
Windows Privilege Escalation
Manual Windows privilege escalation — enumeration, token/Potato attacks (PrintSpoofer/GodPotato), service misconfigurations, AlwaysInstallElevated, credential hunting, UAC bypasses, kernel exploits and scheduled-task/autorun hijacks.
Privilege Escalation
27 cmds
Enumeration
Groups + privileges + integrity level in one shot
List token privileges (look for SeImpersonate/SeBackup/SeDebug)
OS build + installed patches (feed to wesng/watson)
Local users and who is admin
PowerUp automated misconfig checks
Token Privileges (Potato)
SeImpersonate → SYSTEM via the spooler named pipe
Modern SeImpersonate→SYSTEM (DCOM/RPC)
SeImpersonate→SYSTEM on older builds
Dump SAM/SYSTEM with backup rights
Service Misconfigurations
Find unquoted service paths
Find services your user can modify
Hijack a weak-permission service binPath
DLL/binary hijack of a service
Registry & AlwaysInstallElevated
If 1 (both hives) → install a SYSTEM MSI
Run the malicious MSI (AlwaysInstallElevated)
Autologon credentials in the registry
Credential Hunting
Reuse stored credentials without knowing them
Grep the filesystem for passwords
Deployment files often hold local-admin creds
MS14-025 — decryptable domain creds
UAC Bypass & Kernel
Elevate from a medium-integrity admin without a prompt
Alternate auto-elevate bypasses
Map missing patches to kernel exploits
Spooler RCE/LPE
Scheduled Tasks & Autoruns
Find tasks running as a higher-priv user
Hijack a scheduled-task executable
Enumerate all autostart entries (Sysinternals)
JWT Attacks
JSON Web Token attacks — decoding, alg=none, weak-secret cracking (hashcat/jwt_tool), RS256→HS256 key confusion, claim tampering and kid/jku/x5u header injection.
Web Pentest
16 cmds
Recon & Decode
Decode header + payload without verifying
Parse and display a token with jwt_tool
Interactive tamper mode
alg=none Bypass
Forge a token with alg=none (strip the signature)
Manual alg=none — note the trailing dot, empty signature
Weak Secret Cracking
Crack an HS256 signing secret offline
Dictionary-crack the HMAC secret with jwt_tool
Crack the secret with John
Key Confusion (RS256 -> HS256)
Sign with the RSA public key as the HMAC secret (alg confusion)
Recover the server public key for the confusion attack
Claim Tampering
Escalate by editing privilege claims, then re-sign
Inject a claim and re-sign with a known secret
Header Injection (kid / jku / x5u)
kid path traversal → sign with an empty/known key
kid SQL injection to control the verification key
jku/x5u header → point verification at your JWKS
Run all tests against a live endpoint
Command Injection
OS command injection — separators and substitution, blind/time-based detection, OOB exfiltration, space/keyword/WAF bypasses, reverse shells and Windows command injection.
Web Pentest
29 cmds
Separators
Chain a second command (semicolon)
Pipe into the injected command
Run only if the first command fails
Background separator (also Windows)
Run if the first command succeeds
Backtick command substitution
Modern command substitution
URL-encoded newline as a separator
Blind / Time-Based
Confirm blind injection via a delay (Unix)
Time delay via substitution
Unix delay via ping
Windows delay via ping
Out-of-Band Exfil
Exfil command output via an HTTP callback
DNS exfil of command output
POST a file to your listener
Base64 the output to survive URL/DNS rules
Space & Keyword Bypass
${IFS} substitutes for a blocked space
Brace expansion avoids spaces
Input redirection instead of a space
Empty quotes break keyword matching
Glob wildcards avoid literal binary names
Base64-decode then execute
Reverse Shells
Bash reverse shell
Netcat reverse shell
Netcat (no -e) FIFO reverse shell
Windows
Windows command separator
Download + execute a payload (certutil)
Run an encoded PowerShell command
PowerShell download-cradle
NoSQL Injection
NoSQL injection (MongoDB-focused) — authentication bypass with operators, query operator injection, blind regex extraction, server-side $where JavaScript injection, JSON vs form delivery, and NoSQLMap/ffuf tooling.
Web Pentest
23 cmds
Authentication Bypass
Operator injection — "not equal to null" matches any password
Log in as the first user when both fields are bypassed
Greater-than-empty matches any set password
Form/URL-encoded operator injection
Regex-match the username, bypass the password
Query Operator Injection
Match anything that is not null
Range operators to match populated fields
Match any value from a list
Filter on field presence
Wildcard regex match
Blind Extraction (Regex Oracle)
Confirm the first character, then iterate the alphabet
Character-by-character extraction of a secret field
Boolean oracle drives blind NoSQLi
JavaScript Injection ($where)
Run server-side JavaScript inside the query
Time-based blind via $where
Break out of a string into the $where JS context
Arbitrary JS predicate
Encoding & Delivery
Send real operator objects (not strings) in a JSON body
Express/PHP parse bracket params into nested operators
Operator injection through query-string bracket notation
Hand-built SQL injection payloads — auth bypass, UNION extraction, schema enum, error/blind/time-based, stacked-query RCE and WAF bypasses across MySQL, MSSQL, PostgreSQL and Oracle.
Web Pentest
38 cmds
Detection & Auth Bypass
Classic always-true authentication bypass
Comment out the rest of the query
Log in as a known user, comment the password check
Break out of a double-quote + parenthesis context
MySQL hash-comment variant
URL-friendly always-true
UNION-Based Extraction
Find the column count (increment until it errors)
Match the column count with NULLs
Identify which columns are reflected
Leak DB version (MySQL/MSSQL)
Dump credentials
Concatenate all creds into one row (MySQL)
Schema Enumeration
List all tables
List columns of a table
List databases (MySQL)
Oracle version banner
List tables (PostgreSQL)
Error-Based
MySQL error-based leak (extractvalue)
MySQL error-based leak (updatexml)
MSSQL error-based type-cast leak
PostgreSQL error-based cast leak
Blind — Boolean & Time
Boolean TRUE baseline
Boolean FALSE baseline (diff the responses)
Extract data one character at a time
MySQL time-based delay
MySQL conditional time delay
MSSQL time-based delay
PostgreSQL time-based delay
Stacked Queries & RCE
Enable xp_cmdshell on MSSQL
Run an OS command via MSSQL
PostgreSQL command exec via COPY TO PROGRAM
MySQL write a webshell (needs FILE priv + writable path)
WAF / Filter Bypass
MySQL versioned-comment keyword bypass
Mixed-case keyword bypass
Inline comments instead of spaces
Tab (%09) used as whitespace
ALL keyword to dodge "UNION SELECT" signatures
Double URL-encoded ' OR 1=1
File Upload Bypass
Bypass file-upload restrictions to reach RCE/XSS — extension and MIME/magic-byte tricks, .htaccess/web.config abuse, SVG/HTML/XXE uploads, path traversal and parser/deserialization bugs.
Web Pentest
24 cmds
Extension Tricks
Double extension — misconfigured servers execute the .php
Case variation to dodge a lowercase blacklist
Alternate PHP extension filters often miss
Legacy PHP extension mapping
PHP archive — executed as PHP
Null-byte truncation (old PHP / CGI)
Trailing dot stripped by Windows, leaving .php
IIS semicolon trick — treated as .asp
MIME & Magic Bytes
Spoof the MIME header while uploading a script
GIF magic-byte prefix + PHP payload
Embed PHP in a real image's EXIF comment
JPEG magic bytes to pass content sniffing
Server Config Upload
Upload .htaccess so .jpg runs as PHP (Apache)
Prepend an uploaded "image" as PHP
Upload web.config to enable script exec on IIS
SVG / HTML / XML
Stored XSS via an uploaded SVG
SVG script execution
XXE via an uploaded SVG
HTML upload → stored XSS on the same origin
Path & Overwrite
Path traversal in the filename to control where it lands
Extraction path traversal via a crafted archive
Overwrite a sensitive file by reusing its name
Parser & Deserialization
Trigger PHAR deserialization on a later file operation
Image-parser RCE (ImageTragick-class bugs)
Certipy — AD CS Abuse (ESC1–ESC16)
Active Directory Certificate Services enumeration and abuse with Certipy v5 — ESC1 through ESC16, NTLM relay to AD CS (ESC8/ESC11), shadow credentials, and golden certificates.
Active Directory
36 cmds
Enumeration & Discovery
Enumerate CAs, templates and ACLs — dumps JSON/TXT report
Show only vulnerable templates (ESC findings) on stdout
Only enabled AND vulnerable templates (real attack surface)
Pass-the-hash enum + BloodHound output for graphing
Force both text and JSON output of the AD CS layout
ESC1 — SAN Impersonation
Request a cert for the template, supplying Administrator UPN in the SAN
Add both UPN and DNS SAN (impersonate a machine/DC)
Embed target SID (required when StrongCertificateBindingEnforcement is on)
ESC2 / ESC3 — Any-Purpose & Enrollment Agent
ESC2 — Any-Purpose EKU template: request, then auth as anyone
ESC13 — template with an issuance policy linked to a privileged group (OID group link)
ESC15 (EKUwu / CVE-2024-49019) — inject app policies into a v1 schema template
ESC16 — CA has the SID security extension disabled domain-wide: pair with a UPN swap like ESC9
Authenticate & UnPAC-the-Hash
PKINIT with the cert → get a TGT (.ccache) AND the account NT hash
Disambiguate the identity when the cert has multiple SANs
Authenticate over LDAP (Schannel) and drop into an interactive LDAP shell
Use the recovered TGT for a SYSTEM shell (pass-the-ticket)
Shadow Credentials & Golden Certificate
Shadow Credentials — add a Key Credential, auth, recover the NT hash, then clean up
Steal the CA private key + cert (requires CA-admin / DA) — basis for a Golden Certificate
GOLDEN CERTIFICATE — forge an auth cert for any user with the stolen CA key (offline)
Split a .pfx into separate cert and key files (for use with other tools)
Coercion & mitm6 — Forced Authentication
Force machine accounts to authenticate to you and relay it — PetitPotam, PrinterBug, DFSCoerce, ShadowCoerce, Coercer and mitm6, paired with ntlmrelayx / Certipy relay (RBCD, Shadow Credentials, ESC8).
Active Directory
20 cmds
mitm6 — IPv6 DNS Takeover
Spoof DHCPv6 to become the network's IPv6 DNS server (WPAD/auth capture)
Only answer FQDN queries for the target domain — quieter, less breakage
Restrict spoofing to a single victim host (targeted)
Relay the IPv6/WPAD-captured machine auth to LDAPS → configure RBCD
Relay → add a new computer account (then use it for RBCD)
PetitPotam — MS-EFSRPC
Unauthenticated EFSRPC coercion (unpatched DCs) — listener then target
Abuse the Print Spooler RPC to coerce the target to auth to your listener
Alternative SpoolSample/PrinterBug trigger
Check whether the MS-RPRN (Spooler) interface is exposed first
DFSCoerce / ShadowCoerce
MS-DFSNM coercion — works even when the Spooler is disabled
MS-FSRVP (VSS) coercion — another no-Spooler path
Coercer — All-in-One
Enumerate which coercion methods/pipes the target actually exposes
Fire every available coercion method at the target at once
Trigger one specific RPC method only
Relay Combos (where the coerced auth goes)
Relay coerced machine auth to LDAPS → grant RBCD over the victim computer
Relay → add Shadow Credentials (msDS-KeyCredentialLink) on the DC
ESC8 — relay coerced DC$ auth to AD CS web enrollment to mint a DC cert
Relay to SMB and stash the session in a SOCKS proxy for reuse
XXE — XML External Entity
XML External Entity attacks — local file read, SSRF, PHP filter/expect wrappers, blind & error-based out-of-band exfiltration via external DTDs, XInclude, SVG/Office documents and entity-expansion DoS.
Web Pentest
15 cmds
Basic File Read
Read a local file via an external entity
Windows local file read
Directory listing on some Java parsers
SSRF via XXE
Reach cloud metadata through XXE
Hit an internal-only service
PHP Wrappers
Base64-wrap to read files with special chars (PHP)
Read application PHP source code
Command exec if the PHP expect wrapper is enabled
Blind / Out-of-Band
Load an external DTD for out-of-band exfil
External DTD that exfiltrates a file over HTTP
Leak file contents inside a parser error message
Other Vectors
XInclude — works when you cannot control the DOCTYPE
XXE through an uploaded SVG
XXE via Office Open XML documents
Billion Laughs entity-expansion DoS
API Security — OWASP API Top 10
REST API penetration testing mapped to the OWASP API Security Top 10 — endpoint/spec discovery, BOLA/BFLA, broken auth, mass assignment & data exposure, resource consumption, SSRF, CORS/misconfig, shadow versions and tooling.
Web Pentest
25 cmds
Recon & Discovery
Hunt API docs that map the entire attack surface
Brute API routes — 401/403 still reveal hidden endpoints
Kiterunner — content discovery tuned for API routes
Crawl and extract API endpoints from JavaScript
Version & shadow-API discovery (API9)
API1 / API5 — BOLA & BFLA
API1 BOLA — read/modify others' objects by changing IDs
API5 BFLA — invoke admin-only functions
Automate authorization testing across the whole API
API2 — Broken Authentication
API2 — brute/stuff when login isn't throttled
Brute the login endpoint
Token and key weaknesses
Account takeover via a weak reset flow
API3 — Mass Assignment & Data Exposure
API3 BOPLA — inject privileged fields the API binds blindly
Excessive data exposure — the server over-returns
Object property-level authorization bypass
API4 — Resource Consumption
API4 — melt the DB/memory with huge page sizes
Cost & DoS via unbounded operations
Parser resource exhaustion
API7 / API8 / API9 — SSRF, Misconfig, Inventory
API7 SSRF via URL-accepting fields
API8 — permissive CORS leaking authenticated data
API8 misconfiguration probes
API9 — deprecated/shadow versions skip new controls
Tooling
Automated API misconfig/exposure checks
Discover hidden JSON parameters
Build the request corpus to fuzz
Active Directory Enumeration
Enumerate Active Directory — ldapsearch/ldapdomaindump/windapsearch, PowerView, built-in net/nltest/setspn, rpcclient/enum4linux null sessions and RID brute, plus BloodHound/Certipy collection references.
Active Directory
22 cmds
ldapsearch (Linux)
Authenticated LDAP dump of the whole domain
Anonymous — grab naming contexts / base DN
Find Kerberoastable accounts via LDAP
Dump users/groups/computers to HTML + JSON
Quick Domain Admins enumeration
PowerView (Windows)
Enumerate users (catch passwords in descriptions)
List members of a privileged group
Find servers by operating system
Where does the current user have local admin?
Hunt where privileged users are currently logged in