HTB CPTS cheat sheet
HTB CPTS · Keep the key ideas within reach.
Penetration Testing Process and Methodologies
Phase order: pre-engagement/scoping, information gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, reporting, cleanup, and retest.
Rules of engagement must define in-scope IP ranges/domains, excluded hosts, test window, allowed techniques (e.g., social engineering, DoS), emergency contact, and data handling.
MITRE ATT&CK organizes adversary behavior into 14 enterprise tactics from Reconnaissance to Impact; use it to map findings to techniques (e.g., T1059 Command and Scripting Interpreter).
PTES has 7 sections: pre-engagement interactions, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and reporting.
Black-box = no prior knowledge; grey-box = partial credentials/architecture; white-box = full source, configs, and credentials. Report the model used because it bounds coverage claims.
A finding needs reproducibility: exact command, timestamp, source IP, target, and observed output. A screenshot alone is not sufficient evidence.
Risk rating commonly combines likelihood and impact; CVSS v3.1 base score = f(AV, AC, PR, UI, S, C, I, A) and is not a substitute for business context.
Cleanup obligations: remove uploaded tools/webshells, revert modified configs, delete created accounts, and document each artifact removed.
Reconnaissance, Enumeration, and OSINT
Passive recon leaves no direct packets to the target: WHOIS, DNS history, certificate transparency (crt.sh), ASN/BGP lookups, Shodan/Censys, and search-engine dorking.
Active recon touches the target: DNS zone transfer (dig AXFR), subdomain brute force, port scanning, and banner grabbing.
Certificate Transparency logs expose subdomains via issued certs: query crt.sh with %.target.com and dedupe against DNS resolution.
Subdomain enumeration sources: amass, subfinder, dnsx for resolution, and permutation tools like alterx; validate with authoritative DNS to avoid wildcard false positives.
ASN-to-CIDR expansion (whois -h whois.radb.net, bgpq4) reveals owned netblocks that may host non-public services outside the named domain scope.
Google dorks: site:, inurl:, intitle:, filetype:, ext:; combine to find exposed admin panels, directory listings, and indexed config/backup files.
TheHarvester aggregates emails, hosts, and employee names from search engines and PGP keyservers; harvested emails feed password-spray and phishing-scope decisions.
Metadata in public documents (exiftool) can reveal usernames, internal paths, software versions, and printer/domain names useful for later enumeration.
Network and Service Exploitation (including Active Directory)
Nmap service detection: -sV for versions, -sC for default scripts, -p- for all TCP ports, and -sU for top UDP ports (161 SNMP, 137/138 NetBIOS, 500 IKE).
SMB enumeration: smbclient -L //host -N for shares, enum4linux-ng for users/shares/policy, and rpcclient for querydispinfo and enumdomusers with null or guest sessions.
Kerberos pre-auth enumeration: kerbrute userenum against port 88 identifies valid usernames without generating 4625 logon failures.
AS-REP roasting targets accounts with DONT_REQ_PREAUTH (GetNPUsers.py -no-pass); Kerberoasting requests TGS tickets for SPN accounts (GetUserSPNs.py) and cracks them offline.
AD attack path: LLMNR/NBT-NS poisoning (Responder) -> NTLMv2 capture -> relay (ntlmrelayx) or crack; SMB signing disabled is the precondition for relay.
BloodHound with SharpHound or bloodhound-python collects ACL, session, and group data; shortest paths to Domain Admin expose GenericAll, WriteDACL, and ForceChangePassword edges.
Zerologon (CVE-2020-1472) abuses Netlogon AES-CFB8 with zero IV; patched domains reject it, so verify patch level before attempting.
PrintNightmare (CVE-2021-34527) abuses the spooler driver-load path; check Spooler service state on DCs and member servers before testing.
Web Application Enumeration and Exploitation
Content discovery: ffuf/gobuster with SecLists wordlists; filter by status, size, and word count (-fs, -fc) to suppress wildcard 200 responses.
Virtual host discovery requires Host-header fuzzing (ffuf -H "Host: FUZZ.target.com") because vhosts often share one IP and return identical default pages.
Directory traversal payload variants: ../, ..%2f, %2e%2e%2f, and double-encoded %252e%252e%252f; success depends on server decode order.
SQL injection classes: in-band UNION, error-based, blind boolean, and time-based; sqlmap --risk/--level tuning and --technique selection control payload aggression.
Command injection separators: ; | || & && ` $() and newline %0a; blind variants are confirmed via time delays (sleep 5) or out-of-band DNS callbacks.
SSRF: test 127.0.0.1, localhost, 169.254.169.254 (cloud metadata), and decimal/octal IP encodings; blocklist bypasses include DNS rebinding and redirects.
File upload bypass: change Content-Type, use double extensions (.php.jpg), null bytes, .htaccess, and magic-byte prefixes; verify where files are stored and served.
JWT testing: alg:none, HS256 with a cracked/known secret, kid path traversal, and jku/x5u header injection; decode with jwt.io or jwt_tool.
Privilege Escalation (Linux and Windows)
Linux quick wins: sudo -l (NOPASSWD entries, GTFOBins), SUID/SGID binaries (find / -perm -4000 -type f 2>/dev/null), and capabilities (getcap -r / 2>/dev/null).
Cron and timer abuse: writable scripts, PATH hijack in cron jobs, wildcard injection (tar --checkpoint, rsync), and /etc/crontab readability.
Kernel exploits require exact version matching (uname -a); dirty pipe is CVE-2022-0847 (5.8-5.16.11), dirty COW is CVE-2016-5195 (2.6.22-4.8.3).
Linux credential sources: ~/.bash_history, ~/.ssh/id_rsa, /etc/shadow if readable, config files with DB passwords, and environment variables in /proc/*/environ.
Windows enumeration: whoami /priv, whoami /groups, systeminfo, and winPEAS; SeImpersonatePrivilege enables Potato-family attacks (JuicyPotato, PrintSpoofer, GodPotato).
Unquoted service paths and weak service ACLs (accesschk -wuvc) allow binary replacement; verify with sc qc and icacls on the service binary directory.
AlwaysInstallElevated (both HKLM and HKCU set to 1) permits MSI execution as SYSTEM via msiexec /quiet /qn /i payload.msi.
Stored credentials: cmdkey /list, runas /savecred, unattend.xml, GPP cpassword in SYSVOL (gpp-decrypt), and DPAPI blobs decrypted in user context.
Lateral Movement and Pivoting
SSH local forward: ssh -L 8080:internal:80 user@jump - local port 8080 reaches internal:80 through the jump host.
SSH remote forward: ssh -R 8080:localhost:80 user@external - the remote host's port 8080 reaches the client's local port 80.
SSH dynamic forward: ssh -D 1080 user@jump creates a SOCKS5 proxy; combine with proxychains4 for tools that lack native proxy support.
Chisel: server on pivot (chisel server -p 8000 --reverse), client connects with R:socks for a reverse SOCKS proxy when inbound access to the pivot is blocked.
Ligolo-ng uses a TUN interface (tun0) instead of SOCKS, giving full IP routing to internal subnets without proxychains and supporting ICMP and non-TCP traffic.
Meterpreter autoroute plus socks: route add 10.10.10.0/24 , then use auxiliary/server/socks_proxy to pivot through the session.
AD lateral movement: PsExec (SMB + service creation), WMI (wmic /node), WinRM (Enter-PSSession), and DCOM; each leaves distinct event log artifacts (7045, 4688, 4104).
Pass-the-Hash works over SMB/WMI with NTLM hashes (impacket psexec -hashes :NThash); it fails where NTLM is disabled or restricted admin is enforced.
Password Attacks and Credential Access
Hash formats: NTLM is 32 hex chars; NetNTLMv2 is captured challenge/response and is not usable for pass-the-hash; bcrypt starts $2a$/$2b$/$2y$.
Hashcat modes: 1000 = NTLM, 5600 = NetNTLMv2, 13100 = Kerberoast TGS-REP, 18200 = AS-REP, 22000 = WPA-PBKDF2.
John the Ripper uses --format= and auto-detects many formats; --wordlist with --rules expands candidates (append digits, capitalize, leetspeak).
Password spraying tries one or few passwords across many accounts to stay under lockout thresholds; verify the domain lockout policy first (net accounts /on DC).
Tools: crackmapexec/nxc smb with -u users -p pass --continue-on-success, and kerbrute passwordspray for Kerberos-based spraying without SMB.
Credential dumping: secretsdump.py for SAM/LSA/NTDS.dit, Mimikatz sekurlsa::logonpasswords for LSASS, and DCSync (DRSUAPI) for domain hashes given replication rights.
Linux credential stores: /etc/shadow (unshadow to combine with passwd), SSH private keys, browser saved passwords, and KeePass .kdbx files (keepass2john).
Offline cracking decisions: dictionary first, then rules, then mask/brute force; GPU hashcat benchmarks determine feasibility against password length and complexity.
Reporting and Communication of Findings
Report structure: executive summary, scope and methodology, risk overview, detailed findings, remediation guidance, and appendices with evidence.
Each finding records: title, severity, affected asset, description, reproduction steps, evidence, business impact, remediation, and references (CVE/CWE).
Severity should map to CVSS base plus environmental modifiers; a critical CVSS on an isolated lab host may be low business risk.
Evidence standards: redact passwords and PII, keep raw tool output, timestamp commands, and store hashes of evidence files for integrity.
Executive summary should state what was tested, what was found in business terms, and the top remediation priorities without exploit detail.
Remediation guidance must be actionable: patch version, configuration change, compensating control, and owner/priority where known.
Communication cadence: immediate notification for critical findings (domain compromise, exposed PII) per the rules of engagement, not only at final delivery.
Retest section defines what will be re-verified, the criteria for closure, and the date window; findings without retest remain open.
Post-Exploitation and Data Exfiltration
Post-exploitation priorities: situational awareness, privilege escalation, credential access, persistence (if in scope), lateral movement, and data collection.
Data staging: collect to one directory, compress (tar/zip), and hash before transfer; staging reduces transfer noise and enables integrity verification.
Exfiltration channels: HTTP(S) POST, DNS tunneling (dnscat2, iodine), ICMP, and cloud storage; DNS is chosen when egress filtering blocks TCP.
Linux transfer: python3 -m http.server, wget/curl, scp, and base64 chunks for small files; Windows: certutil -urlcache, Invoke-WebRequest, and SMB shares.
Persistence mechanisms (only when authorized): Linux cron/systemd/authorized_keys; Windows scheduled tasks, Run keys, and services - each must be documented and removed.
Anti-forensics awareness: timestomping, log clearing, and event log manipulation are detectable and often out of scope; confirm authorization before any such action.
Data handling: classify collected data, encrypt at rest, transfer over approved channels, and delete per retention terms after the engagement closes.
Cleanup verification: re-enumerate created accounts, services, scheduled tasks, and files; confirm removal with the same tooling used to create them.