OSC cheat sheet

Passive OSINT precedes active scanning: WHOIS, DNS (A, AAAA, MX, TXT, NS, SOA), certificate transparency (crt.sh), and search-engine dorking reveal hosts and technologies without touching target infrastructure.

Active host discovery: ARP requests only work on the local broadcast domain; ICMP echo is often filtered, so combine TCP SYN to common ports (80, 443, 22) and UDP probes to 161 and 137 for reliable discovery.

TCP connect scan (-sT) completes the three-way handshake and is logged by the target; SYN scan (-sS) requires raw-socket privilege and is not logged by most applications, but both are visible to network IDS.

Nmap service/version detection (-sV) and default NSE scripts (-sC) map open ports to software and versions; OS fingerprinting (-O) needs at least one open and one closed port for confidence.

UDP scanning is slow because closed ports may not reply; ICMP port-unreachable indicates closed, no response indicates open|filtered. Use --min-rate and retries to bound runtime.

DNS zone transfer (AXFR) succeeds only when the nameserver misconfigures allow-transfer; enumerate with dig axfr @ns target, and also try NSEC/NSEC3 walking for DNSSEC zones.

SMB enumeration: enum4linux-ng or smbclient -L //host -N lists shares and users; rpcclient with a null session can query users, groups, and password policy when RestrictAnonymous is disabled.

SNMP community strings (default public/private) expose interface, ARP, and process tables via snmpwalk -v2c -c public; SNMPv3 requires credentials, so try v1/v2c first.

Web enumeration: directory brute force (ffuf, feroxbuster) with status-code and size filters, virtual-host fuzzing via Host header, and technology fingerprinting from response headers, cookies, and error pages.

CVE identifies a specific vulnerability; CVSS base score combines exploitability (AV, AC, PR, UI) and impact (C, I, A) metrics. A score of 9.0–10.0 is Critical, 7.0–8.9 High, 4.0–6.9 Medium.

Authenticated scans find far more issues than unauthenticated scans because they can read installed patch levels, registry keys, and configuration files instead of inferring from banners.

False positives from banner grabbing are common: confirm version strings against the actual package (dpkg -l, rpm -q, registry Uninstall keys) before reporting.

Nessus/OpenVAS plugin output includes the plugin ID and the exact request/response evidence; cite that evidence in the report rather than the CVSS score alone.

Manual validation: reproduce the condition (e.g., default credentials, exposed .git, directory listing) with a minimal request and capture the request/response pair as proof.

Web vulnerability classes to test manually: injection (SQLi, command, LDAP), broken access control (IDOR, forced browsing), authentication flaws, and insecure deserialization.

CVE/NVD and vendor advisories are the source of truth for affected version ranges; exploit-db and GitHub PoCs indicate exploitability but must be tested in a lab before use.

Risk rating combines likelihood (exposure, exploit maturity) and impact (data sensitivity, blast radius); a CVSS 9.8 on an isolated lab host may be lower business risk than a CVSS 6.5 on an internet-facing domain controller.

Metasploit workflow: search, use, show options, set RHOSTS/LHOST/LPORT, check (if supported), exploit; use a reverse shell when the target can reach the attacker, bind shell when it cannot.

Payload choice: staged payloads (windows/x64/meterpreter/reverse_tcp) send a small stager first; stageless payloads (…/meterpreter_reverse_tcp) are larger but more reliable across filtered networks.

msfvenom -p LHOST=… LPORT=… -f -o generates standalone payloads; match the architecture and format (exe, elf, war, asp, aspx) to the target.

SQL injection to code execution: UNION-based extraction of credentials, then INTO OUTFILE (MySQL) or xp_cmdshell (MSSQL, requires sysadmin) to write a web shell or run commands.

File upload bypass: test extension blacklists with alternative extensions (.php5, .phtml, .phar), content-type and magic-byte checks, and path traversal in the filename.

Deserialization exploits (Java ysoserial, .NET ysoserial.net, PHP) require a gadget chain on the classpath; confirm the library version before selecting a chain.

Client-side initial access: phishing payloads, macro-enabled documents, and LNK/HTA files; OPSEC requires disabling macros prompts or using signed binaries where possible.

Password spraying uses one password against many accounts to avoid lockout; track the lockout threshold and reset window from the domain password policy before spraying.

Linux enumeration: id, sudo -l, uname -a, cat /etc/os-release, find / -perm -4000 -type f 2>/dev/null (SUID), getcap -r / 2>/dev/null (capabilities), and cron jobs in /etc/crontab and /etc/cron.*.

GTFOBins catalogs binaries that escalate when SUID, sudo-allowed, or given capabilities; e.g., sudo vim, sudo find . -exec /bin/sh ; , or SUID nmap --interactive.

Writable PATH or cron script directories allow privilege escalation when a root-run job calls a binary by relative name; verify with ls -la on the script and its directory.

Kernel exploits require matching the exact kernel version and distribution build; check uname -r against the exploit's target range and prefer a lab-tested exploit.

Windows enumeration: whoami /priv, whoami /groups, systeminfo, net user, net localgroup administrators, and accesschk for service and directory permissions.

SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege enables token impersonation attacks (Juicy Potato, Rogue Potato, PrintSpoofer) when a privileged service can be coerced.

Unquoted service paths with a space and a writable parent directory allow binary planting; check with wmic service get name,displayname,pathname,startmode | findstr /i auto.

AlwaysInstallElevated (both HKLM and HKCU policy set to 1) lets any user install an MSI as SYSTEM; verify both registry keys before attempting.

Credential stores to check: Linux /etc/shadow (if readable), .bash_history, SSH keys, and config files; Windows SAM/SYSTEM hive copies, LSASS, and unattend.xml/sysprep files.

Kerberoasting requests service tickets (TGS) for accounts with SPNs and cracks them offline; RC4 (etype 23) tickets crack faster than AES, and no special privilege is needed beyond a domain user.

AS-REP roasting targets accounts with 'Do not require Kerberos preauthentication'; request the AS-REP and crack the encrypted timestamp offline.

Kerberos delegation: unconstrained delegation caches TGTs of connecting users (extractable via Mimikatz); constrained delegation abuses S4U2Self/S4U2Proxy; resource-based constrained delegation is configured on the target computer object.

ACL abuse: GenericAll, GenericWrite, WriteDACL, WriteOwner, and ForceChangePassword on a user or group allow takeover; BloodHound edges map these paths to Domain Admin.

BloodHound collection (SharpHound) gathers users, groups, computers, sessions, and ACLs; shortest paths to Domain Admin and Kerberoastable users are the primary queries.

DCSync requires Replicating Directory Changes (DS-Replication-Get-Changes and -Get-Changes-All) rights, held by Domain Admins, Enterprise Admins, and often by Exchange Windows Permissions.

Golden Ticket forges a TGT with the krbtgt hash; Silver Ticket forges a service ticket with the service account hash. krbtgt rotation twice invalidates golden tickets.

AD CS abuse (ESC1–ESC8): ESC1 is a template allowing requester-supplied subject with client-auth EKU; ESC8 is NTLM relay to the CA's HTTP enrollment endpoint.

Situational awareness first: whoami /all or id, hostname, ipconfig /all or ip a, netstat -ano or ss -tulpn, and the routing table define what the host can reach.

Credential harvesting on Windows: Mimikatz sekurlsa::logonpasswords (LSASS), sekurlsa::ekeys, and lsadump::sam; on Linux read /etc/shadow, ~/.ssh, and application config files.

Persistence mechanisms: scheduled tasks, services, WMI event subscriptions, registry Run keys (Windows); cron, systemd units, and .bashrc (Linux).

Data exfiltration channels include DNS tunneling, HTTPS to attacker infrastructure, and cloud storage; chunk and encrypt data, and prefer protocols already allowed by egress filtering.

Lateral movement requires reusable credentials: NTLM hashes (pass-the-hash), Kerberos tickets (pass-the-ticket), or cleartext passwords; prefer Kerberos where NTLM is restricted.

Logging to consider: Windows Security log (4624 logon, 4625 failure, 4688 process creation), Sysmon, and Linux auditd/journald. Clearing logs (wevtutil cl) is noisy and often detected.

Anti-forensics is not a substitute for OPSEC: timestomping, log clearing, and secure deletion leave their own artifacts; document all actions for the report instead.

SSH local port forward (-L localport:target:targetport) exposes a remote service on the attacker's localhost; remote forward (-R) exposes an attacker service to the target network.

SSH dynamic forward (-D 1080) creates a SOCKS proxy; combine with proxychains to route tools through the pivot without per-tool configuration.

Chisel, Ligolo-ng, and socat create tunnels when SSH is unavailable; Ligolo-ng presents a TUN interface so tools work without proxychains.

Meterpreter: route add and portfwd add -l -p -r extend reach into the target network from an existing session.

Pass-the-hash uses the NTLM hash directly with tools like crackmapexec, impacket-wmiexec, or impacket-psexec; no cleartext password is required.

WinRM (5985/5986) and SMB (445) are the most common lateral movement protocols; RDP (3389) requires interactive access and is more visible.

Pivoting through a compromised host requires it to have routing to the next subnet; verify with ip route or route print before configuring the tunnel.

Report structure: executive summary, scope and methodology, findings (each with title, severity, affected assets, evidence, impact, remediation), and appendices.

Every finding needs reproducible evidence: request/response pairs, command output, screenshots with timestamps, and the exact tool version used.

Severity ratings should state the framework (CVSS v3.1 base plus environmental modifiers) and justify any deviation from the base score in business terms.

Remediation guidance is specific and actionable: patch version, configuration change, or compensating control, with a priority order tied to risk.

Maintain a timestamped activity log during testing so the report can reconstruct the timeline and distinguish tested from untested scope.

Redact sensitive data (passwords, PII, hashes) in the report body and store evidence in an encrypted repository with access controls.

Deliverables should include a retest plan: define which findings will be revalidated and how success is measured.