OSCE3 cheat sheet

SQL injection UNION extraction requires equal column counts: determine count with ORDER BY n incrementing until error, then use NULL placeholders to find string-renderable positions.

Boolean-blind inference encodes one bit per request: compare SUBSTRING-based predicates against a known-true baseline and infer characters by binary search over ASCII range.

Time-based blind detection uses DBMS-specific sleep primitives: MySQL SLEEP(), PostgreSQL pg_sleep(), MSSQL WAITFOR DELAY, Oracle dbms_pipe.receive_message.

Second-order SQLi stores payload in one context (registration, profile) and triggers it where the value is concatenated later; test all write-then-read flows.

SSTI is confirmed by arithmetic evaluation in template syntax; Jinja2 {{77}}, Twig {{7'7'}}, Freemarker ${7*7} distinguish engines by output and error text.

XXE requires a DOCTYPE with an external entity; blind variants exfiltrate via out-of-band parameter entities (SYSTEM identifier pointing at an attacker-controlled DTD).

Deserialization sinks differ by language: Java readObject gadgets, PHP unserialize magic methods (__wakeup, __destruct), Python pickle, .NET BinaryFormatter and TypeNameHandling.

JWT weaknesses to test: alg:none acceptance, RS256-to-HS256 key confusion using the public key as HMAC secret, weak HMAC secrets crackable offline, and missing kid/jku validation.

Kerberoasting requests TGS tickets for accounts with SPNs; the ticket is encrypted with the service account's NTLM hash and crackable offline without touching the target host.

AS-REP roasting targets accounts with DONT_REQ_PREAUTH set; the AS-REP is encrypted with the account hash and can be cracked offline.

Unconstrained delegation hosts cache TGTs of any user authenticating to them; extracting LSASS yields reusable TGTs, and PrinterBug/Coerce forces a DC to authenticate.

Constrained delegation with protocol transition (TRUSTED_TO_AUTH_FOR_DELEGATION) allows S4U2Self plus S4U2Proxy to impersonate any user to the allowed service list.

Resource-based constrained delegation is configured by writing msDS-AllowedToActOnBehalfOfOtherIdentity on the target; the attacker needs a controlled account with an SPN plus S4U2Self/S4U2Proxy.

ACL abuse paths: GenericAll/GenericWrite on a user enables targeted Kerberoasting or password reset; WriteDACL grants DCSync rights; ForceChangePassword resets without knowing the old password.

DCSync requires Replicating Directory Changes and Replicating Directory Changes All; it pulls krbtgt and account hashes over DRSUAPI without executing code on the DC.

Golden Ticket is a forged TGT signed with the krbtgt hash; Silver Ticket is a forged service ticket signed with the service account hash and avoids DC contact.

AMSI scans script content at runtime in PowerShell, VBScript, JScript, and .NET; patching amsi.dll AmsiScanBuffer in-process disables scanning for that process only.

PowerShell Script Block Logging (event 4104) records deobfuscated script blocks; downgrade attacks use PowerShell v2 when available, which lacks logging and AMSI integration.

ETW providers such as Microsoft-Windows-DotNETRuntime and Threat-Intelligence feed EDR detections; patching EtwEventWrite suppresses userland telemetry but not kernel callbacks.

Sysmon Event ID 1 (process creation), 3 (network), 7 (image load), 8 (CreateRemoteThread), and 11 (file create) are the highest-value detection sources to plan around.

Direct syscalls bypass userland API hooks by invoking the syscall instruction with a manually resolved SSN; they do not bypass kernel callbacks such as PsSetCreateProcessNotifyRoutine.

Process injection detection hinges on memory protection transitions: RWX allocations, VirtualProtect to RX on private memory, and cross-process thread creation.

Named pipe impersonation requires SeImpersonatePrivilege; tools like PrintSpoofer and RoguePotato abuse it to obtain SYSTEM from a service account context.

Logon type matters for evasion: type 3 (network) leaves no interactive session, type 10 (RemoteInteractive) creates a session, and type 9 (NewCredentials) creates a network-only token.

Stack canary is a per-process (or per-thread) random value placed before the saved return address; a leak of the canary plus an overflow that preserves it defeats the check.

ASLR randomizes base addresses; a PIE binary also randomizes its own code, so a code pointer leak is needed to compute gadget addresses.

NX/DEP makes stack memory non-executable, forcing ROP: chain gadgets ending in ret to set registers, then invoke a syscall or libc function.

Partial RELRO leaves the GOT writable; full RELRO maps it read-only after relocation, so GOT overwrite requires an arbitrary write primitive elsewhere.

Format string %n writes the count of bytes printed so far; positional specifiers like %7$n target the nth stack argument, enabling arbitrary writes with width padding.

Heap exploitation primitives: use-after-free, double free (tcache/fastbin dup), and unsafe unlink; glibc tcache lacks safe-linking before 2.32 and uses it after.

ret2libc requires the libc base, obtained via a leaked GOT entry; the offset from the leaked function to system('/bin/sh') is fixed for a given libc build.

SROP uses sigreturn to load a full register context from the stack; it needs only a syscall gadget and control of the frame to set rax=15 and execve.