PJPT cheat sheet

Passive recon touches no target infrastructure: WHOIS/RDAP records, DNS history, certificate transparency logs (crt.sh), Shodan/Censys banners, and job postings reveal naming conventions and technology stacks without sending packets to the client.

DNS record types map to assets: A/AAAA = hosts, MX = mail provider, TXT = SPF/DMARC and domain-verification tokens (which disclose SaaS vendors), NS = DNS hoster, and CNAME chains often leak cloud service names.

Subdomain enumeration order: passive sources first (crt.sh, SecurityTrails, amass passive), then active brute force with a wordlist; a wildcard DNS record makes brute force unreliable, so resolve a random label first to detect it.

OSINT for people and email formats: LinkedIn, GitHub commit metadata (author emails), and breach aggregators; email pattern discovery enables username guessing against VPN, OWA, and O365.

Google dorks: site:, filetype: (xls, pdf, bak, sql), inurl:, intitle: ("index of"), and -site: to exclude noise; combine with the client domain to find exposed documents and directory listings.

Certificate transparency logs are permanent: expired subdomains found there often still resolve internally or to forgotten staging hosts with weaker controls.

Metadata in publicly posted PDFs and Office files (author, software, internal paths, printer names) supports social engineering and internal naming discovery.

Scope check precedes any active query: confirm the target's IP ranges and domains in the signed authorization, since recon against out-of-scope assets is unauthorized activity even without exploitation.

Nmap TCP connect scan (-sT) completes the handshake and works without raw-socket privileges; SYN scan (-sU/-sS) is faster and stealthier but requires root and is stopped by stateful firewalls that drop half-open connections.

Port state semantics: open = SYN/ACK or ACK received; closed = RST; filtered = no response or ICMP unreachable; open|filtered = no response, as with UDP scans.

Service/version detection (-sV) and default scripts (-sC) are separate passes; -sV intensity (--version-intensity 0-9) trades accuracy for speed, and -A bundles OS detection, version, scripts, and traceroute.

Timing templates -T0 to -T5 control parallelism and timeouts; -T4 is typical for LAN assessments, while rate limiting (-T2, --max-rate) avoids IDS alerts and service crashes on fragile devices.

UDP scanning is slow because open|filtered requires retries; target likely services (53, 67/68, 123, 161, 500) with --top-ports and a longer --host-timeout rather than scanning all 65535 ports.

Enumeration is protocol-specific: SMB (smbclient -L, enum4linux-ng, smbmap), SNMP (snmpwalk with community strings public/private), LDAP (ldapsearch -x -H ldap://IP -b "dc=corp,dc=local"), NFS (showmount -e), and RPC (rpcdump).

Version banners map to CVE research: searchsploit, NVD, and vendor advisories; a version string alone is not proof of exploitability, so confirm with a benign check before launching an exploit.

Nmap output formats: -oN normal, -oX XML for tool import (Metasploit db_import, EyeWitness), -oG grepable for shell parsing; always save results for the report evidence trail.

The exploitation decision rule: a vulnerability is exploitable only when the vulnerable code path is reachable with attacker-controlled input and the required preconditions (auth level, configuration) hold; verify both before firing a payload.

Metasploit workflow: search, use, show options, set RHOSTS/LHOST/LPORT, check (when a check method exists), exploit; sessions -i to interact, and background with Ctrl+Z to keep a session while running more modules.

Reverse shells are preferred over bind shells because egress filtering is rarer than ingress filtering; a listener on the tester's host (nc -lvnp PORT, or msf multi/handler) receives the callback.

Payload staging: staged payloads (windows/x64/meterpreter/reverse_tcp) fetch a second stage and are smaller on the wire; stageless (…_reverse_tcp with / or _) survive egress proxies that block the second download.

Shell stabilization on Linux: python3 -c 'import pty;pty.spawn("/bin/bash")', then Ctrl+Z, stty raw -echo, fg, export TERM=xterm; this restores job control, tab completion, and clears the need for -i on su/sudo.

Password attacks: hydra for network services (ssh, rdp, ftp, http-post-form), and offline cracking with hashcat -m mode (1000 NTLM, 1800 sha512crypt, 13100 Kerberoast) using rockyou or rules; lockout policy limits online spraying to 1-2 attempts per account per window.

Post-exploitation hygiene: record the exact command and timestamp of every action, avoid destructive changes, and check for host-based monitoring (EDR, sysmon) before running noisy tools like mimikatz or nmap from the host.

Proof of exploitation is minimum necessary: a whoami/hostname output or a benign file read is sufficient evidence; never exfiltrate real customer data or modify production records to demonstrate impact.

Unauthenticated AD attack path: enumerate the DC (port 88 Kerberos, 389/636 LDAP, 445 SMB, 53 DNS), attempt AS-REP roasting (users with DONT_REQ_PREAUTH) and password spraying, then move to authenticated enumeration with any valid credential.

Kerberoasting: request a service ticket for any account with an SPN (GetUserSPNs.py -request), then crack offline with hashcat -m 13100; success depends on the service account's password strength, and the request itself is legitimate Kerberos traffic.

AS-REP roasting: accounts with Kerberos pre-authentication disabled return an encrypted AS-REP crackable offline with hashcat -m 18200; no credentials are needed, only a username list.

BloodHound ingests SharpHound/BloodHound.py collection data (users, groups, sessions, ACLs) and reveals shortest paths to Domain Admin; the key edges are GenericAll, WriteDACL, ForceChangePassword, AddMember, and DCSync rights.

ACL abuse requires only the right object permission: GenericAll on a user allows a password reset; WriteDACL allows granting DCSync; ForceChangePassword allows setting a new password without knowing the old one.

Delegation: unconstrained delegation hosts cache TGTs (capture with Rubeus monitor or PrinterBug coercion); constrained delegation is abused via S4U2Self/S4U2Proxy for any allowed service; resource-based constrained delegation is abused by writing msDS-AllowedToActOnBehalfOfOtherIdentity.

NTLM relay requires SMB signing disabled on the target; coerce authentication with PetitPotam/PrinterBug to a relay listener (ntlmrelayx.py) to gain LDAP or SMB access without cracking any hash.

DCSync requires Replicating Directory Changes (All) rights on the domain object; mimikatz lsadump::dcsync or secretsdump.py -just-dc-ntlm extracts krbtgt and account hashes, and a golden ticket forged from krbtgt persists until that account is rotated twice.

Post-compromise cleanup guidance for the report: identify where Tier 0 credentials were exposed, rotate krbtgt, and document every account and host touched so the client can scope remediation.

Map the attack surface first: crawl with an authenticated session (Burp, ZAP, katana), enumerate parameters from JS files and API docs, and check robots.txt, sitemap.xml, and .well-known paths for hidden endpoints.

Access control testing: change object IDs and user identifiers (IDOR), remove role parameters, and replay requests with a lower-privileged session; vertical and horizontal privilege escalation are separate findings.

Injection decision rule: input reaches a parser (SQL, LDAP, OS command, template, XPath) without contextual encoding; confirm SQLi with a boolean or time-based payload, then use sqlmap with a saved request file to preserve cookies and headers.

XSS types: reflected (payload in the immediate response), stored (persisted and served to other users), DOM-based (sink such as innerHTML or eval receives source data); test the sink, not just the response body.

File upload and path traversal: test extension bypasses (.php5, .phtml, double extensions, content-type and magic-byte checks), and traversal payloads with encoding variants (%2e%2e%2f, ..%5c) against file-serving parameters.

Authentication and session flaws: default credentials, username enumeration via response timing or messages, weak password reset tokens, missing MFA on API endpoints, and session cookies lacking HttpOnly, Secure, or SameSite.

API-specific testing: check for excessive data exposure (verbose JSON objects), mass assignment (adding role=admin to a profile update), and missing rate limits on OTP and login endpoints.

SSRF and XXE confirm out-of-band: use a collaborator or listener to catch DNS/HTTP callbacks; for XXE, an external entity pointing to your listener proves file or network access without dumping sensitive data.

Monitor mode is required for capture: airmon-ng start wlan0 creates wlan0mon; injection support depends on the chipset and driver, and must be verified with aireplay-ng --test before any attack is attempted.

WPA2-PSK handshake capture: airodump-ng -c CH --bssid BSSID -w cap wlan0mon, then force a reconnect with aireplay-ng --deauth N -a BSSID -c CLIENT; the 4-way handshake is cracked offline with aircrack-ng or hashcat -m 22000 against a wordlist.

PMKID attack needs no client: hcxdumptool or the airodump-ng PMKID capture collects the PMKID from the AP's first EAPOL message, cracked offline with hashcat -m 22000; effectiveness varies by AP vendor.

WPS PIN attacks (reaver, bully) exploit the 8-digit PIN split into two halves, reducing the search space; many APs implement lockout after failures, and modern firmware disables WPS by default.

WPA3-SAE resists offline dictionary attacks; the dragonblood weaknesses concern downgrade to WPA2 and side channels, so a WPA3 network is typically attacked via transition-mode downgrade or a rogue AP rather than handshake cracking.

Evil twin and captive portal: hostapd-wpe or a rogue AP clones the SSID, and clients that auto-connect may send credentials to the portal; enterprise (802.1X) clients can leak MSCHAPv2 challenge/response, cracked with asleap.

WPA2-Enterprise testing: capture EAPOL with a rogue RADIUS (hostapd-wpe), crack the MSCHAPv2 exchange offline, and check whether client certificates are validated; without server validation, clients are trivially phished.

Legal boundary: wireless testing is limited to SSIDs and BSSIDs named in the authorization; deauthentication of client devices and rogue APs affect third parties and require explicit written approval.

The authorization document (rules of engagement) must define scope (IPs, domains, SSIDs), test window, allowed techniques, emergency contacts, and data-handling rules; testing outside these terms is unauthorized access regardless of intent.

Report structure: executive summary (business risk in plain language), methodology and scope, findings ranked by severity, evidence per finding, and remediation guidance; the executive summary must be readable without technical background.

A finding needs four elements: title, affected asset, reproducible reproduction steps with request/response or command evidence, and a concrete remediation; a scanner screenshot alone is not a finding.

Severity scoring: CVSS base score reflects technical impact, but the report should adjust with environmental context (exposure, data sensitivity, compensating controls) and state the adjustment rationale explicitly.

Evidence handling: redact passwords, hashes, and personal data; store captures and screenshots with timestamps, and retain them per the agreed destruction timeline after report delivery.

Chain of custody and logging: keep a timestamped activity log (commands, tools, source IP) so any client question about a specific packet can be answered and attributed to the engagement.

Disclosure and liability: report critical findings to the primary contact immediately rather than waiting for the final report; do not publish or share findings outside the agreed channel without written consent.

Retest and closure: define which findings will be retested, and document remediation verification separately from the original assessment so the client has a clear before/after record.

Passive recon sends no traffic to client systems: WHOIS/RDAP, certificate transparency (crt.sh), DNS history, Shodan/Censys banners, and public job postings reveal infrastructure and technology without touching the target.

DNS record roles: MX identifies the mail provider, TXT holds SPF/DMARC and third-party domain-verification tokens that disclose SaaS vendors, and NS reveals the DNS hoster.

Detect wildcard DNS before subdomain brute force: resolve a random nonexistent label; if it answers, brute-force results are false positives and passive sources must be relied on.

Certificate transparency logs are permanent and often list expired subdomains that still resolve to forgotten staging or internal hosts with weaker controls.

Email format discovery (LinkedIn, GitHub commit author metadata, breach data) creates valid usernames for later spraying against VPN, OWA, and O365.

Google dorks combine site:, filetype:, inurl:, and intitle: to locate exposed documents, directory listings, and backup files on the client domain.

Public document metadata (author, software, internal file paths) supports social engineering and reveals internal naming conventions.

Scope verification precedes active queries: recon against out-of-scope IPs or domains is unauthorized activity even when no exploitation occurs.

Port state meaning: open = SYN/ACK or ACK, closed = RST, filtered = no reply or ICMP unreachable, open|filtered = no reply (typical of UDP), so absence of a reply is not proof of closure.

Nmap -sT completes the TCP handshake and needs no root but is logged by the target; -sS is faster and less logged but requires raw-socket privileges and is blocked by stateful firewalls.

-sV performs version detection and -sC runs default scripts; -A combines OS detection, version detection, scripts, and traceroute in one pass.

Timing: -T4 suits stable LAN targets; -T2 or --max-rate reduces IDS alerts and prevents crashing fragile embedded devices during a scan.

UDP scans are slow because open|filtered requires retransmission; limit to likely services (53, 123, 161, 500) with --top-ports and a generous --host-timeout.

Protocol enumeration tools: smbclient -L and enum4linux-ng for SMB, snmpwalk for SNMP community strings, ldapsearch for LDAP naming contexts, showmount -e for NFS exports.

Version banners feed CVE research via searchsploit and NVD, but a banner is not proof of exploitability; confirm with a benign check before launching an exploit.

Save scan output with -oN, -oX (XML for Metasploit db_import and EyeWitness), and -oG (grepable) to preserve an evidence trail for the report.

Exploitability requires a reachable vulnerable code path plus attacker-controlled input and met preconditions (auth level, configuration); verify both before sending a payload.

Metasploit flow: search, use, show options, set RHOSTS/LHOST/LPORT, run check when available, exploit; background a session with Ctrl+Z and re-enter with sessions -i.

Reverse shells beat bind shells because egress filtering is less common than ingress filtering; a listener (nc -lvnp PORT or multi/handler) receives the callback.

Staged payloads fetch a second stage and are smaller; stageless variants survive egress proxies that block the second download.

Linux shell upgrade: python3 pty.spawn('/bin/bash'), Ctrl+Z, stty raw -echo, fg, export TERM=xterm restores job control, tab completion, and interactive su/sudo.

Online password attacks: hydra for ssh/rdp/ftp/http-post-form; lockout policy caps attempts to roughly one or two per account per lockout window.

Offline hash cracking uses hashcat -m mode: 1000 NTLM, 1800 sha512crypt, 13100 Kerberoast, 22000 WPA; mode mismatch produces no cracks.

Proof of exploitation is minimum necessary: whoami or hostname output suffices; never exfiltrate customer data or alter production records to show impact.

Unauthenticated AD path: enumerate DC ports (88, 389/636, 445, 53), attempt AS-REP roasting and password spraying, then switch to authenticated enumeration once any credential is valid.

Kerberoasting requests a service ticket for any SPN-bearing account (GetUserSPNs.py -request) and cracks it offline with hashcat -m 13100; the request is ordinary Kerberos traffic.

AS-REP roasting targets accounts with pre-authentication disabled; the returned AS-REP cracks offline with hashcat -m 18200 and needs only a username list.

BloodHound (SharpHound or BloodHound.py collection) maps users, groups, sessions, and ACLs to shortest paths to Domain Admin; key edges include GenericAll, WriteDACL, ForceChangePassword, AddMember, and DCSync.

ACL abuse needs only object permissions: GenericAll on a user permits a password reset, WriteDACL permits granting DCSync, and ForceChangePassword sets a password without the old one.

Unconstrained delegation hosts cache TGTs, capturable with Rubeus monitor plus PrinterBug coercion; constrained delegation is abused via S4U2Self/S4U2Proxy; RBCD via msDS-AllowedToActOnBehalfOfOtherIdentity.

NTLM relay requires SMB signing disabled on the target; PetitPotam or PrinterBug coerces authentication to ntlmrelayx.py for LDAP or SMB access without cracking any hash.

DCSync needs Replicating Directory Changes (All) on the domain object; secretsdump -just-dc-ntlm or mimikatz dcsync extracts krbtgt, and a golden ticket persists until krbtgt is rotated twice.

Map the surface with an authenticated crawl (Burp, ZAP, katana), extract parameters from JavaScript files and API docs, and check robots.txt, sitemap.xml, and .well-known paths.

Access control tests: change object IDs and user identifiers (IDOR), remove or modify role parameters, and replay requests with a lower-privileged session; vertical and horizontal escalation are separate findings.

SQLi confirmation: boolean-based or time-based payloads prove injection; then sqlmap with a saved request file preserves cookies, headers, and session state.

XSS classes: reflected in the immediate response, stored and served to other users, DOM-based where a sink (innerHTML, eval) receives source data; test the sink, not just the response body.

Upload bypasses to test: alternate extensions (.php5, .phtml), double extensions, content-type checks, and magic-byte validation; traversal variants include %2e%2e%2f and ..%5c.

Authentication flaws: default credentials, username enumeration via timing or messages, weak reset tokens, missing MFA on API endpoints, and cookies lacking HttpOnly, Secure, or SameSite.

API testing: look for excessive data exposure in JSON responses, mass assignment (adding role=admin to a profile update), and missing rate limits on OTP and login endpoints.

SSRF and XXE are confirmed out-of-band: a collaborator or listener catching DNS/HTTP callbacks proves access without dumping sensitive data.

Monitor mode (airmon-ng start wlan0 creates wlan0mon) is required for capture; injection depends on chipset and driver and must be verified with aireplay-ng --test.

WPA2 handshake capture: airodump-ng -c CH --bssid BSSID -w cap wlan0mon, force reconnect with aireplay-ng --deauth, then crack offline with aircrack-ng or hashcat -m 22000.

PMKID capture (hcxdumptool or airodump-ng) needs no client and cracks offline with hashcat -m 22000; effectiveness varies by AP vendor and firmware.

WPS PIN attacks (reaver, bully) exploit the PIN split into two halves, shrinking the search space; many APs lock out after failures and modern firmware disables WPS.

WPA3-SAE resists offline dictionary attacks; practical paths are transition-mode downgrade to WPA2 or a rogue AP, not handshake cracking.

Evil twin and captive portal: hostapd-wpe or a rogue AP clones the SSID; auto-connecting clients may submit credentials, and 802.1X clients can leak MSCHAPv2 challenge/response cracked with asleap.

WPA2-Enterprise testing captures EAPOL via a rogue RADIUS (hostapd-wpe), cracks MSCHAPv2 offline, and checks whether clients validate the server certificate.

Wireless scope is limited to authorized SSIDs and BSSIDs; deauth and rogue APs affect third parties and require explicit written approval.

The rules of engagement must state scope (IPs, domains, SSIDs), test window, allowed techniques, emergency contacts, and data handling; activity outside them is unauthorized access.

Report structure: executive summary in business language, methodology and scope, findings ranked by severity, evidence per finding, and remediation guidance.

A finding requires four elements: title, affected asset, reproducible steps with request/response or command evidence, and concrete remediation; a scanner screenshot alone is insufficient.

Severity uses CVSS base score adjusted by environmental context (exposure, data sensitivity, compensating controls), with the adjustment rationale stated explicitly.

Evidence handling: redact passwords, hashes, and personal data; timestamp captures and screenshots; retain and destroy per the agreed timeline.

Keep a timestamped activity log of commands, tools, and source IPs so any client question about a specific packet can be attributed to the engagement.

Report critical findings to the primary contact immediately rather than waiting for the final report; share findings only through the agreed channel without written consent.

Retesting is documented separately from the original assessment, giving the client a clear before-and-after remediation record.

Passive reconnaissance sends zero packets to the client: WHOIS/RDAP, certificate transparency logs, DNS history, Shodan banners, and job postings supply the initial asset picture.

MX records identify the mail provider, TXT records carry SPF/DMARC plus SaaS domain-verification tokens, and NS records name the DNS hoster.

Wildcard DNS breaks subdomain brute force: resolve a random label first; a wildcard answer means brute-force hits are false positives.

Certificate transparency logs are permanent and often reveal expired subdomains still resolving to forgotten staging hosts with weaker controls.

Email format discovery via LinkedIn, GitHub commit author metadata, and breach data produces valid usernames for later spraying.

Google dorks (site:, filetype:, inurl:, intitle:) locate exposed documents, backup files, and directory listings on the client domain.

Public PDF and Office metadata (author, software, internal paths) supports social engineering and exposes internal naming conventions.

Confirm scope in the signed authorization before any active query; recon against out-of-scope assets is unauthorized activity even without exploitation.

Port states: open = SYN/ACK or ACK, closed = RST, filtered = no reply or ICMP unreachable, open|filtered = no reply (typical UDP); no reply never proves closure.

-sT completes the handshake and needs no root but is logged; -sS is faster and less logged but requires raw sockets and is defeated by stateful firewalls.

-sV detects versions, -sC runs default scripts, and -A bundles OS detection, version detection, scripts, and traceroute.

-T4 suits stable LAN targets; -T2 or --max-rate reduces IDS alerts and avoids crashing fragile embedded devices.

UDP scanning is slow because open|filtered needs retransmission; restrict to likely services (53, 123, 161, 500) with --top-ports and a longer --host-timeout.

Enumeration tools: smbclient -L and enum4linux-ng for SMB, snmpwalk for SNMP, ldapsearch for LDAP naming contexts, showmount -e for NFS exports.

Banners feed CVE research via searchsploit and NVD, but a banner is not proof of exploitability; confirm with a benign check first.

Preserve output with -oN, -oX for Metasploit db_import and EyeWitness, and -oG for shell parsing as report evidence.

An exploit works only when the vulnerable path is reachable, input is attacker-controlled, and preconditions (auth level, configuration) are met; verify before firing.

Metasploit flow: search, use, show options, set RHOSTS/LHOST/LPORT, run check if available, exploit; Ctrl+Z backgrounds a session and sessions -i returns to it.

Reverse shells are preferred because egress filtering is rarer than ingress filtering; nc -lvnp or multi/handler receives the callback.

Staged payloads download a second stage and are smaller on the wire; stageless payloads survive proxies that block the second download.

Linux shell upgrade: pty.spawn('/bin/bash'), Ctrl+Z, stty raw -echo, fg, export TERM=xterm restores job control and interactive su/sudo.

Hydra handles online attacks against ssh, rdp, ftp, and http-post-form; lockout policy limits attempts to one or two per account per window.

Hashcat -m modes: 1000 NTLM, 1800 sha512crypt, 13100 Kerberoast, 22000 WPA; a wrong mode yields no cracks.

Proof of exploitation is minimum necessary: whoami or hostname output is enough; never exfiltrate customer data or modify production records.

Unauthenticated AD path: enumerate DC ports (88, 389/636, 445, 53), try AS-REP roasting and spraying, then continue with authenticated enumeration once a credential works.

Kerberoasting requests a service ticket for any SPN account (GetUserSPNs.py -request) and cracks it offline with hashcat -m 13100; the traffic is ordinary Kerberos.

AS-REP roasting targets accounts without pre-authentication; the AS-REP cracks offline with hashcat -m 18200 using only a username list.

BloodHound maps users, groups, sessions, and ACLs to shortest paths to Domain Admin; key edges are GenericAll, WriteDACL, ForceChangePassword, AddMember, and DCSync.

GenericAll on a user allows a password reset, WriteDACL allows granting DCSync, and ForceChangePassword sets a password without knowing the old one.

Unconstrained delegation hosts cache TGTs (Rubeus monitor plus PrinterBug coercion); constrained delegation is abused via S4U2Self/S4U2Proxy; RBCD via msDS-AllowedToActOnBehalfOfOtherIdentity.

NTLM relay requires SMB signing disabled; PetitPotam or PrinterBug coerces authentication to ntlmrelayx.py for LDAP or SMB access without cracking hashes.

DCSync needs Replicating Directory Changes (All); secretsdump -just-dc-ntlm extracts krbtgt, and a golden ticket persists until krbtgt is rotated twice.

Crawl with an authenticated session (Burp, ZAP, katana), mine parameters from JavaScript and API docs, and check robots.txt, sitemap.xml, and .well-known paths.

IDOR testing changes object IDs and user identifiers; vertical and horizontal privilege escalation are reported as separate findings.

SQLi is confirmed with boolean or time-based payloads, then sqlmap with a saved request file preserves cookies, headers, and session state.

XSS classes: reflected, stored, and DOM-based where a sink (innerHTML, eval) receives source data; test the sink, not just the response body.

Upload bypasses include .php5 and .phtml, double extensions, content-type checks, and magic bytes; traversal variants include %2e%2e%2f and ..%5c.

Auth flaws: default credentials, username enumeration by timing or message, weak reset tokens, missing MFA on APIs, and cookies lacking HttpOnly, Secure, or SameSite.

API testing looks for excessive data exposure, mass assignment (adding role=admin), and missing rate limits on OTP and login endpoints.

SSRF and XXE are confirmed out-of-band with a collaborator or listener catching DNS/HTTP callbacks, avoiding sensitive data dumps.

Monitor mode (airmon-ng start wlan0 gives wlan0mon) is required for capture; injection depends on chipset and driver and is verified with aireplay-ng --test.

WPA2 handshake capture: airodump-ng -c CH --bssid BSSID -w cap wlan0mon, aireplay-ng --deauth to force reconnect, then crack offline with aircrack-ng or hashcat -m 22000.

PMKID capture needs no client and cracks offline with hashcat -m 22000; effectiveness varies by AP vendor and firmware.

WPS PIN attacks (reaver, bully) exploit the two-half PIN split; many APs lock out after failures and modern firmware disables WPS.

WPA3-SAE resists offline dictionary attacks; practical paths are transition-mode downgrade to WPA2 or a rogue AP.

Evil twin via hostapd-wpe or a rogue AP clones the SSID; auto-connecting clients may submit credentials, and 802.1X clients leak MSCHAPv2 challenge/response cracked with asleap.

WPA2-Enterprise testing captures EAPOL through a rogue RADIUS, cracks MSCHAPv2 offline, and checks client server-certificate validation.

Wireless scope covers only authorized SSIDs and BSSIDs; deauth and rogue APs affect third parties and need explicit written approval.

Rules of engagement state scope (IPs, domains, SSIDs), test window, allowed techniques, emergency contacts, and data handling; activity outside them is unauthorized access.

Report structure: business-language executive summary, methodology and scope, severity-ranked findings, evidence per finding, and remediation guidance.

A finding needs a title, affected asset, reproducible steps with request/response or command evidence, and concrete remediation; a scanner screenshot alone is insufficient.

Severity starts from the CVSS base score and adjusts for exposure, data sensitivity, and compensating controls, with the rationale stated explicitly.

Redact passwords, hashes, and personal data from evidence; timestamp captures and destroy them per the agreed timeline.

Maintain a timestamped activity log of commands, tools, and source IPs to attribute any packet the client asks about.

Report critical findings to the primary contact immediately and share findings only through the agreed channel without written consent.

Document retesting separately from the original assessment to give the client a clear before-and-after remediation record.

Passive recon sends no packets to the client: WHOIS/RDAP, certificate transparency, DNS history, Shodan banners, and job postings build the asset picture.

MX records reveal the mail provider, TXT records hold SPF/DMARC and SaaS verification tokens, and NS records name the DNS hoster.

Wildcard DNS invalidates brute force: resolve a random label first; a wildcard answer means brute-force hits are false positives.

Certificate transparency logs persist and often list expired subdomains still resolving to forgotten staging hosts with weaker controls.

Email format discovery through LinkedIn, GitHub commit metadata, and breach data yields valid usernames for later spraying.

Google dorks (site:, filetype:, inurl:, intitle:) find exposed documents, backups, and directory listings on the client domain.

Public PDF and Office metadata (author, software, internal paths) aids social engineering and exposes internal naming conventions.

Verify scope in the signed authorization before active queries; recon against out-of-scope assets is unauthorized even without exploitation.

Port states: open = SYN/ACK or ACK, closed = RST, filtered = no reply or ICMP unreachable, open|filtered = no reply (typical UDP); no reply never proves closure.

-sT completes the handshake without root but is logged; -sS is faster and less logged but needs raw sockets and fails against stateful firewalls.

-sV detects versions, -sC runs default scripts, and -A bundles OS detection, version detection, scripts, and traceroute.

-T4 suits stable LAN targets; -T2 or --max-rate lowers IDS alerts and avoids crashing fragile embedded devices.

UDP scanning is slow because open|filtered needs retransmission; restrict to likely services (53, 123, 161, 500) with --top-ports and a longer --host-timeout.

Enumeration tools: smbclient -L and enum4linux-ng for SMB, snmpwalk for SNMP, ldapsearch for LDAP, showmount -e for NFS exports.

Banners feed CVE research via searchsploit and NVD, but a banner is not proof of exploitability; confirm with a benign check.

Save results with -oN, -oX for Metasploit db_import and EyeWitness, and -oG for shell parsing as report evidence.

An exploit succeeds only when the vulnerable path is reachable, input is attacker-controlled, and preconditions (auth level, configuration) are met.

Metasploit flow: search, use, show options, set RHOSTS/LHOST/LPORT, run check if available, exploit; Ctrl+Z backgrounds a session and sessions -i returns.

Reverse shells are preferred because egress filtering is rarer than ingress filtering; nc -lvnp or multi/handler receives the callback.

Staged payloads fetch a second stage and are smaller on the wire; stageless payloads survive proxies that block the second download.

Linux shell upgrade: pty.spawn('/bin/bash'), Ctrl+Z, stty raw -echo, fg, export TERM=xterm restores job control and interactive su/sudo.

Hydra handles online attacks on ssh, rdp, ftp, and http-post-form; lockout policy limits attempts to one or two per account per window.

Hashcat -m modes: 1000 NTLM, 1800 sha512crypt, 13100 Kerberoast, 22000 WPA; a wrong mode yields no cracks.

Proof of exploitation is minimum necessary: whoami or hostname output suffices; never exfiltrate customer data or modify production records.

Unauthenticated AD path: enumerate DC ports (88, 389/636, 445, 53), attempt AS-REP roasting and spraying, then continue with authenticated enumeration once a credential works.

Kerberoasting requests a service ticket for any SPN account (GetUserSPNs.py -request) and cracks it offline with hashcat -m 13100; the traffic is ordinary Kerberos.

AS-REP roasting targets accounts without pre-authentication; the AS-REP cracks offline with hashcat -m 18200 using only a username list.

BloodHound maps users, groups, sessions, and ACLs to shortest paths to Domain Admin; key edges are GenericAll, WriteDACL, ForceChangePassword, AddMember, and DCSync.

GenericAll on a user allows a password reset, WriteDACL allows granting DCSync, and ForceChangePassword sets a password without the old one.

Unconstrained delegation hosts cache TGTs (Rubeus monitor plus PrinterBug coercion); constrained delegation is abused via S4U2Self/S4U2Proxy; RBCD via msDS-AllowedToActOnBehalfOfOtherIdentity.

NTLM relay requires SMB signing disabled; PetitPotam or PrinterBug coerces authentication to ntlmrelayx.py for LDAP or SMB access without cracking hashes.

DCSync needs Replicating Directory Changes (All); secretsdump -just-dc-ntlm extracts krbtgt, and a golden ticket persists until krbtgt is rotated twice.

Crawl with an authenticated session (Burp, ZAP, katana), mine parameters from JavaScript and API docs, and check robots.txt, sitemap.xml, and .well-known paths.

IDOR testing changes object IDs and user identifiers; vertical and horizontal privilege escalation are reported as separate findings.

SQLi is confirmed with boolean or time-based payloads, then sqlmap with a saved request file preserves cookies, headers, and session state.

XSS classes: reflected, stored, and DOM-based where a sink (innerHTML, eval) receives source data; test the sink, not just the response body.

Upload bypasses include .php5 and .phtml, double extensions, content-type checks, and magic bytes; traversal variants include %2e%2e%2f and ..%5c.

Auth flaws: default credentials, username enumeration by timing or message, weak reset tokens, missing MFA on APIs, and cookies lacking HttpOnly, Secure, or SameSite.

API testing looks for excessive data exposure, mass assignment (adding role=admin), and missing rate limits on OTP and login endpoints.

SSRF and XXE are confirmed out-of-band with a collaborator or listener catching DNS/HTTP callbacks, avoiding sensitive data dumps.

Monitor mode (airmon-ng start wlan0 gives wlan0mon) is required for capture; injection depends on chipset and driver and is verified with aireplay-ng --test.

WPA2 handshake capture: airodump-ng -c CH --bssid BSSID -w cap wlan0mon, aireplay-ng --deauth to force reconnect, then crack offline with aircrack-ng or hashcat -m 22000.

PMKID capture needs no client and cracks offline with hashcat -m 22000; effectiveness varies by AP vendor and firmware.

WPS PIN attacks (reaver, bully) exploit the two-half PIN split; many APs lock out after failures and modern firmware disables WPS.

WPA3-SAE resists offline dictionary attacks; practical paths are transition-mode downgrade to WPA2 or a rogue AP.

Evil twin via hostapd-wpe or a rogue AP clones the SSID; auto-connecting clients may submit credentials, and 802.1X clients leak MSCHAPv2 challenge/response cracked with asleap.

WPA2-Enterprise testing captures EAPOL through a rogue RADIUS, cracks MSCHAPv2 offline, and checks client server-certificate validation.

Wireless scope covers only authorized SSIDs and BSSIDs; deauth and rogue APs affect third parties and need explicit written approval.

Rules of engagement state scope (IPs, domains, SSIDs), test window, allowed techniques, emergency contacts, and data handling; activity outside them is unauthorized access.

Report structure: business-language executive summary, methodology and scope, severity-ranked findings, evidence per finding, and remediation guidance.

A finding needs a title, affected asset, reproducible steps with request/response or command evidence, and concrete remediation; a scanner screenshot alone is insufficient.

Severity starts from the CVSS base score and adjusts for exposure, data sensitivity, and compensating controls, with the rationale stated explicitly.

Redact passwords, hashes, and personal data from evidence; timestamp captures and destroy them per the agreed timeline.

Maintain a timestamped activity log of commands, tools, and source IPs to attribute any packet the client asks about.

Report critical findings to the primary contact immediately and share findings only through the agreed channel without written consent.

Document retesting separately from the original assessment to give the client a clear before-and-after remediation record.