PNPT cheat sheet

Passive DNS and certificate transparency (crt.sh, Censys) enumerate subdomains without touching target infrastructure; querying the target's own DNS is active and must be scoped.

Google dork operators: site:, filetype:, inurl:, intitle:, ext:, cache:; combine with negative terms (-) to filter noise, and use date-restricted search for recent leaks.

WHOIS/RDAP records yield registrant email, nameservers, and creation dates; historical WHOIS (Whoxy, DomainTools) reveals prior ownership and infrastructure pivots.

Shodan/Censys queries filter by product, port, country, and TLS certificate fields; org: and ssl: filters map an organization's exposed assets before any scan.

TheHarvester aggregates emails, hosts, and employee names from public sources; harvested emails feed credential-stuffing risk analysis and phishing simulations only with authorization.

Social media and job postings reveal technology stack (e.g., 'Office 365 migration', 'CrowdStrike administrator') and employee names for username-format inference (first.last, flast).

Breach data (Have I Been Pwned, DeHashed) confirms credential exposure; never use leaked credentials to authenticate without explicit written scope permission.

Metadata in public documents (EXIF, PDF author, Office last-modified-by) exposes internal usernames, software versions, and file paths; use exiftool and metagoofil.

OSINT findings must be timestamped and sourced (URL, capture date) so the report can distinguish verified facts from inference.

AMSI bypass via patching AmsiScanBuffer in memory (e.g., PowerShell reflection) is signature-prone; obfuscation and in-memory execution reduce static detection but behavioral EDR rules still catch known patterns.

Egress filtering test order: DNS (53), HTTP/HTTPS (80/443), then alternates (8080, 8443, 53 TCP/UDP tunneling, ICMP). DNS TXT and DoH tunnels often survive when direct TCP is blocked.

Lateral movement options ranked by stealth: WinRM (5985/5986) and SMB (445) admin shares generate fewer alerts than PsExec service creation; WMI (135/ dynamic RPC) is common but logged.

Pass-the-Hash requires NTLM authentication enabled; Kerberos-only environments block it. Overpass-the-Hash converts an NTLM hash to a Kerberos TGT via asktgt.

Kerberoasting: request service tickets for accounts with SPNs, extract and crack offline (hashcat -m 13100); success depends on service account password strength and AES vs RC4 etype.

AS-REP Roasting targets accounts with 'Do not require Kerberos preauthentication'; no credentials needed, crack with hashcat -m 18200.

DCSync requires Replicating Directory Changes (DS-Replication-Get-Changes and -All) rights; typically held by Domain Admins, Enterprise Admins, and some service accounts. Execute with secretsdump or Mimikatz lsadump::dcsync.

Golden Ticket: forge TGT with krbtgt NTLM hash and domain SID; valid until krbtgt password changed twice. Silver Ticket: forge service ticket for a specific SPN, no DC contact.

BloodHound/SharpHound maps attack paths (shortest path to Domain Admins); collect with -c All and analyze edges like GenericAll, WriteDACL, ForceChangePassword, and AdminTo.

Scope confirmation first: IP ranges, domains, excluded hosts, and testing windows. External tests should begin with passive recon, then active scanning only within authorized ranges.

Nmap host discovery for external: -sn for ping sweep (may be blocked), -Pn to skip discovery; -sS SYN scan requires root; -sV version detection and -sC default scripts add context.

Service enumeration order: 80/443 web (nikto, whatweb, gobuster/feroxbuster), 22 SSH (banner, weak algorithms), 21 FTP (anonymous), 25/587 SMTP (VRFY, open relay), 3389 RDP (BlueKeep check), 445 SMB (external exposure is high risk).

TLS assessment: testssl.sh or sslyze for protocol versions, cipher suites, certificate chain, and known vulnerabilities (Heartbleed, ROBOT).

Web app testing: OWASP WSTG checklist; check for default creds, directory listing, backup files (.bak, .old, .zip), exposed .git, and API documentation endpoints.

VPN and remote access exposures: Citrix (Citrix Bleed CVE-2023-4966), Fortinet, Pulse Secure, and Exchange ProxyLogon/ProxyShell are high-value external targets; verify patch level via version banners.

Cloud asset discovery: enumerate S3 buckets (bucket name permutations), Azure blob storage, and exposed metadata endpoints; check for public read/write permissions.

Credential attacks against external services: password spraying (low attempts per account to avoid lockout), default credentials on appliances, and leaked credential reuse.

Egress and firewall testing from an external foothold: confirm outbound allowed ports to plan C2; document allowed protocols for the internal phase.

Initial internal posture: LLMNR/NBT-NS/mDNS poisoning with Responder captures NetNTLMv2 hashes; relay with ntlmrelayx to SMB signing-disabled hosts.

SMB signing disabled enables relay attacks; check with nmap --script smb2-security-mode or CrackMapExec smb --gen-relay-list.

IPv6 is often enabled and unmanaged; mitm6 exploits DHCPv6 to become DNS server, combined with ntlmrelayx for LDAP relay and RBCD or ACL abuse.

Credential harvesting: Kerberoast, AS-REP roast, GPP passwords (cpassword in SYSVOL), and unattended install files; crack offline with hashcat.

Privilege escalation on Windows hosts: unquoted service paths, weak service permissions (accesschk), AlwaysInstallElevated, and stored credentials (cmdkey, runas /savecred).

Privilege escalation on Linux hosts: SUID binaries (GTFOBins), sudo -l misconfigurations, cron jobs, writable /etc/passwd, and kernel exploits matched to uname -a.

Pivoting: SSH dynamic port forward (-D), Chisel, Ligolo-ng, and Metasploit autoroute; maintain a pivot map to avoid losing access.

AD enumeration tools: PowerView (Get-NetUser, Get-NetComputer, Get-NetGroupMember), BloodHound, and ADRecon for a full domain report.

Local admin password reuse across hosts (same local admin hash) enables pass-the-hash lateral movement; check with CrackMapExec smb -u admin -H .

Report structure: executive summary, scope and methodology, findings (with evidence), risk ratings, remediation, and appendices. Executive summary must be understandable to non-technical leadership.

Risk rating formula commonly uses likelihood × impact (CVSS base score as input); document the rating method used so clients can reproduce it.

Each finding needs: title, severity, affected asset(s), description, evidence (screenshot/command output with timestamps), business impact, and specific remediation steps.

Evidence must be reproducible: include exact commands, tool versions, and timestamps; redact credentials and PII in the final report.

Debrief (readout) agenda: scope recap, attack narrative (how the domain was compromised), top risks, quick wins, and Q&A. Keep to 45–60 minutes.

During debrief, avoid blame; frame findings as systemic gaps (e.g., 'SMB signing not enforced') rather than individual failures.

Deliverables: draft report for factual accuracy review, final report (PDF), raw evidence archive, and remediation tracking spreadsheet.

Retest scope and timing should be agreed in the statement of work; report should state what was tested, what was not, and any limitations (time, scope exclusions).

Compliance mapping: map findings to frameworks (CIS Controls, NIST 800-53, ISO 27001) when the client requires it; do not claim certification.