Tips & Tricks
Short, practical notes from the field: tooling, tradecraft, and shortcuts.
Active Directory
16
Windows and Active Directory tradecraft.
AI & LLM Security
19
Auth & Tokens
12
Cloud & Containers
13
Cloud and identity tips.
Exploitation
2
Turning bugs into working access.
Linux & Privesc
8
Linux tips and privilege escalation.
Recon & OSINT
11
Finding attack surface and mapping targets.
Red Team & Evasion
9
Source Code Review
31
Web & API
22
Web application testing tips.
Windows Post-Exploitation
8
All tips
- Loot the Credential Manager and Windows Vault Saved RDP, web, and network credentials in the Vault are DPAPI-protected but decrypt trivially in the user's own session.
- Extract Kerberos tickets and keys from LSA with Rubeus Dumping tickets from LSA gives you TGTs to pass, and requesting them for kerberoastable SPNs yields hashes to crack offline.
- Move as another logged-on user by stealing their token On a multi-user host, duplicating the primary token of another session lets you act as that user, including a domain admin who logged in.
- Persist with a WMI permanent event subscription A filter-to-consumer binding stored in the WMI repository runs your payload on an event trigger with no file on disk and no Run key.
- Escalate through weak service permissions and unquoted paths A service you can reconfigure, or one whose unquoted path runs through a writable directory, executes your binary as its account on restart.
- SeImpersonate to SYSTEM with a potato technique A service account holding SeImpersonatePrivilege can coerce a SYSTEM authentication and duplicate its token for a full-privilege shell.
- Decrypt DPAPI secrets with the domain backup key With the domain DPAPI backup key from a DC, you can decrypt any user's masterkeys and the browser, vault, and RDP secrets they protect, offline.
- Dump LSASS quietly with the comsvcs MiniDump export A signed rundll32 call into comsvcs.dll writes an LSASS minidump without dropping mimikatz, sidestepping name-based detections.
- Inject into a root process with cap_sys_ptrace A shell or binary holding cap_sys_ptrace can attach to a root-owned process and hijack it to run your shellcode as root.
- Abuse sudo LD_PRELOAD and LD_LIBRARY_PATH If sudoers preserves LD_PRELOAD or LD_LIBRARY_PATH, any command you are allowed to run as root loads your shared object first.