Pentest

The Windows privilege escalation surface has narrowed since the days of unquoted-service-path goldmines, but it hasn’t disappeared. Token abuse, misconfigured services, and overlooked AutoLogon registry entries still net SYSTEM on a meaningful percentage of corporate hosts. Step 0: Baseline whoami /all systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type" hostname whoami /all is the single most informative command. Look at: ...

You have a low-privilege shell. Now what? This cheat sheet is the ordered, opinionated checklist that solves the privesc step on most CTFs and audits. 0. Stabilize the Shell python3 -c 'import pty; pty.spawn("/bin/bash")' export TERM=xterm-256color stty raw -echo; fg # back in your terminal: stty rows X cols Y A broken shell wastes hours. ...

Nmap is the single most important tool in any network security professional’s toolkit. This tutorial covers everything from basic discovery to the Nmap Scripting Engine (NSE) and firewall evasion. Why Nmap Still Matters in 2026 Despite an explosion of newer scanners (Masscan, Naabu, Rustscan), Nmap remains canonical because of three things: accurate service detection, the NSE library, and decades of edge-case handling. Most production “fast scanners” pipe their output back into Nmap for verification. ...