Skill UI

This guide details how to perform authenticated (credentialed) vulnerability scans using industry-leading tools like Nessus, Qualys, and OpenVAS. By utilizing service credentials (SSH, SMB, WinRM, SNMPv3), the scan moves beyond superficial banner checks to deeply inspect installed patches, configurations, and local system settings on Linux, Windows, and network devices. This is crucial for detecting vulnerabilities that unauthenticated scans often miss, significantly improving security assessment accuracy.

A comprehensive playbook detailing expert techniques for lateral movement across Windows networks. It covers various protocols and methods for pivoting between compromised hosts, including PsExec, WMI, WinRM, DCOM, SMB, RDP, and advanced credential techniques like Pass-the-Hash (PTH) and Pass-the-Ticket (PTT).

NetExec is a comprehensive, multi-protocol tool designed for authorized penetration testing and red-teaming. It functions as a 'swiss-army knife' for assessing Windows, Active Directory, and Linux environments. Key capabilities include validating credentials, performing password spraying, enumerating network shares, executing commands across multiple protocols (SMB, WinRM, LDAP, MSSQL, SSH), and dumping critical credentials (SAM, LSA, NTDS). It directly supports techniques for lateral movement and post-exploitation activities.

A specialized skill for analyzing complex, host-to-host lateral movement chains within a Windows environment. It focuses on tracing protocols like WinRM, SMB, and RDP, replaying captured Kerberos tickets, understanding privilege edges, and identifying the exact accepting service or host that facilitates credential movement. Used in advanced penetration testing and digital forensics scenarios.

This guide provides comprehensive, battle-tested techniques for expanding access across a compromised network. It covers credential-based movement (Pass-the-Hash, Pass-the-Ticket), NTLM relay attacks, and remote execution protocols (WMI, WinRM). Used exclusively in authorized red team engagements and penetration testing, it details command sequences and OPSEC considerations required to reach high-value targets while minimizing detection.