Hack Log

Network pivoting is one of the most critical techniques in internal penetration testing. Once you’ve compromised an internet-facing host, you rarely stop there – the real targets (domain controllers, database servers, internal APIs) are buried deeper in network segments with no direct internet access. Pivoting lets you route your attack traffic through a compromised host […]

TL;DR: Once you have NTLM hashes – from a SAM dump, secretsdump, or Responder capture – Hashcat can recover plaintext passwords offline in minutes. Use mode -m 1000 for NTLM and -m 5600 for NTLMv2 (Net-NTLMv2). Start with a dictionary attack against rockyou.txt, layer on rules (best64.rule), and escalate to hybrid or brute-force if needed.

Introduction During a post-exploitation engagement, the moment you have local admin or SYSTEM on a Windows box, the next question is almost always: what credentials can I pull from this machine? Mimikatz – written by Benjamin Delpy – remains the most direct answer. It reads the LSASS (Local Security Authority Subsystem Service) process memory and

Type: Methodology GuideDomain: Offensive Security / IdentityAudience: Red teamers, penetration testers, offensive security engineers Introduction: Identity Is the Perimeter In 2026, credential-based attacks account for the initial access vector in the majority of confirmed breaches. The perimeter dissolved – cloud-first organizations replaced VPNs and firewalls with identity providers. Entra ID, Okta, and AWS IAM are

TL;DR SQL Injection remains OWASP A03:2021 (Injection) and one of the most critical web vulnerabilities you will encounter. This post covers manual detection techniques (error-based, union-based, time-based blind, boolean-based blind), SQLMap automation essentials, WAF bypass strategies, and how to write a finding report that will actually get remediated. Skip to the section you need –

Type: Threat Intelligence / CVE AnalysisDomain: AI/ML Security / LLM Application SecurityCVE: CVE-2024-8309Affected Component: langchain-community < 0.2.19Severity: High (broad DB credentials) / Medium (read-only scoping) The Attack Class Before the CVE Before getting into the specifics of CVE-2024-8309, it is worth naming the attack class clearly: LLM-mediated injection. Traditional SQL injection works because user input

TL;DR: Gobuster’s dir mode fires wordlist-based HTTP requests to uncover hidden paths on a web server. Install it, point it at an authorised target, pick a wordlist, tune threads and extensions, and read the results by status code. That’s it. Well – mostly. Read on. 1. Introduction Picture a developer at 11pm on a Friday,

TL;DR: Server-Side Request Forgery remains one of the most impactful vulnerability classes in cloud-hosted applications. In 2026, SSRF is routinely used to steal cloud credentials via metadata endpoints, pivot to internal services, and chain into RCE. This post covers the full exploitation spectrum: cloud metadata abuse, blind SSRF via DNS callbacks, protocol smuggling with gopher://,

TL;DR Phase Primary Tools Key Goal Recon nmap, masscan, Shodan, Censys Map the attack surface Service Enum enum4linux, crackmapexec, snmpwalk, ldapsearch Identify exploitable services Initial Access Responder, ntlmrelayx, Metasploit Gain first foothold Lateral Movement impacket (psexec, wmiexec, smbexec), CrackMapExec Expand access Common Findings – Default creds, plaintext protocols, unauthed services Target Audience Mid-level pentesters conducting

Category: Active Directory | Credential Access | Kerberos AbuseAudience: Blue Team / DefendersSeverity: High – enables domain privilege escalation without password knowledge TL;DR Shadow Credentials is an Active Directory attack that lets an adversary authenticate as any user or computer account by writing a rogue cryptographic key to the msDS-KeyCredentialLink attribute – no password required.