# InfoSec Notes ## InfoSec Notes - [InfoSec Notes](https://notes.qazeer.io/readme.md) - [External recon](https://notes.qazeer.io/general/external_recon.md) - [Ports scan](https://notes.qazeer.io/general/ports_scan.md) - [Bind / reverse shells](https://notes.qazeer.io/general/shells.md) - [File transfer / exfiltration](https://notes.qazeer.io/general/file_transfer.md) - [Pivoting](https://notes.qazeer.io/general/pivoting.md) - [Passwords cracking](https://notes.qazeer.io/general/passwords_cracking.md) - [Recon - Domain Recon](https://notes.qazeer.io/active-directory/recon-domain_recon.md) - [Recon - AD scanners](https://notes.qazeer.io/active-directory/recon-ad_scanners.md) - [Exploitation - NTLM capture and relay](https://notes.qazeer.io/active-directory/exploitation-ntlm_capture_and_relay.md) - [Exploitation - Password spraying](https://notes.qazeer.io/active-directory/exploitation-password_spraying.md) - [Exploitation - Domain Controllers CVE](https://notes.qazeer.io/active-directory/exploitation-dc_cve.md) - [Exploitation - Kerberos AS\_REP roasting](https://notes.qazeer.io/active-directory/exploitation-kerberos_as_rep_roasting.md) - [Exploitation - Credentials theft shuffling](https://notes.qazeer.io/active-directory/exploitation-credentials_theft_shuffling.md) - [Exploitation - GPP and shares searching](https://notes.qazeer.io/active-directory/exploitation-gpp_and_shares_searching.md) - [Exploitation - Kerberos Kerberoasting](https://notes.qazeer.io/active-directory/exploitation-kerberos_kerberoasting.md) - [Exploitation - ACL exploiting](https://notes.qazeer.io/active-directory/exploitation-acl_exploiting.md) - [Exploitation - GPO users rights](https://notes.qazeer.io/active-directory/exploitation-gpo_users_rights.md) - [Exploitation - Active Directory Certificate Services](https://notes.qazeer.io/active-directory/exploitation-certificate_services.md) - [Exploitation - Kerberos tickets usage](https://notes.qazeer.io/active-directory/exploitation-kerberos_tickets_usage.md) - [Exploitation - Kerberos silver tickets](https://notes.qazeer.io/active-directory/exploitation-kerberos_silver_tickets.md) - [Exploitation - Kerberos delegations](https://notes.qazeer.io/active-directory/exploitation-kerberos_delegations.md) - [Exploitation - gMS accounts (gMSAs)](https://notes.qazeer.io/active-directory/exploitation-gms_accounts.md) - [Exploitation - Azure AD Connect](https://notes.qazeer.io/active-directory/exploitation-azure_ad_connect.md) - [Exploitation - Operators to Domain Admins](https://notes.qazeer.io/active-directory/exploitation-operators_to_domain_admins.md) - [Post Exploitation - ntds.dit dumping](https://notes.qazeer.io/active-directory/post_exploitation-ntds_dit_dumping.md) - [Post Exploitation - Kerberos golden tickets](https://notes.qazeer.io/active-directory/post_exploitation-kerberos_golden_tickets.md) - [Post Exploitation - Trusts hopping](https://notes.qazeer.io/active-directory/post_exploitation-trusts_hopping.md) - [Post Exploitation - Persistence](https://notes.qazeer.io/active-directory/post_exploitation-persistence.md) - [Methodology](https://notes.qazeer.io/l7/1-methodology.md) - [21 - FTP](https://notes.qazeer.io/l7/methodology.md) - [22 - SSH](https://notes.qazeer.io/l7/methodology-1.md) - [25 - SMTP](https://notes.qazeer.io/l7/methodology-2.md) - [53 - DNS](https://notes.qazeer.io/l7/methodology-3.md) - [111 / 2049 - NFS](https://notes.qazeer.io/l7/methodology-4.md) - [113 - Ident](https://notes.qazeer.io/l7/methodology-5.md) - [135 - MSRPC](https://notes.qazeer.io/l7/methodology-6.md) - [137-139 - NetBIOS](https://notes.qazeer.io/l7/methodology-7.md) - [161 - SNMP](https://notes.qazeer.io/l7/methodology-8.md) - [389 / 3268 - LDAP](https://notes.qazeer.io/l7/methodology-9.md) - [445 - SMB](https://notes.qazeer.io/l7/methodology-10.md) - [512 / 513 - REXEC / RLOGIN](https://notes.qazeer.io/l7/methodology-11.md) - [554 - RTSP](https://notes.qazeer.io/l7/methodology-12.md) - [1099 - JavaRMI](https://notes.qazeer.io/l7/methodology-13.md) - [1433 - MSSQL](https://notes.qazeer.io/l7/methodology-14.md) - [1521 - ORACLE\_DB](https://notes.qazeer.io/l7/methodology-15.md) - [3128 - Proxy](https://notes.qazeer.io/l7/methodology-16.md) - [3306 - MySQL](https://notes.qazeer.io/l7/methodology-17.md) - [3389 - RDP](https://notes.qazeer.io/l7/methodology-18.md) - [5985 / 5986 - WSMan](https://notes.qazeer.io/l7/methodology-19.md) - [8000 - JDWP](https://notes.qazeer.io/l7/methodology-20.md) - [9100 - Printers](https://notes.qazeer.io/l7/methodology-21.md) - [11211 - memcached](https://notes.qazeer.io/l7/methodology-22.md) - [27017 / 27018 - MongoDB](https://notes.qazeer.io/l7/methodology-23.md) - [Shellcode and PE loader](https://notes.qazeer.io/windows/shellcode_and_pe_loader.md) - [Bypass PowerShell ConstrainedLanguageMode](https://notes.qazeer.io/windows/bypass_ps_constrainedlanguagemode.md) - [Bypass AppLocker](https://notes.qazeer.io/windows/bypass_applocker.md) - [Local privilege escalation](https://notes.qazeer.io/windows/local_privilege_escalation.md) - [Post exploitation](https://notes.qazeer.io/windows/post_exploitation.md) - [Credentials dumping](https://notes.qazeer.io/windows/post_exploitation/credentials_dumping.md) - [Defense evasion](https://notes.qazeer.io/windows/post_exploitation/defense_evasion.md) - [Local persistence](https://notes.qazeer.io/windows/post_exploitation/local_persistence.md) - [Lateral movements](https://notes.qazeer.io/windows/lateral_movements.md) - [Local credentials re-use](https://notes.qazeer.io/windows/lateral_movements/local_credentials_reuse.md) - [Over SMB](https://notes.qazeer.io/windows/lateral_movements/over_smb.md) - [Over WinRM](https://notes.qazeer.io/windows/lateral_movements/over_winrm.md) - [Over WMI](https://notes.qazeer.io/windows/lateral_movements/over_wmi.md) - [Over DCOM](https://notes.qazeer.io/windows/lateral_movements/over_dcom.md) - [CrackMapExec](https://notes.qazeer.io/windows/lateral_movements/crackmapexec.md) - [Local privilege escalation](https://notes.qazeer.io/linux/local_privilege_escalation.md) - [Post exploitation](https://notes.qazeer.io/linux/post_exploitation.md) - [Common](https://notes.qazeer.io/dfir/common.md) - [Image acquisition and mounting](https://notes.qazeer.io/dfir/common/image_acquisition_and_mounting.md) - [Memory forensics](https://notes.qazeer.io/dfir/common/memory_forensics.md) - [Web logs analysis](https://notes.qazeer.io/dfir/common/web_logs_analysis.md) - [Browsers forensics](https://notes.qazeer.io/dfir/common/browsers_forensics.md) - [Email forensics](https://notes.qazeer.io/dfir/common/email_forensics.md) - [Docker forensics](https://notes.qazeer.io/dfir/common/docker_forensics.md) - [Windows](https://notes.qazeer.io/dfir/windows.md) - [Artefacts overview](https://notes.qazeer.io/dfir/windows/_artefacts_overview.md) - [Amcache](https://notes.qazeer.io/dfir/windows/_artefacts_overview/amcache.md) - [EVTX](https://notes.qazeer.io/dfir/windows/_artefacts_overview/evtx.md) - [Jumplist](https://notes.qazeer.io/dfir/windows/_artefacts_overview/jumplist.md) - [LNKFile](https://notes.qazeer.io/dfir/windows/_artefacts_overview/lnkfile.md) - [MFT](https://notes.qazeer.io/dfir/windows/_artefacts_overview/mft.md) - [Outlook\_files](https://notes.qazeer.io/dfir/windows/_artefacts_overview/outlook_files.md) - [Prefetch](https://notes.qazeer.io/dfir/windows/_artefacts_overview/prefetch.md) - [RecentFilecache](https://notes.qazeer.io/dfir/windows/_artefacts_overview/recentfilecache.md) - [RecycleBin](https://notes.qazeer.io/dfir/windows/_artefacts_overview/recyclebin.md) - [Shellbags](https://notes.qazeer.io/dfir/windows/_artefacts_overview/shellbags.md) - [Shimcache](https://notes.qazeer.io/dfir/windows/_artefacts_overview/shimcache.md) - [SRUM](https://notes.qazeer.io/dfir/windows/_artefacts_overview/srum.md) - [Timestamps](https://notes.qazeer.io/dfir/windows/_artefacts_overview/timestamps.md) - [User Access Logging (UAL)](https://notes.qazeer.io/dfir/windows/_artefacts_overview/user_access_logging.md) - [UsnJrnl](https://notes.qazeer.io/dfir/windows/_artefacts_overview/usnjrnl.md) - [Miscellaneous](https://notes.qazeer.io/dfir/windows/_artefacts_overview/misc.md) - [TTPs analysis](https://notes.qazeer.io/dfir/windows/ttps_analysis.md) - [Accounts usage](https://notes.qazeer.io/dfir/windows/ttps_analysis/accounts_usage.md) - [Local persistence](https://notes.qazeer.io/dfir/windows/ttps_analysis/local_persistence.md) - [Lateral movement](https://notes.qazeer.io/dfir/windows/ttps_analysis/lateral_movement.md) - [PowerShell activity](https://notes.qazeer.io/dfir/windows/ttps_analysis/powershell_activity.md) - [Program execution](https://notes.qazeer.io/dfir/windows/ttps_analysis/program_execution.md) - [Timestomping](https://notes.qazeer.io/dfir/windows/ttps_analysis/timestomping.md) - [EVTX integrity](https://notes.qazeer.io/dfir/windows/ttps_analysis/evtx_integrity.md) - [System uptime](https://notes.qazeer.io/dfir/windows/ttps_analysis/system_uptime.md) - [ActiveDirectory replication metadata](https://notes.qazeer.io/dfir/windows/ttps_analysis/activedirectory_replication_metadata.md) - [ActiveDirectory persistence](https://notes.qazeer.io/dfir/windows/ttps_analysis/activedirectory_persistence.md) - [Linux](https://notes.qazeer.io/dfir/linux.md) - [Artefacts overview](https://notes.qazeer.io/dfir/linux/_artefacts_overview.md) - [TTPs analysis](https://notes.qazeer.io/dfir/linux/ttps_analysis.md) - [Timestomping](https://notes.qazeer.io/dfir/linux/ttps_analysis/timestomping.md) - [Cloud](https://notes.qazeer.io/dfir/cloud.md) - [Azure](https://notes.qazeer.io/dfir/cloud/azure.md) - [AWS](https://notes.qazeer.io/dfir/cloud/aws.md) - [Tools](https://notes.qazeer.io/dfir/tools.md) - [Velociraptor](https://notes.qazeer.io/dfir/tools/velociraptor.md) - [KAPE](https://notes.qazeer.io/dfir/tools/kape.md) - [Dissect](https://notes.qazeer.io/dfir/tools/dissect.md) - [plaso](https://notes.qazeer.io/dfir/tools/plaso.md) - [Splunk usage](https://notes.qazeer.io/dfir/tools/splunk.md) - [Phishing - Office Documents](https://notes.qazeer.io/red-team-specifics/phishing_officedocuments.md) - [OpSec Operating Systems environment](https://notes.qazeer.io/red-team-specifics/opsec_operatingsystems.md) - [EDR bypass with EDRSandBlast](https://notes.qazeer.io/red-team-specifics/edr_bypass_with_edrsandblast.md) - [Cobalt Strike](https://notes.qazeer.io/red-team-specifics/cobalt_strike.md) - [Recon - Server exposure](https://notes.qazeer.io/web-applications/recon-server_exposure.md) - [Recon - Hostnames discovery](https://notes.qazeer.io/web-applications/recon-hostnames_discovery.md) - [Recon - Application mapping](https://notes.qazeer.io/web-applications/recon-application_mapping.md) - [Recon - Attack surface overview](https://notes.qazeer.io/web-applications/recon-attack_surface.md) - [CMS & softwares](https://notes.qazeer.io/web-applications/cms_and_softwares.md) - [ColdFusion](https://notes.qazeer.io/web-applications/cms_and_softwares/coldfusion.md) - [DotNetNuke](https://notes.qazeer.io/web-applications/cms_and_softwares/dotnetnuke.md) - [Jenkins](https://notes.qazeer.io/web-applications/cms_and_softwares/jenkins.md) - [Jira](https://notes.qazeer.io/web-applications/cms_and_softwares/jira.md) - [Ovidentia](https://notes.qazeer.io/web-applications/cms_and_softwares/ovidentia.md) - [WordPress](https://notes.qazeer.io/web-applications/cms_and_softwares/wordpress.md) - [WebDAV](https://notes.qazeer.io/web-applications/cms_and_softwares/webdav.md) - [Exploitation - Overview](https://notes.qazeer.io/web-applications/exploitation-overview.md) - [Exploitation - Authentication](https://notes.qazeer.io/web-applications/exploitation-authentication.md) - [Exploitation - LDAP injections](https://notes.qazeer.io/web-applications/exploitation-ldap_injections.md) - [Exploitation - Local and remote file inclusions](https://notes.qazeer.io/web-applications/exploitation-local_and_remote_file_inclusions.md) - [Exploitation - File upload](https://notes.qazeer.io/web-applications/exploitation-file_upload.md) - [Exploitation - SQL injections](https://notes.qazeer.io/web-applications/exploitation-sql_injections.md) - [SQLMAP.md](https://notes.qazeer.io/web-applications/exploitation-sql_injections/sqlmap.md) - [MSSQL.md](https://notes.qazeer.io/web-applications/exploitation-sql_injections/mssql.md) - [MySQL.md](https://notes.qazeer.io/web-applications/exploitation-sql_injections/mysql.md) - [SQLite.md](https://notes.qazeer.io/web-applications/exploitation-sql_injections/sqlite.md) - [Exploitation - NoSQL injections](https://notes.qazeer.io/web-applications/exploitation-nosql_injections.md) - [NoSQLMap.md](https://notes.qazeer.io/web-applications/exploitation-nosql_injections/nosqlmap.md) - [mongoDB.md](https://notes.qazeer.io/web-applications/exploitation-nosql_injections/mongodb.md) - [Exploitation - GraphQL](https://notes.qazeer.io/web-applications/exploitation-graphql.md) - [Linux - ELF64 ROP leaks](https://notes.qazeer.io/binary-exploitation/elf64_rop_leaks.md) - [(Very) Basic reverse](https://notes.qazeer.io/binary-exploitation/reverse.md) - [Basic static analysis](https://notes.qazeer.io/android/static_analysis.md) - [Regex 101](https://notes.qazeer.io/miscellaneous/regex101.md) - [WinDbg Kernel](https://notes.qazeer.io/miscellaneous/windbg_kernel.md) - [Basic coverage guided fuzzing](https://notes.qazeer.io/miscellaneous/coverage_guideded_fuzzing.md)