{
"generatedAt": "2026-07-25T10:42:12.863Z",
"posts": [
{
"id": "7fac556a05ae",
"title": "CCPA Update: Cybersecurity Requirements (Part 2)",
"url": "https://trustedsec.com/blog/ccpa-update-cybersecurity-requirements-part-2",
"iso": "2026-07-24",
"via": null,
"blurb": "Blog CCPA Update: Cybersecurity Requirements (Part 2) July 24, 2026 CCPA Update: Cybersecurity Requirements (Part 2) Written by Chris Camejo Privacy Compliance Information Security Compliance Risk Assessment Table of contentsApplicabilityEnforcementRollout TimelineCertificationAudit…",
"image": "https://trusted-sec.transforms.svdcdn.com/production/images/Blog-Covers/CCPA-P2_SEO.jpg?w=1200&h=630&q=82&auto=format&fit=crop&dm=1784726875&s=2ef3a8fab1c1e558df0ca29755c54100",
"person": "Chris Camejo",
"personKey": "chris camejo",
"cardId": "ba4b3ce1b1543da5"
},
{
"id": "09ead285fdc6",
"title": "CCPA Update: Who’s In Scope (Part 1)",
"url": "https://trustedsec.com/blog/ccpa-update-whos-in-scope-part-1",
"iso": "2026-07-23",
"via": null,
"blurb": "Blog CCPA Update: Who’s In Scope (Part 1) July 23, 2026 CCPA Update: Who’s In Scope (Part 1) Written by Chris Camejo Privacy Compliance Information Security Compliance Risk Assessment Table of contentsApplicabilityEnforcementShareShare URLShare via EmailShare on FacebookShare on XShare on…",
"image": "https://trusted-sec.transforms.svdcdn.com/production/images/Blog-Covers/CCPA_SEO.jpg?w=1200&h=630&q=82&auto=format&fit=crop&dm=1784669244&s=5025de57ba1ddb905aee033951534c8f",
"person": "Chris Camejo",
"personKey": "chris camejo",
"cardId": "ba4b3ce1b1543da5"
},
{
"id": "e01d54c1a9f9",
"title": "Russian Global Webmail Espionage",
"url": "https://unit42.paloaltonetworks.com/russian-webmail-espionage/",
"iso": "2026-07-23",
"via": null,
"blurb": "Threat Research CenterThreat ResearchCybercrime Cybercrime Russian Global Webmail Espionage 3 min read Related ProductsAdvanced DNS SecurityAdvanced URL FilteringCloud-Delivered Security ServicesCortexUnit 42 Incident Response By:Unit 42 Published:July 23, 2026 Categories:CybercrimeThreat…",
"image": "https://unit42.paloaltonetworks.com/wp-content/uploads/2026/07/06_Nation-State-cyberattacks_1920x900-1.jpg",
"person": "Unit 42",
"personKey": "unit 42",
"cardId": "0babc96aed71d704"
},
{
"id": "9a693dc08e2f",
"title": "Dark Elevator: Windows Install Service Local Privilege Escalation (CVE-2026-50343)",
"url": "https://blog.calif.io/p/dark-elevator-windows-install-service",
"iso": "2026-07-22",
"via": null,
"blurb": "Dark Elevator: Windows Install Service Local Privilege Escalation (CVE-2026-50343)A pure-logic, 100% reliable path from a normal user to SYSTEMr0kebJul 22, 20267ShareToday we walk through Dark Elevator, a LPE in Windows 11. We reported it to Microsoft on May 20, 2026, and it is now fixed as…",
"image": "https://substackcdn.com/image/fetch/$s_!l9I0!,w_1200,h_675,c_fill,f_jpg,q_auto:good,fl_progressive:steep,g_auto/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2Fc5c62a24-012b-4bb9-8ee0-c7a71990025b_1696x2502.jpeg",
"person": "calif",
"personKey": "calif",
"cardId": "55a7e8597699c5e6"
},
{
"id": "0c6f1c94f985",
"title": "Introducing the SpecterOps Tradecraft Academy",
"url": "https://specterops.io/blog/2026/07/21/introducing-the-specterops-tradecraft-academy/",
"iso": "2026-07-21",
"via": null,
"blurb": "Back to Blog Company Updates Introducing the SpecterOps Tradecraft Academy Author Andrew Chiles Read Time 4 mins Published Jul 21, 2026 Share Put Insights Into Action Explore our Platform Explore Services TL;DR: SpecterOps Tradecraft Academy is now live at academy.specterops.io, offering free,…",
"image": "https://specterops.io/wp-content/uploads/sites/3/2026/07/TradecraftAcademy_Icon_Color-2.png",
"person": "Andrew Chiles",
"personKey": "andrew chiles",
"cardId": "2f34e9dbabe8a28d"
},
{
"id": "0cb59ba43963",
"title": "Windows Privilege Escalation: SeRestorePrivilege",
"url": "https://www.hackingarticles.in/windows-privilege-escalation-serestoreprivilege/",
"iso": "2026-07-21",
"via": null,
"blurb": "Privilege Escalation Windows Privilege Escalation: SeRestorePrivilege July 21, 2026 by raj Overview SeRestorePrivilege is a Windows special privilege that allows its holder to restore files and directories, effectively bypassing discretionary access controls on the file system. When assigned to…",
"image": "https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhx6J8m2qxyUfhVDUfXA6OxpVmuaKOpX6gBqF1XZRxw37LyZpAIFLnAT9rKn1CwvwZNrUtIaFSkshIagFGVeDGE5bWXzZ_4SzMbRuuw26pxY1KfLmFZjbJg2yQaS10n9Oi9s740zUFY8UzfbV8TARauX_tw7nkRm1_CKK9BRUAAdiRN9eaasXrWp1i89NTm/s1600/0.png",
"person": "Raj Chandel",
"personKey": "raj chandel",
"cardId": "1e72b6ace26c314d"
},
{
"id": "1034ccfb8987",
"title": "Beyond the Scanner: Lares OWASP Top 10 Findings",
"url": "https://www.lares.com/blog/beyond-the-scanner-lares-owasp-top-10-findings/",
"iso": "2026-07-21",
"via": null,
"blurb": "Beyond the Scanner: Lares OWASP Top 10 Findings Beyond the Scanner: Lares OWASP Top 10 Findings https://www.lares.com/wp-content/themes/movedo/images/empty/thumbnail.jpg 150 150 Lares Labs Lares Labs https://www.lares.com/wp-content/plugins/ultimate-member/assets/img/default_avatar.jpg July 21,…",
"image": "https://www.lares.com/wp-content/uploads/2022/09/Lares_logo_Damovo_red.png",
"person": "Lares Labs",
"personKey": "lares labs",
"cardId": "a367ffcf7c9122c3"
},
{
"id": "ed93333453b0",
"title": "Azure VM Command Execution using Third-Party Extensions - Chef",
"url": "https://www.netspi.com/blog/technical-blog/cloud-pentesting/azure-vm-command-execution-using-third-party-extensions/",
"iso": "2026-07-21",
"via": null,
"blurb": "Technical / Cloud Pentesting Azure VM Command Execution using Third-Party Extensions – Chef July 21, 2026 Thomas Byrne Background In our previous blogs, we have covered different methods of executing code on Azure Virtual machines such as through Custom Script Extensions, Desired State…",
"image": "https://www.netspi.com/wp-content/uploads/2026/07/07.21.26_TECH_Azure-VM-Part-1_Thomas-Byrne_1200x630.jpg",
"person": "Thomas Byrne",
"personKey": "thomas byrne",
"cardId": "7288df6906cafd60"
},
{
"id": "392674ec82b7",
"title": "CVE-2026-63030 & CVE-2026-60137: WordPress Core Pre-Authentication RCE Overview & Takeaways",
"url": "https://www.netspi.com/blog/executive-blog/critical-vulnerability/cve-2026-63030-cve-2026-60137-wordpress-core-rce/",
"iso": "2026-07-20",
"via": null,
"blurb": "Executive / Critical Vulnerability CVE-2026-63030 & CVE-2026-60137: WordPress Core Pre-Authentication RCE Overview & Takeaways July 20, 2026 Sachin Wagh WordPress has disclosed a critical vulnerability chain nicknamed “wp2shell,” consisting of CVE-2026-63030 (REST API Route Confusion) and…",
"image": "https://www.netspi.com/wp-content/uploads/2026/07/TB-Design-1_1200x630-14.png",
"person": "Emily Hinderaker",
"personKey": "emily hinderaker",
"cardId": "d7e3499d600a54e6"
},
{
"id": "050b161b1600",
"title": "GraphQL < BorderGate",
"url": "https://www.bordergate.co.uk/graphql/",
"iso": "2026-07-19",
"via": null,
"blurb": "Web Application 2026 bordergate GraphQL is a query language that allows clients to request exactly the data they need from a server, without resorting to calling multiple REST endpoints. Unlike traditional REST APIs, where the structure of the response is typically determined by the server and…",
"image": "http://www.bordergate.co.uk/wp-content/uploads/2026/07/graph.jpg",
"person": "bordergate",
"personKey": "bordergate",
"cardId": "1adf7a7d165dfeae"
},
{
"id": "c11847b96dc7",
"title": "HTB: Logging",
"url": "https://0xdf.gitlab.io/2026/07/18/htb-logging.html",
"iso": "2026-07-18",
"via": null,
"blurb": "TOC HTB: Logging HTB: Logging Logging is a Windows domain controller offered as an assume breach box, starting with credentials for a low privileged domain user. I’ll find an application log on an open SMB share that leaks an old password for a service account, then guess the current password by…",
"image": "https://pub-4caceed5c57c4466b559b0834d2806c9.r2.dev/img/logging-cover.png",
"person": "0xdf",
"personKey": "0xdf",
"cardId": "ea128cfbebd57ab0"
},
{
"id": "0a6783a72bd0",
"title": "wp2shell - Code Trace Deep Dive",
"url": "https://blog.zsec.uk/wp2shell-code-trace-deep-dive/",
"iso": "2026-07-18",
"via": null,
"blurb": "TL;DR: wp2shell chains an unauth SQLi that can be used to obtain the admin password and then login to upload a vulnerable plugin for RCE. This can then be chained with a myriad of privilege escalation bugs to obtain root on the WP server.WordPress is one of the most common platforms out there…",
"image": "https://blog.zsec.uk/content/images/2025/05/YoutubeHeader-Recovered.png",
"person": "Andy Gill",
"personKey": "andy gill",
"cardId": "e23fe7fb2b4ce7cc"
},
{
"id": "e75903dc72f0",
"title": "AI Assisted Vulnerability Research on Embedded Targets",
"url": "https://quentinkaiser.be/security/2026/07/18/ia-assisted-vuln-research/",
"iso": "2026-07-18",
"via": null,
"blurb": "Photo by Vinoth Ragunathan on unsplash Recently, bl4sty created vibe coded sl0p.foo, a streaming platform where you can live stream your agents working in tmux sessions for fun. I liked the idea, and it finally got me to experiment with AI-assisted vulnerability research and exploit development.",
"image": "https://quentinkaiser.be/security/2026/07/18/ia-assisted-vuln-research/vinoth-ragunathan-cvQ6wD3bPYE-unsplash.jpg",
"person": "Quentin Kaiser",
"personKey": "quentin kaiser",
"cardId": "bae8b4a25b1e703b"
},
{
"id": "fb2256670577",
"title": "NoSQL Injection < BorderGate",
"url": "https://www.bordergate.co.uk/nosql-injection/",
"iso": "2026-07-18",
"via": null,
"blurb": "Web Application 2026 bordergate NoSQL refers to a family of database engines that do not use a traditional relational table model. NoSQL databases normally store information as documents in a JSON-like format.",
"image": "http://www.bordergate.co.uk/wp-content/uploads/2026/07/mango.jpg",
"person": "bordergate",
"personKey": "bordergate",
"cardId": "1adf7a7d165dfeae"
},
{
"id": "c3665548e220",
"title": "Filtering S3 events by CloudFormation stack",
"url": "https://awsteele.com/blog/2026/07/17/filtering-s3-events-by-cloudformation-stack.html",
"iso": "2026-07-17",
"via": null,
"blurb": "Filtering S3 events by CloudFormation stack AWS just announced that S3 event notifications now include the system-generated tags attached to the bucket responsible for the notification. This sounds like a small change, but it will enable some useful patterns.",
"image": null,
"person": "Aidan Steele",
"personKey": "aidan steele",
"cardId": "23bb77f9e3aca89f"
},
{
"id": "1e6faaad41f9",
"title": "Journey to Root, Episode I: The Maglev King",
"url": "https://blog.calif.io/p/journey-to-root-episode-i-the-maglev",
"iso": "2026-07-17",
"via": null,
"blurb": "Journey to Root, Episode I: The Maglev KingHacking Chrome with AIJul 17, 2026ShareTable of ContentsIntroductionWhy Do We Do This?So, Where Were All The Humans?Anatomy Of An Exploit ChainRenderer Exploit Chain OverviewAct I: A Forgotten Barrier That Derails MaglevCore ConceptsThe BugThe…",
"image": "https://substackcdn.com/image/fetch/$s_!nEjT!,w_1200,h_675,c_fill,f_jpg,q_auto:good,fl_progressive:steep,g_auto/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2Fd9fe0b4c-9eae-429a-95e6-9841a99c1614_848x1264.jpeg",
"person": "calif",
"personKey": "calif",
"cardId": "55a7e8597699c5e6"
},
{
"id": "518fba0c6d20",
"title": "I Thought I Found a Prime Pattern That Breaks RSA | 🔐Blog of Osanda",
"url": "https://osandamalith.com/2026/07/17/i-thought-i-found-a-prime-pattern-that-breaks-rsa/",
"iso": "2026-07-17",
"via": null,
"blurb": "I didn’t. But working out why taught me more about RSA than any tutorial ever did, because it forced me to find the exact spot where the security lives and poke it.",
"image": "https://i0.wp.com/osandamalith.com/wp-content/uploads/2018/02/cropped-wallhaven-377439.jpg?fit=512%2C512&ssl=1",
"person": "Osanda Malith Jayathissa",
"personKey": "osanda malith jayathissa",
"cardId": "b293b625cc9bf032"
},
{
"id": "d58139501f6d",
"title": "Crystal Palace User Intrinsics",
"url": "https://rastamouse.me/crystal-palace-user-intrinsics/",
"iso": "2026-07-17",
"via": null,
"blurb": "Intrinsics are functions used in code that are later replaced - typically with compiler-generated instructions. Examples of intrinsics include __movsb, which generates a rep movsb instruction; and __stosb, which generates a rep stosb instruction.Crystal Palace provides a handful of built-in…",
"image": "https://static.ghost.org/v5.0.0/images/publication-cover.jpg",
"person": "Rasta Mouse",
"personKey": "rasta mouse",
"cardId": "a1481876ae7e3fee"
},
{
"id": "a41c8cadd329",
"title": "Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy",
"url": "https://unit42.paloaltonetworks.com/siemens-rox-ii-zero-day-vulnerabilities/",
"iso": "2026-07-17",
"via": null,
"blurb": "Threat Research CenterThreat ResearchVulnerabilities Vulnerabilities Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy 9 min read Related ProductsAdvanced Threat PreventionCloud-Delivered Security ServicesIndustrial and Operational TechnologyIoT SecurityNext-Generation Firewall…",
"image": "https://unit42.paloaltonetworks.com/wp-content/uploads/2026/07/03_Vulnerabilities_1920x900.jpg",
"person": "Eviatar Gerzi",
"personKey": "eviatar gerzi",
"cardId": "ef7505192cc8394d"
},
{
"id": "7a4aed98a60c",
"title": "LSH delish",
"url": "https://aff-wg.org/2026/07/16/lsh-delish/",
"iso": "2026-07-16",
"via": null,
"blurb": "Another Crystal Palace and Tradecraft Garden release is now available. This release fills some gaps from recent releases and rounds out the feature set (aka, stuff I wanted to ship, but didn’t get to in time).",
"image": "https://i0.wp.com/aff-wg.org/wp-content/uploads/2026/07/adversary-fan-fiction-writers-guild-6a57ed4e9cc98.png?fit=1200%2C655&ssl=1",
"person": "Raphael Mudge",
"personKey": "raphael mudge",
"cardId": "c604cac63fc85485"
},
{
"id": "1f64803436be",
"title": "Malware development trick 60: Function stomping (remote process). Simple C example",
"url": "https://cocomelonc.github.io/malware/2026/07/16/malware-tricks-60.html",
"iso": "2026-07-16",
"via": null,
"blurb": "﷽ Hello, cybersecurity enthusiasts and white hackers! Next one in my blog about remote function stomping.",
"image": "https://cocomelonc.github.io/assets/images/215/2026-07-16_15-27.png",
"person": "cocomelonc",
"personKey": "cocomelonc",
"cardId": "8aa46440db075f17"
},
{
"id": "f18fc801433b",
"title": "Analysis of a Low-Detection Linux Implant with Hands-On Intrusion Capabilities",
"url": "https://dmpdump.github.io/posts/Unattributed_Linux_Implant/",
"iso": "2026-07-16",
"via": null,
"blurb": "UPDATE: After reviewing related infra found by @500mk500 and a related sample by @malwrhunterteam, I found quite a few similarities with the Adaptix Agent using the adaptix_gopher protocol.In early July 2026, MalwareHunterTeam shared an interesting ELF named gregbfdah.png with minimal detection…",
"image": "https://dmpdump.github.io/assets/images/linbdoor/main.png",
"person": "dmpdump",
"personKey": "dmpdump",
"cardId": "46efab9fa8adc7de"
},
{
"id": "dfb1810f51e5",
"title": "Overcomplicated Linux Process Enumeration",
"url": "https://maldevblog.com/posts/linux-proc-enumeration/",
"iso": "2026-07-16",
"via": null,
"blurb": "The guide on how to overthink process enumeration in Linux.I am coming from the Windows heavy internals background, however, Linux has been always super interesting to me. This is where I started, back in the day doing some heavy auditd stuff here and there.",
"image": "https://maldevblog.com/images/procfs.png",
"person": "Malware Dev Blog",
"personKey": "malware dev blog",
"cardId": "833dea9677d901f9"
},
{
"id": "56c1923c7d94",
"title": "Movement | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/",
"iso": "2026-07-16",
"via": null,
"blurb": "Movement This is a work-in-progressBelow is a checklist to go through when conducting a pentest. Order is irrelevant and many tests require authenticated or admin access.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "4a336a068dab",
"title": "Certificate Services (AD-CS) | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/adcs/",
"iso": "2026-07-16",
"via": null,
"blurb": "Certificate Services (AD-CS) Theory AD CS is Microsoft’s PKI implementation that provides everything from encrypting file systems, to digital signatures, to user authentication (a large focus of our research), and more. While AD CS is not installed by default for Active Directory environments,…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "6982d739326b",
"title": "Access controls | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/adcs/access-controls",
"iso": "2026-07-16",
"via": null,
"blurb": "Access controls Theory In their research papers, Will Schroeder and Lee Christensen found multiple vectors of domain escalation based on access control misconfigurations (dubbed ESC4, ESC5 and ESC7).Active Directory Certificate Services add multiple objects to AD, including securable ones…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "4164fc87382b",
"title": "Certificate authority | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/adcs/certificate-authority",
"iso": "2026-07-16",
"via": null,
"blurb": "Certificate authority Theory Certificate Authority misconfiguration In their research papers, Will Schroeder and Lee Christensen found a domain escalation vector based on a dangerous CA setting (i.e. the EDITF_ATTRIBUTESUBJECTALTNAME2 flag).",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "0b3ac594dc8c",
"title": "Certificate templates | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/adcs/certificate-templates",
"iso": "2026-07-16",
"via": null,
"blurb": "Certificate templates Theory Template theory AD CS Enterprise CAs issue certificates with settings defined by AD objects known as certificate templates. These templates are collections of enrollment policies and predefined certificate settings and contain things like “How long is this…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "1dec2c569921",
"title": "CVE-2022-26923 | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/adcs/certifried",
"iso": "2026-07-16",
"via": null,
"blurb": "Certifried Theory Certifried (CVE-2022-26923) is a vulnerability discovered by Oliver Lyak on AD CS that lets a domain-joined user escalate its privileges in the domain.A domain user creating a computer account obtains the Validated write to DNS host name and Validated write to service…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "93ff5d0dc2f3",
"title": "Unsigned endpoints | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/adcs/unsigned-endpoints",
"iso": "2026-07-16",
"via": null,
"blurb": "Unsigned endpoints Theory In their research papers, Will Schroeder and Lee Christensen found a domain escalation vector based on web endpoints vulnerable to NTLM relay attacks. The escalation vector was dubbed ESC8.AD CS supports several HTTP-based enrollment methods via additional server…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "87e984b2bf8a",
"title": "MachineAccountQuota | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/builtins/machineaccountquota",
"iso": "2026-07-16",
"via": null,
"blurb": "MachineAccountQuota Theory MachineAccountQuota (MAQ) is a domain level attribute that by default permits unprivileged users to attach up to 10 computers to an Active Directory (AD) domain (source)Practice There are multiple ways attackers can leverage that power.Force client authentications,…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "77789fc45903",
"title": "Pre-Windows 2000 computers | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/builtins/pre-windows-2000-computers",
"iso": "2026-07-16",
"via": null,
"blurb": "Pre-Windows 2000 computers Theory When a new computer account is configured as \"pre-Windows 2000 computer\", its password is set based on its name (i.e. lowercase computer name without the trailing $).",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "7f0732b70cb5",
"title": "RODC | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/builtins/rodc",
"iso": "2026-07-16",
"via": null,
"blurb": "RODC Theory The read-only Domain Controller (RODC) is a solution that Microsoft introduced for physical locations that don’t have adequate security to host a Domain Controller but still require directory services for resources in those locations. A branch office is the classic use case.(By…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "dc3682404486",
"title": "Security groups | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/builtins/security-groups",
"iso": "2026-07-16",
"via": null,
"blurb": "Security groups Theory In the Windows Server operating system, there are several built-in accounts and security groups that are preconfigured with the appropriate rights and permissions to perform specific tasks. (Microsoft)There are scenarios where testers can obtain full control over members…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "5e185195d080",
"title": "Password guessing | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/credentials/bruteforcing/guessing",
"iso": "2026-07-16",
"via": null,
"blurb": "Password guessing Theory There are scenarios where testers need to operate credential guessing for lateral movement, privilege escalation, or for obtaining a foothold on a system. Depending on the target user (or target system), guessing can be achieved differently.There are three major types…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "b678c72f64a3",
"title": "Spraying | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/credentials/bruteforcing/spraying",
"iso": "2026-07-16",
"via": null,
"blurb": "Spraying Credential spraying is a technique that attackers use to try a few passwords (or keys) against a set of usernames instead of a single one. This technique is just credential guessing but \"sprayed\" (i.e.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "2a3e86741357",
"title": "Stuffing | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/credentials/bruteforcing/stuffing",
"iso": "2026-07-16",
"via": null,
"blurb": "Stuffing When credentials are found (through dumping or cracking for instance), attackers can try to use them to obtain access on other accounts. This attacks can be powerful against organizations that use shared or common passwords.This technique can be combined with credential guessing when…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "69a1810926e2",
"title": "Cracking | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/credentials/cracking",
"iso": "2026-07-16",
"via": null,
"blurb": "Cracking Theory Attacking Active Directory domains often leads to obtaining password interesting, but either hashed or encrypted data. When this information cannot be directly leveraged for higher privileges (like with pass-the-hash, overpass-the-hash), it is required to crack it.Cracking is…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "5dead1ef5128",
"title": "Dumping | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/credentials/dumping/",
"iso": "2026-07-16",
"via": null,
"blurb": "Dumping When gaining control of a computer or account, useful information can often be obtained, sometimes leading to the compromise of additional objects. Many techniques can be carried out for credential dumping (either in the form of plaintext passwords, hashed passwords, or tickets).",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "bd7b11503c34",
"title": "Cached Kerberos tickets | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/credentials/dumping/cached-kerberos-tickets",
"iso": "2026-07-16",
"via": null,
"blurb": "Cached Kerberos tickets Theory Kerberos tickets can be cached on systems to allow for faster authentication without requiring users to re-enter credentials.From a red-team perspective, even though Linux and Windows use different cache formats to store Kerberos tickets (Kerberos on Linux uses…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "e1831478d8ce",
"title": "DCSync | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/credentials/dumping/dcsync",
"iso": "2026-07-16",
"via": null,
"blurb": "DCSync Theory DCSync is a technique that uses Windows Domain Controller's API to simulate the replication process from a remote domain controller. This attack can lead to the compromise of major credential material such as the Kerberos krbtgt keys used legitimately for tickets creation, but…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "2a5043b4a47f",
"title": "DPAPI secrets | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/credentials/dumping/dpapi-protected-secrets",
"iso": "2026-07-16",
"via": null,
"blurb": "DPAPI secrets Theory The DPAPI (Data Protection API) is an internal component in the Windows system. It allows various applications to store sensitive data (e.g.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "35ffad7d91c6",
"title": "Group Policy Preferences | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/credentials/dumping/group-policies-preferences",
"iso": "2026-07-16",
"via": null,
"blurb": "Group Policy Preferences Theory Windows systems come with a built-in Administrator (with an RID of 500) that most organizations want to change the password of. This can be achieved in multiple ways but there is one that is to be avoided: setting the built-in Administrator's password through…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "7c7f2e843fa3",
"title": "In-memory secrets | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/credentials/dumping/in-memory",
"iso": "2026-07-16",
"via": null,
"blurb": "In-memory secrets Theory Just like the LSASS process on Windows systems allowing for LSASS dumping, some programs sometimes handle credentials in the memory allocated to their processes, sometimes allowing attackers to dump them.Practice Just like LSASS dum",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "cf9044f0d46c",
"title": "Kerberos key list | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/credentials/dumping/kerberos-key-list",
"iso": "2026-07-16",
"via": null,
"blurb": "Kerberos key list Theory It is possible to retrieve the long term secret of a user (e.g. NT hash) by sending a TGS-REQ (service ticket request) to the KRBTGT service with a KERB-KEY-LIST-REQ message type.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "a55cbf29f63b",
"title": "LSASS secrets | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/credentials/dumping/lsass",
"iso": "2026-07-16",
"via": null,
"blurb": "LSASS secrets Theory The Local Security Authority Subsystem Service (LSASS) is a Windows service responsible for enforcing the security policy on the system. It verifies users logging in, handles password changes and creates access tokens.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "4b1c80e1cac4",
"title": "Network protocols | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/credentials/dumping/network-protocols",
"iso": "2026-07-16",
"via": null,
"blurb": "Network protocols Theory Plaintext protocols (like HTTP, FTP, SNMP, SMTP) are widely used within organizations. Being able to capture and parse that traffic could offer attackers valuable information like sensitive files, passwords or hashes.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "d42c4b3271f2",
"title": "Network shares | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/credentials/dumping/network-shares",
"iso": "2026-07-16",
"via": null,
"blurb": "Network shares Theory In organization networks, it is common to find passwords in random files (logs, config files, personal documents, Office documents, ...). Other credential dumping techniques (SAM & LSA, NTDS.dit, some web browsers, ...) could be considered as sub-techniques of credential…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "024cac09ab4b",
"title": "NTDS secrets | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/credentials/dumping/ntds",
"iso": "2026-07-16",
"via": null,
"blurb": "NTDS secrets NTDS (Windows NT Directory Services) is the directory services used by Microsoft Windows NT to locate, manage, and organize network resources. The NTDS.dit file is a database that stores the Active Directory data (including users, groups, security descriptors and password hashes).",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "291b7a2eb6e8",
"title": "SAM & LSA secrets | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/credentials/dumping/sam-and-lsa-secrets",
"iso": "2026-07-16",
"via": null,
"blurb": "SAM & LSA secrets Theory In Windows environments, passwords are stored in a hashed format in registry hives like SAM (Security Account Manager) and SECURITY.HiveDetailsFormat or credential materialSAMstores locally cached credentials (referred to as SAM secrets)LM or NT hashesSECURITYstores…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "b5c8b853cae2",
"title": "Web browsers | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/credentials/dumping/web-browsers",
"iso": "2026-07-16",
"via": null,
"blurb": "Web browsers Theory Just like other common programs and applications, most web browsers offer \"credential saving\" features allowing users to access restricted resources without supplying a username and password every time. The downside of this kind of features is that attackers that have…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "fdda2eaac212",
"title": "🛠️ Windows Credential Manager | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/credentials/dumping/windows-credential-manager",
"iso": "2026-07-16",
"via": null,
"blurb": "🛠️ Windows Credential Manager Theory Windows Credential Manager is a built-in feature that securely stores sensitive login information for websites, applications, and networks. It houses login credentials such as usernames, passwords, and web addresses.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "27f2d892bf56",
"title": "Impersonation | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/credentials/impersonation",
"iso": "2026-07-16",
"via": null,
"blurb": "Impersonation When credentials are found (through dumping or cracking for instance), attackers try to use them to obtain access to new resources. Depending on the harvested credential material type, the impersonation can be done in different ways.LM or NT password hash: pass-the-hashRC4…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "790c078f68cb",
"title": "Shuffling | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/credentials/shuffling",
"iso": "2026-07-16",
"via": null,
"blurb": "Shuffling When credentials are found (through dumping or cracking for instance), attackers try to use them to obtain access to new resources and eventually dump new credentials. Those new credentials can then be used to access other resources, eventually find other credentials, and so forth.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "0236cac11900",
"title": "DACL abuse | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/dacl/",
"iso": "2026-07-16",
"via": null,
"blurb": "DACL abuse Theory Access privileges for resources in Active Directory Domain Services are usually granted through the use of an Access Control Entry (ACE). Access Control Entries describe the allowed and denied permissions for a principal (e.g.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "539840852978",
"title": "AddMember | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/dacl/addmember",
"iso": "2026-07-16",
"via": null,
"blurb": "AddMember This abuse can be carried out when controlling an object that has a GenericAll, GenericWrite, Self, AllExtendedRights or Self-Membership, over the target group.UNIX-likeWindowsIt can also be achieved from UNIX-like system with net, a tool for the administration of samba and cifs/smb…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "12e45757c609",
"title": "ForceChangePassword | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/dacl/forcechangepassword",
"iso": "2026-07-16",
"via": null,
"blurb": "ForceChangePassword This abuse can be carried out when controlling an object that has a GenericAll, AllExtendedRights or User-Force-Change-Password over the target user.UNIX-likeWindowsIt can also be achieved from UNIX-like system with net, a tool for the administration of samba and cifs/smb…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "5485e08d2493",
"title": "Grant ownership | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/dacl/grant-ownership",
"iso": "2026-07-16",
"via": null,
"blurb": "Grant ownership t has the following command-line arguments.This abuse can be carried out when controlling an object that has WriteOwner or GenericAll over any object.The attacker can update the owner of the target object. Once the object owner has been changed to a principal the attacker…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "7d722dff5e09",
"title": "Grant rights | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/dacl/grant-rights",
"iso": "2026-07-16",
"via": null,
"blurb": "Grant rights This abuse can be carried out when controlling an object that has WriteDacl over another object.The attacker can write a new ACE to the target object’s DACL (Discretionary Access Control List). This can give the attacker full control of the target object.Instead of giving full…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "1fc539ce789b",
"title": "Logon script | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/dacl/logon-script",
"iso": "2026-07-16",
"via": null,
"blurb": "Logon script It is worth noting that during lab testing, I couldn't find a way to practice this scenario. Since I didn't find practical enough resources on the Internet, feel free to reach out if you manage to exploit this.This abuse can be carried out when controlling an object that has a…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "a53ebe048167",
"title": "ReadGMSAPassword | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/dacl/readgmsapassword",
"iso": "2026-07-16",
"via": null,
"blurb": "ReadGMSAPassword This abuse stands out a bit from other abuse cases. It can be carried out when controlling an object that is listed as a principal in the target gMSA account's msDS-GroupMSAMembership attribute (also known as PrincipalsAllowedToRetrieveManagedPassword).",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "58ffb767175a",
"title": "ReadLAPSPassword | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/dacl/readlapspassword",
"iso": "2026-07-16",
"via": null,
"blurb": "ReadLAPSPassword This abuse can be carried out when controlling an object that has GenericAll or AllExtendedRights (or combination of GetChanges and (GetChangesInFilteredSet or GetChangesAll) for domain-wise synchronization) over the target computer configured for LAPS. The attacker can then…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "86c6acf095d8",
"title": "Rights on RODC object | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/dacl/rights-on-rodc-object",
"iso": "2026-07-16",
"via": null,
"blurb": "Rights on RODC object With administrative control over the RODC computer object in the Active Directory, there is a path to fully compromise the domain. It is possible to modify the RODC’s msDS-NeverRevealGroup and msDS-RevealOnDemandGroup attributes to allow a Domain Admin to authenticate and…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "1440457a5eb4",
"title": "Targeted Kerberoasting | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/dacl/targeted-kerberoasting",
"iso": "2026-07-16",
"via": null,
"blurb": "Targeted Kerberoasting This abuse can be carried out when controlling an object that has a GenericAll, GenericWrite, WriteProperty or Validated-SPN over the target. A member of the Account Operator group usually has those permissions.The attacker can add an SPN (ServicePrincipalName) to that…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "14dd0f2ab6d0",
"title": "Group policies | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/group-policies",
"iso": "2026-07-16",
"via": null,
"blurb": "Group policies Theory \"Group Policy\" is a management feature of Active Directory. It allows admins to manage computers and users.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "662c79a0cdff",
"title": "Kerberos | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/kerberos/",
"iso": "2026-07-16",
"via": null,
"blurb": "Kerberos A Kerberos realm is a logical group of networked computers that share a common authentication database. The authentication database is used to store the Kerberos tickets that are issued to users and services when they authenticate to the network.In a Kerberos environment, each…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "e524e8932e0f",
"title": "Delegations | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/kerberos/delegations/",
"iso": "2026-07-16",
"via": null,
"blurb": "Delegations Theory Kerberos delegations allow services to access other services on behalf of domain users.Types of delegation The \"Kerberos\" authentication protocol features delegation capabilities described as follows. There are three types of Kerberos delegationsUnconstrained delegations…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "01c17eb38393",
"title": "Bronze Bit | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/kerberos/delegations/bronze-bit",
"iso": "2026-07-16",
"via": null,
"blurb": "Bronze Bit Theory When abusing Kerberos delegations, S4U extensions usually come into play. One of those extensions is S4U2proxy.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "773a3a70827f",
"title": "(KCD) Constrained | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/kerberos/delegations/constrained",
"iso": "2026-07-16",
"via": null,
"blurb": "(KCD) Constrained Theory If a service account, configured with constrained delegation to another service, is compromised, an attacker can impersonate any user (e.g. domain admin, except users protected against delegation) in the environment to access another service the initial one can…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "85cca19da234",
"title": "(RBCD) Resource-based constrained | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/kerberos/delegations/rbcd",
"iso": "2026-07-16",
"via": null,
"blurb": "(RBCD) Resource-based constrained Theory If an account, having the capability to edit the msDS-AllowedToActOnBehalfOfOtherIdentity attribute of another object (e.g. the GenericWrite ACE, see Abusing ACLs), is compromised, an attacker can use it populate that attribute, hence configuring that…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "7e2b084577b7",
"title": "S4U2self abuse | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/kerberos/delegations/s4u2self-abuse",
"iso": "2026-07-16",
"via": null,
"blurb": "S4U2self abuse Theory The following recipe shows how to abuse S4U2self for Local Privilege Escalation, or for stealthier alternative to Silver Ticket. There are other tricks based on S4U2self, using u2u (user-to-user) as well.Delegation and extensions Kerberos delegations allow services to…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "3459317ce83d",
"title": "(KUD) Unconstrained | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/kerberos/delegations/unconstrained",
"iso": "2026-07-16",
"via": null,
"blurb": "(KUD) Unconstrained Theory If an account (user or computer) with unconstrained delegation is compromised, an attacker must wait for a privileged user to authenticate to it via Kerberos (or force it). When a target authenticates to a KUD-enabled service, the KDC embeds a copy of the target's…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "5db7fcdc4fe0",
"title": "Forged tickets | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/kerberos/forged-tickets/",
"iso": "2026-07-16",
"via": null,
"blurb": "Forged tickets Silver, Golden, Diamond and Sapphire tickets are forged or modified Kerberos tickets that can be used with pass-the-ticket to access services in an Active Directory domain.GlossaryPAC (Privileged Attribute Certificate): a special set of data contained in the ticket (TGT or…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "21ec86d38041",
"title": "Diamond tickets | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/kerberos/forged-tickets/diamond",
"iso": "2026-07-16",
"via": null,
"blurb": "Diamond tickets Theory Golden and Silver tickets can usually be detected by probes that monitor the service ticket requests (KRB_TGS_REQ) that have no corresponding TGT requests (KRB_AS_REQ). Those types of tickets also feature forged PACs that sometimes fail at mimicking real ones, thus…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "e298f0a261a0",
"title": "Golden tickets | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/kerberos/forged-tickets/golden",
"iso": "2026-07-16",
"via": null,
"blurb": "Golden tickets Theory The long-term key of the krbtgt account can be used to forge a special TGT (Ticket Granting Ticket) that can later be used with Pass-the-ticket to access any resource within the AD domain. The krbtgt's key is used to encrypt the PAC.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "5a191f8d6faf",
"title": "MS14-068 | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/kerberos/forged-tickets/ms14-068",
"iso": "2026-07-16",
"via": null,
"blurb": "MS14-068 Theory This vulnerability allows attackers to forge a TGT with high privileges (i.e. with a modified PAC stating the user is a member of privileged groups).",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "887b3842e505",
"title": "RODC Golden tickets | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/kerberos/forged-tickets/rodc-golden-tickets",
"iso": "2026-07-16",
"via": null,
"blurb": "RODC Golden tickets Theory With administrative access to an RODC, it is possible to dump all the cached credentials, including those of thekrbtgt_XXXXX account. The hash can be used to forge a \"RODC golden ticket\" for any account in the msDS-RevealOnDemandGroup and not in the…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "cbef4e487e9e",
"title": "Sapphire tickets | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/kerberos/forged-tickets/sapphire",
"iso": "2026-07-16",
"via": null,
"blurb": "Sapphire tickets Theory Sapphire tickets are similar to Diamond tickets in the way the ticket is not forged, but instead based on a legitimate one obtained after a request. The difference lays in how the PAC is modified.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "87a951393b6b",
"title": "Silver tickets | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/kerberos/forged-tickets/silver",
"iso": "2026-07-16",
"via": null,
"blurb": "Silver tickets Theory The long-term key of a service account can be used to forge a Service ticket that can later be used with Pass-the-ticket to access that service. In a Silver Ticket scenario, an attacker will forge a Service Ticket containing a PAC that features arbitrary information about…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "7dcb3ef4cd99",
"title": "Overpass the hash | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/kerberos/pass-the/opth",
"iso": "2026-07-16",
"via": null,
"blurb": "Overpass the hash This technique is a form of pass the key.Kerberos offers 4 different key types: DES, RC4, AES-128 and AES-256.When attackers know the RC4 key (which is in fact the user's NT hash), and when the RC4 etype is not disabled, they can use it to o",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "aa1ceb40d4a0",
"title": "Pass the Certificate | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/kerberos/pass-the/pass-the-certificate",
"iso": "2026-07-16",
"via": null,
"blurb": "Pass the Certificate Theory The Kerberos authentication protocol works with tickets in order to grant access. An ST (Service Ticket) can be obtained by presenting a TGT (Ticket Granting Ticket).",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "82429f944670",
"title": "Pass the cache | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/kerberos/pass-the/ptc",
"iso": "2026-07-16",
"via": null,
"blurb": "Pass the cache This technique is equivalent to pass the ticket.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "d4d58620ea33",
"title": "Pass the key | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/kerberos/pass-the/ptk",
"iso": "2026-07-16",
"via": null,
"blurb": "Pass the key Theory The Kerberos authentication protocol works with tickets in order to grant access. A Service Ticket (ST) can be obtained by presenting a TGT (Ticket Granting Ticket).",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "a5d00658a3bf",
"title": "Pass the ticket | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/kerberos/pass-the/ptt",
"iso": "2026-07-16",
"via": null,
"blurb": "Pass the ticket Theory There are ways to come across (cached Kerberos tickets) or forge (overpass the hash, silver ticket and golden ticket attacks) Kerberos tickets. A ticket can then be used to authenticate to a system using Kerberos without knowing any password.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "bd103c0ce859",
"title": "Pre-auth bruteforce | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/kerberos/pre-auth-bruteforce",
"iso": "2026-07-16",
"via": null,
"blurb": "Pre-auth bruteforce Theory The Kerberos authentication protocol works with tickets in order to grant access. A ST (Service Ticket) can be obtained by presenting a TGT (Ticket Granting Ticket).",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "b8333e800c8f",
"title": "Dollar ticket | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/kerberos/principal-confusion/dollar-ticket",
"iso": "2026-07-16",
"via": null,
"blurb": "Dollar ticket Theory The Dollar ticket attack exploits name confusion vulnerabilities in Kerberos authentication within Active Directory environments. The attack leverages the behavior of machine accounts (which traditionally end with a $ character) and the default principal-to-username…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "0ee744bcf4f8",
"title": "sAMAccountName spoofing | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/kerberos/principal-confusion/samaccountname-spoofing",
"iso": "2026-07-16",
"via": null,
"blurb": "sAMAccountName spoofing Theory In November 2021, two vulnerabilities caught the attention of many security researchers as they could allow domain escalation from a standard user.Relationship with other principal confusion attacks sAMAccountName spoofing and the Dollar ticket attack both…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "687bac002cde",
"title": "Kerberos relay | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/kerberos/relay",
"iso": "2026-07-16",
"via": null,
"blurb": "Kerberos relay Theory Under certain conditions, an attacker can relay Kerberos authentication to targets of his choosing. Depending on the mitigations in place, he will be able to move laterally and escalate privileges within an Active Directory domain.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "1bd58639f83b",
"title": "ASREProast | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/kerberos/roasting/asreproast",
"iso": "2026-07-16",
"via": null,
"blurb": "ASREProast Theory The Kerberos authentication protocol works with tickets in order to grant access. A ST (Service Ticket) can be obtained by presenting a TGT (Ticket Granting Ticket).",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "f78354cc5a41",
"title": "ASREQroast | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/kerberos/roasting/asreqroast",
"iso": "2026-07-16",
"via": null,
"blurb": "ASREQroast Theory The Kerberos authentication protocol works with tickets in order to grant access. A ST (Service Ticket) can be obtained by presenting a TGT (Ticket Granting Ticket).",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "c6f9a26decf2",
"title": "Kerberoast | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/kerberos/roasting/kerberoast",
"iso": "2026-07-16",
"via": null,
"blurb": "Kerberoast Theory When asking the KDC (Key Distribution Center) for a Service Ticket (ST), the requesting user needs to send a valid TGT (Ticket Granting Ticket) and the service name (sname) of the service wanted. If the TGT is valid, and if the service exists, the KDC sends the ST to the…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "26fcdd0f1cb7",
"title": "Timeroasting | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/kerberos/roasting/timeroast",
"iso": "2026-07-16",
"via": null,
"blurb": "Timeroasting Theory Timeroasting is an attack technique that abuses Microsoft's proprietary NTP extension to extract password-equivalent hashes for computer and trust accounts from domain controllers without requiring authentication. These hashes can subsequently be cracked…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "fb4559036adc",
"title": "Shadow Credentials | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/kerberos/shadow-credentials",
"iso": "2026-07-16",
"via": null,
"blurb": "Shadow Credentials Theory The Kerberos authentication protocol works with tickets in order to grant access. An ST (Service Ticket) can be obtained by presenting a TGT (Ticket Granting Ticket).",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "72de0384960e",
"title": "SPN-jacking | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/kerberos/spn-jacking",
"iso": "2026-07-16",
"via": null,
"blurb": "SPN-jacking Theory This attack combines Kerberos Constrained delegation abuse and DACL abuse. A service configured for Kerberos Constrained Delegation (KCD) can impersonate users on a set of services.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "b03c2a751124",
"title": "UnPAC the hash | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/kerberos/unpac-the-hash",
"iso": "2026-07-16",
"via": null,
"blurb": "UnPAC the hash Theory When using PKINIT to obtain a TGT (Ticket Granting Ticket), the KDC (Key Distribution Center) includes in the ticket a PAC_CREDENTIAL_INFO structure containing the NTLM keys (i.e. LM and NT hashes) of the authenticating user.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "358c632af677",
"title": "MITM & coercion | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/mitm-and-coerced-authentications/",
"iso": "2026-07-16",
"via": null,
"blurb": "MITM & coercion In Active Directory domains, attackers often rely on coerced authentications and MitM (man in the middle) techniques to operate lateral movement, especially when attempting authentication relaying attacks (e.g. NTLM relay or Kerberos relay), or when abusing Kerberos…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "6381fd3f5546",
"title": "ADIDNS poisoning | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/mitm-and-coerced-authentications/adidns-spoofing",
"iso": "2026-07-16",
"via": null,
"blurb": "ADIDNS poisoning Theory In order to function properly, Active Directory services need DNS. In that matter, Active Directory Domain Services (AD-DS) offer an integrated storage and replication service for DNS records.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "438d9fde76b9",
"title": "ARP poisoning | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/mitm-and-coerced-authentications/arp-poisoning",
"iso": "2026-07-16",
"via": null,
"blurb": "ARP poisoning Theory The ARP (Address Resolution Protocol) is used to link IPv4 addresses with MAC addresses, allowing machines to communicate within networks. Since that protocol works in broadcast, attackers can try to impersonate machines by answering ARP requests (\"Who is using address…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "29a9f736d930",
"title": "DHCP poisoning | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/mitm-and-coerced-authentications/dhcp-poisoning",
"iso": "2026-07-16",
"via": null,
"blurb": "DHCP poisoning Theory When a workstation reboots or plugs into a network, a broadcast DHCP request is emitted. It's goal is to ask for network settings like an IPv4 address.Windows uses several custom DHCP options such as NetBIOS, WINS, WPAD settings.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "9bd7f4748cfa",
"title": "DHCPv6 spoofing | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/mitm-and-coerced-authentications/dhcpv6-spoofing",
"iso": "2026-07-16",
"via": null,
"blurb": "DHCPv6 spoofing Theory DHCPv6 spoofing and poisoning By default on Windows environments, IPv6 is enabled and has priority over IPv4. Usually, IPv6 is neither used nor configured.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "bac971391ea0",
"title": "DNS spoofing | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/mitm-and-coerced-authentications/dns-spoofing",
"iso": "2026-07-16",
"via": null,
"blurb": "DNS spoofing Theory DNS is not multicast or broadcast like LLMNR, NBT-NS or mDNS. In order to answer DNS requests, attacker first need to receive them.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "8b465c327b39",
"title": "🛠️ ICMP Redirect | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/mitm-and-coerced-authentications/icmp-redirect",
"iso": "2026-07-16",
"via": null,
"blurb": "🛠️ ICMP Redirect bashpython3 tools/Icmp-Redirect.py --interface $INTERFACE --ip $my_ip --gateway $gateway --target $target --route $dnsserver1 --secondaryroute $dnsserver2need iptablehttps://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/nx-os-softwar",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "eae0b64f583c",
"title": "🛠️ Living off the land | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/mitm-and-coerced-authentications/living-off-the-land",
"iso": "2026-07-16",
"via": null,
"blurb": "🛠️ Living off the land This is a work-in-progress. It's indicated with the 🛠️ emoji in the page name or in the category nameTheory In the physical world, “living off the land” simply means to survive only by the resources that you can harvest from the natural land.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "21ec0d160851",
"title": "LLMNR, NBT-NS, mDNS spoofing | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/mitm-and-coerced-authentications/llmnr-nbtns-mdns-spoofing",
"iso": "2026-07-16",
"via": null,
"blurb": "LLMNR, NBT-NS, mDNS spoofing In some environments (like Windows ones), multicast name resolution protocols are enabled by default, such as LLMNR (Link-Local Multicast Name Resolution), NBT-NS (NetBIOS Name Service) and mDNS (multicast Domain Name System). Those environments can fallback to…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "e7d336f479c8",
"title": "🛠️ NBT Name Overwrite | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/mitm-and-coerced-authentications/nbt-name-overwrite",
"iso": "2026-07-16",
"via": null,
"blurb": "Skip to contentMenuReturn to topBy the creator of this site Professional environments for pentesting, red team, ctf 🛠️ NBT Name Overwrite https://twitter.com/PythonResponder/status/1379251124985851904TermsPrivacyAbout",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "30d293031550",
"title": "PushSubscription abuse | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/mitm-and-coerced-authentications/pushsubscription-abuse",
"iso": "2026-07-16",
"via": null,
"blurb": "PushSubscription abuse Theory \"PushSubscription\" is an API on Exchange Web Services that allows to subscribe to push notifications. Attackers abuse it to make Exchange servers authenticate to a target of their choosing.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "5df0690c573b",
"title": "MS-DFSNM abuse (DFSCoerce) | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/mitm-and-coerced-authentications/rpc-coercions/ms-dfsnm",
"iso": "2026-07-16",
"via": null,
"blurb": "MS-DFSNM abuse (DFSCoerce) Theory MS-DFSNM is Microsoft's Distributed File System Namespace Management protocol. It provides an RPC interface for administering DFS configurations (docs.microsoft.com) and is available as an RPC interface.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "97e545b6e99d",
"title": "MS-EFSR abuse (PetitPotam) | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/mitm-and-coerced-authentications/rpc-coercions/ms-efsr",
"iso": "2026-07-16",
"via": null,
"blurb": "MS-EFSR abuse (PetitPotam) Theory MS-EFSR is Microsoft's Encrypting File System Remote protocol. It performs maintenance and management operations on encrypted data that is stored remotely and accessed over a network (docs.microsoft.com) and is available as an RPC interface.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "d0d187183d0b",
"title": "MS-FSRVP abuse (ShadowCoerce) | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/mitm-and-coerced-authentications/rpc-coercions/ms-fsrvp",
"iso": "2026-07-16",
"via": null,
"blurb": "MS-FSRVP abuse (ShadowCoerce) Theory MS-FSRVP is Microsoft's File Server Remote VSS Protocol. It's used for creating shadow copies of file shares on a remote computer, and for facilitating backup applications in performing application-consistent backup and restore of data on SMB2 shares…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "b36074d159cc",
"title": "MS-RPRN abuse (PrinterBug) | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/mitm-and-coerced-authentications/rpc-coercions/ms-rprn",
"iso": "2026-07-16",
"via": null,
"blurb": "MS-RPRN abuse (PrinterBug) Theory Microsoft’s Print Spooler is a service handling the print jobs and other various tasks related to printing. An attacker controling a domain user/computer can, with a specific RPC call, trigger the spooler service of a target running it and make it authenticate…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "922bf6bc5d1b",
"title": "WebClient abuse (WebDAV) | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/mitm-and-coerced-authentications/webclient",
"iso": "2026-07-16",
"via": null,
"blurb": "WebClient abuse (WebDAV) Theory Web Distributed Authoring and Versioning (WebDAV) is an extension to Hypertext Transfer Protocol (HTTP) that defines how basic file functions such as copy, move, delete, and create are performed by using HTTP (docs.microsoft.com)The WebClient service needs to be…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "96b6c6611170",
"title": "WPAD spoofing | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/mitm-and-coerced-authentications/wpad-spoofing",
"iso": "2026-07-16",
"via": null,
"blurb": "WPAD spoofing Theory A proxy can be used to handle clients requests (for example to access the Internet). In a network in which the topology changes frequently, adaptive configurations are needed.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "f2e59eaa8ce4",
"title": "WSUS spoofing | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/mitm-and-coerced-authentications/wsus-spoofing",
"iso": "2026-07-16",
"via": null,
"blurb": "WSUS spoofing Theory WSUS (Windows Server Update Services) allow administrators to centralize the management and deployment of Windows updates within their organization network. When first configuring this set of services, the default configuration makes the WSUS use HTTP without any secure…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "b6be79e628f4",
"title": "ZeroLogon | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/netlogon/zerologon",
"iso": "2026-07-16",
"via": null,
"blurb": "ZeroLogon Theory Netlogon is a service verifying logon requests, registering, authenticating, and locating domain controllers. MS-NRPC, the Netlogon Remote Protocol RPC interface is an authentication mechanism part of that service.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "4a3589286c9a",
"title": "NTLM | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/ntlm/",
"iso": "2026-07-16",
"via": null,
"blurb": "NTLM Theory A common error people do is mix LM, NT, NTLM, Net-NTLM etc. Let's make things clear.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "f0e92667fef4",
"title": "Capture | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/ntlm/capture",
"iso": "2026-07-16",
"via": null,
"blurb": "Capture Theory After successfully forcing a victim to authenticate with LM or NTLM to an attacker's server, the attacker can try to recover credentials by capturing and cracking the NTLM responses (\"hashes\") sent by the victim.Practice NTLM capture can be combined with any forced…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "bd244b2ba9d6",
"title": "Pass the hash | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/ntlm/pth",
"iso": "2026-07-16",
"via": null,
"blurb": "Pass the hash Theory An attacker knowing a user's NT hash can use it to authenticate over NTLM (pass-the-hash) (or indirectly over Kerberos with overpass-the-hash).Practice There are many tools that implement pass-the-hash: Impacket scripts (Python) (psexec, smbexec, secretsdump...), NetExec…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "99c45e6ee758",
"title": "NTLM relay | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/ntlm/relay",
"iso": "2026-07-16",
"via": null,
"blurb": "NTLM relay Theory After successfully forcing a victim to authenticate with LM or NTLM to an attacker's server, the attacker can try to relay that authentication to targets of his choosing. Depending on the mitigations in place, he will be able to move laterally and escalate privileges within…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "e8a52227e7c3",
"title": "PrinterBug | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/print-spooler-service/printerbug",
"iso": "2026-07-16",
"via": null,
"blurb": "PrinterBug This vulnerability allows low-privileged users to coerce authentications from machines that run the Print Spooler Service by crafting a specific RPC call through MS-RPRN, Microsoft’s Print System Remote Protocol.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "7859372fcc9f",
"title": "PrintNightmare | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/print-spooler-service/printnightmare",
"iso": "2026-07-16",
"via": null,
"blurb": "PrintNightmare Theory The print spooler The Print Spooler is a Microsoft built-in service that manages printing jobs. It is enabled by default and runs within the SYSTEM context.3 RPC protocols are registered by the spooler:MS-RPRN: Microsoft’s Print System Remote Protocol.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "7bcee1d99ea4",
"title": "SCCM / MECM | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/sccm-mecm/",
"iso": "2026-07-16",
"via": null,
"blurb": "SCCM / MECM Theory The System Center Configuration Manager (SCCM), now (since 2020) known as Microsoft Endpoint Configuration Manager (MECM), is a software developed by Microsoft to help system administrators manage the servers and workstations in large Active Directory environments. It…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "bba622d00a9d",
"title": "Lateral movement | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/sccm-mecm/lateral-movement/",
"iso": "2026-07-16",
"via": null,
"blurb": "Lateral movement Theory Since the main goal of SCCM is to deploy applications and services on the managed assets of the Active Directory, it is also a pretty good candidate to move latteraly on the network. With administrative rights on the primary site server, this can be done by deploying…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "00f8c0e17b40",
"title": "AdminService API | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/sccm-mecm/lateral-movement/adminservice-api",
"iso": "2026-07-16",
"via": null,
"blurb": "AdminService API Theory It appears that, with SCCM administrative rights, it is possible to directly interact with the AdminService API, without using CMPivot, for post SCCM exploitation purpose.Prior to Configuration Manager version 2509, the AdminService API was vulnerable to NTLM relay…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "56a8ec07a2af",
"title": "Applications and scripts deployment | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/sccm-mecm/lateral-movement/deployment",
"iso": "2026-07-16",
"via": null,
"blurb": "Applications and scripts deployment Theory With administrative rights on the primary site server, applications and scripts can be deployed on target devices to move laterally across the network.For additional attack techniques and defense strategies related to application and script deployment…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "b46ef0431cc6",
"title": "Admin & Special Account Enumeration | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/sccm-mecm/lateral-movement/enumeration",
"iso": "2026-07-16",
"via": null,
"blurb": "Admin & Special Account Enumeration Theory Administrative privileges over the SCCM Management Point (MP) are required to query the MP's WMI database for admin and special accounts.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "448f037f89fa",
"title": "SCCM Hierarchy takeover | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/sccm-mecm/lateral-movement/hierarchy-takeover",
"iso": "2026-07-16",
"via": null,
"blurb": "SCCM Hierarchy takeover Theory As indicated by Chris Thompson in his article SCCM Hierarchy Takeover, by default, when a new user is promoted to any SCCM administrative role on a primary site server (for example, Full Administrator), the role is automatically propagated to the other SCCM site…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "538cf70dfe70",
"title": "Privilege escalation | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/sccm-mecm/privilege-escalation/",
"iso": "2026-07-16",
"via": null,
"blurb": "Privilege escalation Theory There are currently three different pathways for privilege escalation in an SCCM environment in order to take control over the infrastructure:Credential harvestingClient Push account authentication coercionSCCM site takeoverPractice Credential harvesting An SCCM…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "85ba7dddfb2e",
"title": "Client Push account authentication coercion | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/sccm-mecm/privilege-escalation/client-push-coercion",
"iso": "2026-07-16",
"via": null,
"blurb": "Client Push account authentication coercion Theory If SCCM is deployed via Client Push Accounts, it is possible, from a compromised SCCM client, to coerce the Client Push Account into authenticating to an arbitrary remote resource. It is then possible to retrieve NTLM authentication data in…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "a18b153a7b35",
"title": "Credential harvesting | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/sccm-mecm/privilege-escalation/credential-harvesting",
"iso": "2026-07-16",
"via": null,
"blurb": "Credential harvesting Theory For more details on this subject, see this Synacktiv article.This blogpost also contains useful information on the topic.For additional attack techniques and defense strategies related to credential harvesting in SCCM, refer to the following techniques from the…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "bcef0f072ff3",
"title": "SCCM site takeover | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/sccm-mecm/privilege-escalation/site-takeover",
"iso": "2026-07-16",
"via": null,
"blurb": "SCCM site takeover Theory Some SCCM configurations make it possible to abuse the permissions of the site server / passive site server machine accounts in order to compromise the SCCM infrastructure via relay attacks.For additional attack techniques and defense strategies related to SCCM site…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "dc78f7ef4045",
"title": "Pass the Certificate | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/schannel/passthecert",
"iso": "2026-07-16",
"via": null,
"blurb": "Pass the Certificate This technique extends the notion of Pass the Certificate, thus dubbed by myself, @_nwodtuhs, in a Twitter thread about AD CS and PKINIT here. Even if both techniques share the same name and the same concept, the authentication method is different.Theory Sometimes, Domain…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "9e743caeee30",
"title": "Trusts | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/movement/trusts/",
"iso": "2026-07-16",
"via": null,
"blurb": "Trusts Theory Attacking Active Directory trust relationships requires a good understanding of a lot of concepts (what forests and domains are, how trusts work, what security mechanisms are involved and how they work, ...). Consequently, this page is lengthy, especially in the theory and…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "974c3e5210ec",
"title": "Certificate Services (AD-CS) | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/persistence/adcs/",
"iso": "2026-07-16",
"via": null,
"blurb": "Certificate Services (AD-CS) See AD > Movement > AD-CS to know more about it.Theory AD CS is Microsoft’s PKI implementation that provides everything from encrypting file systems, to digital signatures, to user authentication (a large focus of our research), and more. While AD CS is not…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "54a363008720",
"title": "Access controls | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/persistence/adcs/access-controls",
"iso": "2026-07-16",
"via": null,
"blurb": "Access controls Theory In their research papers, Will Schroeder and Lee Christensen identified a set of vectors of domain persistence based on access control misconfigurations (dubbed DPERSIST3).Active Directory Certificate Services add multiple objects to AD, including securable ones which…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "67cb18dce7ab",
"title": "Certificate authority | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/persistence/adcs/certificate-authority",
"iso": "2026-07-16",
"via": null,
"blurb": "Certificate authority Theory In their research papers, Will Schroeder and Lee Christensen identified 2 domain persistence techniques relying on the role of the Certificate Authority within a PKI.Forging certificates with a stolen CA certificates (DPERSIST1)Trusting rogue CA certificates…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "03a1a8a44ab0",
"title": "Golden certificate | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/persistence/adcs/golden-certificate",
"iso": "2026-07-16",
"via": null,
"blurb": "Golden certificate Theory Golden certificates usually refer to one of two types of attacks.Forge certificate and sign them with the CA cert private key --> #stolen-caModify a template and turn it into a SmartCard template --> access-controls.mdMost tools (certsync, certipy) and resources refer…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "774969203144",
"title": "AdminSDHolder | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/persistence/adminsdholder",
"iso": "2026-07-16",
"via": null,
"blurb": "AdminSDHolder Theory AdminSdHolder protects domain objects against permission changes. \"AdminSdHolder\" either refers to a domain object, a \"worker code\" or an operation depending on the context.The operation consists in the PDC (Principal Domain Controller) Emulator restoring pre-set…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "d229bfc6f13b",
"title": "🛠️ Access controls | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/persistence/dacl",
"iso": "2026-07-16",
"via": null,
"blurb": "🛠️ Access controls https://www.slideshare.net/harmj0y/an-ace-in-the-hole-stealthy-host-persistence-via-security-descriptorshttps://specterops.io/assets/resources/an_ace_up_the_sleeve.pdfDPERSIST on AD CS : https://www.specterops.io/assets/resources/Certified",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "7afc895507f7",
"title": "DC Shadow | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/persistence/dcshadow/",
"iso": "2026-07-16",
"via": null,
"blurb": "DC Shadow Theory The idea behind this persistence technique is to have an attacker-controlled machine act as a domain controller (shadow DC) to push changes onto the domain by forcing other domain controllers to replicate.There are two requirements for a mac",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "7fcda951ea24",
"title": "DSRM Persistence | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/persistence/dsrm",
"iso": "2026-07-16",
"via": null,
"blurb": "DSRM Persistence Theory The Directory Services Restore Mode (DSRM) is a special mode available on every Domain Controller (DC) for recovery operations. When a server is promoted to a Domain Controller, a local administrator account named \"Administrator\" is created with a DSRM password.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "f2afd9717611",
"title": "GoldenGMSA | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/persistence/goldengmsa",
"iso": "2026-07-16",
"via": null,
"blurb": "GoldenGMSA Theory What is a gMSA account? Within an Active Directory environment, service accounts are often created and used by different applications.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "be24ae9c2b22",
"title": "Delegation to KRBTGT | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/persistence/kerberos/delegation-to-krbtgt",
"iso": "2026-07-16",
"via": null,
"blurb": "Delegation to KRBTGT Theory The idea behind this technique is to configure resource-based constrained delegation on the krbtgt account to generate TGTs on-demand as a persistence technique. The requirements for the technique are to have enough privileges (i.e.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "4131efb71df0",
"title": "Forged tickets | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/persistence/kerberos/forged-tickets",
"iso": "2026-07-16",
"via": null,
"blurb": "Forged tickets Silver, Golden, Diamond and Sapphire tickets are similar variants of forged Kerberos tickets, for different purposes and stealth levels, that can be used with pass-the-ticket to access services in an Active Directory domain.When one of krbtgt's Kerberos keys is known, a golden…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "1608db8d0950",
"title": "Shadow Principals (PAM) | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/persistence/shadow-principals",
"iso": "2026-07-16",
"via": null,
"blurb": "Shadow Principals (PAM) Theory When a Bastion Forest is compromised, there are multiple ways to obtain persistence on the forest it manages (i.e.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "45906d379ae5",
"title": "SID History | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/persistence/sid-history",
"iso": "2026-07-16",
"via": null,
"blurb": "SID History Theory The SID (Security Identifier) is a unique identifier that is assigned to each security principal (e.g. user, group, computer).",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "d31864f3d679",
"title": "Skeleton key | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/persistence/skeleton-key/",
"iso": "2026-07-16",
"via": null,
"blurb": "Skeleton key Theory Skeleton key is a persistence attack used to set a master password on one or multiple Domain Controllers. The master password can then be used to authenticate as any user in the domain while they can still authenticate with their original password.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "64e534f120ff",
"title": "Reconnaissance | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/recon/",
"iso": "2026-07-16",
"via": null,
"blurb": "Reconnaissance When attacking an Active Directory, or in fact any system, it is essential to gather useful information that will help define who, what, when and where. Here are some examples of what information to look for.The location of the domain controllers (and other major AD services like…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "d012a65790d3",
"title": "BloodHound ⚙️ | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/recon/bloodhound/",
"iso": "2026-07-16",
"via": null,
"blurb": "BloodHound ⚙️ Theory BloodHound is an awesome tool that allows mapping of relationships within Active Directory environments. It mostly uses Windows API functions and LDAP namespace functions to collect data from domain controllers and domain-joined Windows systems.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "542d08708ea0",
"title": "DHCP | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/recon/dhcp",
"iso": "2026-07-16",
"via": null,
"blurb": "DHCP When connecting a computer to most enterprise networks, if the Dynamic Host Configuration Protocol (DHCP) is enabled, it will assign an IP address to that computer, and send a lot of information. Nameservers and domain names are usually set through DHCP offer packets.On UNIX-like systems,…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "23337c6de186",
"title": "DNS | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/recon/dns",
"iso": "2026-07-16",
"via": null,
"blurb": "DNS Finding Domain Controllers AD-DS (Active Directory Domain Services) rely on DNS SRV RR (service location resource records). Those records can be queried to find the location of some servers: the global catalog, LDAP servers, the Kerberos KDC and so on.dnsutilsnmapnslookup is a DNS client…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "0d40666ec388",
"title": "enum4linux ⚙️ | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/recon/enum4linux",
"iso": "2026-07-16",
"via": null,
"blurb": "enum4linux ⚙️ The Perl script enum4linux.pl is a powerful tool able to operate recon techniques for LDAP, NBT-NS and MS-RPC. It's an alternative to a similar program named enum.exe (C++) created for Windows systems.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "133ce1f1b176",
"title": "LDAP | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/recon/ldap",
"iso": "2026-07-16",
"via": null,
"blurb": "LDAP A lot of information on an AD domain can be obtained through LDAP. Most of the information can only be obtained with an authenticated bind but metadata (naming contexts, DNS server name, Domain Functional Level (DFL)) can be obtainable anonymously, even with anonymous binding…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "8c9499567dcb",
"title": "MS-RPC | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/recon/ms-rpc",
"iso": "2026-07-16",
"via": null,
"blurb": "MS-RPC Theory MS-RPC (Microsoft Remote Procedure Call) is a protocol that allows requesting service from a program on another computer without having to understand the details of that computer's network. An MS-RPC service can be accessed through different transport protocols, among which:a…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "c2b20b9841aa",
"title": "NBT-NS | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/recon/nbt-ns",
"iso": "2026-07-16",
"via": null,
"blurb": "NBT-NS Just like DNS, the NBT-NS (NetBIOS name service) protocol is used to translate names to IP addresses.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "9d92f767b50c",
"title": "Password policy | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/recon/password-policy",
"iso": "2026-07-16",
"via": null,
"blurb": "Password policy When attacking Active Directory domains, directly targeting accounts is usually a great start. It could provide initial access and help the attackers operate lateral movement.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "85c2e31d5e1f",
"title": "Port scanning | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/recon/port-scanning",
"iso": "2026-07-16",
"via": null,
"blurb": "Port scanning In an Active Directory domain, domain controllers can be easily spotted depending on what services they host. Each service is usually accessible specific TCP and/or UDP port(s) making the DCs stand out in the network.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "98d7f73570c9",
"title": "Responder ⚙️ | The Hacker Recipes",
"url": "https://thehacker.recipes/ad/recon/responder",
"iso": "2026-07-16",
"via": null,
"blurb": "Responder ⚙️ Responder (Python) is a great tool for LLMNR, NBTNS, MDNS poisoning and WPAD spoofing but it can also be used in \"analyze\" modes.BROWSER mode: inspect Browse Service messages and map IP addresses with NetBIOS namesLANMAN mode: passively map domai",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "0ded6cf6f6fe",
"title": "Sponsor 🌟 | The Hacker Recipes",
"url": "https://thehacker.recipes/contributing/ads",
"iso": "2026-07-16",
"via": null,
"blurb": "Sponsor 🌟 The Hacker Recipes is a free platform, created in 2020, dedicated to theoretical and practical guides on offensive security. Our mission is simple: to share knowledge by providing harmonized, reliable, and high-quality content on ethical offensive cybersecurity.If you're a company or…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "70bd930d7ab1",
"title": "Title | The Hacker Recipes",
"url": "https://thehacker.recipes/contributing/template",
"iso": "2026-07-16",
"via": null,
"blurb": "Title Theory Lorem ipsum dolor sit amet, consectetur adipiscing elit. Fusce ut ex purus.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "9edb38ddbba0",
"title": "Variables | The Hacker Recipes",
"url": "https://thehacker.recipes/contributing/variables",
"iso": "2026-07-16",
"via": null,
"blurb": "Variables Throughout The Hacker Recipes, we use variables to make commands and code samples more adaptable to your specific environment. Click on any variable (prefixed with $) to modify its value, and that change will be reflected across the entire site.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "4bf2bc475c79",
"title": "Guide for authors 📝 | The Hacker Recipes",
"url": "https://thehacker.recipes/contributing/write",
"iso": "2026-07-16",
"via": null,
"blurb": "Guide for authors 📝 The Hacker Recipes is a community-driven project, and we welcome contributions from anyone who wants to share their knowledge and help others learn. In order to keep the quality of the content high, in terms of readability and structure, we ask contributors to follow a…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "2e1eb0926f5f",
"title": "(AV) Anti-Virus | The Hacker Recipes",
"url": "https://thehacker.recipes/evasion/av/",
"iso": "2026-07-16",
"via": null,
"blurb": "(AV) Anti-Virus Theory Most of the anti-virus vendors do not communicate much about the rules they put in place to block malicious software. Consequently, there are 3 main possible options to understand the underground process of an anti-virus:reverse the anti-virus binarysearch on the…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "9f064e2146d5",
"title": "🛠️ Dropper | The Hacker Recipes",
"url": "https://thehacker.recipes/evasion/av/dropper",
"iso": "2026-07-16",
"via": null,
"blurb": "🛠️ Dropper This is a work-in-progress. It's indicated with the 🛠️ emoji in the page name or in the category name.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "575ede228284",
"title": "🛠️ Loader | The Hacker Recipes",
"url": "https://thehacker.recipes/evasion/av/loader",
"iso": "2026-07-16",
"via": null,
"blurb": "🛠️ Loader This is a work-in-progress. It's indicated with the 🛠️ emoji in the page name or in the category name.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "3e8775fe7c24",
"title": "🛠️ Obfuscation | The Hacker Recipes",
"url": "https://thehacker.recipes/evasion/av/obfuscation",
"iso": "2026-07-16",
"via": null,
"blurb": "🛠️ Obfuscation This is a work-in-progress. It's indicated with the 🛠️ emoji in the page name or in the category name.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "942c5a6eeb5c",
"title": "🛠️ Process injection | The Hacker Recipes",
"url": "https://thehacker.recipes/evasion/av/process-injection",
"iso": "2026-07-16",
"via": null,
"blurb": "🛠️ Process injection This is a work-in-progress. It's indicated with the 🛠️ emoji in the page name or in the category name.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "40301efe6ba3",
"title": "🛠️ Stealth with C2 | The Hacker Recipes",
"url": "https://thehacker.recipes/evasion/av/stealth",
"iso": "2026-07-16",
"via": null,
"blurb": "🛠️ Stealth with C2 This is a work-in-progress. It's indicated with the 🛠️ emoji in the page name or in the category name.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "90006bfe7dd8",
"title": "🛠️ Port forwarding | The Hacker Recipes",
"url": "https://thehacker.recipes/infra/pivoting/port-forwarding",
"iso": "2026-07-16",
"via": null,
"blurb": "🛠️ Port forwarding This is a work-in-progress. It's indicated with the 🛠️ emoji in the page name or in the category name.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "24fa3bd8a40d",
"title": "🛠️ SOCKS proxy | The Hacker Recipes",
"url": "https://thehacker.recipes/infra/pivoting/socks-proxy",
"iso": "2026-07-16",
"via": null,
"blurb": "🛠️ SOCKS proxy Theory SOCKS (SOCKet Secure) is a network protocol that allows users to route network traffic to a server on a client's behalf. SOCKS is between the application and the transport layer of the OSI model.This is especially useful for penetration testing engagements where a target…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "b499c4f0c11f",
"title": "🛠️ Capabilities | The Hacker Recipes",
"url": "https://thehacker.recipes/infra/privilege-escalation/unix/capabilities",
"iso": "2026-07-16",
"via": null,
"blurb": "🛠️ Capabilities Theory Linux capabilities are a way to improve permission granularity in unix-like systems. It allows to follow the least-privilege principle by defining fine-grained permissions that can be attributed to threads and files.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "30c56a349225",
"title": "🛠️ Living off the land | The Hacker Recipes",
"url": "https://thehacker.recipes/infra/privilege-escalation/unix/living-off-the-land",
"iso": "2026-07-16",
"via": null,
"blurb": "🛠️ Living off the land Theory Living of the Land is a well known privilege escalation technique, where an attacker will leverage binaries found on the attacked machine to perform a privilege escalation. Indeed, many UNIX programs have options that can be exploited to open a shell.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "d025d0cfafc5",
"title": "🛠️ Network secrets | The Hacker Recipes",
"url": "https://thehacker.recipes/infra/privilege-escalation/unix/network-secrets",
"iso": "2026-07-16",
"via": null,
"blurb": "Skip to contentMenuReturn to topBy the creator of this site Professional environments for pentesting, red team, ctf 🛠️ Network secrets cf.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "6d12598fe678",
"title": "SUDO | The Hacker Recipes",
"url": "https://thehacker.recipes/infra/privilege-escalation/unix/sudo",
"iso": "2026-07-16",
"via": null,
"blurb": "SUDO Theory sudo (Super User DO) is a program for UNIX-like computer operating systems that allows users to run programs with the security privileges of another user (by default, the superuser).Unlike the similar command su, users must, by default, supply their own password for authentication,…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "7bc6831c7c4c",
"title": "SUID/SGID binaries | The Hacker Recipes",
"url": "https://thehacker.recipes/infra/privilege-escalation/unix/suid-sgid-binaries",
"iso": "2026-07-16",
"via": null,
"blurb": "SUID/SGID binaries Theory On UNIX-like systems, binaries have permissions, just like any other file. Some of them often are over-privileged, sometimes allowing attackers to escalate their privileges on the system.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "1c29c3339a55",
"title": "🛠️ Account privileges | The Hacker Recipes",
"url": "https://thehacker.recipes/infra/privilege-escalation/windows/account-privileges",
"iso": "2026-07-16",
"via": null,
"blurb": "Skip to contentMenuReturn to topBy the creator of this site Professional environments for pentesting, red team, ctf 🛠️ Account privileges https://twitter.com/fr0gger_/status/1379465943965909000/photo/1TermsPrivacyAbout",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "3cb2f62762a9",
"title": "🛠️ Living off the land | The Hacker Recipes",
"url": "https://thehacker.recipes/infra/privilege-escalation/windows/living-off-the-land",
"iso": "2026-07-16",
"via": null,
"blurb": "🛠️ Living off the land Theory Living of the Land is a well known privilege escalation technique, where an attacker will leverage binaries found on the attacked machine to perform a privilege escalation. Indeed, many UNIX programs have options that can be exploited to open a shell.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "ec20194d0111",
"title": "🛠️ Network secrets | The Hacker Recipes",
"url": "https://thehacker.recipes/infra/privilege-escalation/windows/network-secrets",
"iso": "2026-07-16",
"via": null,
"blurb": "Skip to contentMenuReturn to topBy the creator of this site Professional environments for pentesting, red team, ctf 🛠️ Network secrets cf.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "0a888df45215",
"title": "🛠️ Weak service permissions | The Hacker Recipes",
"url": "https://thehacker.recipes/infra/privilege-escalation/windows/weak-service-permissions",
"iso": "2026-07-16",
"via": null,
"blurb": "🛠️ Weak service permissions Theory File permissions in Windows define who is allowed to access, modify, or execute files on the system. If these permissions are misconfigured, they can enable unauthorized users to alter or replace critical files, potentially leading to security…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "32cb862df1c9",
"title": "Initial access (protocols) | The Hacker Recipes",
"url": "https://thehacker.recipes/infra/protocols/",
"iso": "2026-07-16",
"via": null,
"blurb": "Initial access (protocols) Theory To gain initial access into an information system, one of the most common vectors will be exploiting badly configured protocols inside the enterprise network. If companies don't necessarily implement each of the protocols listed in this category, most of them…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "c14bdad949f6",
"title": "🛠️ DNS | The Hacker Recipes",
"url": "https://thehacker.recipes/infra/protocols/dns",
"iso": "2026-07-16",
"via": null,
"blurb": "🛠️ DNS Theory The Domain Name System (DNS) is a fundamental protocol of the Internet that translates human-readable domain names into IP addresses. It functions as a distributed database system that enables computers to resolve domain names to the corresponding network addresses required for…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "adc9d79e5978",
"title": "🛠️ FTP | The Hacker Recipes",
"url": "https://thehacker.recipes/infra/protocols/ftp",
"iso": "2026-07-16",
"via": null,
"blurb": "🛠️ FTP Theory The File Transfer Protocol (FTP) is a standard network protocol used for the transfer of files between a client and server. It usually runs on ports 21/tcp or 2121/tcp.Basic usage Standard UNIX-like commands, like cd, ls, mkdir, rm can be used.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "2db6c4f69a9d",
"title": "🛠️ NFS | The Hacker Recipes",
"url": "https://thehacker.recipes/infra/protocols/nfs",
"iso": "2026-07-16",
"via": null,
"blurb": "🛠️ NFS Theory NFS or Network File system allows a client to access files over a network in the same way they would access a local storage file.A NFS server determines what ressources to make available and ensures to recognize validated clients. From the client perspective, the machine…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "f8d4acddf8ff",
"title": "🛠️ SMB | The Hacker Recipes",
"url": "https://thehacker.recipes/infra/protocols/smb",
"iso": "2026-07-16",
"via": null,
"blurb": "🛠️ SMB Theory SMB (Server Message Block) is a protocol running on port 445/tcp. It is used to share access to files, printers and serial ports on a networkIn 1996 Microsoft releases a customized SMB they call CIFS (Common Internet File System).",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "165f6262adfb",
"title": "🛠️ SSH | The Hacker Recipes",
"url": "https://thehacker.recipes/infra/protocols/ssh",
"iso": "2026-07-16",
"via": null,
"blurb": "🛠️ SSH Theory The SSH protocol (Secure Shell) is used to login from one machine to another securely. It offers several options for strong authentication, as it protects the connections and communications security and integrity with strong encryption.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "9acf7e173a4e",
"title": "🛠️ Telnet | The Hacker Recipes",
"url": "https://thehacker.recipes/infra/protocols/telnet",
"iso": "2026-07-16",
"via": null,
"blurb": "🛠️ Telnet Theory Telnet (teletype network) is a network protocol used to gain access to a virtual terminal in local or in remote systems . It provides bidirectional text-based communication .Common telnet commands CommandDescriptionopenConnects to a specified local/remote hostcloseCloses the…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "504843ec149d",
"title": "🛠️ Hosts discovery | The Hacker Recipes",
"url": "https://thehacker.recipes/infra/recon/hosts-discovery",
"iso": "2026-07-16",
"via": null,
"blurb": "🛠️ Hosts discovery Theory When targeting machines connected to a network, identifying which hosts are up and running (and their IP address) is the first step in getting to know the attack surface. There are multiple active and passive ways to discover hosts in a network, each relying on…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "4bcb3ac9762d",
"title": "Port scanning | The Hacker Recipes",
"url": "https://thehacker.recipes/infra/recon/port-scanning",
"iso": "2026-07-16",
"via": null,
"blurb": "Port scanning Theory When targeting machines connected to a network, identifying which services are running and accessible remotely allows attackers to have a better understanding of the attack surface.Services open to the network usually rely on one of two transport protocols: TCP or UDP.TCP…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "4a36b7da070c",
"title": "Emails | The Hacker Recipes",
"url": "https://thehacker.recipes/intelligence-gathering/cybint/emails",
"iso": "2026-07-16",
"via": null,
"blurb": "Emails Theory Searching for emails is a common part of an external pentest and could also be useful for internal pentest, depending on the perimeter and Red Team. Find emails could help to get more information about the target's mail servers.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "5438ad790272",
"title": "Web infrastructure | The Hacker Recipes",
"url": "https://thehacker.recipes/intelligence-gathering/cybint/web-infrastructure",
"iso": "2026-07-16",
"via": null,
"blurb": "Web infrastructure Theory Practice shodan : net:\"SUBNET/MASK\"org:\"company name\"zoomeye : IP/MASKfofa.soGet the DNS servers, their records, and map the domain: -https://dnsdumpster.com/ IP enumeration + response header from domain name: -https://zoomeye.org Find subdomains:…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "21375de102a5",
"title": "GEOINT | The Hacker Recipes",
"url": "https://thehacker.recipes/intelligence-gathering/geoint",
"iso": "2026-07-16",
"via": null,
"blurb": "GEOINT Theory Geospacial intelligence (GEOINT) is intelligence by analyzing geospacial maps and images about the human activity. This part will present some tools to find and analyze geospacial information.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "34a2d70b1a35",
"title": "OSINT | The Hacker Recipes",
"url": "https://thehacker.recipes/intelligence-gathering/osint",
"iso": "2026-07-16",
"via": null,
"blurb": "OSINT Theory When it comes to social engineering, gathering information about the target is crucial, especially if you target a specific person.If you know the enemy and know yourself, you need not fear the result of a hundred battles. If you know yourself but not the enemy, for every victory…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "4e5f3af7dd86",
"title": "Android | The Hacker Recipes",
"url": "https://thehacker.recipes/mobile-apps/android",
"iso": "2026-07-16",
"via": null,
"blurb": "Android Auditing Android apps usually requires to be able tocapture and handles requests generated by the phone (e.g. through a proxy like Burp)communicate with the phone easily (\"android debug bridge\", a.k.a.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "c7e0080c0ec5",
"title": "Android Debug Bridge ⚙️ | The Hacker Recipes",
"url": "https://thehacker.recipes/mobile-apps/android/android-debug-bridge",
"iso": "2026-07-16",
"via": null,
"blurb": "Android Debug Bridge ⚙️ Theory Android Debug Bridge (adb) is a versatile command-line tool that lets you communicate with a device. The adb command facilitates a variety of device actions, such as installing and debugging apps, and it provides access to a Unix shell that you can use to run a…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "a0545364d835",
"title": "APK transform | The Hacker Recipes",
"url": "https://thehacker.recipes/mobile-apps/android/apk-transform",
"iso": "2026-07-16",
"via": null,
"blurb": "APK transform Theory An .APK file (e.g. Android Package) is a compressed collection of files (i.e.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "e897bc9b39f7",
"title": "Magisk | The Hacker Recipes",
"url": "https://thehacker.recipes/mobile-apps/android/magisk",
"iso": "2026-07-16",
"via": null,
"blurb": "Magisk Theory Magisk is a suite of open source software for customizing Android, supporting devices higher than Android 6.0. Some highlight features:MagiskSU: Provide root access for applicationsMagisk Modules: Modify read-only partitions by installing modulesMagiskBoot: The most complete tool…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "ce4a6c73afc4",
"title": "Certificate pinning | The Hacker Recipes",
"url": "https://thehacker.recipes/mobile-apps/ios/certificate-pinning",
"iso": "2026-07-16",
"via": null,
"blurb": "Skip to contentMenuReturn to topBy the creator of this site Professional environments for pentesting, red team, ctf Certificate pinning bypass (need jailbroken)https://github.com/nabla-c0d3/ssl-kill-switch2https://portswigger.net/burp/documentation/desktop/to",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "1124803e304b",
"title": "Locks | The Hacker Recipes",
"url": "https://thehacker.recipes/physical/lockpicking",
"iso": "2026-07-16",
"via": null,
"blurb": "Skip to contentMenuReturn to topBy the creator of this site Professional environments for pentesting, red team, ctf Locks generate STL files for keys https://keygen.co/decode key https://github.com/MaximeBeasse/KeyDecoderTermsPrivacyAbout",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "0509273c7b18",
"title": "Network Access Control | The Hacker Recipes",
"url": "https://thehacker.recipes/physical/networking/network-access-control",
"iso": "2026-07-16",
"via": null,
"blurb": "Network Access Control Theory NAC (Network Access Control) acts as a kind of a gatekeeper to the local network infrastructure. It usually works with whitelists, blacklists, authentication requirements or host scanning to restrict access and keep unwanted devices out of the network.Basics NAC…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "54bde7743c1a",
"title": "Airstrike attack | The Hacker Recipes",
"url": "https://thehacker.recipes/physical/physical-access/airstrike-attack",
"iso": "2026-07-16",
"via": null,
"blurb": "Skip to contentMenuReturn to topBy the creator of this site Professional environments for pentesting, red team, ctf Airstrike attack https://shenaniganslabs.io/2021/04/13/Airstrike.htmlTermsPrivacyAbout",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "705213b4a6c7",
"title": "Encryption | The Hacker Recipes",
"url": "https://thehacker.recipes/physical/physical-access/encryption",
"iso": "2026-07-16",
"via": null,
"blurb": "Encryption Bitpixie To bypass BitLocker, a proof-of-concept can be used called 'bitpixie': https://github.com/andigandhi/bitpixie. The requirements for this attack are:It must use BitLocker without pre-boot authentication.It must be able to boot in PXE mode.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "4247d7fe3f4b",
"title": "🍌 Banana & chocolate cake | The Hacker Recipes",
"url": "https://thehacker.recipes/physical/super-secret-zones/banana-and-chocolate-cake",
"iso": "2026-07-16",
"via": null,
"blurb": "🍌 Banana & chocolate cake Theory The banana, chocolate, oatmeal and peanut butter cake is the ultimate reward after owning a system or company. Its composition features simple yet powerful elements.The following elements are needed for this recipe to work (for 2 to 3 attackers):2 bananas…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "35ff341391ff",
"title": "🍔 Burger du seigneur | The Hacker Recipes",
"url": "https://thehacker.recipes/physical/super-secret-zones/burger-du-seigneur",
"iso": "2026-07-16",
"via": null,
"blurb": "🍔 Burger du seigneur Theory El famoso \"Burger de seigneur\" is the ultimate meal after successfully completing an engagement. This meal was created in \"montceau-les-mines\" in 2022 by famous (not really) french head cook \"Toma\".The requirements for this meal are as follow (for 3 attackers):32…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "53333e15f611",
"title": "🍳 Omelette du fromage | The Hacker Recipes",
"url": "https://thehacker.recipes/physical/super-secret-zones/omelette-du-fromage",
"iso": "2026-07-16",
"via": null,
"blurb": "🍳 Omelette du fromage Theory The French dish \"Omelette du fromage\" is famously known for its ability to convey strength and resistance to its eaters. Its preparation and consumption is common for fast-paced attackers in need of daily nutrients.The requirements for this omelette are as follow…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "408f02def222",
"title": "🥞 The Pancakes of Heaven | The Hacker Recipes",
"url": "https://thehacker.recipes/physical/super-secret-zones/the-pancakes-of-heaven",
"iso": "2026-07-16",
"via": null,
"blurb": "🥞 The Pancakes of Heaven Theory Those who made it here are one of the luckiest. The legend says that hackers who ate these pancakes saw the doors of heaven wide open!",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "4a97e6570bb8",
"title": "Mifare Classic | The Hacker Recipes",
"url": "https://thehacker.recipes/radio/rfid/mifare-classic/",
"iso": "2026-07-16",
"via": null,
"blurb": "Skip to contentMenuReturn to topBy the creator of this site Professional environments for pentesting, red team, ctf Mifare Classic This is a work-in-progress.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "cf2bed20dbc8",
"title": "🛠️ WEP | The Hacker Recipes",
"url": "https://thehacker.recipes/radio/wi-fi/wep/",
"iso": "2026-07-16",
"via": null,
"blurb": "🛠️ WEP Theory This is a work-in-progress. It's indicated with the 🛠️ emoji in the page name or in the category nameWEP (Wired Equivalent Privacy) was designed around 1999 to offer security to wireless network users.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "dbb191d8358e",
"title": "🛠️ WPA2 | The Hacker Recipes",
"url": "https://thehacker.recipes/radio/wi-fi/wpa2/",
"iso": "2026-07-16",
"via": null,
"blurb": "🛠️ WPA2 Theory Attacks //TODO : differences between CCMP and TKIP for cipher ?Sniffing De-authentication WPA handshake capture & cracking clients neededsniffing + deauthgives \"WPA handshake\" followed by AP MAC addr, possible to crackeither crack with ai",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "79221bfd0188",
"title": "WPS | The Hacker Recipes",
"url": "https://thehacker.recipes/radio/wi-fi/wps/",
"iso": "2026-07-16",
"via": null,
"blurb": "WPS Theory Wi-Fi Protected Setup (WPS) is a simplified configuration protocol designed to make connecting devices to a secure wireless network easier. WPS employs an 8-digit PIN for user network connection, verifying the first 4 digits before proceeding to check the remaining 4.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "1b43bb920315",
"title": "Wireless keyboard/mouse | The Hacker Recipes",
"url": "https://thehacker.recipes/radio/wireless-keyboard-mouse",
"iso": "2026-07-16",
"via": null,
"blurb": "Skip to contentMenuReturn to topBy the creator of this site Professional environments for pentesting, red team, ctf Wireless keyboard/mouse //TODO : attacsks on non-bluetooth wireless keyboard/mouse : mousejacking vulnerabilities class : https://twitter.com/c",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "13f32ec04f11",
"title": "🛠️ Account deletion | The Hacker Recipes",
"url": "https://thehacker.recipes/web/accounts-and-sessions/account-deletion",
"iso": "2026-07-16",
"via": null,
"blurb": "🛠️ Account deletion Theory Removing an account is a sensitive action that should be taken into consideration.Practice Some protection mechanisms should be incorporated:Protection: when deleting an account, the web application should request the user to sub",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "b85cbc27f491",
"title": "🛠️ Logging in | The Hacker Recipes",
"url": "https://thehacker.recipes/web/accounts-and-sessions/logging-in",
"iso": "2026-07-16",
"via": null,
"blurb": "🛠️ Logging in Theory link default passwordsAuthentication issues are important to take into consideration. A login page can be the beginning of serious issues regarding accounts takeover.or bruteforcePractice or authentication bypassBrute-force Brute-forcing can have 2 interesting purposes…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "528eb339cefd",
"title": "Password change | The Hacker Recipes",
"url": "https://thehacker.recipes/web/accounts-and-sessions/password-change",
"iso": "2026-07-16",
"via": null,
"blurb": "Password change Websites that manage user accounts usually offer a \"password change\" feature. This offers attackers an interesting vector as it could potentially lead to Account Takeover (ATO).When this feature is present on a website, there a a few things to check.Is the previous password…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "31aae75efb38",
"title": "🛠️ Password reset | The Hacker Recipes",
"url": "https://thehacker.recipes/web/accounts-and-sessions/password-reset",
"iso": "2026-07-16",
"via": null,
"blurb": "🛠️ Password reset Theory Websites that manage user accounts usually have a \"forgot password\" or \"reset password\" feature. This offers attackers an interesting vector as it could potentially lead to Account Takeover (ATO).Practice When this feature is present on a website, there a a few…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "11b93e558dd5",
"title": "Security policies | The Hacker Recipes",
"url": "https://thehacker.recipes/web/accounts-and-sessions/security-policies",
"iso": "2026-07-16",
"via": null,
"blurb": "Security policies Theory Passwords are strings used to authenticate a user or services. They are very important and must meet several criteria because a password that is too weak can easily be guessed via a brute force attack.For a simple user: at least twelve alphanumeric characters using…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "87cbe5cc413a",
"title": "Account creation | The Hacker Recipes",
"url": "https://thehacker.recipes/web/accounts-and-sessions/signing-in",
"iso": "2026-07-16",
"via": null,
"blurb": "Account creation Theory When creating an account the presence of a captcha is important. It helps to differentiate a real human user from a malicious computer program used by an attacker.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "c1b4fd7a6290",
"title": "Default credentials | The Hacker Recipes",
"url": "https://thehacker.recipes/web/config/default-credentials",
"iso": "2026-07-16",
"via": null,
"blurb": "Default credentials Theory Default credentials are a really simple and extremely common way to get initial access to a system. Many devices (especially in the Internet of Things) come with default non-random passwords that are often left unchanged.",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "6889c1bb56d7",
"title": "🛠️ Denial of Service (DoS) | The Hacker Recipes",
"url": "https://thehacker.recipes/web/config/dos-mitigations",
"iso": "2026-07-16",
"via": null,
"blurb": "🛠️ Denial of Service (DoS) Theory There are two distinct types of denial of service:Denial of Service (DoS): using a single machine, a DoS attack reduces or prevents accessibility of service for its users. It usually does so by flooding the targeted machine with a consequent amount of…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "6a5c03879bdd",
"title": "HTTP security headers | The Hacker Recipes",
"url": "https://thehacker.recipes/web/config/http-headers/",
"iso": "2026-07-16",
"via": null,
"blurb": "HTTP security headers Theory HTTP security headers are used to inform a client (browser) how to behave when handling a website's content. These headers are important in preventing exploitation of vulnerabilities such as XSS, Man-in-the-Middle, clickjacking, etc.STS (Strict-Transport-Security)…",
"image": "https://thehacker.recipes/images/social-preview.png",
"person": "Charlie Bromberg",
"personKey": "charlie bromberg",
"cardId": "ae6498ca90347178"
},
{
"id": "6fccdc3bd7e2",
"title": "Clickjacking | The Hacker Recipes",
"url": "https://thehacker.recipes/web/config/http-headers/clickjacking/",
"iso": "2026-07-16",
"via": null,
"blurb": "Clickjacking Theory Lots of websites allow to browsers to render them in a ,