RECONNAISSANCE
- IPv4 Network Access Control (NAC) Bypass
- Unauthenticated Asset Discovery
- Authenticated Asset/Username Discovery
- Port Discovery
Vulnerability Identification
- Vulnerability Scanners
Initial Foothold
- Default Credentials
- Acquire Credentials
Cracking Hashes
- Wordlists and Rules and Masks
Windows Vertical Privilege Escalation
- Remote User to Admin
Windows Horizontal Privilege Escalation
- Logged In Users
- Remote Mimikatz/LSA Dumps From Local Admin
- Pass The Hash (PTH)
- Pass The Key (PTK)
- Pass The Ticket (PTT)
- Silver Ticket
- Golden Ticket
- Automate Local Admin To Domain Admin (Noisy)
Credential Pillaging
- Extract SAM & Cached Hashes Manually
- Extract NTDS.dit Hashes Manually
- Extract NTDS.dit Hashes (Automated)
- Find Plaintext Passwords
- WPA PSK String Extraction
Wireless
- WPA/WPA2 Hash Capture with Users
- WPA/WPA2 Hash Capture without Users (PMKID)
- WPS
- Enterprise Wireless
- Evil Twin (social Engineering)
- Open Wireless
- WEP Wireless