Pentesting & Recon

Trace Active Directory attack paths through Kerberos, AD CS and BloodHound graphs

Decrypt Windows DPAPI secrets and browser credentials during authorized red team tests

Test AD privilege escalation through shadow credentials in authorized engagements

Enumerate Entra ID tenants and abuse tokens with ROADtools in authorized red teams

Run device-code and illicit consent phishing tests against Microsoft 365 and Entra ID

Validate Entra ID and AD FS defenses with AADInternals recon and Golden SAML checks

Stand up a hardened Sliver C2 team server with redirectors for authorized red teams

Build nginx and Apache C2 redirectors with TLS and traffic filtering for red teams

Deploy Havoc C2 with HTTPS and SMB listeners, redirectors and malleable profiles

Find unprotected pages and admin interfaces by forced browsing during authorized tests

Coerce machine authentication with PetitPotam and Coercer to relay NTLM into AD CS

Run authorized penetration tests against AWS, Azure and GCP with Pacu and ScoutSuite

Run DCSync to pull KRBTGT and admin hashes via replication rights in authorized tests

Map external attack surface from DNS, certs and public sources without touching targets

Plan and run a MITRE ATT&CK aligned red team engagement from recon to post-exploitation

Run an internal pentest as an insider to find lateral movement and privilege escalation

Map Active Directory attack paths from a foothold to Domain Admin with BloodHound CE

Simulate man-in-the-middle attacks with Bettercap and mitmproxy to test TLS defenses

Test iOS and Android apps for storage, network and auth flaws using the OWASP MASTG

Run a full network pentest with host discovery, port scanning and controlled exploitation

Move laterally with Pass-the-Ticket by reusing Kerberos tickets from LSASS in tests

Plan social engineering pentests with OSINT profiling, phishing, vishing and pretexting

Run authorized vishing pretext calls to test staff susceptibility to social engineering

Run spearphishing simulations with GoPhish, OSINT pretexts and tracked results

Test Wi-Fi networks for weak encryption, evil twin and captive portal bypasses

Sniff and analyze Bluetooth Low Energy traffic with Ubertooth, nRF52840 and bleak

Run Stratus Red Team to detonate MITRE-mapped cloud attacks and test your detections

Map AWS and Azure attack paths with read-only CloudFox enumeration

Test container breakouts via privileged pods, host mounts, runC CVEs and Docker sockets

Simulate AD attacks with BloodHound, Mimikatz and trust abuse to test domain defenses

Run authorized phishing simulations to track open, click and credential entry rates

Plan red team engagements with scope, rules of engagement and emergency stop procedures

Run stealthy adversary emulation with Cobalt Strike or Sliver to test SOC detection

Abuse AD CS ESC1 misconfigurations to request certificates as privileged users

Map hidden AD attack paths and trust relationships with BloodHound during red team tests

Find and exploit AD CS ESC1 to ESC16 misconfigurations with Certipy

Run the Pacu framework for AWS privilege escalation scans and IAM enumeration

Simulate BGP hijacks in a lab to test RPKI, route origin checks and monitoring

Find broken external links to expired or unclaimed domains that a site loads

Abuse Kerberos constrained delegation with Impacket to impersonate privileged users

Test Android and iOS deep links for intent hijacking, data injection and redirect flaws

Test HTTP request smuggling from Content-Length and Transfer-Encoding parsing gaps

Find insecure data storage in Android and iOS apps, from databases to keychain misuse

Test IPv6 networks for SLAAC spoofing, rogue router advertisements and tunnel abuse

Request service tickets for SPN accounts with GetUserSPNs and crack them offline

Verify and exploit MS17-010 EternalBlue on SMBv1 hosts with Nmap and Metasploit

Escalate to Domain Admin with noPac CVE-2021-42278 and CVE-2021-42287 using Impacket

Exploit SMB flaws with Metasploit to show risks from unpatched Windows and weak shares

Confirm CVEs are really exploitable with Metasploit and verify patch remediation