Pentesting & Recon

Find exposed assets and subdomains with Shodan, Censys and ProjectDiscovery tools

Proxy mobile app traffic through Burp Suite to find insecure APIs and data leaks

Collect AD and Entra data with SharpHound and AzureHound to map hybrid attack paths

Validate credentials and spray passwords safely with NetExec across SMB, WinRM and LDAP

Run a Havoc C2 team server with malleable profiles and evasive Demon agents

Stand up Sliver mTLS listeners and generate implants for red-team emulation

Graph AD attack paths from a compromised user to Domain Admin with BloodHound

Audit AD forest trusts for SID filtering gaps and SID history abuse with Impacket

Run an AD pentest with BloodHound, Certipy, Rubeus and NetExec to reach Domain Admin

Assess AD posture with PingCastle, BloodHound and Purple Knight for misconfigurations

Run MobSF static analysis on Android APKs to find hardcoded secrets and weak crypto

Simulate ARP spoofing in a lab to validate Dynamic ARP Inspection and port security

Find IAM misconfigurations that let users escalate privileges with Pacu and CloudFox

Simulate bandwidth throttling in a lab with tc and iperf3 to test QoS and monitoring

Enumerate BLE GATT services with bleak and flag unauthenticated reads and writes

Run Pacu against AWS to enumerate IAM, find escalation paths and test lateral movement

Recover stored browser and vault passwords with LaZagne during red team operations

Enumerate DNS records, try zone transfers and brute-force subdomains during recon

Hook Android app runtime with Frida and Objection to test behavior and intercept calls

Test internet-facing hosts with PTES-based recon, scanning and exploitation

Find public GCP buckets with GCPBucketBrute and map IAM escalation paths with gcloud

Crack password hashes with Hashcat attack modes, custom rules and GPU benchmarks

Capture session tokens and bypass MFA with Evilginx3 in authorized red team tests

Test iOS apps with Frida, Objection, SSL pinning bypass and keychain extraction

Assess IoT devices across hardware, firmware, network, cloud APIs and companion apps

Request SPN service tickets and crack them offline to recover service account passwords

Test Kubernetes clusters for paths to compromise with kube-hunter and peirates

Move laterally on Windows networks with Impacket wmiexec and CrackMapExec in red teams

Bypass SSL pinning in Android and iOS apps with Frida, Objection and custom scripts

Assess oil and gas pipeline, refinery and wellhead control systems against IEC 62443

Gather public intelligence on a target organization for red team engagements

Automate OSINT scans with SpiderFoot to build a target intelligence profile

Assess OT and SCADA networks for Purdue layer gaps, IT/OT links and firewall rules

Craft and inject custom packets with Scapy and hping3 to test firewall and IDS rules

Run phishing awareness campaigns in GoPhish and measure click and submit rates

Plan authorized physical intrusion tests covering badges, locks and guard procedures

Assess power grid and substation security against NERC CIP and IEC 61850

Find privilege escalation paths from low-privilege access to root or SYSTEM

Enumerate Linux misconfigurations, SUID binaries and kernel flaws to reach root

Build GoPhish campaigns in Python with tracking pixels, SMTP profiles and CSV targets

Operate the Covenant C2 framework for listeners, grunts and lateral movement tracking

Test Siemens S7 PLC protocols for replay attacks, unauthorized CPU stops and tampering

Assess SCADA HMI web interfaces and PLC links against IEC 62443 and NIST 800-82

Find stored SQL injection where saved input runs in an unsafe query later

Test SOAP and WSDL services for XXE, XML injection and WS-Security bypasses

Test HSTS and HTTPS downgrade defenses with sslstrip and mitmproxy in a lab

Probe web apps for SSRF through cloud metadata endpoints and IP encoding bypasses

Enumerate subdomains passively with ProjectDiscovery Subfinder to map attack surface

Test desktop apps for hardcoded credentials, DLL hijacking and insecure local storage