Pentesting & Recon

Test Active Directory attack paths with BloodHound, Kerberoasting and DCSync

Run Certipy ADCS abuse chains from vulnerable template discovery to krbtgt

Coerce Windows NTLM authentication with PetitPotam, PrinterBug and DFSCoerce

Configure ntlmrelayx NTLM relay attacks across SMB, LDAP and HTTP targets

Apply evidence-led methods for Active Directory operator work and findings

Run the Active Directory attack lane with BloodHound, Kerberoasting and DCSync

Test AD Certificate Services ESC1 template flaws in authorized engagements

Craft adversarial examples that make ML classifiers misclassify at inference

Plan authorized adversary emulation with ATT&CK technique fidelity checks

Test gRPC services for reflection leaks, missing auth and mTLS bypasses

Route API attack testing by protocol across gRPC, SOAP, WebSocket and SSE

Test Server-Sent Events endpoints for origin abuse and stream injection

Test SOAP and WSDL services for XXE, replay and SAML token injection

Test WebSocket endpoints for cross-site hijacking and missing message auth

Profile APT10 (Stone Panda) TTPs for authorized adversary emulation exercises

Profile APT28 (Fancy Bear) TTPs for authorized adversary emulation exercises

Profile APT29 cloud identity tradecraft for authorized M365 and Entra emulation

Profile APT29 (Cozy Bear) TTPs for authorized adversary emulation exercises

Profile APT33 (Elfin) TTPs for authorized adversary emulation exercises

Profile APT34 (OilRig) TTPs for authorized adversary emulation exercises

Profile APT36 (Transparent Tribe) TTPs for authorized adversary emulation

Profile APT37 (Reaper) TTPs for authorized adversary emulation exercises

Profile APT41 (Double Dragon) TTPs for authorized adversary emulation

Find and crack AS-REP hashes from accounts without Kerberos preauth

Walk through account takeover paths, chains and MFA bypass entry points

Enumerate AWS IAM policies and map 21 known privilege escalation primitives

Abuse iam:PassRole and AssumeRole chains to reach higher-privilege AWS roles

Abuse Azure Managed Identity tokens via IMDS, Graph, ARM and Key Vault

Set the Decepticon engagement to CTF-style flag capture benchmark mode

Enumerate BLE GATT services and test pairing downgrades and missing auth

Run blind SQL injection past WAF token filters with manual bypass steps

Pick a BloodHound CE runtime and analyze Active Directory collection data

Query authorized AD collection data in BloodHound CE for attack paths

Test U-Boot bootloaders for console interrupts, env tampering and secure boot

Format bug bounty reports with repro steps for HackerOne, Bugcrowd and Immunefi

Test business logic flaws like role field tampering and 2FA response bypass

Plan C2 infrastructure with listeners, redirectors and malleable profiles

Test covert C2 channels over DNS-over-HTTPS, chat bots and cloud functions

Run Cobalt Strike beacons, listeners and Malleable C2 profiles in engagements

Set up CDN domain fronting for C2 redirectors on CloudFront, Azure and Fastly

Run Havoc C2 with indirect syscalls, sleep obfuscation and HTTP profiles

Run Mythic C2 with its web UI, RabbitMQ backend and custom payload profiles

Run Sliver C2 operations through hosted tools or a standalone console

Test web cache deception that exposes authenticated pages to visitors

Chain leaked or weak credentials into privileged access across services

Chain IDOR bugs into privilege escalation and control-plane actions

Build and validate SSRF chains that pivot into metadata and code execution

Chain XSS into account takeover or privileged action execution

Write cleanup plans with artifact inventories and post-engagement checks