DΛΣMӨП-RΣF

Six shelves. One vault.

01DΛΣMӨП

02Cheatsheets

03Offline search

04Copy-ready

0514 shelves

06Zero fluff

SysOpen notebook/

SearchPagefind · offline/

Sheets325 · curated/

ThemeThree palettes · two modes/

FieldAD · web · privesc/

MirrorThree upstream trees/

DoctrineTerse, not thin/

Index / operator

Start here.

325 sheets across 14 shelves, plus two full upstream mirrors. The shelves are below; the index itself runs under them.

Offline searchCopy-readyZero fluff

daemon@ref~%vault --status

sheets: 325 · curated
shelves: 14 · domains
search: offline · fuzzy · no tracking
updated: 2026.10 · latest

Quick search / 2026

14 shelves

325 sheets

03 mirrors

Open the index325 sheets↓Pick a shelf14 shelves↓Mirrored trees03 upstream↓

Start here

Pentesting: How Attacks Work — learn the foundations, follow interactive diagrams, and connect the attacks from DAEMONSEC write-ups to their tools.

Reference transmissions

Terse, tested, kept current.

325 sheets across 14 shelves, each stripped to the commands that matter.

Payloads ↗Internal ↗HackTricks ↗10 shown

01 WEBcURL 2026.10.13cURL for web and API testing: methods and bodies, auth, cookies, reading a response to pick the next request, uploads, proxies, header manipulation and scripting.Web · web · http 02 WEBcurl + wget Field Card 2026.10.13curl and wget for HTB web recon: read response headers without Burp, craft requests, cookies and auth, proxy through Burp, find vhosts, move files on and off a box, and mirror sites.Web · web · http 03 ENUMRustScan 2026.10.13Practical RustScan: scan all 65,535 TCP ports in seconds, hand only the open ones to Nmap, and tune batch/timeout so you don't miss ports over a VPN. Copy-paste recipes for HTB boxes, Windows/DCs, subnets, pivots and UDP, plus the gotchas that silently break scans.Enumeration · enumeration · port-scanning 04 WEBWeb Shells 2026.10.13Writing, landing and running web shells: matching the shell to the stack (PHP, ASPX, classic ASP, JSP/WAR, CFM), upload-filter bypasses, LFI/SQLi/CMS/Tomcat delivery, driving the shell, upgrading to a reverse shell, and cleanup.Web · web · webshell 05 TOOLWindows .NET Tooling on wine (NixOS) 2026.10.13Run Windows-only offensive .NET binaries — ysoserial.net, Rubeus, SharpHound and friends — from a Linux attack box using wine or a Mono container, with NixOS-specific setup.Tools · wine · nixos 06 PWNysoserial.net 2026.10.13Generate signed ASP.NET ViewState payloads with the correct framework mode and machineKey settings, then submit them without double URL encoding.Exploitation · exploitation · dotnet 07 CREDansible-vault & ansible2john 2026.10.12Extract supported Ansible Vault records, recover a weak passphrase and view encrypted data without replacing the original.Password Attacks · pentesting · tool-workflow 08 CREDaxcrypt2john & AxCrypt 2026.10.12Recover a weak AxCrypt file password and validate decryption in the original application.Password Attacks · pentesting · tool-workflow 09 ADBloodyAD 2026.10.12BloodyAD LDAP privilege-abuse toolkit: RBCD, shadow creds, DACL edits, password/attribute writes.Active Directory · active-directory · ldap 10 CREDcisco7crack 2026.10.12Decode Cisco type 7 configuration passwords and separate reversible obfuscation from type 5 password cracking.Password Attacks · pentesting · tool-workflow 11 PRIVcsvtool 2026.10.12Understand csvtool callbacks and why unrestricted sudo access to this parser can execute commands.Privilege Escalation · pentesting · tool-workflow 12 ENUMdig 2026.10.12Query DNS records, validate zone transfers, and distinguish DNS discovery from HTTP virtual hosts.Enumeration · pentesting · tool-workflow 13 PRIVEnableAllTokenPrivs & TcbElevation 2026.10.12Distinguish disabled token privileges from missing privileges and assess SeTcbPrivilege in a controlled lab.Privilege Escalation · pentesting · tool-workflow 14 ADEvil-WinRM & evil-winrm-py 2026.10.12Connect over WinRM with passwords, NT hashes, Kerberos or certificates; distinguish client flags, endpoint permissions and file-transfer contexts.Active Directory · active-directory · winrm 15 ADgMSADumper 2026.10.12Check gMSA password-read rights, parse accessible managed-password blobs and validate the resulting identity.Active Directory · pentesting · tool-workflow 16 PWNGroovy 2026.10.12Understand server-side scripting consoles in Jenkins, Liferay and Nexus and verify the execution context.Exploitation · pentesting · tool-workflow 17 TOOLInveigh 2026.10.12Capture NTLM challenge responses with scoped listeners and distinguish capture, cracking and relay.Tools · pentesting · tool-workflow 18 TOOLLaZagne 2026.10.12Recover locally accessible stored credentials and distinguish user-context recovery from administrative access.Tools · pentesting · tool-workflow 19 PIVOTLigolo-ng CLI: Routes, Listeners, and Multi-Hop Pivoting 2026.10.12Ligolo-ng v0.9.x CLI guide covering managed routes, listeners, first pivots, multi-hop tunnels, reverse connections, scanning, and troubleshooting.Tunneling & Pivoting · ligolo-ng · pivoting 20 PWNMetasploit Framework 2026.10.12msfconsole and Meterpreter workflow: search, exploits, payloads, sessions, post modules, pivoting.Exploitation · exploitation · framework 21 ENUMNmap 2026.10.12Nmap host discovery, port/service/version scanning, timing, output formats and common scan recipes.Enumeration · enumeration · port-scanning 22 PRIVPsExec 2026.10.12Use Sysinternals PsExec with an existing administrative identity and distinguish it from Impacket psexec.Privilege Escalation · pentesting · tool-workflow 23 PIVOTSSH Tunneling & Port Forwarding 2026.10.12SSH local/remote/dynamic forwarding and Metasploit route/portfwd pivoting, worked end to end.Tunneling & Pivoting · pivoting · ssh 24 FLOWStage 09 — Privilege Escalation 2026.10.12Pentest attack-flow reference for stage 09 — privilege escalation in an authorised engagement.Pentest Workflow · htb · htb-attack-flow

Showing 10 of 325 sheetsAll 14 shelves ↗

Shelves / taxonomy

Pick your vector.

14 shelves, grouped by how you actually reach for them.

0128 sheetsPentest Workflow 02143 sheetsActive Directory 0329 sheetsEnumeration 0418 sheetsOSINT 0512 sheetsExploitation 065 sheetsPrivilege Escalation 0711 sheetsPassword Attacks 0815 sheetsWeb 097 sheetsTunneling & Pivoting 103 sheetsCryptography 1118 sheetsDFIR 1225 sheetsTools 139 sheetsLinux & IT 147 sheetsGit & Workflow

Third party / mirrored

Some trees are borrowed.

Three directories are generated from upstream security references: swisskyrepo's PayloadsAllTheThings and InternalAllTheThings, plus an attributed selection from HackTricks — mirrored because the official site has gotten harder to read on its own terms, buried under ads and AI-generated filler. Same content, read clean, searchable offline, and every page still links back to its exact source. Attribution, modification notes, and licences live on the credits page.

Trees: 03
Licence: Upstream
Sync: Scheduled
Edits: None

Read the credits →

Mirror manifest // upstreamswisskyrepo

01payloads/136 files

02internal/176 files

03hacktricks/613 files

04payloads/methodology-and-resources/34 files

05internal/active-directory/72 files

06hacktricks/section/linux-hardening/69 files

Scope

Authorised testing, CTFs and education only. HackTricks-derived pages are also restricted to non-commercial use under CC BY-NC 4.0. Know your scope, and get permission first, before you touch a system.

☧ CPTS · ordered posts

Locked

Unlock with your Main_Key through local GPG.

Start the local GPG helper

In your cheatsheet checkout, run:

npm run unlock:helper

Open the link it prints, or paste its pairing code below. Keep the terminal open until GPG finishes.

Import an index you already decrypted

Download the encrypted index, then decrypt with GPG:

gpg --output report-index.json --decrypt report-index.gpg

Choose your decrypted JSON once to save access:

Your private key stays in GPG. The decrypted index is saved in this browser so you can reopen it after navigation, refreshes and restarts. Lock this browser or clear this site's browser data to remove the saved index. Nothing is uploaded.