01^:12 sheets

Credential Access

01 advancedAttack #1 — Password Spraying 2026-08-1002 advancedAttack #2 — Kerberoasting 2026-08-1003 advancedAttack #3 — AS-REP Roasting 2026-08-1004 advancedAttack #4 — Pass-the-Hash (PtH) 2026-08-1005 advancedAttack #5 — Pass-the-Ticket (PtT) 2026-08-1006 advancedAttack #6 — Overpass-the-Hash (Pass-the-Key) 2026-08-1007 advancedAttack #7 — NTLM Relay Attacks 2026-08-1008 advancedAttack #8 — LLMNR NBT-NS mDNS Poisoning 2026-08-1009 advancedAttack #9 — mitm6 (IPv6 DNS Spoofing DHCPv6 Takeover) 2026-08-1010 advancedAttack #10 — Credential Hunting in Shares GPP Passwords 2026-08-1011 advancedADFSDump & ADFSpoof 2026-10-1112 advancedImpacket dpapi 2026-10-11

02^:10 sheets

Kerberos & Delegation

01 advancedAttack #11 — Golden Ticket Attack 2026-08-1002 advancedAttack #12 — Silver Ticket Attack 2026-08-1003 advancedAttack #13 — Diamond Ticket Attack 2026-08-1004 advancedAttack #14 — Sapphire Ticket Attack 2026-08-1005 advancedAttack #15 — Unconstrained Delegation Abuse 2026-08-1006 advancedAttack #16 — Constrained Delegation Abuse (S4U2Proxy) 2026-08-1007 advancedAttack #17 — Resource-Based Constrained Delegation (RBCD) 2026-08-1008 advancedAttack #18 — Bronze Bit Attack (CVE-2020-17049) 2026-08-1009 intermediateKerberoasting 2026-08-0910 advancedKerberoasting — Local On-Host 2026-08-10

03^:8 sheets

ACL Abuse

01 advancedAttack #19 — GenericAll Abuse 2026-08-1002 advancedAttack #20 — GenericWrite Abuse 2026-08-1003 advancedAttack #21 — WriteDACL Abuse 2026-08-1004 advancedAttack #22 — WriteOwner Abuse 2026-08-1005 advancedAttack #23 — ForceChangePassword Abuse 2026-08-1006 advancedAttack #24 — AllExtendedRights DCSync ACE Abuse 2026-08-1007 advancedAttack #25 — Shadow Credentials Attack (msDS-KeyCredentialLink) 2026-08-1008 advancedAttack #26 — AdminSDHolder Persistence via ACL 2026-08-10

04^:42 sheets

ADCS & Certificates

01 advancedAttack #27 — ESC1 SAN Specification in Template 2026-08-1002 advancedAttack #28 — ESC2 Any Purpose EKU No EKU 2026-08-1003 advancedAttack #29 — ESC3 Certificate Request Agent 2026-08-1004 advancedAttack #30 — ESC4 Template Write Permissions 2026-08-1005 advancedAttack #31 — ESC6 EDITF_ATTRIBUTESUBJECTALTNAME2 Flag 2026-08-1006 advancedAttack #32 — ESC7 Vulnerable CA Officer Permissions 2026-08-1007 advancedAttack #33 — ESC8 NTLM Relay to ADCS HTTP Endpoint 2026-08-1008 advancedAttack #34 — ESC11 NTLM Relay to ADCS RPC 2026-08-1009 advancedAttack #35 — Golden Certificate Attack 2026-08-1010 advancedAttack #36 — Certifried (CVE-2022-26923) 2026-08-1011 advancedESC1 — SAN Specification in Template 2026-08-1012 advancedESC2 — Any Purpose EKU No EKU (The Swiss Certificate) 2026-08-1013 advancedESC3 — Misconfigured Enrollment Agent Templates 2026-08-1014 advancedESC4 — Vulnerable Certificate Template Access Control 2026-08-1015 advancedESC5 — Vulnerable PKI Object Access Control 2026-08-1016 advancedESC6 — EDITF_ATTRIBUTESUBJECTALTNAME2 Flag 2026-08-1017 advancedESC7 — Vulnerable CA Access Control (ManageCA ManageCertificates) 2026-08-1018 advancedESC8 — NTLM Relay to ADCS HTTP Web Enrollment 2026-08-1019 advancedESC9 — No Security Extension (Template-Level) 2026-08-1020 advancedESC10 — Weak Certificate Mapping 2026-08-1021 advancedESC11 — NTLM Relay to ADCS RPC (ICPR) 2026-08-1022 advancedESC12 — Shell Access to CA with YubiHSM 2026-08-1023 advancedESC13 — Issuance Policy OID Group Link 2026-08-1024 advancedESC14 — Weak Explicit Certificate Mapping 2026-08-1025 advancedESC15 — EKUwu (CVE-2024-49019) 2026-08-1026 advancedESC16 — Security Extension Disabled on CA (Globally) 2026-08-1027 advancedESC17 — ADCS Certificate Spoofing to Attack HTTPS-Enabled WSUS Clients 2026-08-1028 advancedPERSIST1 — Active User Credential Theft via Certificates 2026-08-1029 advancedPERSIST2 — Machine Account Persistence via Certificates 2026-08-1030 advancedPERSIST3 — Account Persistence via Certificate Renewal 2026-08-1031 advancedTHEFT1 — Exporting Certificates and Keys 2026-08-1032 advancedTHEFT2 — User Certificate Theft via DPAPI 2026-08-1033 advancedTHEFT3 — Machine Certificate Theft via DPAPI 2026-08-1034 advancedTHEFT4 — Finding Certificate Files 2026-08-1035 advancedTHEFT5 — NTLM Theft via PKINIT (UnPAC-the-Hash) 2026-08-1036 advancedDPERSIST2 — Rogue CA Certificate (NTAuth Injection) 2026-08-1037 advancedDPERSIST3 — Malicious Misconfiguration (ACL Backdoor) 2026-08-1038 advancedADCS Attack Methodology 2026-08-0939 advancedCertificate Persistence — Certifried (CVE-2022-26923) 2026-08-1040 advancedGolden Certificate Attack — DPERSIST1 2026-08-1041 advancedkrbrelayx 2026-10-1142 advancedShadow Credentials — msDS-KeyCredentialLink Abuse 2026-08-10

05^:8 sheets

Domain Controller Attacks

01 advancedAttack #37 — DCSync Attack 2026-08-1002 advancedAttack #38 — DCShadow Attack 2026-08-1003 advancedAttack #39 — NTDS.dit Extraction and Dumping 2026-08-1004 advancedAttack #40 — Zerologon (CVE-2020-1472) 2026-08-1005 advancedAttack #41 — PetitPotam (CVE-2021-36942) 2026-08-1006 advancedAttack #42 — PrinterBug SpoolSample 2026-08-1007 advancedAttack #43 — PrintNightmare (CVE-2021-34527) 2026-08-1008 advancedAttack #44 — noPAC Sam-the-Admin (CVE-2021-42278 42287) 2026-08-10

06^:9 sheets

Privilege & Group Abuse

01 advancedAttack #45 — Token Impersonation (SeImpersonatePrivilege) 2026-08-1002 advancedAttack #46 — DNSAdmins DLL Injection 2026-08-1003 advancedAttack #47 — MachineAccountQuota (MAQ) Abuse 2026-08-1004 advancedAttack #48 — GPP Password Decryption 2026-08-1005 advancedAttack #49 — Abusing Backup Operators Group 2026-08-1006 advancedAttack #50 — Abusing Account Operators Group 2026-08-1007 advancedAttack #51 — Abusing Server Operators Group 2026-08-1008 advancedAttack #52 — Abusing Print Operators Group 2026-08-1009 advancedAttack #53 — Exchange Windows Permissions (WriteDACL to DCSync) 2026-08-10

07^:9 sheets

Lateral Movement

01 advancedAttack #54 — PsExec Remote Execution via SMB 2026-08-1002 advancedAttack #55 — WinRM Evil-WinRM Lateral Movement 2026-08-1003 advancedAttack #56 — RDP Lateral Movement and Hijacking 2026-08-1004 advancedAttack #57 — DCOM Lateral Movement 2026-08-1005 advancedAttack #58 — WMI Lateral Movement 2026-08-1006 advancedAttack #59 — SCM Service Manager Lateral Movement 2026-08-1007 advancedAttack #60 — Token Stealing and Impersonation 2026-08-1008 intermediateEvil-WinRM & evil-winrm-py 2026-10-1209 intermediateRun as Another User from an Evil-WinRM Session 2026-09-25

08^:7 sheets

Persistence

01 advancedAttack #61 — Skeleton Key Attack 2026-08-1002 advancedAttack #62 — DSRM Backdoor Abuse 2026-08-1003 advancedAttack #63 — SID History Injection 2026-08-1004 advancedAttack #64 — Golden Ticket Persistence 2026-08-1005 advancedAttack #65 — ACL Backdooring (Persistence via DCSync ACE) 2026-08-1006 advancedAttack #66 — Malicious GPO Creation 2026-08-1007 advancedAttack #67 — ADCS Certificate-Based Persistence 2026-08-10

09^:4 sheets

Trust Abuse

01 advancedAttack #68 — Cross-Domain Trust Abuse (SID History) 2026-08-1002 advancedAttack #69 — Forest Trust Abuse Cross-Forest Ticket Forging 2026-08-1003 advancedAttack #70 — ADCS Cross-Domain Enrollment 2026-08-1004 advancedAttack #71 — PAM Trust Abuse (Bastion Forest) 2026-08-10

10^:7 sheets

Advanced & Post-Exploitation

01 advancedAttack #72 — LAPS Password Extraction 2026-08-1002 advancedAttack #73 — gMSA Password Extraction 2026-08-1003 advancedAttack #74 — Azure AD Connect Credential Extraction 2026-08-1004 advancedAttack #75 — SCCM MECM Exploitation 2026-08-1005 advancedAttack #76 — MSSQL Server and Linked Server Abuse 2026-08-1006 advancedAttack #77 — DFSCoerce MS-DFSNM Coercion 2026-08-1007 advancedAttack #78 — AD Recycle Bin Object Abuse 2026-08-10

11^:25 sheets

Tooling & Recon

01 advancedActive Directory Attack Methodology 2026-08-0902 intermediateActive Directory Enumeration — Native Tooling 2026-09-2503 intermediateActive-Directory_cheat_sheet 2026-08-1004 advancedAD Pentest Tools Workflow 2026-08-0905 intermediateAD Recycle Bin Enumeration & Deleted-Object Recovery 2026-09-2506 intermediateAutobloody 2026-08-1107 intermediateBloodHound 2026-08-0908 intermediatebloodhound-ce-python 2026-08-1009 intermediateBloodHound-Python_ 2026-08-1010 intermediateBloodyAD 2026-10-1211 advancedCertipy 2026-08-0912 intermediateCertipy-ad 2026-08-1013 intermediatednstool & bloodyAD 2026-10-1114 intermediatefaketime 2026-08-1015 intermediateImpacket 2026-10-1216 beginnerKerbrute 2026-08-0917 intermediateLDAP Enumeration 2026-08-0918 intermediateLDAP Search 2026-10-1219 intermediateldapdomaindump 2026-08-1020 intermediateMimikatz 2026-08-0921 intermediateNetExec (nxc) 2026-10-1222 advancedPowerView and PowerUp Deep-Dive 2026-09-1923 advancedRubeus 2026-10-1224 intermediateRustHound-CE 2026-09-1325 intermediateSharpHound 2026-10-12

12^:2 sheets

Other

01 intermediategMSADumper 2026-10-1202 intermediatetargetedKerberoast 2026-10-12

☧ CPTS · ordered posts

Locked

Unlock with your Main_Key through local GPG.

Start the local GPG helper

In your cheatsheet checkout, run:

npm run unlock:helper

Open the link it prints, or paste its pairing code below. Keep the terminal open until GPG finishes.

Import an index you already decrypted

Download the encrypted index, then decrypt with GPG:

gpg --output report-index.json --decrypt report-index.gpg

Your private key stays in GPG. The decrypted index is saved in this browser so you can reopen it after navigation, refreshes and restarts. Lock this browser or clear this site's browser data to remove the saved index. Nothing is uploaded.