01^:20 sheets

Pentest Attack Flow

01 intermediateHTB Pentest Attack Flow — Dashboard 2026-08-2902 intermediateStage 00 — Passive External Recon 2026-08-2903 intermediateStage 01 — Recon and Host Discovery 2026-09-1704 intermediateStage 02 — Web Enumeration and Exploitation 2026-08-2905 intermediateFoothold Toolkit — File Transfers 2026-08-2906 intermediateFoothold Toolkit — Shells, Payloads, and Metasploit 2026-08-2907 intermediateStage 03 — Service Enumeration 2026-08-2908 intermediateStage 04 — Active Directory Enumeration 2026-08-2909 advancedStage 05 — Kerberos Attacks 2026-08-2910 advancedStage 06 — ACL and Object Abuse 2026-08-2911 advancedStage 07 — ADCS and Certificate Abuse 2026-08-2912 intermediateStage 08 — Password Attacks and Credential Hunting 2026-08-2913 intermediateStage 09 — Privilege Escalation 2026-10-1214 advancedStage 10 — Lateral Movement, Pivoting, and Loot 2026-08-2915 advancedDomain Trusts and Cross-Forest 2026-08-2916 intermediateStage 11 — Documentation and Reporting 2026-08-2917 advancedAppendix — Worked Chains 2026-08-2918 intermediateTool Index 2026-08-2919 intermediateHTB Attack Flow Playbook 2026-08-2720 advancedLoot — Attacking Enterprise Networks (INLANEFREIGHT.LOCAL) 2026-08-29

02^:7 sheets

Companion Guides

01 intermediateAttack Flow Guide 2026-07-1802 intermediateMost Used Commands 2026-07-1803 intermediateNetwork Service Attack Manual 2026-09-1504 intermediateAttacking Common Applications — Full Guide 2026-09-1505 intermediateAttacking Common Services — Full Guide 2026-09-1606 advancedPotato Attacks — SeImpersonate to SYSTEM 2026-09-1707 intermediateNTFS Alternate Data Streams — Hiding & Finding Hidden Data 2026-09-25

03^:1 sheet

Foundations

01 beginnerPentesting: How Attacks Work 2026-10-11

DL^:51 signed files · 260.6 MiB

Signed attachment library

Every attachment referenced by the workflow sheets is mirrored here. Each download has an individual SHA-256 checksum and detached OpenPGP signature; the combined manifest covers the complete set.

SHA256SUMSManifest signature
23
nc64.exe3e59379f585ebf0becb6b4e06d0fbbf806de28a4bb256e837b4555f1b4245571
44.2 KiB
SHA-256GPG
31
pspy321e38ac09d7851b22e16980abc58f93cabdc4a02859c56a2810aa51930277d450
2.8 MiB
SHA-256GPG
32
pspy64c93f29a5cc1347bdb90e14a12424e6469c8cfea9a20b800bc249755f0043a3bb
3.0 MiB
SHA-256GPG

☧ CPTS · ordered posts

Locked

Unlock with your Main_Key through local GPG.

Start the local GPG helper

In your cheatsheet checkout, run:

npm run unlock:helper

Open the link it prints, or paste its pairing code below. Keep the terminal open until GPG finishes.

Import an index you already decrypted

Download the encrypted index, then decrypt with GPG:

gpg --output report-index.json --decrypt report-index.gpg

Your private key stays in GPG. The decrypted index is saved in this browser so you can reopen it after navigation, refreshes and restarts. Lock this browser or clear this site's browser data to remove the saved index. Nothing is uploaded.