# CPTS - Completed

## **Overview**

This folder contains comprehensive notes and resources for preparing for the CPTS (Certified Penetration Testing Professional) certification from HTB Academy. The materials are organized to follow the HTB Academy CPTS path structure.

***

## **Current Structure**

```
CPTS-PREP/
├── README.md                           # This overview file
├── footprinting.md                     # Infrastructure Based Enumeration (Domain + Cloud + DNS)
├── firewall-evasion.md                 # Firewall and IDS/IPS Evasion techniques
├── vulnerability-assessment.md         # Nessus vulnerability scanning and credentialed assessment
├── web-enumeration/                    # Web application enumeration guides
│   ├── web-information-gathering.md    # Web application information gathering overview
│   ├── subdomain-enumeration.md        # DNS enumeration and subdomain discovery
│   └── web-application-enumeration.md  # Directory enumeration and virtual hosts
├── databases/                          # Database enumeration guides
│   ├── mysql-enumeration.md            # MySQL service enumeration
│   ├── mssql-enumeration.md            # Microsoft SQL Server enumeration
│   └── oracle-enumeration.md           # Oracle TNS enumeration
├── services/                           # Network service enumeration
│   ├── ftp-enumeration.md              # FTP service enumeration
│   ├── smb-enumeration.md              # SMB share and authentication testing
│   ├── nfs-enumeration.md              # Network File System enumeration
│   ├── smtp-enumeration.md             # SMTP enumeration and testing
│   ├── email-enumeration.md            # IMAP/POP3 enumeration
│   ├── snmp-enumeration.md             # SNMP network management testing
│   └── ipmi-enumeration.md             # Hardware management interface testing
├── passwords-attacks/                  # Password attacks and lateral movement
│   ├── pass-the-hash.md               # Pass the Hash (PtH) attacks
│   ├── pass-the-ticket.md             # Pass the Ticket (PtT) attacks
│   ├── pass-the-certificate.md        # Pass the Certificate (ESC8 & ADCS attacks)
│   ├── active-directory-ntds-attacks.md # NTDS.dit extraction and analysis
│   └── [other password attack techniques]
├── pivoting-tunneling-port-forwarding/ # Network pivoting and tunneling techniques
│   ├── pivoting-overview.md           # Module overview and network segmentation concepts
│   ├── dynamic-port-forwarding.md     # SSH SOCKS tunneling
│   ├── remote-port-forwarding.md      # Reverse shells and Meterpreter pivoting
│   ├── ssh-tunneling.md               # Complete SSH forwarding guide (Local, Remote, Dynamic)
│   ├── chisel-socks5-tunneling.md     # Modern HTTP/SOCKS5 tunneling with Chisel
│   ├── sshuttle-pivoting.md           # VPN-like tunneling over SSH
│   ├── meterpreter-tunneling.md       # Metasploit autoroute and pivoting modules
│   ├── socat-redirection.md           # Socat for port forwarding and redirection
│   ├── plink-windows-pivoting.md      # Windows SSH client for tunneling
│   ├── netsh-windows-portforward.md   # Native Windows port forwarding
│   ├── socksoverrdp-windows-pivoting.md # RDP-based SOCKS tunneling
│   ├── rpivot-web-pivoting.md         # HTTP/HTTPS tunneling with rpivot
│   ├── dnscat2-dns-tunneling.md       # DNS tunneling techniques
│   ├── ptunnel-ng-icmp-tunneling.md   # ICMP tunneling with ptunnel-ng
│   └── skills-assessment-complete-walkthrough.md # Complete HTB Academy skills assessment (All 7 questions)
├── attacking-common-services/          # Protocol exploitation techniques
│   ├── ftp-attacks.md                 # FTP exploitation and abuse
│   ├── smb-attacks.md                 # SMB protocol attacks and RCE
│   ├── sql-attacks.md                 # MySQL/MSSQL database exploitation
│   └── [other service exploitation]
├── attacking-common-applications/      # Application-specific exploitation
│   ├── README.md                      # Module overview and methodology
│   ├── wordpress-discovery-enumeration.md # WordPress scanning and enumeration
│   ├── wordpress-attacks.md           # WordPress exploitation techniques
│   ├── joomla-discovery-enumeration.md # Joomla scanning and enumeration
│   ├── joomla-attacks.md              # Joomla exploitation techniques
│   ├── drupal-discovery-enumeration.md # Drupal scanning and enumeration
│   ├── drupal-attacks.md              # Drupal exploitation techniques
│   ├── tomcat-discovery-enumeration.md # Tomcat enumeration and analysis
│   ├── tomcat-attacks.md              # Tomcat exploitation and privilege escalation
│   ├── jenkins-discovery-enumeration.md # Jenkins scanning and enumeration
│   ├── jenkins-attacks.md             # Jenkins exploitation and credential extraction
│   ├── splunk-discovery-enumeration.md # Splunk enumeration and analysis
│   ├── splunk-attacks.md              # Splunk exploitation and privilege escalation
│   └── [other application attacks]    # CGI, IIS, ColdFusion, LDAP, etc.
├── active-directory-enumeration-attacks/ # Active Directory penetration testing
│   ├── initial-enumeration-domain.md     # Initial domain enumeration
│   ├── llmnr-nbt-ns-poisoning-linux.md   # LLMNR/NBT-NS poisoning with Responder
│   └── [additional AD attack modules]    # More AD techniques to be added
├── linux-priv-esc/                    # Linux privilege escalation techniques
│   ├── README.md                      # Module overview and methodology
│   ├── environment-enumeration.md     # System reconnaissance and information gathering
│   ├── services-internals-enumeration.md # Deep system analysis and service enumeration
│   ├── credential-hunting.md          # Systematic credential discovery across file system
│   ├── path-abuse.md                  # PATH variable manipulation and command hijacking
│   ├── wildcard-abuse.md              # Wildcard character exploitation for privilege escalation
│   ├── escaping-restricted-shells.md  # Techniques for breaking out of restricted shells
│   ├── special-permissions.md         # SUID/SGID binary exploitation and GTFOBins
│   ├── sudo-rights-abuse.md           # Sudo privilege misconfigurations and GTFOBins exploitation
│   ├── privileged-groups.md           # LXD, Docker, Disk, ADM group privilege escalation
│   ├── capabilities.md                # Linux capabilities privilege escalation exploitation
│   ├── vulnerable-services.md         # Known service vulnerabilities and exploitation
│   ├── cron-job-abuse.md              # Cron job misconfiguration exploitation
│   ├── lxd-container-escape.md        # LXD container privilege escalation exploitation
│   ├── docker-container-escape.md     # Docker container privilege escalation exploitation
│   ├── logrotate-exploitation.md      # Logrotate vulnerability exploitation and race conditions
│   ├── miscellaneous-techniques.md    # Additional techniques (traffic capture, NFS, tmux hijacking)
│   ├── shared-libraries.md            # LD_PRELOAD shared library hijacking exploitation
│   ├── shared-object-hijacking.md     # Custom library RUNPATH hijacking exploitation
│   ├── python-library-hijacking.md    # Python module import hijacking exploitation
│   ├── sudo-cve-exploits.md           # Sudo CVE exploitation (Baron Samedit, Policy Bypass)
│   ├── polkit-pwnkit.md               # Polkit CVE-2021-4034 Pwnkit privilege escalation
│   ├── dirty-pipe.md                  # Dirty Pipe CVE-2022-0847 kernel vulnerability exploitation
│   ├── netfilter-kernel-exploits.md   # Netfilter kernel module CVE exploits (advanced)
│   ├── linux-hardening.md             # Defensive measures and system hardening practices
│   ├── permissions-based-privesc.md   # File permissions, SUID/SGID exploitation
│   ├── service-based-privesc.md      # Running services and process exploitation
│   ├── configuration-based-privesc.md # Misconfigurations and weak settings
│   ├── kernel-exploitation.md        # Operating system vulnerabilities
│   ├── application-specific-privesc.md # Vulnerable installed software
│   ├── automated-tools.md            # LinPEAS, LinEnum, and enumeration scripts
│   ├── persistence-techniques.md     # Maintaining elevated access
│   └── skills-assessment.md          # Practical exercises and challenges
└── remote-management/                  # Remote access protocols
    ├── remote-management.md            # Overview of remote management protocols
    ├── linux-remote-protocols.md      # SSH, Rsync, R-Services
    └── windows-remote-protocols.md    # RDP, WinRM, WMI
```

***

## **Study Materials**

### **📋 Phase 1: Information Gathering**

#### **🔍 Host-Based Enumeration**

*Complete service enumeration methodology organized by categories*

**🗄️ Database Services:**

* [**MySQL Enumeration**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/database-services/mysql-enumeration) - MySQL service testing, authentication, and exploitation
* [**MSSQL Enumeration**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/database-services/mssql-enumeration) - Microsoft SQL Server enumeration and attacks
* [**Oracle TNS Enumeration**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/database-services/oracle-enumeration) - Oracle database service testing

**📁 Network Services:**

* [**FTP Enumeration**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/network-services/ftp-enumeration) - File Transfer Protocol testing and exploitation
* [**SMB Enumeration**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/network-services/smb-enumeration) - SMB share enumeration, authentication testing, and CVE exploitation
* [**NFS Enumeration**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/network-services/nfs-enumeration) - Network File System testing and security assessment
* [**SMTP Enumeration**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/network-services/smtp-enumeration) - Mail server testing and user enumeration
* [**Email Services**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/network-services/email-enumeration) - IMAP/POP3 enumeration and certificate analysis
* [**SNMP Enumeration**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/network-services/snmp-enumeration) - Network management protocol testing and information gathering
* [**IPMI Enumeration**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/network-services/ipmi-enumeration) - Hardware management interface testing and hash extraction

**⚔️ Attacking Common Services:**

* [**FTP Attacks**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/attacking-common-services/ftp-attacks) - FTP exploitation techniques, brute forcing, bounce attacks, and file transfer abuse
* [**SMB Attacks**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/attacking-common-services/smb-attacks) - SMB protocol exploitation, Pass-the-Hash, RCE, forced authentication, and NTLM relay
* [**SQL Database Attacks**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/attacking-common-services/sql-attacks) - MySQL/MSSQL exploitation, command execution, hash stealing, privilege escalation, and lateral movement
* [**DNS Attacks**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/attacking-common-services/dns-attacks) - DNS zone transfers, subdomain enumeration, domain takeover, and DNS-based attacks
* [**RDP Attacks**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/attacking-common-services/rdp-attacks) - RDP exploitation, password spraying, session hijacking, and Pass-the-Hash attacks
* [**Email Services Attacks**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/attacking-common-services/smtp-attacks) - SMTP/IMAP/POP3 exploitation, user enumeration, mail relay abuse, and credential harvesting
* [**Skills Assessment**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/attacking-common-services/skills-assessment) - Complete attack chain scenarios (Easy/Medium/Hard) with HTB Academy solutions

**🌐 Attacking Common Applications:**

* [**Module Overview**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/web-application-attacks/attacking-common-applications) - Comprehensive methodologies for attacking prevalent applications in penetration testing
* **CMS Attacks** - WordPress, Joomla, Drupal discovery, enumeration, and exploitation
  * [**WordPress Discovery & Enumeration**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/web-application-attacks/attacking-common-applications/wordpress-discovery-enumeration) - WPScan, plugin enumeration, and version detection
  * [**WordPress Attacks & Exploitation**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/web-application-attacks/attacking-common-applications/wordpress-attacks) - Theme manipulation, plugin vulnerabilities, Metasploit integration
  * [**Joomla Discovery & Enumeration**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/web-application-attacks/attacking-common-applications/joomla-discovery-enumeration) - JoomScan, version detection, component analysis
  * [**Joomla Attacks & Exploitation**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/web-application-attacks/attacking-common-applications/joomla-attacks) - Template RCE, CVE-2019-10945 directory traversal, core vulnerabilities
  * [**Drupal Discovery & Enumeration**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/web-application-attacks/attacking-common-applications/drupal-discovery-enumeration) - DroopeScan, CHANGELOG analysis, module discovery
  * [**Drupal Attacks & Exploitation**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/web-application-attacks/attacking-common-applications/drupal-attacks) - PHP Filter abuse, Drupalgeddon series, backdoored modules
* **Development Tools** - Tomcat, Jenkins discovery and exploitation
  * [**Tomcat Discovery & Enumeration**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/web-application-attacks/attacking-common-applications/tomcat-discovery-enumeration) - Servlet container fingerprinting, manager interface discovery
  * [**Tomcat Attacks & Exploitation**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/web-application-attacks/attacking-common-applications/tomcat-attacks) - Manager brute force, WAR uploads, JSP shells, CVE-2020-1938
  * [**Jenkins Discovery & Enumeration**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/web-application-attacks/attacking-common-applications/jenkins-discovery-enumeration) - CI/CD automation server reconnaissance, plugin analysis
  * [**Jenkins Attacks & Exploitation**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/web-application-attacks/attacking-common-applications/jenkins-attacks) - Script Console abuse, Groovy RCE, pipeline manipulation
* **Infrastructure Monitoring** - Splunk, PRTG, GitLab attacks
  * [**Splunk Discovery & Enumeration**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/web-application-attacks/attacking-common-applications/splunk-discovery-enumeration) - SIEM log analytics reconnaissance, license analysis
  * [**Splunk Attacks & Exploitation**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/web-application-attacks/attacking-common-applications/splunk-attacks) - Custom app RCE, scripted inputs, Universal Forwarder compromise
  * [**GitLab Discovery & Enumeration**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/web-application-attacks/attacking-common-applications/gitlab-discovery-enumeration) - Repository mining, user enumeration, CVE exploitation
  * [**PRTG Network Monitor Attacks**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/web-application-attacks/attacking-common-applications/prtg-attacks) - Command injection via notification parameters
* **Specialized Applications** - CGI, IIS, ColdFusion, LDAP, Binary Analysis
  * [**CGI Shellshock Attacks**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/web-application-attacks/attacking-common-applications/cgi-shellshock-attacks) - CVE-2014-6271 exploitation via HTTP headers
  * [**IIS Tilde Enumeration**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/web-application-attacks/attacking-common-applications/iis-tilde-enumeration) - Short filename discovery using 8.3 format
  * [**ColdFusion Discovery & Enumeration**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/web-application-attacks/attacking-common-applications/coldfusion-discovery-enumeration) - CFML application testing, port 5500 protocols
  * [**LDAP Injection Attacks**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/web-application-attacks/attacking-common-applications/ldap-injection-attacks) - Authentication bypass via environment variables
  * [**Binary Reverse Engineering**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/web-application-attacks/attacking-common-applications/binary-reverse-engineering) - Connection string extraction from compiled applications
  * [**osTicket System Exploitation**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/web-application-attacks/attacking-common-applications/osticket-attacks) - Support system credential harvesting
  * [**Other Notable Applications**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/web-application-attacks/attacking-common-applications/other-notable-applications) - WebLogic, Axis2, WebSphere, Zabbix, Nagios

**🔀 Pivoting, Tunneling & Port Forwarding:**

* [**Module Overview**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/pivoting-tunneling-and-port-forwarding/pivoting-overview) - Concepts, network segmentation, and methodology
* [**SSH Tunneling Complete Guide**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/pivoting-tunneling-and-port-forwarding/ssh-tunneling) - Local, Remote, and Dynamic port forwarding
* [**Dynamic Port Forwarding**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/pivoting-tunneling-and-port-forwarding/dynamic-port-forwarding) - SSH SOCKS tunneling and proxychains
* [**Remote Port Forwarding**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/pivoting-tunneling-and-port-forwarding/remote-port-forwarding) - Reverse shells and Meterpreter pivoting
* [**Chisel SOCKS5 Tunneling**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/pivoting-tunneling-and-port-forwarding/chisel-socks5-tunneling) - Modern HTTP/SOCKS5 tunneling
* [**SSHuttle Pivoting**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/pivoting-tunneling-and-port-forwarding/sshuttle-pivoting) - VPN-like tunneling over SSH
* [**Meterpreter Tunneling**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/pivoting-tunneling-and-port-forwarding/meterpreter-tunneling) - Metasploit autoroute and framework integration
* [**Socat Redirection**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/pivoting-tunneling-and-port-forwarding/socat-redirection) - Advanced port forwarding and redirection
* [**Plink Windows Pivoting**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/pivoting-tunneling-and-port-forwarding/plink-windows-pivoting) - Windows SSH client for tunneling
* [**Netsh Port Forwarding**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/pivoting-tunneling-and-port-forwarding/netsh-windows-portforward) - Native Windows port forwarding
* [**SocksOverRDP**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/pivoting-tunneling-and-port-forwarding/socksoverrdp-windows-pivoting) - RDP-based SOCKS tunneling
* [**Rpivot Web Pivoting**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/pivoting-tunneling-and-port-forwarding/rpivot-web-pivoting) - HTTP/HTTPS tunneling techniques
* [**DNS Tunneling with dnscat2**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/pivoting-tunneling-and-port-forwarding/dnscat2-dns-tunneling) - DNS-based covert channels
* [**ICMP Tunneling with ptunnel-ng**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/pivoting-tunneling-and-port-forwarding/ptunnel-ng-icmp-tunneling) - ICMP-based tunneling

**🏰 Active Directory Enumeration & Attacks:**

* [**Initial Domain Enumeration**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/active-directory-enumeration-and-attacks/initial-enumeration-domain) - Network discovery, service enumeration, and user enumeration with Kerbrute
* [**LLMNR/NBT-NS Poisoning from Linux**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/active-directory-enumeration-and-attacks/llmnr-nbt-ns-poisoning-linux) - Responder attacks, hash capture, and credential harvesting
* [**LLMNR/NBT-NS Poisoning from Windows**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/active-directory-enumeration-and-attacks/llmnr-nbt-ns-poisoning-windows) - Inveigh attacks, hash capture, and credential extraction
* [**Password Policy Enumeration**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/active-directory-enumeration-and-attacks/password-policy-enumeration) - Domain password policy discovery and analysis
* [**Password Spraying User List Creation**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/active-directory-enumeration-and-attacks/password-spraying-user-list) - Username enumeration for password spraying attacks
* [**Password Spraying from Linux**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/active-directory-enumeration-and-attacks/password-spraying-linux) - rpcclient, Kerbrute, and CrackMapExec spraying techniques
* [**Password Spraying from Windows**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/active-directory-enumeration-and-attacks/password-spraying-windows) - DomainPasswordSpray.ps1 and Windows-based credential discovery
* [**Security Controls Enumeration**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/active-directory-enumeration-and-attacks/security-controls-enumeration) - Windows Defender, AppLocker, LAPS, and Constrained Language Mode assessment
* [**Credentialed Enumeration from Linux**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/active-directory-enumeration-and-attacks/credentialed-enumeration-linux) - CrackMapExec, SMBMap, rpcclient, Impacket, Windapsearch, and BloodHound.py
* [**Credentialed Enumeration from Windows**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/active-directory-enumeration-and-attacks/credentialed-enumeration-windows) - ActiveDirectory PowerShell, PowerView, SharpView, Snaffler, and BloodHound
* [**Living Off the Land**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/active-directory-enumeration-and-attacks/living-off-the-land) - Native Windows tools, PowerShell techniques, WMI, net commands, and dsquery
* [**Kerberoasting from Linux**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/active-directory-enumeration-and-attacks/kerberoasting-linux) - Impacket GetUserSPNs.py, TGS ticket extraction, and offline cracking with Hashcat
* [**Kerberoasting from Windows**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/active-directory-enumeration-and-attacks/kerberoasting-windows) - setspn.exe, PowerShell, Mimikatz, PowerView, Rubeus, and encryption type analysis
* [**ACL Enumeration**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/active-directory-enumeration-and-attacks/acl-enumeration) - PowerView ACL analysis, attack path discovery, BloodHound visualization, and privilege escalation chains
* [**ACL Abuse Tactics**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/active-directory-enumeration-and-attacks/acl-abuse-tactics) - Practical ACL attack execution, password manipulation, group membership abuse, targeted Kerberoasting, cleanup procedures, and detection evasion
* [**DCSync Attack**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/active-directory-enumeration-and-attacks/dcsync-attack) - Ultimate domain compromise technique using Directory Replication Service, secretsdump.py and Mimikatz execution, reversible encryption exploitation, and complete domain credential extraction
* [**Privileged Access**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/active-directory-enumeration-and-attacks/privileged-access) - Lateral movement and privilege expansion using BloodHound enumeration, WinRM/PSRemote exploitation, SQL Server administrative access, and multi-service attack chaining
* [**Kerberos "Double Hop" Problem**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/active-directory-enumeration-and-attacks/kerberos-double-hop-problem) - Overcoming Kerberos authentication limitations in multi-hop scenarios, PSCredential object workarounds, PSSession configuration methods, and advanced lateral movement techniques
* [**Bleeding Edge Vulnerabilities**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/active-directory-enumeration-and-attacks/bleeding-edge-vulnerabilities) - Latest critical AD attack vectors including NoPac (SamAccountName Spoofing), PrintNightmare, and PetitPotam (MS-EFSRPC) for rapid domain compromise
* [**Miscellaneous Misconfigurations**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/active-directory-enumeration-and-attacks/miscellaneous-misconfigurations) - Diverse AD vulnerabilities including Exchange attacks, GPP passwords, ASREPRoasting, DNS enumeration, Printer Bug, and various administrative oversights
* [**Domain Trusts Primer**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/active-directory-enumeration-and-attacks/domain-trusts-primer) - Foundation of AD trust relationships, enumeration techniques (PowerView, netdom, BloodHound), and trust-based attack path identification
* [**Child → Parent Trust Attacks**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/active-directory-enumeration-and-attacks/child-parent-trust-attacks) - SID History exploitation, ExtraSids attacks with Mimikatz/Rubeus, Golden Ticket creation for forest privilege escalation
* [**Child → Parent Trust Attacks - from Linux**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/active-directory-enumeration-and-attacks/child-parent-trust-attacks-linux) - Cross-platform ExtraSids attacks using Impacket toolkit (secretsdump, lookupsid, ticketer, psexec, raiseChild)
* [**Cross-Forest Trust Abuse - from Windows**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/active-directory-enumeration-and-attacks/cross-forest-trust-abuse-windows) - Cross-forest Kerberoasting, admin password reuse, foreign group membership enumeration, and SID History abuse across forest boundaries
* [**Cross-Forest Trust Abuse - from Linux**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/active-directory-enumeration-and-attacks/cross-forest-trust-abuse-linux) - Cross-platform cross-forest attacks using Impacket GetUserSPNs, bloodhound-python multi-domain collection, and foreign group membership discovery

**🎯 Skills Assessment:**

* [**Skills Assessment Part I - Complete Walkthrough**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/active-directory-enumeration-and-attacks/skills-assessment-part-1) - Comprehensive 8-question practical assessment covering web shells, Kerberoasting, pivoting, credential dumping, DCSync attacks, and domain takeover with working commands and troubleshooting
* [**Skills Assessment Part II - Advanced Professional Methodology**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/active-directory-enumeration-and-attacks/skills-assessment-part-2) - 12-question advanced assessment demonstrating superior SSH dynamic port forwarding + proxychains methodology, LLMNR poisoning, SQL exploitation, privilege escalation, and complete domain compromise with professional-grade techniques

**🖥️ Remote Management:**

* [**Remote Management Overview**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/remote-management/remote-management) - Overview of remote access protocols
* [**Linux Remote Protocols**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/remote-management/linux-remote-protocols) - SSH, Rsync, R-Services enumeration
* [**Windows Remote Protocols**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/remote-management/windows-remote-protocols) - RDP, WinRM, WMI testing

**🪟 Windows Privilege Escalation:**

* [**Module Overview**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/windows-privilege-escalation/windows-priv-esc) - Comprehensive Windows privilege escalation methodology
* [**Situational Awareness**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/windows-privilege-escalation/situational-awareness) - Network enumeration, security protections, system context assessment
* [**Initial Enumeration**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/windows-privilege-escalation/initial-enumeration) - System information, processes, users, groups, and services enumeration
* [**Communication with Processes**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/windows-privilege-escalation/communication-with-processes) - Network services and named pipes analysis for privilege escalation
* [**SeImpersonate & SeAssignPrimaryToken**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/windows-privilege-escalation/seimpersonate-privilege-escalation) - Token impersonation attacks using JuicyPotato, PrintSpoofer, and RoguePotato
* [**SeDebugPrivilege**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/windows-privilege-escalation/sedebug-privilege-escalation) - LSASS memory dumping, credential extraction, and SYSTEM privilege escalation
* [**SeTakeOwnershipPrivilege**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/windows-privilege-escalation/setakeownership-privilege-escalation) - File ownership takeover, ACL manipulation, and sensitive data access
* [**Windows Built-in Groups**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/windows-privilege-escalation/windows-builtin-groups) - Backup Operators exploitation, SeBackupPrivilege abuse, and Domain Controller NTDS.dit extraction
* [**Event Log Readers**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/windows-privilege-escalation/event-log-readers) - Event log analysis, process creation auditing, and credential extraction from command-line history
* [**DnsAdmins**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/windows-privilege-escalation/dnsadmins-privilege-escalation) - DNS service manipulation, custom DLL injection, and Domain Controller privilege escalation attacks
* [**Hyper-V Administrators**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/windows-privilege-escalation/hyperv-administrators) - Virtual machine cloning attacks and hard link exploitation techniques
* [**Print Operators**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/windows-privilege-escalation/print-operators) - SeLoadDriverPrivilege exploitation and malicious driver loading attacks
* [**Server Operators**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/windows-privilege-escalation/server-operators) - Service control, binary path modification, and Domain Controller compromise techniques
* [**UAC Bypass**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/windows-privilege-escalation/uac-bypass) - User Account Control bypass via DLL hijacking, auto-elevating binaries, and UACME techniques
* [**Weak Permissions**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/windows-privilege-escalation/weak-permissions) - File system ACLs, service permissions, unquoted service paths, registry ACLs, and autorun binary exploitation
* [**Kernel Exploits**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/windows-privilege-escalation/kernel-exploits) - Historical and modern Windows kernel vulnerabilities including HiveNightmare, PrintNightmare, and legacy exploits
* [**Vulnerable Services**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/windows-privilege-escalation/vulnerable-services) - Third-party application vulnerabilities, service enumeration, and exploitation techniques including Druva inSync command injection
* [**Credential Hunting**](https://github.com/kabaneridev/oscp-notes/blob/main/CPTS-PREP/windows-priv-esc/credential-hunting.md) - File system credential discovery, PowerShell history analysis, browser dictionaries, unattended installation files, and DPAPI credential decryption
* [**Other Files**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/windows-privilege-escalation/other-files) - Advanced credential hunting in StickyNotes databases, system backup files, network shares, and application-specific storage locations
* [**Further Credential Theft**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/windows-privilege-escalation/further-credential-theft) - Browser credential extraction, password manager cracking, LaZagne automation, SessionGopher, registry-stored credentials, and WiFi password retrieval
* [**Citrix Breakout**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/windows-privilege-escalation/citrix-breakout) - Escaping restricted virtualization environments using dialog boxes, UNC paths, alternate tools, and privilege escalation chains
* [**Interacting with Users**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/windows-privilege-escalation/interacting-with-users) - Social engineering attacks including traffic capture, SCF/LNK file hash capture, process monitoring, and credential harvesting
* [**Pillaging**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/windows-privilege-escalation/pillaging) - Post-exploitation data extraction from applications, browsers, clipboard, backup systems, and configuration files
* [**Miscellaneous Techniques**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/windows-privilege-escalation/miscellaneous-techniques) - LOLBAS exploitation, AlwaysInstallElevated, CVE-2019-1388, scheduled tasks, and virtual disk mounting
* [**Windows Server 2008**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/windows-privilege-escalation/windows-server-2008) - Legacy system exploitation using Sherlock, missing patches, and Metasploit privilege escalation
* [**Windows 7 Exploitation**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/windows-privilege-escalation/windows-7-exploitation) - End-of-life desktop exploitation using Windows-Exploit-Suggester and MS16-032 PowerShell attacks

**📋 Documentation & Reporting:**

* [**Notetaking & Organization**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/documentation-and-reporting/notetaking-organization) - Comprehensive notetaking structure, Tmux logging setup, evidence collection, and artifact tracking for professional penetration testing assessments
* [**Types of Reports**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/documentation-and-reporting/types-of-reports) - Assessment methodologies, report categories, specialized testing types, and professional deliverable standards
* [**Components of a Report**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/documentation-and-reporting/components-of-a-report) - Executive summary best practices, attack chain documentation, findings structure, and appendix organization
* [**How to Write Up a Finding**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/documentation-and-reporting/how-to-write-up-a-finding) - Professional finding structure, evidence presentation, remediation recommendations, and quality reference selection
* [**Reporting Tips and Tricks**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/documentation-and-reporting/reporting-tips-and-tricks) - Professional workflow, MS Word techniques, automation strategies, client communication, and quality assurance processes
* [**HTB Academy Example**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/documentation-and-reporting/htb_academy_example) - Practical Obsidian notetaking structure demonstrating professional penetration test documentation for INLANEFREIGHT.LOCAL assessment

**🌐 Attacking Enterprise Networks:**

* [**External Information Gathering**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/attacking-enterprise-networks/external-information-gathering) - Systematic reconnaissance, Nmap enumeration, DNS zone transfers, vhost discovery, and attack surface mapping for enterprise network penetration testing
* [**Service Enumeration & Exploitation**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/attacking-enterprise-networks/service-enumeration-exploitation) - FTP, SSH, SMTP, email services testing, user enumeration, anonymous access validation, and vulnerability research
* [**Web Enumeration & Exploitation**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/attacking-enterprise-networks/web-enumeration-exploitation) - EyeWitness automation, HTTP verb tampering, file upload bypasses, WordPress exploitation, SQL injection, XSS, SSRF, XXE, and command injection with 11 comprehensive lab solutions
* [**Initial Access**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/attacking-enterprise-networks/initial-access) - Socat reverse shell establishment, TTY upgrade techniques, audit log credential mining, privilege escalation, and DMZ to internal network pivot preparation
* [**Post-Exploitation Persistence**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/attacking-enterprise-networks/post-exploitation-persistence) - SSH key extraction via GTFOBins, root privilege escalation, stable access establishment, and internal network pivot preparation
* [**Internal Information Gathering**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/attacking-enterprise-networks/internal-information-gathering) - SSH/Metasploit pivoting setup, internal host discovery, NFS share exploitation, DotNetNuke credential harvesting, and Active Directory infrastructure mapping
* [**Exploitation & Privilege Escalation**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/attacking-enterprise-networks/exploitation-privilege-escalation) - DotNetNuke administrative exploitation, xp\_cmdshell enablement, PrintSpoofer SeImpersonate attacks, SAM database extraction, and domain credential discovery
* [**Lateral Movement**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/attacking-enterprise-networks/lateral-movement) - BloodHound enumeration, ForceChangePassword privilege abuse, file share credential hunting, Kerberoasting attacks, password spraying, and Sysax Automation privilege escalation
* [**Active Directory Compromise**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/attacking-enterprise-networks/active-directory-compromise) - GenericWrite ACL abuse, targeted Kerberoasting attacks, Server Admins group escalation, DCSync privilege exploitation, and complete domain administrator access
* [**Post-Exploitation**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/attacking-enterprise-networks/post-exploitation) - Domain password analysis, double pivoting techniques, protected network access, DirtyPipe kernel exploitation, and comprehensive enterprise impact demonstration

**🐧 Linux Privilege Escalation:**

* [**Module Overview**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/linux-privilege-escalation/linux-priv-esc) - Comprehensive Linux privilege escalation methodology
* [**Environment Enumeration**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/linux-privilege-escalation/environment-enumeration) - System reconnaissance and information gathering techniques
  * **System Information Gathering** - OS version, kernel, hardware details and security controls
  * **User and Group Analysis** - Account enumeration, permission mapping, and group membership
  * **Network Configuration** - Interface analysis, routing tables, and internal network discovery
  * **File System Analysis** - Mounted drives, hidden files, temporary directories, and block devices
  * **Manual Enumeration Checklist** - Systematic approach to Linux system reconnaissance
* [**Services & Internals Enumeration**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/linux-privilege-escalation/services-internals-enumeration) - Deep system analysis for privilege escalation vectors
  * **Running Services Analysis** - Process enumeration, service identification, and root process targeting
  * **User Activity Investigation** - Login history, active sessions, and command history analysis
  * **Scheduled Tasks Discovery** - Cron jobs, systemd timers, and automation script analysis
  * **Configuration Discovery** - System configs, application settings, and credential harvesting
* [**Credential Hunting**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/linux-privilege-escalation/credential-hunting) - Systematic credential discovery and extraction techniques
  * **File System Credential Search** - Configuration files, scripts, backups containing stored secrets
  * **SSH Key Discovery** - Private key enumeration, known\_hosts analysis, lateral movement prep
  * **Database Credential Extraction** - WordPress, MySQL, PostgreSQL, application database passwords
  * **Advanced Discovery Methods** - Memory analysis, environment variables, process inspection
* [**PATH Abuse**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/linux-privilege-escalation/path-abuse) - PATH variable manipulation for privilege escalation
  * **PATH Variable Exploitation** - Directory precedence manipulation and command execution hijacking
  * **Writable Directory Detection** - PATH enumeration and write permission identification
  * **Script Hijacking Attacks** - Sudo scripts, cron jobs, and relative command exploitation
  * **Binary Substitution Techniques** - Malicious script creation and execution interception
* [**Wildcard Abuse**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/linux-privilege-escalation/wildcard-abuse) - Shell wildcard exploitation for argument injection
  * **Filename Expansion Attacks** - Wildcard character abuse for command argument injection
  * **tar Command Exploitation** - checkpoint-action parameter injection for code execution
  * **Cron Job Wildcard Targeting** - Automated script exploitation through file creation
* [**Escaping Restricted Shells**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/linux-privilege-escalation/escaping-restricted-shells) - Breaking out of rbash, rksh, rzsh limitations
  * **SSH Bypass Techniques** - Remote connection restriction circumvention
  * **Command Substitution Escapes** - Backtick and variable expansion exploitation
  * **Built-in Command Abuse** - Vi, less, man page escape sequences for shell access
* [**Special Permissions**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/linux-privilege-escalation/special-permissions) - SUID/SGID binary exploitation for privilege escalation
  * **SUID/SGID Binary Discovery** - Finding and enumerating special permission files
  * **GTFOBins Exploitation** - Leveraging known privilege escalation binaries and techniques
  * **Common Binary Abuse** - Text editors, interpreters, file utilities with elevated permissions
* [**Sudo Rights Abuse**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/linux-privilege-escalation/sudo-rights-abuse) - Sudo misconfiguration exploitation
  * **Sudo Permission Enumeration** - sudo -l analysis and configuration file review
  * **GTFOBins Sudo Exploitation** - Text editors, system tools, interpreter abuse via sudo
* [**Privileged Groups**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/linux-privilege-escalation/privileged-groups) - Dangerous group membership exploitation
  * **Container Group Abuse** - LXD/LXC and Docker group privilege escalation techniques
  * **System Group Exploitation** - Disk, ADM, shadow group access for privilege vectors
* [**Capabilities**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/linux-privilege-escalation/capabilities) - Linux capabilities privilege escalation
  * **Capability Enumeration** - Finding binaries with dangerous capability assignments
  * **File Permission Bypass** - cap\_dac\_override exploitation for system file modification
* [**Vulnerable Services**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/linux-privilege-escalation/vulnerable-services) - Service vulnerability exploitation
  * **Service Version Enumeration** - Identifying outdated software with known CVEs
  * **Screen 4.5.0 Exploitation** - CVE-2017-5618 ld.so.preload overwrite privilege escalation
* [**Cron Job Abuse**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/linux-privilege-escalation/cron-job-abuse) - Scheduled task misconfiguration exploitation
  * **Cron Job Discovery** - Finding writable scripts in scheduled tasks
  * **Process Monitoring** - pspy usage for automated task pattern detection
* [**LXD Container Escape**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/linux-privilege-escalation/lxd-container-escape) - Container manager privilege escalation
  * **LXD Group Exploitation** - Privileged container creation and host filesystem mounting
  * **Container Image Management** - Importing, configuring, and exploiting container images
* [**Docker Container Escape**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/linux-privilege-escalation/docker-container-escape) - Docker runtime privilege escalation
  * **Docker Group Exploitation** - Container runtime privilege escalation via host mounting
  * **Privileged Container Execution** - Bypassing isolation through privileged containers
* [**Logrotate Exploitation**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/linux-privilege-escalation/logrotate-exploitation) - Log management vulnerability exploitation
  * **Logrotate Vulnerability Assessment** - Version identification and vulnerable configuration detection
  * **Logrotten Race Condition Exploit** - Race condition exploitation via log rotation hijacking
* [**Miscellaneous Techniques**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/linux-privilege-escalation/miscellaneous-techniques) - Additional privilege escalation vectors
  * **Passive Traffic Capture** - Network sniffing for credential extraction using tcpdump
  * **Weak NFS Privileges** - no\_root\_squash exploitation for SUID binary upload and system access
* [**Shared Libraries**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/linux-privilege-escalation/shared-libraries) - LD\_PRELOAD exploitation for privilege escalation
  * **LD\_PRELOAD Environment Abuse** - Shared library injection through environment variable manipulation
  * **Malicious Library Deployment** - Custom shared object creation and sudo command hijacking
* [**Shared Object Hijacking**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/linux-privilege-escalation/shared-object-hijacking) - RUNPATH library hijacking exploitation
  * **RUNPATH Directory Exploitation** - Writable library path abuse in SUID binaries
  * **Custom Library Injection** - Missing function implementation for privilege escalation
* [**Python Library Hijacking**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/linux-privilege-escalation/python-library-hijacking) - Python module import system exploitation
  * **Python Module Import Hijacking** - sys.path manipulation and module precedence abuse
  * **PYTHONPATH Environment Manipulation** - Environment variable abuse for import redirection
* [**Sudo CVE Exploits**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/linux-privilege-escalation/sudo-cve-exploits) - Critical sudo vulnerability exploitation
  * **CVE-2021-3156 Baron Samedit** - Heap buffer overflow for immediate root shell access
  * **CVE-2019-14287 Policy Bypass** - Negative user ID exploitation for privilege escalation
* [**Polkit/Pwnkit**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/linux-privilege-escalation/polkit-pwnkit) - Universal privilege escalation via polkit vulnerability
  * **CVE-2021-4034 Pwnkit Exploitation** - Memory corruption in pkexec for universal root access
  * **Zero-Prerequisite Escalation** - Any local user exploitation without authentication
* [**Dirty Pipe**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/linux-privilege-escalation/dirty-pipe) - Kernel vulnerability exploitation for file modification
  * **CVE-2022-0847 Kernel Exploitation** - Pipe mechanism abuse for arbitrary root file writes
  * **File Modification Attacks** - /etc/passwd modification and SUID binary hijacking via kernel exploit
* [**Netfilter Kernel Exploits**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/linux-privilege-escalation/netfilter-kernel-exploits) - ⚠️ **Advanced kernel exploits (high risk)**
  * **Multiple Kernel CVEs** - CVE-2021-22555, CVE-2022-25636, CVE-2023-32233 targeting kernels 2.6-6.3.1
  * **High-Risk Kernel Exploitation** - Direct kernel attacks with significant system stability risks
* [**Linux Hardening**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/linux-privilege-escalation/linux-hardening) - Defensive security measures and system hardening
  * **Update Management** - Kernel and package update strategies for vulnerability mitigation
  * **Configuration Hardening** - File system, service, and user management security practices

**🕷️ Web Enumeration:**

* [**Web Information Gathering**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/web-enumeration/web-information-gathering) - Overview and quick start guide for web reconnaissance
* [**Subdomain Enumeration**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/web-enumeration/subdomain-enumeration) - DNS enumeration and subdomain discovery techniques
* [**Web Application Enumeration**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/web-enumeration/web-application-enumeration) - Directory enumeration, virtual hosts, and web application testing

**🌐 Web Application Attacks:**

* [**Cross-Site Scripting (XSS)**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/web-application-attacks/xss-cross-site-scripting) - Complete XSS guide covering Stored, Reflected, and DOM-based XSS with HTB Academy techniques
* [**File Inclusion**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/web-application-attacks/file-inclusion) - Comprehensive LFI/RFI module with 9 specialized guides covering Basic Techniques, Advanced Bypasses, PHP Wrappers RCE, Remote File Inclusion, File Upload + LFI, Log Poisoning, Automated Scanning, Prevention & Hardening, and complete HTB Academy Skills Assessment
* [**File Upload Attacks**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/web-application-attacks/file-upload-attacks) - Complete file upload exploitation guide covering web shells, reverse shells, bypass techniques, and HTB Academy lab solutions
* [**Command Injection Attacks**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/web-application-attacks/command-injection) - **🏆 COMPLETE MODULE** (10 comprehensive sections: Detection + Exploitation + Filter Bypasses + Advanced Obfuscation + Skills Assessment) - OS Command Execution with direct and blind injection techniques, filter bypass methods, advanced evasion and automated tools, complete methodology with HTB Academy lab solutions

**🔐 Password Attacks & Lateral Movement:**

* [**Skills Assessment Workflow**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/password-attacks-and-lateral-movement/complete-assessment-workflows/skills-assessment-workflow) - Complete password attacks methodology from foothold to domain compromise
* [**Pass the Hash Attacks**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/password-attacks-and-lateral-movement/lateral-movement-techniques/pass-the-hash) - NTLM hash relay and authentication bypass
* [**Pass the Ticket Attacks**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/password-attacks-and-lateral-movement/lateral-movement-techniques/pass-the-ticket) - Kerberos ticket manipulation and Golden Ticket attacks
* [**Pass the Certificate Attacks**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/password-attacks-and-lateral-movement/lateral-movement-techniques/pass-the-certificate) - ESC8 ADCS attacks and PKINIT exploitation
* [**NTDS.dit Attacks**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/password-attacks-and-lateral-movement/active-directory-attacks/active-directory-ntds-attacks) - Domain controller credential extraction

#### **🌐** [**Infrastructure Enumeration**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/footprinting)

*Domain and cloud infrastructure reconnaissance*

**Topics Covered:**

* Domain Information Gathering
* DNS Enumeration and Zone Transfers
* Cloud Service Identification
* Certificate Transparency Analysis
* Subdomain Discovery

#### **🛡️** [**Firewall Evasion**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/firewall-evasion)

*Techniques for bypassing security controls*

**Techniques Covered:**

* Firewall Detection and Fingerprinting
* IDS/IPS Evasion Methods
* Port Scanning Evasion
* Protocol Manipulation

**Practical Application:**

* [**Complete Skills Assessment**](https://kabaneridev.gitbook.io/pentesting-notes/certification-preparation/cpts-prep/pivoting-tunneling-and-port-forwarding/skills-assessment-complete-walkthrough) - All 7 HTB Academy questions with full solutions and troubleshooting
* [**Skills Assessment**](https://github.com/kabaneridev/oscp-notes/blob/main/CPTS-PREP/pivoting-tunneling-port-forwarding/skills-assessment.md) - Hands-on lab scenarios and HTB Academy exercises

***

## **Key Features**

### **🎯 Comprehensive Coverage**

* **30+ Service Types** - Complete enumeration guides for all major services
* **Complete Attack Modules** - Full HTB Academy "Attacking Common Services" (4,262 lines) + "Attacking Common Applications" (22 documents)
* **Web Application Attacks** - XSS (Cross-Site Scripting), File Inclusion module (9 specialized guides), File Upload Attacks (9 comprehensive sections), Command Injection (10 comprehensive sections), and Web Attacks (HTTP Verb Tampering, IDOR, XXE)
* **Application-Specific Exploitation** - WordPress, Joomla, Drupal, Tomcat, Jenkins, Splunk, and specialized applications
* **Windows Privilege Escalation** - Comprehensive module covering situational awareness, initial enumeration, privilege exploitation (SeImpersonate, SeDebugPrivilege, SeTakeOwnershipPrivilege), Windows Built-in Groups abuse (Backup Operators, Event Log Readers, DnsAdmins, Hyper-V Administrators, Print Operators, Server Operators), UAC bypass techniques, weak permissions exploitation, kernel exploits (HiveNightmare, PrintNightmare, legacy vulnerabilities), vulnerable third-party services, credential hunting techniques, advanced file system searches, further credential theft (browsers, password managers, automated tools), and systematic escalation techniques
* **Linux Privilege Escalation** - Complete module with 24 techniques covering environment enumeration, permissions-based attacks, service exploitation, container escapes, kernel exploits, and defensive hardening
* **Skills Assessment Coverage** - Multiple complete walkthroughs for different difficulty levels
* **Web Application Focus** - Dedicated web reconnaissance and enumeration
* **CVE References** - Known vulnerabilities with exploitation examples
* **HTB Academy Style** - Lab questions and practical examples
* **Real-World Scenarios** - Practical penetration testing methodologies

### **📚 Practical Focus**

* **Step-by-step Commands** - Copy-paste ready enumeration commands
* **Tool Comparisons** - Multiple tools for each enumeration task
* **Security Assessment** - Vulnerability identification and exploitation
* **Defensive Measures** - Hardening and protection recommendations

***

## **Study Resources**

### **📖 Essential Reading**

* **HTB Academy CPTS Path** - Official certification curriculum
* **PTES Standard** - Penetration Testing Execution Standard
* **NIST Guidelines** - Cybersecurity framework references
* **OWASP Top 10** - Web application security fundamentals

### **🛠️ Required Tools**

* **Nmap** - Network discovery and security auditing
* **Burp Suite** - Web application security testing
* **Metasploit** - Penetration testing framework
* **Bloodhound** - Active Directory environment analysis
* **Custom Scripts** - Automation and efficiency tools

### **🏆 Certification Path**

1. **Study Phase** - Review all enumeration guides systematically
2. **Lab Practice** - Complete HTB Academy lab exercises
3. **Exam Preparation** - Review methodologies and checklists
4. **Certification Exam** - Apply knowledge in simulated environment

***

*This CPTS preparation guide is designed to provide comprehensive coverage of penetration testing methodologies while maintaining practical applicability for real-world security assessments.*
