Guides

AWS IAM is both the most powerful and most abused system in cloud security. Get the permissions wrong — even slightly — and an attacker can go from a low-privilege read-only role to full AdministratorAccess in under five minutes. This guide covers every IAM privilege escalation technique that works in 2026. Real attack paths, real commands, detection notes where relevant. If you’re doing cloud pentesting, red team engagements, or studying for AWS security certs — this is the complete reference. ...

Azure is the second-largest cloud platform on the planet and the dominant choice in enterprise environments. Microsoft’s deep integration with Active Directory, Office 365, and enterprise tooling means Azure is everywhere corporate red teams operate. If you’re doing internal red team work or enterprise pentesting in 2026, Azure is unavoidable. This guide covers the full attack chain — from initial recon through credential theft, RBAC abuse, lateral movement, and persistence — with real commands and the tools that actually work. ...

AWS is the biggest cloud provider on the planet. It’s also one of the most common attack surfaces in modern red team engagements. If you’re doing pentesting in 2026 and you don’t understand how to attack AWS, you’re leaving scope on the table. This guide covers the full attack chain — from initial recon through privilege escalation — with real commands and the tools that actually matter. You need a lab environment to practice this. Spin up a dedicated AWS account for testing. If you want a VPS to run attack tooling from, Vultr and DigitalOcean are solid choices — cheap, fast, and you can tear them down when done. ...

Windows privilege escalation is one of the most critical skills in offensive security. You land on a box as a low-privileged user, and your job isn’t done until you have SYSTEM. This cheat sheet covers every technique that actually works in 2026 — with real commands, the right tools, and notes on which Windows versions each technique applies to. Bookmark it. You’ll use it. Why Windows PrivEsc Is Different From Linux Linux privilege escalation has patterns: SUID binaries, sudo misconfigs, writable cron jobs, kernel exploits. Clean and predictable. ...

Linux privilege escalation is the step between getting a shell and owning the box. You land as www-data or a low-priv user — the goal is root. This cheat sheet covers every technique worth knowing in 2026, with commands you can run immediately. Practice these techniques on a real machine. Vultr and DigitalOcean both offer $5–6/month VPS you can spin up, break, and destroy. Cheap, legal, and resets whenever you want. ...

This article is written from 14+ years of offensive security practice. Some links are affiliate links that help keep this site running — I only recommend tools and services I’d use myself. Kali Linux comes loaded with over 600 security tools. If you’re new to penetration testing, that’s not empowering — that’s paralyzing. Here’s the honest truth: working pentesters don’t use most of what’s installed. They use a tight core of tools extremely well, and add specialized ones when a specific engagement calls for it. The practitioners who get hired aren’t the ones who can name every tool — they’re the ones who can actually use ten of them. ...

Metasploit is the exploitation framework everyone knows and half the people actually understand. This cheat sheet covers everything from first-time msfconsole navigation to post-exploitation pivoting — organized by how you actually use it on an engagement, not alphabetically by command. Updated for 2026. Bookmark it. Starting Metasploit # Start msfconsole msfconsole # Start with quiet mode (skip banner) msfconsole -q # Start with a resource script msfconsole -r setup.rc # Start with a specific database msfconsole -y /path/to/database.yml # Update Metasploit msfupdate Database Setup Metasploit’s database stores hosts, services, credentials, and loot. Worth setting up. ...

You don’t memorize Nmap. Nobody does. You keep a cheat sheet, you use it constantly, and eventually the important stuff sticks. This is that cheat sheet — updated for 2026, organized by what you actually do on engagements, not alphabetically by flag name. Covers everything from basic discovery to NSE scripting to firewall evasion. If it’s not here, you probably don’t need it in the field. Target Specification These go at the end of any Nmap command. Mix and match as needed. ...

This article contains affiliate links. If you purchase through them, we may earn a commission at no extra cost to you. We only recommend tools we’d actually use. Operational security isn’t a checkbox. It’s a discipline — and it’s the difference between a red team that gets away clean and one that burns its own infrastructure mid-engagement. This guide covers red team OPSEC in 2026: what it means, why most teams still get it wrong, and the concrete steps that separate professional operators from script kiddies playing dress-up. ...

If you’ve spent any time in offensive security communities, you’ve seen the debate: build a home lab vs spin up a VPS and call it a day. Both camps have loud advocates, and both camps are partially right. I’ve run dedicated home labs for years, and I’ve also done engagements and personal research entirely on cloud infrastructure. Neither is universally better. The right answer depends on what you’re trying to learn, your budget, your living situation, and — critically — your threat model for legal exposure. ...