Guides

SQL injection has been on the OWASP Top 10 since the list started. In 2026, it still breaks real systems. Poorly sanitized inputs, legacy codebases, ORM misconfigurations — the attack surface hasn’t gone away. If anything, the rise of AI-generated code has introduced new classes of injection bugs. This guide covers everything: how SQLi works, how to detect it, how to exploit it across all major categories, how to weaponize SQLMap, and how to bypass WAFs when they’re in the way. ...

Web application pentesting is where most red teamers spend the majority of their billable hours. It’s also where a huge chunk of real-world breaches happen — not through exotic exploits, but through the same OWASP Top 10 vulnerabilities that have existed for decades. This guide covers the full methodology: reconnaissance, mapping the attack surface, exploiting common vulnerabilities, and reporting findings. Whether you’re doing your first web pentest or sharpening your methodology for bug bounty, this is the process. ...

OSINT is where red team engagements actually begin. Not when you fire up Metasploit. Not when you scan the first subnet. Before any of that — you do recon. You learn everything you can without touching the target. Done right, OSINT tells you where the doors are before you ever try to open one. This guide covers the full methodology: what to collect, which tools to use, how to stay invisible while doing it, and how to turn raw intelligence into an attack plan. ...

A red team report is the only thing that survives the engagement. The access you got, the shells you dropped, the domain admin you owned — none of it matters if the report doesn’t communicate it clearly to the people who need to act on it. Most red team reports fail in one of two ways: they’re written for other red teamers (and executives ignore them), or they’re dumbed down for executives (and the technical team can’t remediate). A good report speaks to both audiences at once. ...

If your C2 server IP ends up in a threat intel feed, your engagement is over. Redirectors exist to prevent exactly that. A redirector sits between your operator machine and your implant. The implant only ever talks to the redirector. Your actual C2 — Sliver, Havoc, Cobalt Strike — sits behind it, invisible. If the blue team burns the redirector, you spin up another one in ten minutes. The C2 keeps running. ...

Once you have credentials or a shell on one host, the real game begins: moving through the network without getting caught. Lateral movement in Active Directory is where most engagements are won or lost. This is the full playbook. Every technique. The tools, the commands, the detection notes, and the OPSEC considerations that separate a successful engagement from a blocked one. What Is Lateral Movement in AD? Lateral movement is the process of using access on one system to gain access to others. In an Active Directory environment, this is especially powerful because credentials, tickets, and tokens are often reusable across the domain. ...

What Is a DCSync Attack? DCSync is a credential dumping technique that abuses Active Directory’s replication mechanism. Instead of running code on a Domain Controller, an attacker with the right privileges impersonates a Domain Controller and requests password data directly from another DC using the MS-DRSR (Directory Replication Service Remote Protocol). The result: you get NTLM hashes, Kerberos keys, and plaintext passwords (in some configurations) for any account in the domain — including krbtgt and Domain Admins — without ever touching LSASS on a DC. ...

Active Directory credential attacks come in two flavors that confuse people constantly: Pass-the-Hash (PtH) and Pass-the-Ticket (PtT). Both let you authenticate as another user without knowing their plaintext password. But they work on completely different protocols, hit different defenses, and fail in different ways. This guide covers how each attack actually works under the hood, when to reach for one vs the other, how defenders detect them, and how red teamers stay ahead of detection. ...

Kerberoasting is one of the most reliable privilege escalation techniques in Active Directory environments. It’s quiet, requires no special privileges to execute, and often yields domain admin within hours — because organizations routinely set weak passwords on service accounts and never rotate them. This guide covers everything: how Kerberos works, why the attack is possible, what you need to execute it, and how defenders detect it. What Is Kerberoasting? Kerberoasting targets service accounts in Active Directory that have a Service Principal Name (SPN) set. Any authenticated domain user can request a Kerberos Ticket Granting Service (TGS) ticket for any SPN — and those tickets are encrypted with the service account’s NTLM hash. ...

BloodHound is the closest thing to a cheat code for Active Directory pentesting. Feed it your domain data and it draws a map of every path from regular user to Domain Admin — paths that would take you days to find manually. This guide covers everything: installation, data collection with SharpHound, running Cypher queries, and using the attack paths you find to actually escalate privileges. What BloodHound Does (and Why It Matters) Active Directory environments are complex. Thousands of users, hundreds of groups, nested permissions, ACL misconfigurations, Kerberos delegation settings — no human can reason about all of it manually. ...