OFFENSIVE SECURITY
Offensive Security is the practice of simulating real-world cyberattacks to identify and exploit
vulnerabilities in systems, networks, or applications for the purpose of improving overall
security.
Below is the list of offensive techniques which need to be curated as per the needs of our labs.
System Hacking
1) Password Cracking – Windows SAM Extraction
a. Extract and crack local Windows user password hashes from the SAM database
2) Scanning & Enumeration
a. Discover live hosts, open ports, and running services using tools like nmap.
3) Pass-the-Hash Attack
a. Authenticate to systems using stolen NTLM hash instead of plaintext password.
4) Vulnerability Scanning with Nessus/OpenVAS
a. Scan target systems for known vulnerabilities and misconfigurations.
5) Exploitation Using Metasploit Framework
a. Exploit known vulnerabilities using Metasploit to gain access to target systems.
6) Man-in-the-Middle (MITM) Attack
a. Intercept and manipulate network traffic between two devices on the same
network.
7) Bind Shells
a. Open a command shell on the target that listens for an incoming connection.
8) Reverse Shells
a. Initiate a connection from the target back to the attacker’s machine.
9) DLL Hijacking
a. Replace a legitimate DLL with a malicious one to execute code when a program
runs.
10) Scheduled Task Persistence
a. Create a scheduled task to maintain access after system reboot.
11) Registry Run Key Persistence
a. Add a registry entry to ensure malware or payload runs at system startup.
12) Privilege Escalation – Linux
a. Exploit system misconfigurations to elevate privileges to root on Linux systems.
13) Post-Exploitation with Meterpreter
a. Use Metasploit's Meterpreter for advanced post-exploitation tasks.
14) Token Impersonation
a. Steal and use access tokens to impersonate privileged users.
15) UAC Bypass
a. Bypass User Account Control to run commands with elevated privileges.
16) Windows Rootkit Installation
a. Install kernel-level malware to hide processes, files, and connections.
17) Linux Rootkit Installation
a. Load kernel modules to hide malicious activity on Linux systems.
18) Buffer Overflow Exploitation
a. Overwrite memory buffers to execute arbitrary code and gain control.
19) Service Misconfiguration Abuse
a. Exploit poorly configured services to escalate privileges or gain access.
20) Linux Capabilities Abuse
a. Exploit extended file capabilities for privilege escalation on Linux.
21) Reverse Shell Post-Exploitation
a. Maintain access and perform reconnaissance after gaining initial foothold.
Network Hacking
1. ARP Spoofing / MITM Attack
2. MAC Flooding Attack
3. VLAN Hopping
4. STP Manipulation (Spanning Tree Protocol)
5. DHCP Starvation & Rogue DHCP Server
6. DNS Spoofing / Cache Poisoning
7. DNS / ICMP Tunneling
8. TCP Session Hijacking
9. TCP/UDP/ICMP Flood (DoS Attack)
10. Man-in-the-Middle (MITM) using BetterCAP
11. Wireless Deauthentication Attack
12. BGP Route Injection (Route Hijacking)
Web Application Security
1) SQL Injection (Manual & Automated)
2) Cross-Site Scripting (XSS) – Reflected and Stored
3) Command Injection in Web Apps
4) File Inclusion Vulnerabilities (LFI/RFI)
5) Directory Traversal and Path Manipulation
6) IDOR (Insecure Direct Object Reference)
7) CSRF (Cross-Site Request Forgery)
8) Session Hijacking and Fixation
9) JWT Token Tampering
10) OAuth Misconfiguration Exploitation
Active Directory (AD) Exploitation
1) Pass-the-Hash (PtH) Attack
2) Golden Ticket Attack
3) Silver Ticket Attack
4) Kerberoasting
5) AS-REP Roasting
6) Exploiting Weak Group Policy Preferences (GPP)
7) NTLM Relay Attack
8) LDAP Enumeration & Privilege Escalation
IoT Security
1. Extracting Firmware from an IoT Device
2. Firmware Emulation with Firmadyne
3. Reverse Engineering Firmware with Ghidra
4. Finding Hardcoded Credentials in Firmware
5. Bluetooth Sniffing and Pairing Hijacking
6. Wi-Fi Pineapple Rogue Access Point Attack
7. Zigbee Packet Sniffing and Injection
8. Radio Reception with RTL-SDR
9. Spectrum Scanning and Signal Identification
10. Wireless Communication Exploitation
