A comprehensive offensive security knowledge base — from initial foothold to full domain compromise.
B00t2R00t is a curated encyclopedia of penetration testing and red teaming techniques, methodologies, tools, and ready-to-use scripts. Spanning Active Directory, Cloud, Web, Network, Wireless, and Red Team operations, it's organized around the real attacker kill chain: Enumerate → Exploit → Escalate → Persist.
⚠️ Disclaimer: This material is provided strictly for authorized security testing, research, and education. Only use these techniques on systems you own or have explicit written permission to test. The author assumes no liability for misuse. Unauthorized access to computer systems is illegal.
- New to a target type? Start in
Methodology/— it's the high-level playbook for what to do and in what order. - Need a specific technique? Jump straight to the relevant domain folder below.
- Looking for a tool's syntax? Head to
Tools/— usage docs are separated from techniques on purpose. - On an engagement? Use the methodology as your checklist, then drill into the technique pages as needed.
| Section | What's Inside |
|---|---|
| 🗺️ Methodology | Step-by-step playbooks for each target type |
| 🏰 Active Directory | Enumeration, exploitation, Kerberos, ADCS, trusts, persistence |
| ☁️ Cloud | AWS, Azure, GCP, Kubernetes |
| 🌐 Web Applications | OWASP-style attacks, injection, auth bypasses, WAF evasion |
| 🔌 Network Services | Protocol-by-protocol attack references |
| 📡 Wireless | WEP/WPA/WPS attacks, sniffing, MITM |
| 🎭 Red Teaming | Evasion, C2, payloads, phishing, exfiltration |
| ⬆️ Privilege Escalation | Linux, Windows, and Docker escapes |
| 🔀 Pivoting | Tunneling, port forwarding, lateral movement |
| 🐛 CVEs | Notable exploits and write-ups |
| 🤖 AI Pentesting | Prompt injection, jailbreaks, model attacks |
| 🛠️ Tools | Usage docs for the offensive toolkit |
| 🧩 Miscellaneous | File transfers, shells, wordlists, neat tricks |
The playbook layer — start here to understand the flow of an engagement before diving into specific techniques.
- Reconnaissance · Enumeration · Public Exploit Search
- Active Directory — No Creds / One Credential / Valid Credentials paths
- Cloud — AWS, Azure, GCP, Containers
- Privilege Escalation — Linux & Windows
- Web Applications — full web attack workflow
- Protocols — per-service approach (DNS, SMB, SSH, SQL, etc.)
- Lateral Movement · Network Pivoting · Password Cracking
The most extensive section — a complete AD attack lifecycle.
| Phase | Topics |
|---|---|
| Enumeration | No Credentials · Valid Credentials · Username Only |
| Exploitation | Kerberos · GPO · Known Vulns · ACL/ACE |
| ADCS | Certificate Services attacks — ESC1–ESC10, theft, persistence, mindmaps |
| Kerberos Delegation | Unconstrained / Constrained / RBCD |
| Lateral Movement | PtH, PtT, Pass-the-Cert, WinRM, WMI, more |
| MITM & Relay | NTLM Relay, Responder, coercion attacks |
| Privilege Escalation | DACL attacks, dangerous groups, LAPS, more |
| Persistence | Golden/Silver/Diamond tickets, DCShadow, Skeleton Key, more |
| Trust Relationships | Cross-domain & cross-forest compromise |
| Domain Admin Access | NTDS dumping, DPAPI backup keys |
| Mitigations | Defensive guidance & Event IDs |
Provider-by-provider attack references, each following enum → exploit → privesc → persistence.
- AWS — IAM, EC2, S3, Lambda, EKS, RDS, Secrets Manager, and more
- Azure — Entra ID, managed identities, Key Vaults, app services, abuse paths
- Google Cloud (GCP) — IAM fuzzing, metadata SSRF, privilege escalation
- Kubernetes — cluster recon, node escapes, secrets
- Cross-Platform — Cloudfox, Trufflehog, and multi-cloud tooling
Comprehensive coverage of web attacks:
- Injection: SQLi · Command Injection · SSTI · XXE · NoSQL/LDAP/XPath/ORM
- Client-side: XSS · CSRF · Prototype Pollution
- Server-side: SSRF · LFI/RFI · RCE · Deserialization
- Auth & Tokens: JWT · OAuth · MFA bypass
- Bypasses: WAF evasion · filter bypasses · 403 bypass
- Modern: HTTP Request Smuggling · GraphQL · Browser Desync
A protocol-by-protocol attack library covering: SMB, LDAP, SSH, FTP, RDP, SNMP, SMTP, MSSQL, MySQL, PostgreSQL, MongoDB, Redis, NFS, RPC, IPMI, VNC, VoIP, Java RMI/JDWP, gRPC, WebDAV, and more — plus CI/CD tooling and database navigation.
Full wireless attack coverage: WEP cracking, WPA2-PSK, PMKID, WPS PIN/Pixie Dust, deauth & fake-auth, packet injection/sniffing, MITM, DNS spoofing, and traffic decryption.
End-to-end adversary simulation tradecraft:
- Evasion Techniques — AMSI bypass, AV/EDR evasion, and a deep AV/EDR Architecture breakdown
- Command & Control · Data Exfiltration (DNS / ICMP / HTTPS / TCP)
- Advanced Techniques — process injection, hollowing, HTA/JScript
- Payloads · Stagers · Shellcode Runners
- Spearphishing — macros, OLE/LNK, XLL, device-code phishing
- LOLBins · Offensive PowerShell · Password Attacks
- Linux — SUID, capabilities, cron, kernel exploits, sudo abuse, and dozens more
- Windows — service misconfigs, potato exploits, DLL hijacking, token abuse, UAC bypass
- Docker Escapes — privileged containers, exposed daemons, namespace abuse
Tunneling and lateral movement: Chisel, Ligolo-ng, SSH tunneling, Proxychains, DNS/HTTP/ICMP tunneling, double pivots, and ready-to-go scripts.
Curated exploit write-ups: Zerologon, noPAC, PrintNightmare, ProxyShell, Certifried, PetitPotam, Log4j, and more.
- AI Penetration Testing — prompt injection, jailbreaking, model inversion, guardrail bypass
- Exploit Development — buffer overflows, race conditions, reverse engineering
- Data Lake Pentesting — Hadoop, HDFS, Kerberos keytabs
- Bug Bounty Hunting — recon automation & workflow
Usage references for the offensive toolkit, grouped by purpose:
- Active Directory — Impacket, NetExec, BloodHound, Mimikatz, Rubeus, Responder, Certipy, and more
- C2 Frameworks — Cobalt Strike (in depth), Sliver, PowerShell Empire
- Enumeration · Network Scanners · Fuzzers
- Password Crackers — Hashcat, John, Hydra, Medusa
- Phishing Campaigns — Evilginx + phishlets
- Web Applications · Exploitation Frameworks · Wireless · AV Evasion
Handy operational references: file transfer methods (Linux & Windows), reverse shells, shell stabilization, credential harvesting, wordlist creation, and a big bag of neat tricks.
Contributions, corrections, and additions are welcome! Feel free to open an issue or submit a pull request.
See LICENSE.md for details.
⭐ If you find this useful, consider starring the repo! ⭐
Built and maintained by H3llKa1ser
For educational and authorized testing purposes only.