OSEP Checklist

Byaghanim

Last Updated on December 15, 2023 by aghanim

OSEP/osep_checklistv2.md at main · In3x0rabl3/OSEP · GitHub

Web Application:

  • Unrestricted File upload (ASPX)
  • SQL Injection
  • Server Side Template Injection
  • RFI
  • LFI
  • Web Service
  • BruteForce
  • CVE
  • Phishing
  • Code Exec
  • BAD PDF

MSSQL:

  • Linked Servers
  • Priv Esc
  • Enable Shell
  • Code Exec
  • Relay netv2 hash

Privilege Escalation:

Windows

  • PowerUP
  • LinPeas
  • Creds in Config Files
  • SEimpersonation (PrintSpoofer,Spooler,etc)
  • ShadowCopy
  • Hivenightmare
  • Mimikatz
  • UAC
  • MSSQL
  • Listening Services
  • Kernel

Linux

  • Shared Library
  • Sudo
  • Groups
  • Listening Services
  • Ansible (Unix)
  • lse / Linpeas
  • JFROG

Lateral Movement:

  • LAPS
  • Unconstrained Delegation
  • Constrained Delegation
  • Resource Based Constrained Delegation
  • MSSQL Linked Servers
  • Pass the Ticket
  • Tickets in /tmp
  • Pass The Hash
  • Relay The Hash
  • Crack the Hash
  • RDP / SharpRDP
  • Web Application
  • Fileless Lateral Movement
  • Mimikatz
  • Ligolo-ng/chisel/Proxychains / Autoroute / SSH (Port Fowarding)
  • Bloodhound/SharpHound[.exe/.ps1]
  • JFROG
  • KEYTAB (Kerberos)
  • SSH
  • Ansible
  • SPOOLSS
  • Reuse of passwords (.\administrator NOT domain\administrator)
  • adPeas.ps1

Similar Posts

  • THM – Burp suite – Part 11

    Byaghanim

    Last Updated on January 25, 2022 by aghanim Table Of ContentsIntro  Proxy Target Definition TASKS  Tasks Tasks Tasks Tasks  Intro   Burp Suite is a framework of web appliccation pentesting tool. It is used to perform web app testing.   To install burp suite follow this guide. https://portswigger.net/burp/documentation/desktop/getting-started  Overview of Features  Proxy – What allows us to funnel traffic through Burp Suite for further analysis  Target – How we set the scope of our project. We can also use this to effectively create a…

  • THM – OWASP Top 10 – Part 12

    Byaghanim

    Last Updated on January 25, 2022 by aghanim Table Of ContentsIntro [Severity 1] Injection[Severity 1] OS Command Injection[Severity 1] Command Injection Practical [Severity 2] Broken Authentication[Severity 2] Broken Authentication Practical [Severity 3] Sensitive Data exposure (Introduction) [Severity 3] Sensitive Data exposure (Supporting material 1)  [Severity 3] Sensitive Data exposure (Supporting material 2) [Severity 3] Sensitive Data exposure (Challenge)[Severity 4] XML External…

  • THM – What the Shell – Part 19

    Byaghanim

    Last Updated on September 5, 2022 by aghanim This is a continued series where I document my path through different tryhackme courses. I recommend everyone that wants to learn cyber security to subscribe to tryhackme.com and take the courses there. Table Of ContentsWhat is a shell?ToolsTypes of ShellNetcatNetcat shell stabilizationSocatSocat encrypted shellsCommon shell payloadsMsfvenomMetasploit multi/handlerWebShells…

  • AV Evasion 101: Essential Techniques and Concepts

    Byaghanim

    Last Updated on December 11, 2023 by aghanim Table Of ContentsSourceGood toolsMalware forums/channels/discordTest payload against AVDefcon – Writing custom backdoor payloads with C#Step by Step for obfuscating codeAV Evasion MindMap – From Start to finishGeneral AV Evasion cheatsheetCheck AV – Running, Exclusion, DisableWindows FirewallPowershell – ASMI bypass methods, Disable AV, etcAMSI BypassBypass CLM (Constrained Language…

  • THM – Walking An Application – Part 3

    Byaghanim

    Last Updated on January 25, 2022 by aghanim This is my notes from the Junior Pentesting course at TryHackMe. This course takes you through the basics and some advanced topics regarding penetration testing. Table Of ContentsIntroductionExploring The WebsiteViewing the Page SourceHow do I view the Page Source?Let’s view some Page Source!Developer Tools – InspectorDeveloper ToolsInspectorDeveloper…

  • Handbook V – Maldev

    Byaghanim

    Last Updated on October 16, 2025 by aghanim Work in Progress Table Of ContentsCoursesSourcesx86 & x64 Assembler and DisassemblerCallback function listExample: Using  ​CertEnumSystemStore​ Convert raw shellcode to raw binary formatEDR TelematryEDR Telematry v2Entropy reductionHijackLibsJoesandbox – Malware AnalysisMalapi.ioNo-defenderNtDoc – The native NT API online documentationParasite-invokeReverse engineering of everything MicrosoftVergilius projectUnprotect.itEvasion techniquesWindows Icons Courses SEKTOR7 Institute https://maldevacademy.com/ EvasionEDR…