- `aureport`can be used for `audit.log` - take time on web portions to narrow down vuln types - try manual SQLi before using `sqlmap` - perform fuzzing with common extensions `.php`, `.txt`, `.bak` - look out for odd HTTP headers and Google them - logins that tell us "Invalid Credentials!" or the like may be welcoming us to brute force as we know the rejection message semantics - If we run into a file upload with a blacklist, closely consider using revshells and the like with less questionable characters like `&`, `/`, `|`, `;`, etc. - NOTE: `socat` is a relatively clean revshell that can be used in place of `nc` if available on target host - If we are able to submit a ticket or other form and the resultant message is "we will review and get back to you later", assume that it will be clicked on - If the target is Windows, we maybe be able to leak an NTLMv2 hash - If the target is Linus or Windows, we may be able to steal a cookie for session hijacking purposes - `nc` works well for pushing files from target to Kali - once we have `nt authority\system` on a host, run `inveigh.exe` - manually enum `c:\Program Files` and `c:\Program Files (x86)` > `winpeas` only enums `c:\Program Files` - look for non-default programs and enum their ACLs ![[images/IMG_7642.jpeg]]