Individual skill
system
System exploitation testing - Active Directory attacks, privilege escalation (Linux/Windows), and exploit development.
skills/system/SKILL.md
Source commit 95fdc128af4ca1ae16b3226f9430f1bad97b0656
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- Yes
- Observed behavior
- Network or broad shell
- Last checked
- Nov 10, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 613
- Repository last updated
- Jul 29, 2026
- License
- MIT
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- bounty-hunters Repository topic
- hackerone Repository topic
- pentest Repository topic
- pentest-tool Repository topic
- security Repository topic
- security-research Repository topic
- security-tools Repository topic
- testing Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 1,318 bytesreference/INDEX.mddoc · 17,477 bytesreference/foothold-patterns.mddoc · 12,247 bytesreference/format-string-exploitation.mddoc · 3,320 bytesreference/heap-exploitation.mddoc · 7,330 bytesreference/scenarios/ad/acl-abuse-chains.mddoc · 15,421 bytesreference/scenarios/ad/adcs-esc1.mddoc · 3,234 bytesreference/scenarios/ad/adcs-esc15.mddoc · 6,571 bytesreference/scenarios/ad/adcs-esc16.mddoc · 2,086 bytesreference/scenarios/ad/adcs-esc3.mddoc · 2,866 bytesreference/scenarios/ad/adcs-esc4.mddoc · 2,488 bytesreference/scenarios/ad/adcs-esc6.mddoc · 2,291 bytesreference/scenarios/ad/adcs-esc7.mddoc · 2,930 bytesreference/scenarios/ad/adcs-esc8-kerb-relay.mddoc · 4,555 bytesreference/scenarios/ad/adfs-golden-saml.mddoc · 3,932 bytesreference/scenarios/ad/as-rep-roast.mddoc · 2,383 bytesreference/scenarios/ad/badsuccessor-dmsa.mddoc · 5,308 bytesreference/scenarios/ad/certipy-ldap-shell-fallback.mddoc · 4,670 bytesreference/scenarios/ad/constrained-delegation.mddoc · 4,576 bytesreference/scenarios/ad/cross-forest-trust.mddoc · 6,355 bytesreference/scenarios/ad/cross-session-ntlm-relay.mddoc · 5,746 bytesreference/scenarios/ad/dcsync.mddoc · 3,472 bytesreference/scenarios/ad/dns-record-poisoning.mddoc · 2,553 bytesreference/scenarios/ad/gmsa.mddoc · 6,234 bytesreference/scenarios/ad/golden-ticket.mddoc · 1,617 bytesreference/scenarios/ad/kerberoast.mddoc · 1,496 bytesreference/scenarios/ad/kerberos-only-domain.mddoc · 12,338 bytesreference/scenarios/ad/kpasswd-expired-password-reset.mddoc · 4,735 bytesreference/scenarios/ad/lansweeper-cred-mapping-honeypot.mddoc · 6,317 bytesreference/scenarios/ad/laps-readers.mddoc · 3,185 bytesreference/scenarios/ad/ldap-simple-bind-capture.mddoc · 5,764 bytesreference/scenarios/ad/ldap-via-gc-when-389-filtered.mddoc · 4,334 bytesreference/scenarios/ad/ntlm-relay.mddoc · 2,676 bytesreference/scenarios/ad/openssh-key-drop-via-smb-home.mddoc · 2,929 bytesreference/scenarios/ad/pass-the-hash.mddoc · 1,718 bytesreference/scenarios/ad/pass-the-ticket-impacket.mddoc · 2,709 bytesreference/scenarios/ad/pkinit.mddoc · 2,569 bytesreference/scenarios/ad/pre-windows-2000-access.mddoc · 3,673 bytesreference/scenarios/ad/protected-users-bypass.mddoc · 2,390 bytesreference/scenarios/ad/rbcd.mddoc · 4,018 bytesreference/scenarios/ad/rodc-exploitation.mddoc · 6,702 bytesreference/scenarios/ad/shadow-credentials.mddoc · 2,451 bytesreference/scenarios/ad/silver-ticket.mddoc · 2,767 bytesreference/scenarios/ad/spn-less-rbcd-nthash-trick.mddoc · 7,882 bytesreference/scenarios/ad/unconstrained-delegation.mddoc · 6,769 bytesreference/scenarios/ad/wim-image-credential-extraction.mddoc · 3,799 bytesreference/scenarios/ad/wsus-mitm.mddoc · 2,922 bytesreference/scenarios/dtv-poisoning-via-worker-uaf.mddoc · 5,727 bytesreference/scenarios/foothold-access-db-vba.mddoc · 6,653 bytesreference/scenarios/fsop-house-of-apple-2-vfprintf-flag-mods.mddoc · 4,595 bytesreference/scenarios/glibc-tcache-info-leak-via-small-chunk-overlap.mddoc · 4,510 bytesreference/scenarios/house-of-botcake-glibc-237-safe-linking-bypass.mddoc · 7,335 bytesreference/scenarios/linux-privesc/apparmor-hat-bypass.mddoc · 2,948 bytesreference/scenarios/linux-privesc/asterisk-runuser-respawn-root.mddoc · 3,404 bytesreference/scenarios/linux-privesc/baron-samedit.mddoc · 1,741 bytesreference/scenarios/linux-privesc/binfmt-misc-suid-laundering.mddoc · 2,964 bytesreference/scenarios/linux-privesc/buffer-overflow.mddoc · 3,518 bytesreference/scenarios/linux-privesc/cap-dac-override.mddoc · 4,125 bytesreference/scenarios/linux-privesc/clamav-debug-xxe.mddoc · 4,044 bytesreference/scenarios/linux-privesc/credential-files-hunt.mddoc · 4,520 bytesreference/scenarios/linux-privesc/docker-escape.mddoc · 5,484 bytesreference/scenarios/linux-privesc/fail2ban-action-hijack.mddoc · 4,344 bytesreference/scenarios/linux-privesc/info-zip-symlink-follow.mddoc · 3,122 bytesreference/scenarios/linux-privesc/jenkins-anon-script-console.mddoc · 4,305 bytesreference/scenarios/linux-privesc/log-and-tmux-credential-reuse.mddoc · 9,194 bytesreference/scenarios/linux-privesc/lxd-privesc.mddoc · 3,558 bytesreference/scenarios/linux-privesc/nifi-anon-rest-rce.mddoc · 6,099 bytesreference/scenarios/linux-privesc/nodejs-inspector-abuse.mddoc · 4,513 bytesreference/scenarios/linux-privesc/polkit-race.mddoc · 2,219 bytesreference/scenarios/linux-privesc/postgres-tablespace-symlink-zip.mddoc · 5,453 bytesreference/scenarios/linux-privesc/pwnkit.mddoc · 5,522 bytesreference/scenarios/linux-privesc/pycache-poisoning.mddoc · 3,114 bytesreference/scenarios/linux-privesc/rbash-escape.mddoc · 2,211 bytesreference/scenarios/linux-privesc/snap-confine-race.mddoc · 2,633 bytesreference/scenarios/linux-privesc/ssh-ca-forgery.mddoc · 1,918 bytesreference/scenarios/linux-privesc/ssh-controlmaster-hijack.mddoc · 1,866 bytesreference/scenarios/linux-privesc/sudo-cve-2025-32463-chwoot.mddoc · 4,686 bytesreference/scenarios/linux-privesc/sudo-git-apply-symlink.mddoc · 3,586 bytesreference/scenarios/linux-privesc/sudo-python-sitedir-pth.mddoc · 2,716 bytesreference/scenarios/linux-privesc/sudo-symlink.mddoc · 10,043 bytesreference/scenarios/linux-privesc/suid-binary-exploitation.mddoc · 7,682 bytesreference/scenarios/linux-privesc/toctou-cron-md5-symlink-flip.mddoc · 5,308 bytesreference/scenarios/linux-privesc/udisks2-polkit.mddoc · 3,060 bytesreference/scenarios/linux-privesc/vault-otp-ssh-role.mddoc · 3,706 bytesreference/scenarios/linux-privesc/wcf-soap-localhost.mddoc · 2,052 bytesreference/scenarios/linux-privesc/webmin-packageup-rce.mddoc · 4,507 bytesreference/scenarios/mssql/errorlog-secrets.mddoc · 1,690 bytesreference/scenarios/mssql/linked-server-chain.mddoc · 5,974 bytesreference/scenarios/mssql/xp-cmdshell.mddoc · 4,916 bytesreference/scenarios/mssql/xp-dirtree-coercion.mddoc · 2,156 bytesreference/scenarios/oob-write-via-state-power-index.mddoc · 6,517 bytesreference/scenarios/qsort-r-multi-resort-table-shift.mddoc · 40,214 bytesreference/scenarios/windows-privesc/autoadminlogon.mddoc · 2,664 bytesreference/scenarios/windows-privesc/dll-hijacking.mddoc · 1,561 bytesreference/scenarios/windows-privesc/dpapi-browser-creds.mddoc · 3,342 bytesreference/scenarios/windows-privesc/file-transfer-ssh-pty.mddoc · 1,538 bytesreference/scenarios/windows-privesc/forgotten-backup-zip.mddoc · 2,358 bytesreference/scenarios/windows-privesc/iis-log-credentials.mddoc · 2,024 bytesreference/scenarios/windows-privesc/kernel-eop.mddoc · 5,507 bytesreference/scenarios/windows-privesc/kiosk-and-applocker-escape.mddoc · 11,064 bytesreference/scenarios/windows-privesc/memory-dump-creds.mddoc · 2,469 bytesreference/scenarios/windows-privesc/msi-repair-toctou.mddoc · 1,700 bytesreference/scenarios/windows-privesc/multi-user-flag-sweep.mddoc · 2,226 bytesreference/scenarios/windows-privesc/perflib-dll-hijack.mddoc · 5,861 bytesreference/scenarios/windows-privesc/potatoes-sanity-check.mddoc · 7,791 bytesreference/scenarios/windows-privesc/printnightmare.mddoc · 1,412 bytesreference/scenarios/windows-privesc/psreadline-history.mddoc · 2,584 bytesreference/scenarios/windows-privesc/scheduled-task-zip-poll.mddoc · 1,594 bytesreference/scenarios/windows-privesc/sebackuprivilege.mddoc · 3,528 bytesreference/scenarios/windows-privesc/seh-overflow-static-binary.mddoc · 5,745 bytesreference/scenarios/windows-privesc/server-operators-imagepath.mddoc · 4,081 bytesreference/scenarios/windows-privesc/service-required-privileges.mddoc · 2,667 bytesreference/scenarios/windows-privesc/unquoted-service-path.mddoc · 1,519 bytesreference/scenarios/windows-privesc/wcf-named-pipe.mddoc · 1,794 bytesreference/scenarios/windows-privesc/writable-service-binary-race.mddoc · 8,144 bytesreference/system-exploitation-principles.mddoc · 7,898 bytes
Read excerpt
# System
Test system-level security including Active Directory, privilege escalation, and exploit development.
## Techniques
| Type | Key Vectors |
|------|-------------|
| **Active Directory** | Kerberoasting, AS-REP roasting, DCSync, PtH, Golden/RODC Ticket, RBCD, ACL abuse, KeyList, Shadow Credentials, ADCS (ESC1-9/16) |
| **Privilege Escalation** | SUID/sudo abuse, kernel exploits, service misconfig, token manipulation |
| **Exploit Development** | Buffer overflow, format string, ROP chains, shellcode, heap exploitation |
## Workflow