Cloud Security AWS IAM Privilege Escalation Paths
Disclaimer: This article is provided strictly for educational purposes and authorized security testing. Only run these t...
Privilege Escalation
Cloud Security 
Cloud Security GCP Service Account Impersonation and Escalation
Disclaimer: This article is provided strictly for educational purposes and authorized security testing. Only run these t...
Containers & DevSecOps Kubernetes RBAC Abuse and Privilege Escalation
Disclaimer: This article is provided strictly for educational purposes and authorized security testing. Only run these t...
Containers & DevSecOps Container Escapes: Privileged Containers and Host Mounts
Disclaimer: This article is provided strictly for educational purposes and authorized security testing. Only run these t...
Linux Privesc systemd Security: Unit Sandboxing and Common Misconfigurations
Disclaimer: This article is provided strictly for educational purposes and authorized security testing. Only run these t...
Linux Privesc Ambient and Inheritable Linux Capabilities Explained
Disclaimer: This article is provided strictly for educational purposes and authorized security testing. Only run these t...
Malware & C2 COM Hijacking for Persistence and Privilege Escalation
Disclaimer: This article is provided strictly for educational purposes and authorized security testing. Only run these t...
Windows Privesc Windows Access Tokens Deep Dive: Integrity Levels and Privileges
Disclaimer: This article is provided strictly for educational purposes and authorized security testing. Only run these t...
Active Directory Active Directory Trust Attacks: SID History and Cross-Forest Escalation
Disclaimer: This article is provided strictly for educational purposes and authorized security testing. Only run these t...
Active Directory sAMAccountName Spoofing: noPac (CVE-2021-42278 / CVE-2021-42287)
Disclaimer: This article is provided strictly for educational purposes and authorized security testing. Only run these t...
Active Directory Abusing Unconstrained Delegation: From Printer Bug to Domain Compromise
How attackers abuse Kerberos Unconstrained Delegation to capture TGTs and pivot to Domain Admin, plus blue-team defenses.
Active Directory Abusing Kerberos Constrained Delegation: S4U2Self and S4U2Proxy
A practical walkthrough of abusing Kerberos Constrained Delegation via S4U2Self and S4U2Proxy to impersonate privileged users.
Active Directory Resource-Based Constrained Delegation (RBCD) Attack: From a Single Computer Account to Domain Compromise
A practical walkthrough of the Resource-Based Constrained Delegation attack, abusing msDS-AllowedToActOnBehalfOfOtherIdentity for privilege escalation.
Active Directory ADCS Attacks: A Practical Overview of ESC1 Through ESC8
A field guide to Active Directory Certificate Services attacks ESC1-ESC8, with Certipy commands and Blue Team defenses.
Active Directory Abusing Group Policy Objects for Privilege Escalation and Lateral Movement
How attackers weaponize editable Group Policy Objects with SharpGPOAbuse and GPP cpassword, plus blue-team detection and hardening.
Active Directory Abusing Active Directory DACLs: GenericAll, WriteDACL, and the Path to Domain Compromise
How attackers abuse GenericAll and WriteDACL ACEs in Active Directory, and how blue teams detect and prevent it.
Security Abusing Windows Token Privileges: The Potato Attack Family
How service accounts with SeImpersonatePrivilege escalate to SYSTEM via JuicyPotato, PrintSpoofer, and RoguePotato, plus blue-team defenses.
Windows Privesc Privilege Escalation via Unquoted Service Paths on Windows
How unquoted Windows service paths with spaces let low-privileged users plant a binary and escalate to SYSTEM, plus blue-team defenses.
Windows Privesc Weak Service Permissions: Privilege Escalation via SERVICE_CHANGE_CONFIG on Windows
Abuse misconfigured Windows service DACLs to rewrite binPath and escalate to SYSTEM, plus detection and hardening.
Security DLL Hijacking: Privilege Escalation and Persistence on Windows
How DLL search order hijacking and phantom DLLs lead to privilege escalation and persistence, plus Blue Team detection and defense.
Windows Privesc Abusing AlwaysInstallElevated for Windows Privilege Escalation
How a misconfigured AlwaysInstallElevated policy lets a low-privileged user run a malicious MSI as SYSTEM, plus detection and defense.
Windows Privesc UAC Bypass Techniques: A Practical Overview of Auto-Elevation Abuse
A practical tour of Windows UAC bypass techniques abusing auto-elevating binaries, registry hijacks, and UACME, plus blue-team defenses.
Windows Privesc Abusing Scheduled Tasks for Windows Persistence and Privilege Escalation
How attackers abuse writable task XML, schtasks, and Task Scheduler to persist and escalate on Windows, plus blue-team detection.
Windows Privesc Abusing Registry Autoruns for Windows Persistence and Privilege Escalation
How attackers abuse writable Run keys and other autorun locations for persistence and privesc, plus how blue teams detect it.
Windows Privesc Named Pipe Impersonation: How Windows getsystem Really Works
A deep dive into ImpersonateNamedPipeClient and how named pipe impersonation powers Meterpreter's getsystem.
Windows Privesc PrintNightmare: Abusing the Windows Print Spooler for Privilege Escalation and RCE
A practical walkthrough of CVE-2021-1675 and CVE-2021-34527 (PrintNightmare): abusing AddPrinterDriverEx for SYSTEM-level code execution, plus blue-team defenses.
Windows Privesc Practical Windows Enumeration with winPEAS
A hands-on guide to running winPEASx64 for Windows privilege escalation enumeration, with defensive countermeasures.
Windows Privesc Abusing SeBackupPrivilege and SeRestorePrivilege for Windows Privilege Escalation
How attackers abuse SeBackupPrivilege/SeRestorePrivilege to dump SAM, SYSTEM, and ntds.dit, plus blue-team detection and defense.
Linux Privesc Exploiting SUID/SGID Binaries for Linux Privilege Escalation
How attackers abuse SUID/SGID binaries to escalate to root on Linux, plus blue-team detection and hardening.
Linux Privesc Exploiting sudo Misconfigurations with GTFOBins
How attackers turn weak sudo rules, NOPASSWD, env_keep, and LD_PRELOAD into root — and how blue teams shut it down.
Linux Privesc Abusing Linux Capabilities for Privilege Escalation
How attackers abuse cap_setuid and cap_dac_read_search file capabilities to escalate to root, and how blue teams detect it.
Linux Privesc Privilege Escalation via Cron Job Abuse on Linux
Exploit writable cron scripts, weak PATH, and wildcard injection to escalate to root, plus blue-team detection and hardening.
Linux Privesc PATH Hijacking: Privilege Escalation via Writable PATH Directories and Relative Binaries
How attackers abuse relative paths and writable PATH directories to plant malicious binaries and escalate privileges on Linux.
Linux Privesc Abusing NFS no_root_squash for Local Privilege Escalation
How a misconfigured NFS export with no_root_squash lets a low-priv user plant a root SUID binary and escalate.
Linux Privesc Abusing a World-Writable /etc/passwd for Root
How a writable /etc/passwd or /etc/shadow leads to instant root, with PoC and Blue Team defenses.
Linux Privesc Kernel Exploits Deep Dive: Dirty COW and Dirty Pipe
A practical look at CVE-2016-5195 (Dirty COW) and CVE-2022-0847 (Dirty Pipe): how they work, PoCs, and defenses.
Linux Privesc Privilege Escalation via the Docker Group: From User to Root
How membership in the docker group is equivalent to root, with PoCs for volume mounts and privileged containers, plus detection.
Linux Privesc Abusing LD_PRELOAD and LD_LIBRARY_PATH for Linux Privilege Escalation
How attackers weaponize sudo env_keep with LD_PRELOAD/LD_LIBRARY_PATH to escalate to root, and how blue teams stop it.
Linux Privesc Wildcard Injection: Privilege Escalation via tar and rsync in Cron Jobs
Abuse shell wildcard expansion in tar and rsync backup jobs to inject arguments and escalate to root on Linux.
Linux Privesc Abusing systemd Services and Timers for Linux Privilege Escalation
How writable unit files, ExecStart hijacks, and timer abuse turn a foothold into root on systemd Linux hosts.