xalgord.

abusing-hop-by-hop-headers

Testing proxies, load balancers, and CDNs for improper handling of HTTP hop-by-hop headers, where an

analyzing-macos-persistence-and-autostart

Enumerating, planting, and hunting macOS persistence and auto-start (ASEP) locations during authorized

api-discovery

API endpoint discovery including OpenAPI/Swagger detection, hidden versioning, REST/GraphQL enumeration, and content negotiation

bypassing-binary-exploitation-mitigations

Methodology for identifying and defeating common binary hardening mitigations during authorized exploitation —

bypassing-captcha-protections

Identifying weaknesses in CAPTCHA implementations and bypassing them via replay, field removal,

bypassing-macos-gatekeeper-tcc-and-sip

Assessing and bypassing macOS userland and platform security controls during authorized engagements -

bypassing-restricted-shells

Escaping restricted shells (rbash, rksh, lshell), chroot jails, and language sandboxes (Lua, Python)

bypassing-two-factor-and-otp

Identifying and exploiting flaws in two-factor authentication and one-time password verification

deep

Exhaustive security assessment with maximum coverage, depth, and vulnerability chaining

exploiting-ai-model-file-rce

Testing machine-learning model files and model-loading services for remote code execution caused by insecure

exploiting-arbitrary-write-to-execution

Methodology for converting an arbitrary-write (write-what-where) or write-anything-anywhere primitive into

exploiting-client-side-path-traversal

Exploiting Client-Side Path Traversal (CSPT, also known as On-Site Request Forgery) where attacker-controlled

exploiting-client-side-template-injection

Exploiting Client-Side Template Injection (CSTI) where a frontend framework (AngularJS, Vue, Mavo, Alpine.js)

exploiting-container-escapes

Escaping Docker/containerd containers to the host during authorized engagements via privileged-container

exploiting-cookie-based-vulnerabilities

Testing and exploiting cookie-related weaknesses including attribute misconfiguration (SameSite, HttpOnly,

exploiting-cross-site-script-inclusion-xssi

Identifying and exploiting Cross-Site Script Inclusion (XSSI), where the script tag's exemption from the

exploiting-csv-formula-injection

Identifying and exploiting CSV/Excel formula (DDE) injection in import and export features where

exploiting-dangling-markup-injection

Exploiting dangling markup / scriptless HTML injection to exfiltrate clear-text secrets, steal form data,

exploiting-dbus-and-socket-command-injection

Enumerating the D-Bus system bus and abusing root-exposed methods, policy and Polkit misconfigurations, and

exploiting-dependency-confusion

Identifying and exploiting dependency confusion (substitution) attacks where a package manager resolves an

exploiting-file-upload-vulnerabilities

Identifying and exploiting insecure file upload functionality to achieve remote code execution, stored XSS, path traversal, and denial of service during authorized penetration tests.

exploiting-format-string-vulnerabilities

Methodology for exploiting format string bugs where attacker-controlled data reaches the format argument of

exploiting-glibc-heap-vulnerabilities

Methodology for exploiting glibc ptmalloc2 heap vulnerabilities during authorized engagements — use-after-free,

exploiting-integer-overflow-vulnerabilities

Methodology for finding and exploiting integer overflow, underflow, truncation, and signedness bugs in native

exploiting-ldap-injection

Exploiting LDAP injection where web applications build LDAP search filters from unsanitized user input,

exploiting-linux-capabilities

Enumerating and abusing Linux capabilities (file and process) for local privilege escalation and container

exploiting-linux-kernel-vulnerabilities

Methodology for discovering and exploiting Linux kernel memory-corruption vulnerabilities (UAF, OOB read/write,

exploiting-macos-dyld-hijacking-and-process-injection

Exploiting macOS dynamic-linker and process-injection primitives during authorized engagements - DYLD_INSERT_LIBRARIES injection, @rpath/missing-dylib hijacking with re-export proxy libraries, dyld interposing and fishhook symbol rebinding, Objective-C method swizzling, and Mach task-port thread hijacking (task_for_pid) including arm64e PAC handling - using otool, codesign, install_name_tool, gcc/clang, and lldb, with EndpointSecurity detection notes.

exploiting-orm-injection

Exploiting ORM injection (ORM Leak) where applications pass attacker-controlled keys/operators directly into

exploiting-os-command-injection

Identifying and exploiting OS command injection vulnerabilities in web

exploiting-postmessage-vulnerabilities

Exploiting insecure cross-window messaging where senders use a wildcard targetOrigin (leaking sensitive

exploiting-reverse-tab-nabbing

Identifying and exploiting reverse tabnabbing, where a link opened with target="_blank" without

exploiting-saml-authentication-flaws

Identifying and exploiting SAML SSO weaknesses including XML Signature Wrapping (XSW1-8), comment

exploiting-server-side-includes-esi-injection

Exploiting Server-Side Includes (SSI) and Edge-Side Includes (ESI) injection where unsanitized input is

exploiting-stack-buffer-overflows

Methodology for discovering and exploiting stack-based buffer overflows in native binaries during authorized

exploiting-subdomain-takeover-vulnerabilities

Identifying and exploiting dangling DNS records pointing to unclaimed cloud services, enabling subdomain takeover for phishing, cookie stealing, and authentication bypass during authorized penetration tests.

exploiting-sudo-suid-and-cron-misconfigurations

Local privilege escalation through sudo rule abuse (GTFOBins, SETENV/LD_PRELOAD/BASH_ENV/PYTHONPATH),

exploiting-xpath-injection

Exploiting XPath injection where applications build XPath/XQuery expressions from unsanitized user input to

exploiting-xslt-server-side-injection

Exploiting server-side XSLT injection where an application transforms XML with attacker-influenced

javascript-analysis

JavaScript file analysis for API endpoint extraction, hardcoded secrets, DOM source-sink mapping, and source map exploitation

pentesting-ajp

Testing Apache JServ Protocol (AJP13) connectors (default 8009/TCP) for the Ghostcat LFI/RCE vulnerability (CVE-2020-1938), trusted-request-attribute abuse, AJP secret brute forcing, and reaching the Tomcat Manager via an nginx/Apache AJP proxy during authorized engagements.

pentesting-couchdb

Testing Apache CouchDB document databases (default HTTP port 5984, HTTPS 6984) for unauthenticated/admin-party access, database dumping over the REST API, default/weak credentials, the CVE-2017-12635 privilege-escalation admin-creation bug and CVE-2017-12636/CVE-2018-8007 remote-code-execution paths, plus Erlang EPMD cookie abuse during authorized engagements.

pentesting-dns

Testing DNS services (default 53/TCP+UDP, 5353/UDP mDNS) for zone transfers (AXFR), version/banner disclosure, subdomain and reverse-lookup enumeration, open recursion/amplification, DNSSEC and CAA misconfiguration, and Active Directory SRV record discovery during authorized engagements.

pentesting-docker

Testing the Docker Engine remote API (default 2375/TCP plaintext, 2376/TCP TLS) for unauthenticated access leading to instant host takeover by mounting the host filesystem into a privileged container, plus secret/credential extraction and container-escape pivoting during authorized engagements.

pentesting-docker-registry

Testing Docker Registry / Distribution services (default 5000/TCP, HTTP or HTTPS) for unauthenticated catalog access, image and blob/manifest extraction, weak basic-auth, and supply-chain image backdooring (push poisoned WordPress/SSH images) during authorized engagements.

pentesting-elasticsearch

Testing Elasticsearch search/analytics clusters (default HTTP port 9200, transport 9300) for disabled authentication and full index dumping, default/weak credentials, write access to indices, and the historical Groovy/MVEL dynamic-scripting remote-code-execution CVEs (CVE-2015-1427, CVE-2014-3120) during authorized engagements.

pentesting-freeipa

Enumerating and attacking FreeIPA domains during authorized engagements — anonymous and authenticated LDAP

pentesting-ftp

Testing FTP services (default port 21, plus FileZilla admin 14147) for anonymous access, default/weak credentials, FTP bounce port scanning and protocol relay, writable webroot uploads, and dangerous vsFTPd/ProFTPD configuration during authorized engagements.

pentesting-imap

Testing IMAP services (default ports 143 cleartext, 993 IMAPS) for weak/default credentials and brute force, NTLM info disclosure, cleartext credential exposure, capability enumeration, and authenticated mailbox access/data extraction via raw IMAP commands and curl during authorized engagements.

pentesting-ipmi

Testing IPMI / BMC out-of-band management interfaces (default 623/UDP, sometimes TCP) for the cipher-zero authentication bypass, RAKP password-hash retrieval, anonymous/default BMC credentials, cleartext password storage, and host takeover via KVM/SOL during authorized engagements.

pentesting-kerberos

Testing the Kerberos authentication service (88/tcp and 88/udp) in Active Directory during authorized

pentesting-ldap

Testing LDAP / LDAPS directory services (389, 636, and Global Catalog 3268/3269) including Active Directory

pentesting-memcached

Testing Memcached distributed memory caching servers (default port 11211 TCP/UDP) for unauthenticated stats/version access, slab-based key dumping and cached-data exfiltration, cache poisoning, and the UDP reflection/amplification DDoS primitive during authorized engagements.

pentesting-mongodb

Testing MongoDB document databases (default ports 27017 and 27018) for no-auth/unauthenticated access, weak credentials, database and collection dumping, predictable ObjectID enumeration, config-based auth bypass, and the MongoBleed unauthenticated memory-disclosure CVE during authorized engagements.

pentesting-msrpc

Testing the Microsoft RPC (MSRPC / DCE-RPC) endpoint mapper and exposed RPC interfaces during authorized

pentesting-mssql

Testing Microsoft SQL Server (default port 1433, UDP 1434 browser) for default/weak SA credentials, Windows-auth and NTLM relay/coercion, xp_cmdshell OS command execution, linked-server lateral movement, and OLE/BULK file read-write primitives during authorized engagements.

pentesting-mysql

Testing MySQL / MariaDB database services (default port 3306) for empty/default root credentials, authentication-bypass and version CVEs, FILE-privilege data theft, and the INTO OUTFILE webshell / lib_mysqludf_sys UDF remote-code-execution primitives during authorized engagements.

pentesting-netbios

Testing NetBIOS over TCP/IP services during authorized engagements. Covers the NetBIOS Name Service (137/udp,

pentesting-nfs

Testing NFS services (default port 2049, with rpcbind/mountd on 111 and dynamic ports) for exported share enumeration, missing authentication, UID/GID impersonation, no_root_squash/no_all_squash misconfiguration, subtree_check export escape, and group-based file access (e.g., /etc/shadow) during authorized engagements.

pentesting-ntp

Testing NTP services (default 123/UDP for time data and legacy control, 4460/TCP for NTS-KE/TLS) for monlist/Mode-7 amplification exposure, remote query/control leakage, time-shift MITM, weak NTS-KE TLS, and known ntpd/chrony/ntpd-rs CVEs during authorized engagements.

pentesting-oracle

Testing Oracle Database via the TNS Listener (default ports 1521, plus secondary listeners 1522-1529) for SID disclosure/bruteforce, default and weak account credentials, TNS listener misconfiguration and poisoning, and ODAT-driven file read/write and OS command-execution primitives during authorized engagements.

pentesting-pop3

Testing POP3 services (default ports 110 cleartext, 995 POP3S) for weak/default credentials and brute force, NTLM info disclosure, cleartext credential exposure, capability enumeration, and authenticated mailbox retrieval/data extraction via raw POP3 commands during authorized engagements.

pentesting-postgresql

Testing PostgreSQL database services (default port 5432, fallback 5433) for trust-auth and default/weak credentials, role/privilege enumeration, the COPY ... FROM PROGRAM command-execution primitive, large-object and server-file read/write, CREATEROLE privilege escalation, and extension/config-file RCE during authorized engagements.

pentesting-rabbitmq

Testing RabbitMQ / AMQP message brokers (default 5672/TCP plaintext, 5671/TCP TLS; management 15672) for default guest credentials, anonymous/SASL login, message sniffing via topic/stream/event-exchange binds, queue-deletion DoS (CVE-2024-51988), Authorization-header log leakage, and message-to-RCE sinks during authorized engagements.

pentesting-rdp

Testing the Remote Desktop Protocol (RDP, 3389/tcp ms-wbt-server) during authorized engagements. Covers

pentesting-redis

Testing Redis in-memory data stores (default port 6379) for unauthenticated access, weak AUTH credentials, keyspace dumping, and the high-impact RCE primitives - module load (system.exec), webshell/cron write via CONFIG SET dir + dbfilename + SAVE, SSH authorized_keys write, Lua sandbox escape CVEs, and master-slave replication abuse - during authorized engagements.

pentesting-rsync

Testing rsync daemon services (default port 873) for unauthenticated module listing and access, weak/default credentials and brute force, arbitrary file read/download and write/upload (including authorized_keys planting), and rsyncd.conf/secrets misconfiguration during authorized engagements.

pentesting-smb

Testing SMB/CIFS file-sharing services (TCP 445, and 139 over NetBIOS) on Windows and Samba hosts during

pentesting-smtp

Testing SMTP services (default ports 25, 465/SSL, 587/submission) for open relays, user enumeration (VRFY/EXPN/RCPT), NTLM info disclosure, weak/no authentication, SPF/DKIM/DMARC spoofing gaps, Secure Email Gateway bypass, and SMTP smuggling during authorized engagements.

pentesting-snmp

Testing SNMP services (default 161/UDP for agents, 162/UDP for traps, 10161/10162 over TLS/DTLS) for default/guessable community strings, sensitive MIB/OID data harvesting, writable rwcommunity strings, and SNMP-to-RCE via NET-SNMP-EXTEND-MIB during authorized engagements.

pentesting-ssh

Testing SSH services (default port 22) for weak algorithms/host keys, default and brute-forceable credentials, key-based auth gaps, SFTP shell escapes and tunneling, auth-method downgrade, and high-impact CVEs (regreSSHion CVE-2024-6387, XZ backdoor CVE-2024-3094, Erlang/OTP CVE-2025-32433, libssh CVE-2018-10933) during authorized engagements.

pentesting-telnet

Testing Telnet services (default port 23) for cleartext credential capture, default/weak and hard-coded credentials, NTLM info disclosure, option negotiation issues, and code-execution/DoS CVEs (inetutils telnetd NEW_ENVIRON option injection CVE-2026-24061, D-Link CVE-2024-45698, NETGEAR CVE-2023-40478, inetutils DoS CVE-2022-39028) during authorized engagements.

pentesting-tftp

Testing TFTP services (default port 69/UDP) for unauthenticated file read/write, default path enumeration (no directory listing), exposure of device configuration files and ROM/firmware images, and arbitrary upload during authorized engagements.

pentesting-vnc

Testing VNC remote desktop services using the Remote Frame Buffer (RFB) protocol during authorized

pentesting-voip

Testing VoIP / SIP infrastructure (default 5060/UDP+TCP, 5061/TLS, RTP media on high UDP ports) for endpoint and extension enumeration, REGISTER/digest credential cracking, unauthenticated INVITE toll fraud, SIP Digest Leak, RTP eavesdropping, and Asterisk PBX misconfiguration abuse during authorized engagements.

pentesting-winrm

Testing Windows Remote Management (WinRM / WS-Management) during authorized engagements. WinRM exposes an

pentesting-x11

Testing the X Window System (X11) display server during authorized engagements. X11 listens on TCP

performing-account-takeover-attacks

Systematically testing authentication, recovery, and identity flows for account takeover (ATO) — including

performing-ai-assisted-vulnerability-discovery

Using LLMs to accelerate vulnerability research and pentest workflows — generating syntax-valid fuzzing

performing-cms-specific-security-testing

Testing WordPress, Drupal, Joomla, and other CMS platforms for known vulnerabilities, plugin/theme exploits, misconfigured permissions, and CMS-specific attack vectors during authorized penetration tests.

performing-email-security-testing

Offensive email security assessment covering SMTP open relay, SPF/DKIM/DMARC bypass, email header injection, and email-based attack vectors during authorized penetration tests.

performing-exploit-verification

Systematic methodology for safely confirming and documenting exploited vulnerabilities with reproducible proof, ensuring zero false positives before reporting.

performing-internal-network-pentesting

Methodology for internal network penetration testing from a foothold on the LAN, covering host discovery,

performing-linux-post-exploitation

Post-exploitation on Linux during authorized engagements — credential harvesting from process environments,

performing-macos-privilege-escalation

Escalating from a low-privileged user (or unprivileged process) to root on macOS during authorized engagements

performing-macos-red-teaming

Conducting red team operations against macOS fleets during authorized engagements by abusing MDM platforms

performing-network-pivoting-and-tunneling

Pivoting into segmented internal networks during authorized engagements via SSH local/remote/dynamic

performing-network-tunneling-and-pivoting

Establishing tunnels, port forwards, and SOCKS proxies to reach internal networks from a foothold during authorized engagements - covering SSH local/remote/dynamic forwarding, proxychains, chisel, ligolo-ng, socat, plink, sshuttle, Meterpreter/Cobalt Strike routing, and covert DNS/ICMP/cloud tunnels.

performing-reflected-file-download

Identifying and exploiting Reflected File Download (RFD) where an endpoint reflects attacker-controlled

performing-return-oriented-programming

Methodology for building Return-Oriented Programming (ROP) chains to bypass NX/DEP by reusing existing code

performing-windows-binary-exploitation

Methodology for exploiting classic 32-bit Windows stack buffer overflows in network services during authorized

performing-xs-search-attacks

Performing XS-Search / XS-Leaks attacks that extract cross-origin information through side channels — using

performing-zero-day-vulnerability-discovery

Systematic methodology for discovering novel vulnerabilities through manual code auditing, fuzzing, reverse engineering, and creative attack chaining during authorized security assessments.

quick

Time-boxed rapid assessment targeting high-impact vulnerabilities

root-agent

Orchestration layer that coordinates specialized subagents for security assessments

standard

Balanced security assessment with systematic methodology and full attack surface coverage

subdomain-enumeration

Advanced multi-source subdomain enumeration combining passive, active, brute-force, and certificate transparency techniques

testing-ecommerce-and-payment-logic

Testing business-logic flaws in e-commerce and payment flows including price/product tampering,

testing-for-crlf-injection

Testing web applications for CRLF (Carriage Return / Line Feed) injection where unsanitized %0d%0a sequences

testing-for-regex-dos-redos

Testing web applications for Regular Expression Denial of Service (ReDoS), where crafted input forces a

testing-llm-prompt-injection-and-jailbreaks

Testing LLM-backed applications, chatbots, and AI agents for direct and indirect prompt injection, jailbreaks,

testing-mcp-server-security

Testing Model Context Protocol (MCP) servers and the clients that consume them for tool poisoning, prompt

testing-password-reset-flaws

Identifying and exploiting weaknesses in password reset flows including weak reset tokens,

testing-registration-and-account-flaws

Identifying and exploiting weaknesses in account registration including duplicate/overwrite registration,

testing-session-management-flaws

Identifying and exploiting weaknesses in session handling including fixation, weak token entropy,