HackTricks
Search…
HackTricks
👾
Welcome!
HackTricks
About the author
Getting Started in Hacking
🤩
Generic Methodologies & Resources
Pentesting Methodology
External Recon Methodology
Pentesting Network
Pentesting Wifi
Phishing Methodology
Basic Forensic Methodology
Brute Force - CheatSheet
Python Sandbox Escape & Pyscript
Exfiltration
Tunneling and Port Forwarding
Search Exploits
Shells (Linux, Windows, MSFVenom)
🐧
Linux Hardening
Checklist - Linux Privilege Escalation
Linux Privilege Escalation
Useful Linux Commands
Bypass Linux Shell Restrictions
Linux Environment Variables
🍏
MacOS Hardening
MacOS Security & Privilege Escalation
🪟
Windows Hardening
Checklist - Local Windows Privilege Escalation
Windows Local Privilege Escalation
Active Directory Methodology
NTLM
Authentication, Credentials, UAC and EFS
Stealing Credentials
Basic CMD for Pentesters
Basic PowerShell for Pentesters
AV Bypass
📱
Mobile Pentesting
Android APK Checklist
Android Applications Pentesting
iOS Pentesting Checklist
iOS Pentesting
👽
Network Services Pentesting
Pentesting JDWP - Java Debug Wire Protocol
Pentesting Printers
Pentesting SAP
Pentesting Remote GdbServer
7/tcp/udp - Pentesting Echo
21 - Pentesting FTP
22 - Pentesting SSH/SFTP
23 - Pentesting Telnet
25,465,587 - Pentesting SMTP/s
43 - Pentesting WHOIS
53 - Pentesting DNS
69/UDP TFTP/Bittorrent-tracker
79 - Pentesting Finger
80,443 - Pentesting Web Methodology
88tcp/udp - Pentesting Kerberos
110,995 - Pentesting POP
111/TCP/UDP - Pentesting Portmapper
113 - Pentesting Ident
123/udp - Pentesting NTP
135, 593 - Pentesting MSRPC
137,138,139 - Pentesting NetBios
139,445 - Pentesting SMB
143,993 - Pentesting IMAP
161,162,10161,10162/udp - Pentesting SNMP
194,6667,6660-7000 - Pentesting IRC
264 - Pentesting Check Point FireWall-1
389, 636, 3268, 3269 - Pentesting LDAP
500/udp - Pentesting IPsec/IKE VPN
502 - Pentesting Modbus
512 - Pentesting Rexec
513 - Pentesting Rlogin
514 - Pentesting Rsh
515 - Pentesting Line Printer Daemon (LPD)
548 - Pentesting Apple Filing Protocol (AFP)
554,8554 - Pentesting RTSP
623/UDP/TCP - IPMI
631 - Internet Printing Protocol(IPP)
873 - Pentesting Rsync
1026 - Pentesting Rusersd
1080 - Pentesting Socks
1098/1099/1050 - Pentesting Java RMI - RMI-IIOP
1433 - Pentesting MSSQL - Microsoft SQL Server
1521,1522-1529 - Pentesting Oracle TNS Listener
1723 - Pentesting PPTP
1883 - Pentesting MQTT (Mosquitto)
2049 - Pentesting NFS Service
2301,2381 - Pentesting Compaq/HP Insight Manager
2375, 2376 Pentesting Docker
3128 - Pentesting Squid
3260 - Pentesting ISCSI
3299 - Pentesting SAPRouter
3306 - Pentesting Mysql
3389 - Pentesting RDP
3632 - Pentesting distcc
3690 - Pentesting Subversion (svn server)
3702/UDP - Pentesting WS-Discovery
4369 - Pentesting Erlang Port Mapper Daemon (epmd)
5000 - Pentesting Docker Registry
5353/UDP Multicast DNS (mDNS) and DNS-SD
5432,5433 - Pentesting Postgresql
5555 - Android Debug Bridge
5601 - Pentesting Kibana
5671,5672 - Pentesting AMQP
5800,5801,5900,5901 - Pentesting VNC
5984,6984 - Pentesting CouchDB
5985,5986 - Pentesting WinRM
5985,5986 - Pentesting OMI
6000 - Pentesting X11
6379 - Pentesting Redis
8009 - Pentesting Apache JServ Protocol (AJP)
8086 - Pentesting InfluxDB
8089 - Pentesting Splunkd
8333,18333,38333,18444 - Pentesting Bitcoin
9000 - Pentesting FastCGI
9001 - Pentesting HSQLDB
9042/9160 - Pentesting Cassandra
9100 - Pentesting Raw Printing (JetDirect, AppSocket, PDL-datastream)
9200 - Pentesting Elasticsearch
10000 - Pentesting Network Data Management Protocol (ndmp)
11211 - Pentesting Memcache
15672 - Pentesting RabbitMQ Management
24007,24008,24009,49152 - Pentesting GlusterFS
27017,27018 - Pentesting MongoDB
44134 - Pentesting Tiller (Helm)
44818/UDP/TCP - Pentesting EthernetIP
47808/udp - Pentesting BACNet
50030,50060,50070,50075,50090 - Pentesting Hadoop
🕸
Pentesting Web
Web Vulnerabilities Methodology
Reflecting Techniques - PoCs and Polygloths CheatSheet
2FA/OTP Bypass
Bypass Payment Process
Captcha Bypass
Cache Poisoning and Cache Deception
Clickjacking
Client Side Template Injection (CSTI)
Command Injection
Content Security Policy (CSP) Bypass
Cookies Hacking
CORS - Misconfigurations & Bypass
CRLF (%0D%0A) Injection
Cross-site WebSocket hijacking (CSWSH)
CSRF (Cross Site Request Forgery)
Dangling Markup - HTML scriptless injection
Deserialization
Domain/Subdomain takeover
Email Injections
File Inclusion/Path traversal
File Upload
Formula Injection
HTTP Request Smuggling / HTTP Desync Attack
HTTP Response Smuggling / Desync
H2C Smuggling
hop-by-hop headers
IDOR
JWT Vulnerabilities (Json Web Tokens)
LDAP Injection
Login Bypass
NoSQL injection
OAuth to Account takeover
Open Redirect
Parameter Pollution
PostMessage Vulnerabilities
Race Condition
Rate Limit Bypass
Registration & Takeover Vulnerabilities
Regular expression Denial of Service - ReDoS
Reset/Forgotten Password Bypass
SAML Attacks
Server Side Inclusion/Edge Side Inclusion Injection
SQL Injection
SSRF (Server Side Request Forgery)
SSTI (Server Side Template Injection)
Reverse Tab Nabbing
Unicode Normalization vulnerability
Web Tool - WFuzz
XPATH injection
XSLT Server Side Injection (Extensible Stylesheet Languaje Transformations)
XXE - XEE - XML External Entity
XSS (Cross Site Scripting)
XSSI (Cross-Site Script Inclusion)
XS-Search
⛈
Cloud Security
GCP Security
Workspace Security
Github Security
Gitea Security
Kubernetes Security
Concourse
CircleCI
Jenkins
Apache Airflow
Atlantis
Cloud Security Review
AWS Security
😎
Hardware/Physical Access
Physical Attacks
Escaping from KIOSKs
Firmware Analysis
🦅
Reversing & Exploiting
Reversing Tools & Basic Methods
Common API used in Malware
Word Macros
Linux Exploiting (Basic) (SPA)
Exploiting Tools
Windows Exploiting (Basic Guide - OSCP lvl)
🔮
Crypto & Stego
Cryptographic/Compression Algorithms
Certificates
Cipher Block Chaining CBC-MAC
Crypto CTFs Tricks
Electronic Code Book (ECB)
Hash Length Extension Attack
Padding Oracle
RC4 - Encrypt&Decrypt
Stego Tricks
Esoteric languages
Blockchain & Crypto Currencies
🧐
External Platforms Reviews/Writeups
BRA.I.NSMASHER Presentation
INE Courses and eLearnSecurity Certifications Reviews
🦂
C2
Merlin
Empire
Salseo
ICMPsh
✍
TODO
Other Big References
More Tools
MISC
Pentesting DNS
Hardware Hacking
Radio Hacking
Burp Suite
Other Web Tricks
Interesting HTTP
Emails Vulnerabilities
Android Forensics
TR-069
6881/udp - Pentesting BitTorrent
CTF Write-ups
1911 - Pentesting fox
Online Platforms with API
Stealing Sensitive Information Disclosure from a Web
Post Exploitation
Powered By
GitBook
Checklist - Local Windows Privilege Escalation
Support HackTricks and get benefits!
Best tool to look for Windows local privilege escalation vectors:
WinPEAS
System Info
Obtain
System informatio
Search for
kernel
exploits using scripts
Use
Google to search
for kernel
exploits
Use
searchsploit to search
for kernel
exploits
Interesting info in
env vars
?
Passwords in
PowerShell history
?
Interesting info in
Internet settings
?
Drives
?
WSUS exploit
?
AlwaysInstallElevated
?
Logging/AV enumeration
Check
Audit
and
WEF
settings
Check
LAPS
Check if
WDigest
is active
LSA Protection
?
Credentials Guard
?
Cached Credentials
?
Check if any
AV
AppLocker Policy
?
UA
User Privileges
Check
current
user
privileges
Are you
member of any privileged group
?
Check if you have
any of these tokens enabled
:
SeImpersonatePrivilege, SeAssignPrimaryPrivilege, SeTcbPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeCreateTokenPrivilege, SeLoadDriverPrivilege, SeTakeOwnershipPrivilege, SeDebugPrivilege
?
Users Sessions
?
Check
users homes
(access?)
Check
Password Policy
What is
inside the Clipboard
?
Network
Check
current
network
information
Check
hidden local services
restricted to the outside
Running Processes
Processes binaries
file and folders permissions
Memory Password mining
Insecure GUI apps
Services
Can you
modify any service
?
Can you
modify
the
binary
that is
executed
by any
service
?
Can you
modify
the
registry
of any
service
?
Can you take advantage of any
unquoted service
binary
path
?
Applications
Write
permissions on installed applications
Startup Applications
Vulnerable
Drivers
DLL Hijacking
Can you
write in any folder inside PATH
?
Is there any known service binary that
tries to load any non-existant DLL
?
Can you
write
in any
binaries folder
?
Network
Enumerate the network(shares, interfaces, routes, neighbours...)
Take a special look to network services listing on local (127.0.0.1)
Windows Credentials
Winlogon
credentials
Windows Vault
credentials that you could use?
Interesting
DPAPI credentials
?
Passwords of saved
Wifi networks
?
Interesting info in
saved RDP Connections
?
Passwords in
recently run commands
?
Remote Desktop Credentials Manager
passwords?
AppCmd.exe
exists
? Credentials?
SCClient.exe
? DLL Side Loading?
Files and Registry (Credentials)
Putty:
Creds
and
SSH host keys
SSH keys in registry
?
Passwords in
unattended files
?
Any
SAM & SYSTEM
backup?
Cloud credentials
?
McAfee SiteList.xml
file?
Cached GPP Password
?
Password in
IIS Web config file
?
Interesting info in
web
logs
?
Do you want to
ask for credentials
to the user?
Interesting
files inside the Recycle Bin
?
Other
registry containing credentials
?
Inside
Browser data
(dbs, history, bookmarks....)?
Generic password search
in files and registry
Tools
to automatically search for passwords
Leaked Handlers
Have you access to any handler of a process run by administrator?
Pipe Client Impersonation
Check if you can abuse it
Support HackTricks and get benefits!
Previous
MacOS Apps - Inspecting, debugging and Fuzzing
Next - Windows Hardening
Windows Local Privilege Escalation
Last modified
18d ago
Copy link
Contents
Best tool to look for Windows local privilege escalation vectors: WinPEAS
System Info
Logging/AV enumeration
Network
Running Processes
Services
Applications
DLL Hijacking
Network
Windows Credentials
Files and Registry (Credentials)
Leaked Handlers
Pipe Client Impersonation