Documentation Index
Fetch the complete documentation index at: /llms.txt
Use this file to discover all available pages before exploring further.

Skip to main content

HTB Writeups Hub home page

Glosario

Glosario táctico

Active Directory · Kerberos & NTLM

Kerberos
NTLM (NT LAN Manager)
Pass-The-Hash (PtH)
Kerberoasting

Active Directory · Vectores avanzados

AS-REP Roasting
Constrained Delegation (KCD)
Resource-Based Constrained Delegation (RBCD)
DCSync
DCShadow
Golden Ticket
Silver Ticket
Diamond Ticket
SeImpersonate Privilege (Potato chain)
Shadow Credentials (msDS-KeyCredentialLink)
PrintNightmare (CVE-2021-34527)
ZeroLogon (CVE-2020-1472)
PetitPotam (CVE-2021-36942)
NoPac (CVE-2021-42278 / CVE-2021-42287)
LAPS abuse
UAC Bypass (fodhelper / computerdefaults / IFileOperation)

Web · OWASP Top 10

LFI (Local File Inclusion)
SQL Injection (SQLi)
IDOR (Insecure Direct Object Reference)
Mass Assignment
Type Confusion (en APIs)

Web · Vectores avanzados

SSRF (Server-Side Request Forgery)
XXE (XML External Entity)
SSTI (Server-Side Template Injection)
Prototype Pollution
JWT — none algorithm + key confusion
Race Conditions — Single-Packet Attack
HTTP Request Smuggling (CL.TE / TE.CL / CL.0 / H2.X)
CORS Misconfiguration
OAuth / OIDC misconfig
GraphQL — Introspection + Batching abuse
Web Cache Poisoning
NoSQL Injection (MongoDB / Elastic)
CSRF + SameSite Lax bypass
Open Redirect → SSO chain

Linux · Privilege Escalation

SUID Binary + PATH Hijacking
Sudo misconfig (NOPASSWD)
Capabilities (`getcap` / `cap_*`)
Cron Jobs PATH abuse / wildcard
Kernel exploits — Dirty Pipe (CVE-2022-0847)
PwnKit (CVE-2021-4034)
Docker socket abuse
LD_PRELOAD / LD_LIBRARY_PATH hijacking
SUDO Baron Samedit (CVE-2021-3156)
NFS no_root_squash
lxd / lxc group membership

Reconocimiento

SMB Null Sessions
SSL Certificate Enumeration
LLMNR / NBT-NS Poisoning (Responder)
mitm6 — IPv6 takeover
SMB Signing not required
SNMP enumeration
IPv6 takeover (mitm6 + ntlmrelayx)

Post-explotación

Mimikatz
BloodHound

Cloud (AWS · Azure · GCP)

IMDSv1 vs IMDSv2 (AWS)
Pacu (AWS exploitation framework)
Entra ID Device Code Phishing
Managed Identity abuse (Azure)
Pass-the-PRT (Primary Refresh Token)
ConfusedFunction (GCP, Tenable 2024)
S3 bucket takeover via dangling DNS

Container & Kubernetes

Container escape (root + cap_sys_admin)
Docker socket mount escape
Kubelet API abuse (puerto 10250)
etcd unauthenticated
RBAC privilege escalation (impersonate, escalate, bind)

Red Team & Evasión

AMSI bypass
ETW patching
BYOVD (Bring Your Own Vulnerable Driver)
Cobalt Strike / Sliver / Mythic / Havoc
Process Hollowing
Indirect / Direct Syscalls

Phishing & Social

Evilginx2 — MFA bypass
GoPhish
Browser-in-the-Browser (BiTB)
Consent Phishing (OAuth abuse)

OSINT

Shodan / Censys dorking
crt.sh — Certificate Transparency
Trufflehog / Gitleaks / Gato-X

WAF Evasion

JA3/JA4 Fingerprint
Client Hints (sec-ch-ua)

Crypto práctica

Padding Oracle attack
Hash Cracking — hashcat
ECB mode cipher reuse

Pwn / Exploit dev

Stack Buffer Overflow + ROP
ASLR / DEP bypass
Format String vulnerability

Defensa

EDR (Endpoint Detection & Response)
SIEM (Splunk / Sentinel / ELK)
Sigma rules
YARA rules
Honeypots / Honeytokens / Canarytokens

Web3 / Blockchain

Reentrancy
Flash Loan attacks
Permit2 / eth_sign phishing

Frameworks & Estándares

CVSS v3.1 vs v4.0
EPSS (Exploit Prediction Scoring System)
KEV (Known Exploited Vulnerabilities — CISA)
CWE Top 25
STRIDE / PASTA threat modeling
NIS2 (Directiva UE 2022/2555)
DORA (Reglamento UE 2022/2554)

Reconocimiento

IPv6 takeover (mitm6 + ntlmrelayx)

Cubierto en mitm6.

Cubierto en mitm6.

Categoría: Reconocimiento Cubierto en mitm6. Ver también ntlmrelayx.

← Volver al glosario completo Última actualización: 2026-06-11

SNMP enumeration

HTB Writeups Hub home page

Plataformas

HackTheBox PortSwigger TryHackMe Catálogo de skills Máquina aleatoria

Recursos

Metodología Glosario Plantilla de informe Roadmap OSCP RSS feed API JSON

Temáticas

Recon web Red team moderno AD CS Bug bounty Cloud pentest LLM Security

Autores

S4vitar El Pingüino de Mario 0xdf IppSec Rana Khalil z3nsh3ll JohnHammond stuffy24

Impulsado porThis documentation is built and hosted on Mintlify, a developer documentation platform