Methodology — Hub
How to approach a box from first scan to first shell. Methodology before tools.
OSCP rule: Enumerate fully before assuming nothing is there. Most footholds come from something almost missed.
📌 Notes in This Folder
| Note | Purpose |
|---|---|
| Initial foothold | Full foothold methodology — phases, techniques, cheat sheet |
| Privilege escalation | After foothold — priv esc workflow, manual enum, vector priority, checklist |
| Every Box - Manual Workflow | What to run on every box — recon, enum, privesc checklist |
| Initial foothold Reminders Techniques + Process | Quick technique checklist (searchsploit, stego, brute, etc.) |
Reference graphs (any phase): Attack Path Graph · Credential Graph · Credential Discovery
📌 Standard Workflow
1. Full port scan → [[RustScan]] or [[Nmap]] → [[UseCases for ports]]
2. Service enum → [[Enumeration]] · [[Attack Path Graph]] (which branch?)
3. Find attack surface → [[Exploitation]] · [[Initial foothold]]
4. Get shell → [[Shells]] + [[Netcat]]
5. Loot creds → [[Credential Discovery]] → [[Credential Graph]]
6. Stabilize & enumerate → [[Linux Tools]] / [[Windows CMD - Powershell Commands]]
7. PrivEsc → **[[Privilege escalation]]** (methodology) · [[Linux]] · [[Windows PrivEsc]]
8. Pivot / DA → [[Post-Exploitation]] · [[LatMovement]]
Exam mental model: Attack Path Graph > OSCP Exam Mental Model