Pentesting

April 22, 2026 · View on GitHub

Penetration testing tricks, cheat sheets and offensive tools
by @kmkz · boffsec-services.com · @kmkz_security

Interactive Kill Chain Map

Full offensive kill chain -- Initial Access, Persistence, Lateral Movement, Post-Exploitation,
Defense Evasion and Payload Delivery -- with commands. Open in browser, no dependencies.

Cheat Sheets

Pentest-Cheat-Sheet

General pentesting methodology and field-tested commands.

Section	Coverage
Shell obtaining	Netcat, hping3, SNMP, man GTFObin
SQL Injection	UNION-based, blind, sqlmap (Tor + WAF bypass)
Firewalk	TCP source port fixation, nmap firewalk script
Wireless	WPA/WPA2, PMKID attack (clientless), hashcat cracking
MSF modules	Post-exploitation, credential gathering, pivoting
Windows BoF	Gadget finding (mona), EIP control, shellcode delivery
Brute-force	RDP (ncrack), SSH (hydra), .htaccess (medusa)
Web attacks	XSS, LFI->RCE, webshell, stored XSS via exiftool
Hash capture	Impacket fake SMB server, whois exfiltration
AD recon	Manual TTP - nltest, net group, EntraID/Azure check
Lolbins	GTFO/LOLBAS refs, sxstrace NTLM hash exfil

Payload-Delivery-Cheat-Sheet

Windows payload delivery techniques for initial access.

Section	Coverage
File transfer	xxd hex dump/restore, bitsadmin, PowerShell wget
DDE / CSV injection	Word, Excel, Outlook, Chrome via DDEAUTO
Base64 droppers	Unicode encoding, exe-to-b64, in-memory decode
AMSI bypass	Non-patched Win10, updated Win10 (SetValue NULL)
PS delivery	IEX webclient, COM objects (IE, Msxml2, WinHttp), DNS TXT
XSL execution	WMIC /format for AppLocker bypass
Proxy-aware AWL bypass	certutil dropper + msbuild indirect exec

Post-Exploitation-Cheat-Sheet

Post-exploitation, pivoting and lateral movement techniques.

Defenses-Evasion-Cheat-Sheet

Defense evasion, AV/EDR bypass and logging suppression techniques.

AV Evasion

Scripts and techniques to bypass antivirus and EDR solutions.

-> AV_Evasion/

File	Description
AMSI-Bypass.ps1	AMSI bypass via PowerShell reflection

Payload Delivery - Hardware

File	Description
RubberDucky-howto	Rubber Ducky setup and payload writing guide
DuckyPayloads/	Ready-to-use Rubber Ducky payloads

Tools

File	Language	Description
Intelx_LeakFinder.py	Python	Leak hunting via IntelX API
preg_rep_webshell.php	PHP	Webshell using preg_replace /e flag

Repository structure

Pentesting/
    killchain-map.html
    CheatSheets/
        Pentest-Cheat-Sheet
        Post-Exploitation-Cheat-Sheet
        Payload-Delivery-Cheat-Sheet
        Defenses-Evasion-Cheat-Sheet
    AV_Evasion/
    DuckyPayloads/
    Hardware/
        RubberDucky-howto
    Tools/
        AMSI-Bypass.ps1
        Intelx_LeakFinder.py
        preg_rep_webshell.php
    README.md

kmkz/Exploits - CVEs, PoCs and advisories
kmkz/PowerShell - PowerShell offensive scripts
kmkz/Assembly-language - x86/ARM shellcode for exploit dev

For professional engagements: boffsec-services.com