🧠 When You Feel Stuck

The gold list — read it top to bottom before giving up

• LOOK AT THE NOTES first (this vault — start at 00-index).
• Try usual password patterns: root:root, admin:admin, etc. If it fails → bruteforce (password-attacks).
• Try default service passwords: postgres:postgres, etc.
• Re-run enumeration: nmap, gobuster (Enum-checklist).
• Google port XXX and exploit SERVICE_NAME.
• Use HackTricks, Google, exploit-db (99-resources).
• Read the JS scripts on the web page.
• Dirbuster: don’t forget extensions -x .php .txt.
• Dirbuster: try -f (append /); ip/cgi-bin and ip/cgi-bin/ differ.
• Try different DNS/subdomains: test.oscp → main.test.oscp (DNS-subdomain).
• Try a different wordlist.
• Search the machine name.
• Inject every input — even cookies and JWT tokens (jwt).
• Curl the page, and curl with -X POST too (don’t trust the browser).
• Try the same exploit at least 3 times.
• If winPEAS fails, check Program Files manually (windows).
• Every app uses a DB — read the app/php config.
• Kernel exploit search: start specific (2.6.24-16-server), then broaden (2.6).
• Check Mimikatz version — newer builds sometimes fail.
• If . .\powerview.ps1 fails, use Import-Module .\powerview.ps1.
• AD password attacks: test against one machine only.
• Reuse usernames AND passwords.
• AD: try both ADname.com\username AND bare username.
• If winPEAS.exe fails, use PrivescCheck.ps1.
• If rockyou.txt fails, try fasttrack.txt / a different wordlist.
• If aspx/asp/hta fails, try cmdasp.aspx.
• Check /usr/share/webshells.
• File inclusion: try HTTP, SMB, FILE — every protocol (lfi-traversal).
• Anything can be blind — exploits can be blind.
• AD: try --local-auth too.
• Images, PDFs, Word files carry metadata (hash-cracking → stego).
• If an advanced reverse shell fails, use a simple command shell.
• SUID → check PATH variables (linux).