tool-index.md (31397B)
1 --- 2 title: "Tool Index" 3 description: "Stage-by-stage CPTS tooling index with locally mirrored, checksum-verified downloads." 4 category: pentest-workflow 5 subcategory: "CPTS Attack Flow" 6 order: 17 7 tags: ["htb", "cpts", "htb-attack-flow", "htb-attack-flow-reference", "pentest-workflow"] 8 tools: ["Multiple"] 9 difficulty: intermediate 10 updated: "2026-08-29" 11 source: "vault:Pentest Attack Flow/17 - Tool Index.md" 12 --- 13 > [!dashboard] Attack-flow navigation 14 > **Dashboard:** [HTB Pentest Attack Flow](/sheets/pentest-workflow/attack-flow-dashboard) 15 > 16 > **Section:** 17 of 17 · **Focus:** Tool Index 17 > 18 > **Previous:** [Appendix — Worked Chains](/sheets/pentest-workflow/worked-chains) · **Next:** [HTB Pentest Attack Flow](/sheets/pentest-workflow/attack-flow-dashboard) 19 20 --- 21 # 🧰 Tool Index — where each lives in the flow 22 23 **Local attachments** ship offline in `attachments/` (integrity: [SHA256SUMS](/downloads/pentest-workflow/SHA256SUMS) ([GPG signature](/downloads/pentest-workflow/SHA256SUMS.asc))) — see the full inventory on the [Dashboard](/sheets/pentest-workflow/attack-flow-dashboard#offline-toolkit-attachments). Everything else links to its canonical repo. 24 25 > [!tip] One-liner install — the pip-side toolchain 26 > ```bash 27 > # pipx keeps each tool's venv isolated (apt install pipx first) 28 > pipx install netexec impacket certipy-ad bloodyad 29 > pipx install git+https://github.com/dirkjanm/BloodHound.py.git@bloodhound-ce # bloodhound-ce-python 30 > # handy extras 31 > pipx install git+https://github.com/ShutdownRepo/targetedKerberoast.git || true # also ships in attachments/ 32 > sudo apt install -y seclists wordlists kerbrute feroxbuster enum4linux-ng 33 > ``` 34 > Go binaries (kerbrute, fscan, gowitness, chisel, ligolo-ng agents) already ship in `attachments/` — no build needed. 35 36 | Stage | Tools | Local attachments | Deep-dive note | 37 | :-- | :-- | :-- | :-- | 38 | 0 Passive Recon | [crt.sh](https://crt.sh), dig, [Shodan](https://www.shodan.io), [google dorks](/sheets/enumeration/google-dorking), [gitleaks](https://github.com/gitleaks/gitleaks), [trufflehog](https://github.com/trufflesecurity/trufflehog), [GrayHatWarfare](https://grayhatwarfare.com), [theHarvester](https://github.com/laramies/theHarvester), [subfinder](https://github.com/projectdiscovery/subfinder), [amass](https://github.com/owasp-amass/amass) | — | 2.0 - Cheatsheet - Infrastructure Enumeration Tools · 2.4 - Cheatsheet - Gitleaks · 2.5 - Cheatsheet - TruffleHog · [01 - Stage 00 - Passive External Recon](/sheets/pentest-workflow/passive-external-recon) | 39 | 1 Recon / Host Discovery | [RustScan](https://github.com/bee-san/RustScan), [nmap](https://github.com/nmap/nmap), [masscan](https://github.com/robertdavidgraham/masscan), [naabu](https://github.com/projectdiscovery/naabu), [faketime](https://github.com/wolfcw/libfaketime), ntpdate | — | RustScan_Cheatsheet · Nmap Cheatsheet 2026 · faketime-cheatsheet · [02 - Stage 01 - Recon and Host Discovery](/sheets/pentest-workflow/recon-and-host-discovery) | 40 | 2 Web | [ffuf](https://github.com/ffuf/ffuf), [feroxbuster](https://github.com/epi052/feroxbuster), [gobuster](https://github.com/OJ/gobuster), [wpscan](https://github.com/wpscanteam/wpscan), [nuclei](https://github.com/projectdiscovery/nuclei), [sqlmap](https://github.com/sqlmapproject/sqlmap), [Burp](https://portswigger.net/burp)/[ZAP](https://github.com/zaproxy/zaproxy), [hydra](https://github.com/vanhauser-thc/thc-hydra), [dnSpy](https://github.com/dnSpy/dnSpy), [EyeWitness](https://github.com/RedSiege/EyeWitness), [gowitness](https://github.com/sensepost/gowitness), [ysoserial](https://github.com/frohoff/ysoserial), [ysoserial.net](https://github.com/pwntester/ysoserial.net) | [gowitness_linux_amd64](/downloads/pentest-workflow/gowitness_linux_amd64) ([SHA-256](/downloads/pentest-workflow/gowitness_linux_amd64.sha256) · [GPG signature](/downloads/pentest-workflow/gowitness_linux_amd64.sha256.asc)) [gowitness_windows_amd64.exe](/downloads/pentest-workflow/gowitness_windows_amd64.exe) ([SHA-256](/downloads/pentest-workflow/gowitness_windows_amd64.exe.sha256) · [GPG signature](/downloads/pentest-workflow/gowitness_windows_amd64.exe.sha256.asc)) [ysoserial-all.jar](/downloads/pentest-workflow/ysoserial-all.jar) ([SHA-256](/downloads/pentest-workflow/ysoserial-all.jar.sha256) · [GPG signature](/downloads/pentest-workflow/ysoserial-all.jar.sha256.asc)) [ysoserial.net_v1.36.zip](/downloads/pentest-workflow/ysoserial.net_v1.36.zip) ([SHA-256](/downloads/pentest-workflow/ysoserial.net_v1.36.zip.sha256) · [GPG signature](/downloads/pentest-workflow/ysoserial.net_v1.36.zip.sha256.asc)) [nt-webshell-rosepine.aspx](/downloads/pentest-workflow/nt-webshell-rosepine.aspx) ([SHA-256](/downloads/pentest-workflow/nt-webshell-rosepine.aspx.sha256) · [GPG signature](/downloads/pentest-workflow/nt-webshell-rosepine.aspx.sha256.asc)) [rp-shell.asp](/downloads/pentest-workflow/rp-shell.asp) ([SHA-256](/downloads/pentest-workflow/rp-shell.asp.sha256) · [GPG signature](/downloads/pentest-workflow/rp-shell.asp.sha256.asc)) [rp-shell.jsp](/downloads/pentest-workflow/rp-shell.jsp) ([SHA-256](/downloads/pentest-workflow/rp-shell.jsp.sha256) · [GPG signature](/downloads/pentest-workflow/rp-shell.jsp.sha256.asc)) [rp-shell.php](/downloads/pentest-workflow/rp-shell.php) ([SHA-256](/downloads/pentest-workflow/rp-shell.php.sha256) · [GPG signature](/downloads/pentest-workflow/rp-shell.php.sha256.asc)) | Ffuf-Cheatsheet · WPScan · sqlmap · LFI - Cheat Sheet · 12 - Attacking Thick Client Applications · [03 - Stage 02 - Web Enumeration and Exploitation](/sheets/pentest-workflow/web-enumeration-and-exploitation) | 41 | ⚙ Foothold Toolkit | reverse shells, msfvenom, [Metasploit](https://github.com/rapid7/metasploit-framework), file transfer (certutil / smbserver / curl), [nishang](https://github.com/samratashok/nishang), nc64, [donut](https://github.com/TheWover/donut), [ConPtyShell](https://github.com/antonioCoco/ConPtyShell), [RunasCs](https://github.com/antonioCoco/RunasCs) | [nc64.exe](/downloads/pentest-workflow/nc64.exe) ([SHA-256](/downloads/pentest-workflow/nc64.exe.sha256) · [GPG signature](/downloads/pentest-workflow/nc64.exe.sha256.asc)) [nishang-master.zip](/downloads/pentest-workflow/nishang-master.zip) ([SHA-256](/downloads/pentest-workflow/nishang-master.zip.sha256) · [GPG signature](/downloads/pentest-workflow/nishang-master.zip.sha256.asc)) [donut_v1.1.zip](/downloads/pentest-workflow/donut_v1.1.zip) ([SHA-256](/downloads/pentest-workflow/donut_v1.1.zip.sha256) · [GPG signature](/downloads/pentest-workflow/donut_v1.1.zip.sha256.asc)) | Impacket-Cheatsheet · meterpreter · smbserver.py · [04 - Foothold Toolkit - File Transfers](/sheets/pentest-workflow/foothold-file-transfers) · [05 - Foothold Toolkit - Shells Payloads and Metasploit](/sheets/pentest-workflow/foothold-shells-payloads-metasploit) | 42 | 3 SMB/RPC/Services | [NetExec](https://github.com/Pennyw0rth/NetExec), smbclient, [smbmap](https://github.com/ShawnDEvans/smbmap), [enum4linux-ng](https://github.com/cddmp/enum4linux-ng), rpcclient, [Snaffler](https://github.com/SnaffCon/Snaffler), [Responder](https://github.com/lgandx/Responder), [ntlmrelayx](https://github.com/fortra/impacket), [mitm6](https://github.com/dirkjanm/mitm6), [Inveigh](https://github.com/Kevin-Robertson/Inveigh), [fscan](https://github.com/shadow1ng/fscan) | [Snaffler.exe](/downloads/pentest-workflow/Snaffler.exe) ([SHA-256](/downloads/pentest-workflow/Snaffler.exe.sha256) · [GPG signature](/downloads/pentest-workflow/Snaffler.exe.sha256.asc)) [Inveigh.ps1](/downloads/pentest-workflow/Inveigh.ps1) ([SHA-256](/downloads/pentest-workflow/Inveigh.ps1.sha256) · [GPG signature](/downloads/pentest-workflow/Inveigh.ps1.sha256.asc)) [fscan_windows_x64.exe](/downloads/pentest-workflow/fscan_windows_x64.exe) ([SHA-256](/downloads/pentest-workflow/fscan_windows_x64.exe.sha256) · [GPG signature](/downloads/pentest-workflow/fscan_windows_x64.exe.sha256.asc)) | SMBMAP · Snaffler · 🔴 Attack · [06 - Stage 03 - Service Enumeration](/sheets/pentest-workflow/service-enumeration) | 43 | 4 AD Enumeration | [NetExec](https://github.com/Pennyw0rth/NetExec), ldapsearch, [ldapdomaindump](https://github.com/dirkjanm/ldapdomaindump), [windapsearch](https://github.com/ropnop/windapsearch), [ldeep](https://github.com/franc-pentest/ldeep), [kerbrute](https://github.com/ropnop/kerbrute), [bloodhound-ce-python](https://github.com/dirkjanm/BloodHound.py), [RustHound-CE](https://github.com/g0h4n/RustHound-CE), [SharpHound](https://github.com/SpecterOps/SharpHound), [PowerView](https://github.com/PowerShellMafia/PowerSploit), [SharpView](https://github.com/tevora-threat/SharpView) | [kerbrute_linux_amd64](/downloads/pentest-workflow/kerbrute_linux_amd64) ([SHA-256](/downloads/pentest-workflow/kerbrute_linux_amd64.sha256) · [GPG signature](/downloads/pentest-workflow/kerbrute_linux_amd64.sha256.asc)) [kerbrute_windows_amd64.exe](/downloads/pentest-workflow/kerbrute_windows_amd64.exe) ([SHA-256](/downloads/pentest-workflow/kerbrute_windows_amd64.exe.sha256) · [GPG signature](/downloads/pentest-workflow/kerbrute_windows_amd64.exe.sha256.asc)) [SharpHound.zip](/downloads/pentest-workflow/SharpHound.zip) ([SHA-256](/downloads/pentest-workflow/SharpHound.zip.sha256) · [GPG signature](/downloads/pentest-workflow/SharpHound.zip.sha256.asc)) [PowerView.ps1](/downloads/pentest-workflow/PowerView.ps1) ([SHA-256](/downloads/pentest-workflow/PowerView.ps1.sha256) · [GPG signature](/downloads/pentest-workflow/PowerView.ps1.sha256.asc)) [SharpView.exe](/downloads/pentest-workflow/SharpView.exe) ([SHA-256](/downloads/pentest-workflow/SharpView.exe.sha256) · [GPG signature](/downloads/pentest-workflow/SharpView.exe.sha256.asc)) | LDAP Search · bloodhound-ce-python-cheatsheet · Kerbrute · [07 - Stage 04 - Active Directory Enumeration](/sheets/pentest-workflow/active-directory-enumeration) | 44 | 5 Kerberos | [Impacket](https://github.com/fortra/impacket) (GetUserSPNs / GetNPUsers / getST / getTGT), [Rubeus](https://github.com/GhostPack/Rubeus), [hashcat](https://github.com/hashcat/hashcat), [kekeo](https://github.com/gentilkiwi/kekeo) | [Rubeus.exe](/downloads/pentest-workflow/Rubeus.exe) ([SHA-256](/downloads/pentest-workflow/Rubeus.exe.sha256) · [GPG signature](/downloads/pentest-workflow/Rubeus.exe.sha256.asc)) | Kerberoasting Cheatsheet · Rubeus-Cheatsheet · [08 - Stage 05 - Kerberos Attacks](/sheets/pentest-workflow/kerberos-attacks) | 45 | 6 ACL / Object Abuse | [bloodyAD](https://github.com/CravateRouge/bloodyAD), [PowerView](https://github.com/PowerShellMafia/PowerSploit), [Impacket](https://github.com/fortra/impacket) (dacledit / rbcd / owneredit / addcomputer), [autobloody](https://github.com/CravateRouge/autobloody), [StandIn](https://github.com/FuzzySecurity/StandIn), [Whisker](https://github.com/eladshamir/Whisker), [pywhisker](https://github.com/ShutdownRepo/pywhisker), [targetedKerberoast](https://github.com/ShutdownRepo/targetedKerberoast), [Powermad](https://github.com/Kevin-Robertson/Powermad) | [StandIn_v13_Net35_45.zip](/downloads/pentest-workflow/StandIn_v13_Net35_45.zip) ([SHA-256](/downloads/pentest-workflow/StandIn_v13_Net35_45.zip.sha256) · [GPG signature](/downloads/pentest-workflow/StandIn_v13_Net35_45.zip.sha256.asc)) [Whisker.exe](/downloads/pentest-workflow/Whisker.exe) ([SHA-256](/downloads/pentest-workflow/Whisker.exe.sha256) · [GPG signature](/downloads/pentest-workflow/Whisker.exe.sha256.asc)) [targetedKerberoast.py](/downloads/pentest-workflow/targetedKerberoast.py) ([SHA-256](/downloads/pentest-workflow/targetedKerberoast.py.sha256) · [GPG signature](/downloads/pentest-workflow/targetedKerberoast.py.sha256.asc)) | BloodyAD · Autobloody · [09 - Stage 06 - ACL and Object Abuse](/sheets/pentest-workflow/acl-and-object-abuse) | 46 | 7 ADCS | [Certipy](https://github.com/ly4k/Certipy), [Certify](https://github.com/GhostPack/Certify), [PetitPotam](https://github.com/topotam/PetitPotam), [Coercer](https://github.com/p0dalirius/Coercer), [DFSCoerce](https://github.com/Wh04m1001/DFSCoerce), [ShadowCoerce](https://github.com/ShutdownRepo/ShadowCoerce), [krbrelayx](https://github.com/dirkjanm/krbrelayx) | [Certify.exe](/downloads/pentest-workflow/Certify.exe) ([SHA-256](/downloads/pentest-workflow/Certify.exe.sha256) · [GPG signature](/downloads/pentest-workflow/Certify.exe.sha256.asc)) [PetitPotam.py](/downloads/pentest-workflow/PetitPotam.py) ([SHA-256](/downloads/pentest-workflow/PetitPotam.py.sha256) · [GPG signature](/downloads/pentest-workflow/PetitPotam.py.sha256.asc)) | Certipy-ad · _ADCS Attack Methodology Guide · _ADCS ESC Attack Index · [10 - Stage 07 - ADCS and Certificate Abuse](/sheets/pentest-workflow/adcs-and-certificate-abuse) | 47 | 8 Passwords / Spraying | [hashcat](https://github.com/hashcat/hashcat), [john](https://github.com/openwall/john), [NetExec](https://github.com/Pennyw0rth/NetExec) (spray), [hydra](https://github.com/vanhauser-thc/thc-hydra), [kerbrute](https://github.com/ropnop/kerbrute) (spray), [Go365](https://github.com/optiv/Go365), [MSOLSpray](https://github.com/dafthack/MSOLSpray), [o365spray](https://github.com/0xZDH/o365spray), [CredMaster](https://github.com/knavesec/CredMaster), [CeWL](https://github.com/digininja/CeWL)/[cupp](https://github.com/Mebus/cupp), [username-anarchy](https://github.com/urbanadventurer/username-anarchy) | [Go365_linux_amd64.tar.gz](/downloads/pentest-workflow/Go365_linux_amd64.tar.gz) ([SHA-256](/downloads/pentest-workflow/Go365_linux_amd64.tar.gz.sha256) · [GPG signature](/downloads/pentest-workflow/Go365_linux_amd64.tar.gz.sha256.asc)) [MSOLSpray.ps1](/downloads/pentest-workflow/MSOLSpray.ps1) ([SHA-256](/downloads/pentest-workflow/MSOLSpray.ps1.sha256) · [GPG signature](/downloads/pentest-workflow/MSOLSpray.ps1.sha256.asc)) [kerbrute_linux_amd64](/downloads/pentest-workflow/kerbrute_linux_amd64) ([SHA-256](/downloads/pentest-workflow/kerbrute_linux_amd64.sha256) · [GPG signature](/downloads/pentest-workflow/kerbrute_linux_amd64.sha256.asc)) | Hashcat-Cheatsheet · john-cheatsheet · Credential Hunting · [11 - Stage 08 - Password Attacks and Credential Hunting](/sheets/pentest-workflow/password-attacks-and-credential-hunting) | 48 | 9 Privilege Escalation | [linpeas](https://github.com/carlospolop/PEASS-ng), [winPEAS](https://github.com/carlospolop/PEASS-ng), [PrivescCheck](https://github.com/itm4n/PrivescCheck), [JAWS](https://github.com/411Hall/JAWS), [PowerUp](https://github.com/PowerShellMafia/PowerSploit), [SharpUp](https://github.com/GhostPack/SharpUp), [Seatbelt](https://github.com/GhostPack/Seatbelt), [Watson](https://github.com/rasta-mouse/Watson)/[Sherlock](https://github.com/rasta-mouse/Sherlock)/[WES-NG](https://github.com/bitsadmin/wesng), [GTFOBins](https://gtfobins.github.io), [pspy](https://github.com/DominicBreuker/pspy), potatoes ([GodPotato](https://github.com/BeichenDream/GodPotato), [PrintSpoofer](https://github.com/itm4n/PrintSpoofer), [SweetPotato](https://github.com/CCob/SweetPotato), [JuicyPotato](https://github.com/ohpe/juicy-potato), [RoguePotato](https://github.com/antonioCoco/RoguePotato)) | [linpeas.sh](/downloads/pentest-workflow/linpeas.sh) ([SHA-256](/downloads/pentest-workflow/linpeas.sh.sha256) · [GPG signature](/downloads/pentest-workflow/linpeas.sh.sha256.asc)) [linpeas_linux_amd64](/downloads/pentest-workflow/linpeas_linux_amd64) ([SHA-256](/downloads/pentest-workflow/linpeas_linux_amd64.sha256) · [GPG signature](/downloads/pentest-workflow/linpeas_linux_amd64.sha256.asc)) [winPEASany.exe](/downloads/pentest-workflow/winPEASany.exe) ([SHA-256](/downloads/pentest-workflow/winPEASany.exe.sha256) · [GPG signature](/downloads/pentest-workflow/winPEASany.exe.sha256.asc)) [winPEASx64.exe](/downloads/pentest-workflow/winPEASx64.exe) ([SHA-256](/downloads/pentest-workflow/winPEASx64.exe.sha256) · [GPG signature](/downloads/pentest-workflow/winPEASx64.exe.sha256.asc)) [PrivescCheck.ps1](/downloads/pentest-workflow/PrivescCheck.ps1) ([SHA-256](/downloads/pentest-workflow/PrivescCheck.ps1.sha256) · [GPG signature](/downloads/pentest-workflow/PrivescCheck.ps1.sha256.asc)) [jaws-enum.ps1](/downloads/pentest-workflow/jaws-enum.ps1) ([SHA-256](/downloads/pentest-workflow/jaws-enum.ps1.sha256) · [GPG signature](/downloads/pentest-workflow/jaws-enum.ps1.sha256.asc)) [PowerUp.ps1](/downloads/pentest-workflow/PowerUp.ps1) ([SHA-256](/downloads/pentest-workflow/PowerUp.ps1.sha256) · [GPG signature](/downloads/pentest-workflow/PowerUp.ps1.sha256.asc)) [SharpUp.exe](/downloads/pentest-workflow/SharpUp.exe) ([SHA-256](/downloads/pentest-workflow/SharpUp.exe.sha256) · [GPG signature](/downloads/pentest-workflow/SharpUp.exe.sha256.asc)) [Seatbelt.exe](/downloads/pentest-workflow/Seatbelt.exe) ([SHA-256](/downloads/pentest-workflow/Seatbelt.exe.sha256) · [GPG signature](/downloads/pentest-workflow/Seatbelt.exe.sha256.asc)) [GodPotato-NET35.exe](/downloads/pentest-workflow/GodPotato-NET35.exe) ([SHA-256](/downloads/pentest-workflow/GodPotato-NET35.exe.sha256) · [GPG signature](/downloads/pentest-workflow/GodPotato-NET35.exe.sha256.asc)) [GodPotato-NET4.exe](/downloads/pentest-workflow/GodPotato-NET4.exe) ([SHA-256](/downloads/pentest-workflow/GodPotato-NET4.exe.sha256) · [GPG signature](/downloads/pentest-workflow/GodPotato-NET4.exe.sha256.asc)) [PrintSpoofer64.exe](/downloads/pentest-workflow/PrintSpoofer64.exe) ([SHA-256](/downloads/pentest-workflow/PrintSpoofer64.exe.sha256) · [GPG signature](/downloads/pentest-workflow/PrintSpoofer64.exe.sha256.asc)) [SweetPotato.exe](/downloads/pentest-workflow/SweetPotato.exe) ([SHA-256](/downloads/pentest-workflow/SweetPotato.exe.sha256) · [GPG signature](/downloads/pentest-workflow/SweetPotato.exe.sha256.asc)) [JuicyPotato.exe](/downloads/pentest-workflow/JuicyPotato.exe) ([SHA-256](/downloads/pentest-workflow/JuicyPotato.exe.sha256) · [GPG signature](/downloads/pentest-workflow/JuicyPotato.exe.sha256.asc)) [pspy32](/downloads/pentest-workflow/pspy32) ([SHA-256](/downloads/pentest-workflow/pspy32.sha256) · [GPG signature](/downloads/pentest-workflow/pspy32.sha256.asc)) [pspy64](/downloads/pentest-workflow/pspy64) ([SHA-256](/downloads/pentest-workflow/pspy64.sha256) · [GPG signature](/downloads/pentest-workflow/pspy64.sha256.asc)) | Linux PrivEsc Cheat Sheet · Windows PrivEsc · [12 - Stage 09 - Privilege Escalation](/sheets/pentest-workflow/privilege-escalation) | 49 | 10 Lateral / Pivot / Loot | [evil-winrm](https://github.com/Hackplayers/evil-winrm), [Impacket](https://github.com/fortra/impacket) (psexec / wmiexec / secretsdump / smbserver), [ligolo-ng](https://github.com/nicocha30/ligolo-ng), [chisel](https://github.com/jpillora/chisel), [sshuttle](https://github.com/sshuttle/sshuttle), [mimikatz](https://github.com/gentilkiwi/mimikatz), [SharpWMI](https://github.com/GhostPack/SharpWMI), [SharpDPAPI](https://github.com/GhostPack/SharpDPAPI), [LaZagne](https://github.com/AlessandroZ/LaZagne), [proxychains-ng](https://github.com/rofl0r/proxychains-ng), [dnscat2](https://github.com/iagox86/dnscat2), [pypykatz](https://github.com/skelsec/pypykatz), [lsassy](https://github.com/login-securite/lsassy), [nanodump](https://github.com/fortra/nanodump) | [chisel.exe](/downloads/pentest-workflow/chisel.exe) ([SHA-256](/downloads/pentest-workflow/chisel.exe.sha256) · [GPG signature](/downloads/pentest-workflow/chisel.exe.sha256.asc)) [chisel_linux_amd64](/downloads/pentest-workflow/chisel_linux_amd64) ([SHA-256](/downloads/pentest-workflow/chisel_linux_amd64.sha256) · [GPG signature](/downloads/pentest-workflow/chisel_linux_amd64.sha256.asc)) [ligolo-ng_agent_linux_amd64.tar.gz](/downloads/pentest-workflow/ligolo-ng_agent_linux_amd64.tar.gz) ([SHA-256](/downloads/pentest-workflow/ligolo-ng_agent_linux_amd64.tar.gz.sha256) · [GPG signature](/downloads/pentest-workflow/ligolo-ng_agent_linux_amd64.tar.gz.sha256.asc)) [ligolo-ng_agent_windows_amd64.zip](/downloads/pentest-workflow/ligolo-ng_agent_windows_amd64.zip) ([SHA-256](/downloads/pentest-workflow/ligolo-ng_agent_windows_amd64.zip.sha256) · [GPG signature](/downloads/pentest-workflow/ligolo-ng_agent_windows_amd64.zip.sha256.asc)) [mimikatz_trunk.zip](/downloads/pentest-workflow/mimikatz_trunk.zip) ([SHA-256](/downloads/pentest-workflow/mimikatz_trunk.zip.sha256) · [GPG signature](/downloads/pentest-workflow/mimikatz_trunk.zip.sha256.asc)) [SharpWMI.exe](/downloads/pentest-workflow/SharpWMI.exe) ([SHA-256](/downloads/pentest-workflow/SharpWMI.exe.sha256) · [GPG signature](/downloads/pentest-workflow/SharpWMI.exe.sha256.asc)) [SharpDPAPI.exe](/downloads/pentest-workflow/SharpDPAPI.exe) ([SHA-256](/downloads/pentest-workflow/SharpDPAPI.exe.sha256) · [GPG signature](/downloads/pentest-workflow/SharpDPAPI.exe.sha256.asc)) [LaZagne.exe](/downloads/pentest-workflow/LaZagne.exe) ([SHA-256](/downloads/pentest-workflow/LaZagne.exe.sha256) · [GPG signature](/downloads/pentest-workflow/LaZagne.exe.sha256.asc)) | Impacket-Cheatsheet · Ligolo-ng Cheat sheet · Mimikatz-Cheatsheet · [13 - Stage 10 - Lateral Movement Pivoting and Loot](/sheets/pentest-workflow/lateral-movement-pivoting-and-loot) | 50 | 11 Reporting | note-taking, PoC capture, [SysReptor](https://github.com/Syslifters/sysreptor)/[pwndoc](https://github.com/pwndoc/pwndoc), [CVSS 4.0 calculator](https://www.first.org/cvss/calculator/4.0), retest | — | 10 - Proof of Concept & Post-Engagement · [15 - Stage 11 - Documentation and Reporting](/sheets/pentest-workflow/documentation-and-reporting) | 51 | 🌲 Trusts | [ticketer](https://github.com/fortra/impacket)/[mimikatz](https://github.com/gentilkiwi/mimikatz) (SID history), [raiseChild](https://github.com/fortra/impacket), [Rubeus](https://github.com/GhostPack/Rubeus) asktgs, nltest, Get-DomainTrust, [DSInternals](https://github.com/MichaelGrafnetter/DSInternals) | [mimikatz_trunk.zip](/downloads/pentest-workflow/mimikatz_trunk.zip) ([SHA-256](/downloads/pentest-workflow/mimikatz_trunk.zip.sha256) · [GPG signature](/downloads/pentest-workflow/mimikatz_trunk.zip.sha256.asc)) [Rubeus.exe](/downloads/pentest-workflow/Rubeus.exe) ([SHA-256](/downloads/pentest-workflow/Rubeus.exe.sha256) · [GPG signature](/downloads/pentest-workflow/Rubeus.exe.sha256.asc)) | 🔶 Attack · 🔶 Attack · [14 - Domain Trusts and Cross-Forest](/sheets/pentest-workflow/domain-trusts-and-cross-forest) | 52 | 🧬 Worked Chains | Forest · Resolute · Fluffy · web→AD pattern (step-by-step: [16 - Appendix - Worked Chains](/sheets/pentest-workflow/worked-chains)) | — | HTB-Forest · Resolute · HTB-Fluffy | 53 54 ## Quick-reference tables 55 56 ### Hash → hashcat mode (memorize for the exam) 57 58 | Material | Sample prefix | hashcat `-m` | john format | 59 |---|---|---|---| 60 | Kerberoast RC4 TGS | `$krb5tgs$23$` | 13100 | krb5tgs | 61 | Kerberoast AES128 / AES256 | `$krb5tgs$17$` / `$18$` | 19600 / 19700 | krb5tgs | 62 | AS-REP roast | `$krb5asrep$23$` | 18200 | krb5asrep | 63 | NetNTLMv2 (Responder/Inveigh) | `user::DOMAIN:...` | 5600 | netntlmv2 | 64 | NTLM (from DCSync/SAM) | 32-hex | 1000 | nt | 65 | MSSQL 2012+ | `0x0200...` | 1731 | mssql12 | 66 67 ### GhostPack / SharpCollection family — which binary does what 68 69 | Binary (ships in attachments/) | Job | Stage | 70 |---|---|---| 71 | [Rubeus.exe](/downloads/pentest-workflow/Rubeus.exe) ([SHA-256](/downloads/pentest-workflow/Rubeus.exe.sha256) · [GPG signature](/downloads/pentest-workflow/Rubeus.exe.sha256.asc)) | Kerberos: roast, asktgt/asktgs, delegation, ticket inject | [Stage 05](/sheets/pentest-workflow/kerberos-attacks) | 72 | [Certify.exe](/downloads/pentest-workflow/Certify.exe) ([SHA-256](/downloads/pentest-workflow/Certify.exe.sha256) · [GPG signature](/downloads/pentest-workflow/Certify.exe.sha256.asc)) | ADCS template/CA enum + ESC abuse | [Stage 07](/sheets/pentest-workflow/adcs-and-certificate-abuse) | 73 | [Seatbelt.exe](/downloads/pentest-workflow/Seatbelt.exe) ([SHA-256](/downloads/pentest-workflow/Seatbelt.exe.sha256) · [GPG signature](/downloads/pentest-workflow/Seatbelt.exe.sha256.asc)) | Host situational awareness | [Stage 09](/sheets/pentest-workflow/privilege-escalation) | 74 | [SharpUp.exe](/downloads/pentest-workflow/SharpUp.exe) ([SHA-256](/downloads/pentest-workflow/SharpUp.exe.sha256) · [GPG signature](/downloads/pentest-workflow/SharpUp.exe.sha256.asc)) | Privesc misconfigs (C# PowerUp) | [Stage 09](/sheets/pentest-workflow/privilege-escalation) | 75 | [SharpDPAPI.exe](/downloads/pentest-workflow/SharpDPAPI.exe) ([SHA-256](/downloads/pentest-workflow/SharpDPAPI.exe.sha256) · [GPG signature](/downloads/pentest-workflow/SharpDPAPI.exe.sha256.asc)) | DPAPI masterkeys / credential blobs | [Stage 10](/sheets/pentest-workflow/lateral-movement-pivoting-and-loot) | 76 | [SharpWMI.exe](/downloads/pentest-workflow/SharpWMI.exe) ([SHA-256](/downloads/pentest-workflow/SharpWMI.exe.sha256) · [GPG signature](/downloads/pentest-workflow/SharpWMI.exe.sha256.asc)) | WMI lateral movement | [Stage 10](/sheets/pentest-workflow/lateral-movement-pivoting-and-loot) | 77 | [SharpView.exe](/downloads/pentest-workflow/SharpView.exe) ([SHA-256](/downloads/pentest-workflow/SharpView.exe.sha256) · [GPG signature](/downloads/pentest-workflow/SharpView.exe.sha256.asc)) | C# PowerView port (AD enum) | [Stage 04](/sheets/pentest-workflow/active-directory-enumeration) | 78 79 > [!warning] No official GhostPack releases 80 > These binaries come via the SharpCollection builds — verify each against [SHA256SUMS](/downloads/pentest-workflow/SHA256SUMS) ([GPG signature](/downloads/pentest-workflow/SHA256SUMS.asc)) and expect AMSI/Defender to flag them (AMSI-bypass or obfuscate via [donut_v1.1.zip](/downloads/pentest-workflow/donut_v1.1.zip) ([SHA-256](/downloads/pentest-workflow/donut_v1.1.zip.sha256) · [GPG signature](/downloads/pentest-workflow/donut_v1.1.zip.sha256.asc)) shellcode only where authorized). 81 82 ### Pivot picker — which tunnel when 83 84 | Situation | Reach for | Why | 85 |---|---|---| 86 | Full TUN interface through one foothold | [ligolo-ng](https://github.com/nicocha30/ligolo-ng) ([ligolo-ng_agent_windows_amd64.zip](/downloads/pentest-workflow/ligolo-ng_agent_windows_amd64.zip) ([SHA-256](/downloads/pentest-workflow/ligolo-ng_agent_windows_amd64.zip.sha256) · [GPG signature](/downloads/pentest-workflow/ligolo-ng_agent_windows_amd64.zip.sha256.asc))) | Real routes; nmap/nxc work natively, no proxychains | 87 | Quick SOCKS over one TCP stream, HTTP-friendly egress | [chisel](https://github.com/jpillora/chisel) ([chisel.exe](/downloads/pentest-workflow/chisel.exe) ([SHA-256](/downloads/pentest-workflow/chisel.exe.sha256) · [GPG signature](/downloads/pentest-workflow/chisel.exe.sha256.asc)) / [chisel_linux_amd64](/downloads/pentest-workflow/chisel_linux_amd64) ([SHA-256](/downloads/pentest-workflow/chisel_linux_amd64.sha256) · [GPG signature](/downloads/pentest-workflow/chisel_linux_amd64.sha256.asc))) | Single binary, works through proxies/WAFs | 88 | SSH available on the pivot | [sshuttle](https://github.com/sshuttle/sshuttle) | No binary on target needed | 89 | Only DNS egress | [dnscat2](https://github.com/iagox86/dnscat2) / [iodine](https://github.com/yarrick/iodine) | Last resort; slow | 90 91 ### Potato picker — SeImpersonate/SeAssignPrimaryToken → SYSTEM 92 93 | Target OS | First try | Fallback | 94 |---|---|---| 95 | Server 2016 / Win10 <1809 (or anything old) | [JuicyPotato.exe](/downloads/pentest-workflow/JuicyPotato.exe) ([SHA-256](/downloads/pentest-workflow/JuicyPotato.exe.sha256) · [GPG signature](/downloads/pentest-workflow/JuicyPotato.exe.sha256.asc)) | [SweetPotato.exe](/downloads/pentest-workflow/SweetPotato.exe) ([SHA-256](/downloads/pentest-workflow/SweetPotato.exe.sha256) · [GPG signature](/downloads/pentest-workflow/SweetPotato.exe.sha256.asc)) | 96 | Server 2019/2022, Spooler running | [PrintSpoofer64.exe](/downloads/pentest-workflow/PrintSpoofer64.exe) ([SHA-256](/downloads/pentest-workflow/PrintSpoofer64.exe.sha256) · [GPG signature](/downloads/pentest-workflow/PrintSpoofer64.exe.sha256.asc)) | [SweetPotato.exe](/downloads/pentest-workflow/SweetPotato.exe) ([SHA-256](/downloads/pentest-workflow/SweetPotato.exe.sha256) · [GPG signature](/downloads/pentest-workflow/SweetPotato.exe.sha256.asc)) | 97 | Server 2019/2022+, Spooler disabled | [GodPotato-NET4.exe](/downloads/pentest-workflow/GodPotato-NET4.exe) ([SHA-256](/downloads/pentest-workflow/GodPotato-NET4.exe.sha256) · [GPG signature](/downloads/pentest-workflow/GodPotato-NET4.exe.sha256.asc)) (.NET 4) or [GodPotato-NET35.exe](/downloads/pentest-workflow/GodPotato-NET35.exe) ([SHA-256](/downloads/pentest-workflow/GodPotato-NET35.exe.sha256) · [GPG signature](/downloads/pentest-workflow/GodPotato-NET35.exe.sha256.asc)) (.NET 3.5) | [SweetPotato.exe](/downloads/pentest-workflow/SweetPotato.exe) ([SHA-256](/downloads/pentest-workflow/SweetPotato.exe.sha256) · [GPG signature](/downloads/pentest-workflow/SweetPotato.exe.sha256.asc)) (EfsRpc mode) | 98 99 > [!tip] CPTS exam tip 100 > `whoami /priv` is the first command on any Windows foothold. SeImpersonatePrivilege + any potato = SYSTEM in under a minute; SeDebugPrivilege → [mimikatz](https://github.com/gentilkiwi/mimikatz)/procdump LSASS; SeBackupPrivilege → copy SAM/SYSTEM/ntds.dit. 101 102 > [!tools] Modern toolchain (2026) — quick reference 103 > - `cme` → [NetExec](https://github.com/Pennyw0rth/NetExec) (`nxc`) — CrackMapExec is legacy. 104 > - BloodHound Legacy → [BloodHound CE](https://github.com/SpecterOps/BloodHound) + bloodhound-ce-python / RustHound-CE collectors. 105 > - ADCS by hand → Certipy (`certipy-ad find -vulnerable`) / on-host Certify. 106 > - Missing a Go binary? kerbrute, fscan, gowitness, chisel and ligolo-ng agents are already in `attachments/`. 107 108 > [!opsec] Before staging any attachment 109 > Every binary in `attachments/` is signatured by modern AV/EDR (Rubeus, mimikatz, Snaffler especially). Verify hashes against [SHA256SUMS](/downloads/pentest-workflow/SHA256SUMS) ([GPG signature](/downloads/pentest-workflow/SHA256SUMS.asc)), stage only on in-scope lab hosts, and delete artifacts on cleanup ([Stage 11](/sheets/pentest-workflow/documentation-and-reporting)). 110 111 > [!info] Companion notes 112 > - **[Most-Used-Commands](/sheets/pentest-workflow/most-used-commands)** — the raw per-tool syntax reference this guide leans on. 113 > - **[Attack-Flow-Guide](/sheets/pentest-workflow/attack-flow-guide)** — service-by-service enumeration playbooks + decision trees (built from the 0xdf CPTS-prep boxes). 114 > - **AD_Pentest_Tools_Cheat_Sheet** — one-line summary of every AD tool. 115 > - The **AD-Attack category folders** (#1–#78) are the exhaustive per-technique deep dives; this guide links the relevant one at each step. 116 117 > [!abstract] `> USING_THIS` 118 > Work the spine (recon → enum → the AD stages), and every time loot drops a new credential, **restart from STAGE 4 as that identity** — new user = new BloodHound edges = new surface. Keep `/etc/hosts` and the clock in sync the whole way. Reverse every AD write you make (STAGE 6 OPSEC). Flags on HTB usually fall at *foothold* and *DA*; the stages between are the grind this playbook is for. 119 > 120 > *Authorized HTB lab / CPTS practice only.* 121 --- 122 123 > [!navigation] Continue the attack flow 124 > **Previous:** [Appendix — Worked Chains](/sheets/pentest-workflow/worked-chains) 125 > 126 > **Dashboard:** [HTB Pentest Attack Flow](/sheets/pentest-workflow/attack-flow-dashboard) 127 > 128 > **Next:** [HTB Pentest Attack Flow](/sheets/pentest-workflow/attack-flow-dashboard)