daemon-sec-cheatsheet

The cheatsheet vault for operators: AD, enumeration, exploitation, priv-esc, web, DFIR
git clone https://git.daemon-sec.xyz/daemon-sec-cheatsheet.git
Log | Files | Refs | README | LICENSE

DateCommit messageAuthorFiles+-
2026-10-10 11:31feat: link the source on git.daemon-sec.xyzDAEMON4+14-3
2026-10-09 12:45added a better rustscan cheatsheetDAEMON3+729-500
2026-10-07 12:41Bring over daemon-sec's dot field, hero card icons, cursor pill and fadesDAEMON31+1858-2956
2026-10-05 14:52Fixed the banner on posts and cheatsheetsDAEMON1+10-7
2026-10-05 14:50UpdateDAEMON0+0-0
2026-10-05 14:49UpDAEMON0+0-0
2026-10-05 14:49UpDAEMON0+0-0
2026-10-05 14:49UpdateDAEMON1+16-4
2026-10-05 14:52WIP: pre-deploy syncDAEMON0+0-0
2026-10-05 14:35UpDAEMON0+0-0
2026-10-05 14:34UpdateDAEMON8+239-13
2026-10-05 12:25JJ Update: removed distracting particle effect from posts, it only shows up in the main page hero and at the top of each page, while viewing a post you will not be abl to see it at all Mon Oct 5 13:25:19 BST 2026DAEMON17+159-395
2026-10-04 06:13Expand verified OSINT guides and add the global signal fieldDAEMON16+3860-220
2026-10-04 05:16Design the signal-field port onto the section bannersDAEMON1+305-0
2026-10-03 17:51Add a discovery index for the two OSINT tool cataloguesDAEMON2+8554-0
2026-10-03 17:51Strip Obsidian vault-renderer artifacts from 21 sheetsDAEMON22+94-165
2026-10-03 17:51Finish the OSINT usage pass: the last six sheetsDAEMON8+3030-225
2026-10-03 17:51Add nine Windows-internals sheets to DFIR, from ired.teamDAEMON9+2269-0
2026-10-03 17:51Add three process-injection sheets under exploitationDAEMON3+478-0
2026-10-03 17:51Give the OSINT sheets working commands instead of tool cataloguesDAEMON8+3354-254
2026-10-03 17:51Fix fetch-ired.py image URLs, and record the ired.team provenance positionDAEMON4+402-5
2026-09-30 05:09Keep the literal characters in the package description$: DAΞMON1+1-1
2026-09-30 05:04Upgrade to Astro 7$: DAΞMON2+3139-3828
2026-09-30 04:56Allow inline scripts by hash instead of 'unsafe-inline'$: DAΞMON4+94-30
2026-09-30 04:32Send security headers from Cloudflare, and drop the eval the CSP forbids$: DAΞMON3+44-3
2026-09-30 03:26Open each page as a circle from the link that was pressed$: DAΞMON2+90-2
2026-09-28 07:17OSINT: add all 282 OSINT Newsletter tools and the missing Bellingcat categoryDAEMON15+403-38
2026-09-28 05:12Drop GitHub Pages, GitLab Pages and Vercel; Cloudflare is the only hostDAEMON7+18-94
2026-09-28 03:55Add an OSINT section: 16 sheets across 10 subsectionsDAEMON18+2334-2
2026-09-28 03:25Keep fetch-ired.py scratch out of the working copyDAEMON2+10-1
2026-09-28 03:05Add ired.team provenance plumbing: references, figure credit, fetch helperDAEMON8+834-0
2026-09-26 13:46Add Google dorking cheat sheet and the dorkforge companion script$: DAΞMON7+2561-1
2026-09-26 09:09Add five DFIR sheets: acquisition, EZ Tools/KAPE, Linux, strings triage, GUI tools$: DAΞMON5+1670-0
2026-09-26 05:50Add link validation, mobile TOC + back-to-top, and expand nine sheets$: DAΞMON23+356-40
2026-09-26 00:07Expand fifteen sheets with lifecycle, detection and tooling detail$: DAΞMON15+1308-70
2026-09-24 20:25Point source links at GitLab and add a GitLab Pages mirror$: DAΞMON5+25-5
2026-09-20 03:17recycle-bin: use certipy-ad, the real binary nameDAEMON1+4-4
2026-09-20 03:01recycle-bin: add SID-filtered Restore-ADObject and Get-ADUser verifyDAEMON1+6-1
2026-09-20 02:53Generalize AD Recycle Bin cheat sheet (drop box-specific naming)DAEMON2+147-190
2026-09-20 02:39Expand Recycle Bin cheat sheet: native PS, PowerView, bloodyAD, ldapsearchDAEMON1+32-4
2026-09-20 01:35Add AD Recycle Bin enumeration cheat sheet (TombWatcher / ESC15)DAEMON1+162-0
2026-09-20 00:51Add native Active Directory enumeration cheat sheet pageDAEMON1+226-0
2026-09-19 08:03updateDAEMON1+235-1
2026-09-19 05:05docs(bloodyad): expand GenericWrite targeted Kerberoast section$: DAΞMON1+57-4
2026-09-18 22:26updateDAEMON1+39-2
2026-09-18 22:26Remove CPTS exam companion and General CPTS cheatsheetsDAEMON12+0-6692
2026-09-17 15:42Add redis-cli cheat sheet$: DAΞMON1+251-0
2026-09-17 04:42Add SMTP user enumeration and Amass cheat sheets$: DAΞMON3+291-1
2026-09-17 00:59State why HackTricks is mirrored on the homepageDAEMON1+4-2
2026-09-17 00:47Fix corpus-wide code fence corruption in the HackTricks mirrorDAEMON570+81282-6547
2026-09-17 00:38Expand ADS enumeration; make the potato→ADS link explicitDAEMON2+58-14
2026-09-17 00:32Split Potato Attacks & ADS guide into two sheetsDAEMON4+876-764
2026-09-17 00:23Fix broken links across the HackTricks mirrorDAEMON151+667-403
2026-09-16 23:52Add HackTricks content mirrorDAEMON626+84624-28
2026-09-16 23:51Add Cloudflare Workers deployment configDAEMON2+18-1
2026-09-16 23:44Add runas/PSCredential guide for running a session as another user$: DAΞMON1+52-0
2026-09-16 23:27Add KeePass vault discovery commands to Windows credential hunting$: DAΞMON1+30-0
2026-09-16 22:09feat: add detailed Attacking Common Services guide (CPTS module 11)$: DAΞMON3+682-3
2026-09-16 01:59Replace unrendered mermaid diagrams with native flow chartsDAEMON39+1765-743
2026-09-15 04:07docs: generalise Potato & ADS guide into a repeatable field methodDAEMON1+120-73
2026-09-15 02:40feat: add Network Service Attack Manual companion guideDAEMON3+1117-4
2026-09-15 02:40feat: add HTB Jeeves worked example to Potato & ADS guideDAEMON1+124-0
2026-09-15 02:40feat: add Potato Attacks & Alternate Data Streams companion guideDAEMON2+555-0
2026-09-15 01:35feat: add detailed Attacking Common Applications guide (CPTS module 24)DAEMON13+1654-0
2026-09-15 00:59feat: add detailed feroxbuster content-discovery cheatsheetDAEMON1+359-0
2026-09-13 23:18fix: added more information to ESC16, wmiexec on fluffy does not work making sure reader knows thisDAEMON1+12-3
2026-09-14 04:55feat: small updateDAEMON1+16-8
2026-09-14 03:18updating a few different AD cheat sheets added credhunting for windows and linuxDAEMON12+932-18
2026-09-14 03:18kerberoasting: add per-tool single-account targeting + clock skewDAEMON1+57-1
2026-09-13 05:50updated the JtR cheatsheet thanksDAEMON1+223-17
2026-09-07 13:36Merge pull request #4 from DAEMON-404/claude/repo-automated-sync-skgk17$: DAΞMON3+183-61
2026-09-07 13:23Move the sync out of the workflow and into a scriptClaude3+183-61
2026-09-07 13:12Merge pull request #3 from DAEMON-404/claude/repo-automated-sync-skgk17$: DAΞMON181+561-423
2026-09-07 13:11sync: InternalAllTheThings @ 203bb0c0b290Claude177+420-354
2026-09-07 13:11Sync both mirrors straight to main, dailyClaude4+141-69
2026-09-07 12:57Merge pull request #2 from DAEMON-404/sync/payloads$: DAΞMON137+326-324
2026-09-07 12:36sync: PayloadsAllTheThings @ 3ac27901c711DAEMON-404137+326-324
2026-09-03 00:31Masthead: point the external icon at the main site, drop the GitHub iconDAEMON2+5-7
2026-09-03 00:11Redesign the vault homepage to match daemon-sec.xyzDAEMON18+1369-331
2026-08-31 20:10sheets: wire Attacking Enterprise Networks into pentest-workflow nav (order + backlinks)DAEMON3+3-1
2026-08-31 11:35sheets: add Attacking Enterprise Networks worked chain (pentest-workflow)DAEMON1+561-0
2026-08-30 18:07sync Vercel-ready redesign into the siteDAEMON203+72143-1570
2026-08-28 20:16scripts: point vault porters at the Linux vault (was stale macOS /Volumes path)$: DAΞMON3+3-3
2026-08-28 20:16sheets: add The jj Field Guide (git-workflow) with embedded PDF$: DAΞMON2+57-0
2026-08-28 19:23Update: Fixed Search iconDAEMON14+3280-3269
2026-08-28 18:49tmux: add pane, session and zoom cheatsDAEMON15+5751-5253
2026-08-19 22:40added link back to main site$: DAΞMON1+10-0
2026-08-15 19:29🔧 Update [main] | 15 Aug 2026 20:29:25 BST$: DAΞMON9+336-3
2026-08-13 01:19Merge branch 'main' of https://github.com/DAEMON-404/daemon-sec-cheatsheet$: DAΞMON0+0-0
2026-08-13 01:06feat: mirror InternalAllTheThings; credit third-party sheets$: DAΞMON2+116-116
2026-08-13 01:06🔧 Update [main] | 13 Aug 2026 02:06:26 BST$: DAΞMON2+116-116
2026-08-13 00:59feat: mirror InternalAllTheThings; credit third-party sheets$: DAΞMON233+29996-667
2026-08-13 00:03ci: pin sync to short sha; manifest page count$: DAΞMON2+6-5
2026-08-12 23:55ci: weekly PayloadsAllTheThings sync workflow$: DAΞMON1+59-0
2026-08-12 23:51🔧 Update [main] | 13 Aug 2026 00:51:34 BST$: DAΞMON3+91-0
2026-08-12 03:17🔧 Update [main] | 12 Aug 2026 04:17:54 BST$: DAΞMON33+2-16425
2026-08-12 02:54🔧 Update [main] | 12 Aug 2026 03:54:36 BST$: DAΞMON36+18404-1237
2026-08-10 02:17🔧 Update [main] | 10 Aug 2026 03:17:49 BST$: DAΞMON138+371-37
2026-08-10 01:30🔧 Update [main] | 10 Aug 2026 02:30:45 BST$: DAΞMON160+51948-10
2026-08-10 00:57🔧 Update [site-aesthetic] | 10 Aug 2026 01:57:07 BST$: DAΞMON30+2520-755
2026-08-09 22:20🔧 Update [main] | 09 Aug 2026 23:20:20 BST$: DAΞMON5+7-7
2026-08-09 22:14Initial Commit$: DAΞMON254+74771-0