Pentesting & Recon

Spot client SOC patches and defensive changes during a red-team engagement

Run external recon with subdomain enumeration, cloud bucket and identity probes

Test Okta tenants for user enumeration, password spray and phishing gaps

Run a staged external OSINT pipeline from seed domains to exposure reporting

Separate real assets from same-named unrelated companies in recon output

Keep red-team testing offensive so real findings are not missed or retracted

Structure client red-team reports with subject, impact and PoC sections

Write bug bounty reports for H1, Bugcrowd and Intigriti with CVSS scoring

Pull payloads, bypass tables and wordlists for web vulnerability testing

Map software supply-chain exposure like dependency confusion and CI injection

Validate a bug finding with a 7-question gate before writing any report

Fingerprint VMware vCenter and map its high-impact CVE attack chain

Chain subfinder, httpx, katana and ffuf into a web recon pipeline

Guide authorized Active Directory pentesting on Kerberoasting, DCSync and ticket attacks

Test APIs for security flaws such as IDOR during authorized bug bounty work

Guide authorized AWS pentests covering IAM, S3, metadata SSRF and Lambda

Test web apps for broken authentication, session flaws and weak password policies

Intercept, modify and scan web traffic with Burp Suite during security testing

Pentest Azure, AWS, GCP and O365 for misconfigurations and exposed secrets

Learn the penetration testing lifecycle from recon through reporting

Test web apps for path traversal and LFI flaws during authorized security tests

Test web pages for HTML injection flaws during authorized security assessments

Find insecure direct object references and broken access control in web apps

Audit Linux systems for sudo, SUID and cron privilege escalation paths

Use Metasploit for authorized exploit testing, payloads and post-exploitation

Configure HTTP, SNMP and SMB services in a lab to practice network testing

Plan a penetration test with scope definition and an assessment checklist

Reference nmap, hydra, john and nikto commands for penetration testing

Review privilege escalation techniques for Linux and Windows in authorized tests

Follow red team and bug bounty methods for recon, subdomains and XSS hunting

Run vulnerability scans for open ports, web apps and cloud compliance

Search Shodan to map exposed services and devices in authorized recon work

Test mail servers for open relays, user enumeration and weak SMTP logins

Test for SQL injection flaws and extract data during authorized assessments

Automate SQL injection testing with sqlmap during authorized database assessments

Audit SSH configurations and test credentials and tunnels in authorized assessments

Find Windows privilege escalation vectors in authorized post-exploitation work

Scan WordPress sites for vulnerable plugins, themes and users with WPScan

Test for cross-site scripting and client-side injection in authorized web tests

Decode hex and scrambled messages by running bundled cipher scripts

Look up CTF techniques across web, crypto, pwn and reverse engineering for study

Test Android apps with APK analysis, runtime hooks, signing recovery and traffic capture

Solve CTF crypto challenges with RSA, AES, ECC and LFSR attack techniques

Work through CTF misc challenges like jail escapes, steganography and encoding chains

Solve CTF web challenges using PHP tricks, SSTI chains and deserialization gadgets

Check HackerOne program scope and rules before testing each in-scope asset

Run lateral movement, credential theft and AD attack tests inside authorized networks

Collect open source intelligence on servers, sites, domains and people

Quick reference for pentest tools, reverse shells, exploits and escalation