Pentesting & Recon

Pivot from GCP service accounts into Google Workspace mail, drive and admin data

Recover full source code, branches and stashes from exposed .git directories

Fingerprint services and middleware versions precisely with gogo port scanning

Attack Harbor container registries with default logins and image tampering

Crack captured password hashes offline with GPU-accelerated hashcat rules and masks

Chain HTTP request smuggling into credential theft, ACL bypass and cache poisoning

Probe HTTP services in bulk for status, titles, tech stacks and CDNs with httpx

Pentest Huawei Cloud IAM, ECS, OBS and container services for misconfigurations

Brute force logins for SSH, FTP, RDP, SMB and 50+ other protocols with Hydra

Test IMAP mail servers for weak logins, mailbox enumeration and command injection

Use Impacket for SMB, Kerberos and WMI remote execution and credential dumps

Map an internal network after a foothold to find hosts, services and domain controllers

Study iOS kernel, WebKit and sandbox exploit chains and known CVEs

Pentest iOS apps through IPA analysis, Frida hooks and Keychain storage checks

Forward ports and build SOCKS5 tunnels through restricted networks with iox

Crack offline hashes from ZIP, PDF, SSH keys and more with John the Ripper

Extract hidden API paths, keys and WebSocket endpoints from JavaScript bundles

Check whether a CTF challenge is solved and what to try next after a failure

Check whether a pentest has covered every attack surface and where gaps remain

Attack JWT tokens with alg none, weak secrets, key confusion and kid injection

Test Kubernetes clusters for container escapes, API server exposure and RBAC abuse

Check Kubernetes ingress-nginx clusters for the IngressNightmare CVE-2025-1974 RCE

Test Istio service mesh authorization policies for Envoy sidecar bypasses

Discover services inside a Kubernetes cluster from a pod using DNS recon

Capture traffic from sidecar containers in shared pod networks to steal data

Exploit NFS, EFS and volume mounts in Kubernetes pods to read sensitive data

Abuse Kubernetes admission webhooks and policy engines like Kyverno and OPA

Discover Kubernetes services through DNS PTR, SRV and zone transfer probes

Exploit unauthenticated Kafka brokers to read topics, ACLs and Connect secrets

Crawl sites and JavaScript to discover endpoints and forms with katana

Request service tickets for offline cracking with Kerberoasting and AS-REP Roasting

Use advanced Kerberos attacks like noPac, Timeroasting and Sapphire tickets

Attack Kerberos with AS-REP roasting, Kerberoasting and forged tickets

Brute force and validate subdomains at high speed with raw packets

Move between Windows and Linux hosts with stolen credentials via SSH, WMI or PsExec

Enumerate Active Directory over LDAP with anonymous binds and injection tests

Navigate local wordlists, payload libraries and PoC collections for fuzzing

Expand, aggregate and slice CIDR ranges into IP lists with mapcidr

Scan huge IP ranges for open ports at very high speed with masscan

Test MCP servers for tool poisoning, shadow tools and cross-server attacks

Test exposed Memcached servers for open access, cache data leaks and DDoS abuse

Exploit Tomcat, WebLogic, JBoss and IIS with weak admins and WAR webshells

Exploit unauthenticated MongoDB servers and NoSQL injection to dump data

Run Metasploit exploits, payload handlers and post-exploitation modules from the CLI

Pentest MSSQL servers for default logins, xp_cmdshell and linked server abuse

Build tunnels with frp, chisel and SSH to pivot through multi-layer networks

Pentest MySQL servers for default logins, UDF abuse and file read or write

Deploy the Mythic C2 framework for authorized red team exercises and payload builds

Find open ports fast with naabu SYN and connect scans before deeper testing