Pentesting & Recon

Poison network name resolution with ARP, DHCP and WPAD spoofing to capture NTLM

Scan web servers for outdated software, dangerous files and misconfigurations with Nikto

Run detailed Nmap scans for service versions, OS fingerprints and NSE checks

Relay NTLM authentication with Responder and ntlmrelayx to SMB, LDAP and ADCS

Check targets against thousands of Nuclei templates for CVEs and misconfigurations

Check credentials and run commands across SMB and AD hosts with NetExec

Exploit common Chinese OA systems like Seeyon, Weaver, Yonyou and Tongda

Assess SCADA, PLC and HMI systems and Modbus or DNP3 industrial protocols

Decrypt and forge CBC ciphertext with PadBuster against padding oracle bugs

Gather target asset intel passively through FOFA, Quake and Hunter search engines

Keep long-term access on Linux and Windows through cron, services and WMI

Escape PHP disable_functions and open_basedir limits after gaining a webshell

Test POP3 mail servers for weak logins, banners and exposed mailbox content

Exploit Portainer through default logins, Docker API abuse and host mounts

Run Linux post-exploitation from privilege escalation to credential hunting

Run Windows post-exploitation for UAC bypass, LSASS dumps and domain recon

Exploit exposed PostgreSQL servers for hash theft, file reads and COPY RCE

Pentest PostgreSQL servers for default logins, file access and command execution

Test LLM apps for indirect prompt injection through web pages and documents

Test chatbots against jailbreak techniques such as role-play and encoding tricks

Test LLM apps for system prompt leaks and exposed tool lists

Attack exposed RabbitMQ brokers through guest logins and management API abuse

Exploit race conditions in balances, coupons and limits with single-packet attacks

Test RDP services for weak logins, session hijacking and NLA bypass

Run full active reconnaissance from subdomains and port scans to POC checks

Orchestrate a full red team engagement from reconnaissance through to reporting

Exploit unauthenticated Redis servers for data theft and remote code execution

Pentest Redis servers for unauthenticated access, webshell writes and SSH key injection

Write a formal penetration test or red team report with CVSS risk ratings

Capture NTLMv2 hashes by poisoning LLMNR, NBT-NS and mDNS name lookups with Responder

Review sandbox evasion techniques such as environment checks and timing tricks

Attack Microsoft SCCM and MECM sites for credential theft and server takeover

Attack Istio and Linkerd service meshes for config theft and lateral movement

Generate C, C++ or Rust shellcode loaders from a stored component library

Operate the Sliver C2 framework with mTLS, DNS and WireGuard implants

Test SMB shares, users and credentials for lateral movement on Windows networks

Test SMTP servers for user enumeration, open relay and mail spoofing

Test SNMP services for default community strings and exposed device configs

Gather staff emails and org details to prepare phishing and social engineering tests

Attack SonarQube instances for source code theft through default admin logins

Brute force directories and fingerprint web targets quickly with spray

Exploit SQL Server with xp_cmdshell, linked servers and SQL Agent persistence

Test SSH services for weak credentials, user enumeration and tunnel pivoting

Combine DNS brute force, OSINT and crawling to find more subdomains

Enumerate subdomains passively from Shodan, Censys and VirusTotal with subfinder

Test package registries for dependency confusion, typosquatting and CI poisoning

Build a structured target profile and attack-surface summary for team tests

Pentest Tencent Cloud CAM, CVM, COS, TKE and SCF for privilege escalation

Inspect TLS certificates, cipher suites and JARM fingerprints with tlsx