CRTO Certified Red Team Operator
  • 👋Exam Guide and Notes
  • Author
  • 1️⃣Getting Started
    • Course Introduction
    • What is Red Teaming?
    • What is OPSEC?
    • Primum non nocere?
    • Attack Lifecycle
    • Engagement Planning
    • Post-Engagement & Reporting
  • 2️⃣Command & Control
    • Overview
    • Red Team Ops Lab
    • Cobalt Strike
    • Starting the Team Server
    • Listener Management
    • Generating Payloads
    • Interacting with Beacon
    • Pivot Listeners
    • Running as a Service
  • 3️⃣External Reconnaissance
    • Page 2
    • External Reconnaissance
    • DNS Records
    • Google Dorks
    • Social Media
  • 4️⃣Initial Compromise
    • 🌴Initial Compromise
    • Password Spraying
    • Internal Phishing
    • Initial Access Payloads
    • Visual Basic for Applications (VBA) Macros
    • Remote Template Injection
    • HTML Smuggling
  • 🟢Host Reconnaissance
    • 🌴Host Reconnaissance
    • Processes
    • Seatbelt
    • Screenshots
    • Keylogger
    • Clipboard
    • User Sessions
  • 🟢Host Persistence
    • Host Persistence
    • Startup Folder
    • Registry AutoRun
    • Hunting for COM Hijacks
    • Headless Cobalt Strike
  • 💚Host Privilege Escalation
    • Host Privilege Escalation
    • Windows Services
    • Unquoted Service Paths
    • Weak Service Permissions
    • Weak Service Binary Permissions
    • UAC Bypasses
  • 🟢Host Persistence (Reprised)
    • Elevated Host Persistence
    • Windows Services
    • WMI Event Subscriptions
  • 🟢Credential Theft
    • Obtaining Credential Material
    • Beacon + Mimikatz
    • NTLM Hashes
    • Kerberos Encryption Keys
    • Security Account Manager
    • Domain Cached Credentials
    • Extracting Kerberos Tickets
    • DCSync
  • 🟢Password Cracking Tips & Tricks
    • Password Cracking Tips & Tricks
    • Wordlists
    • Wordlist + Rules
    • Masks
    • Mask Length & Mask Files
    • Combinator
    • Hybrid
    • kwprocessor
  • 🟢Domain Reconnaissance
    • Domain Recon
    • PowerView
    • SharpView
    • ADSearch
  • 🟢User Impersonation
    • User Impersonation
    • Pass the Hash
    • Pass the Ticket
    • Overpass the Hash
    • Token Impersonation
    • Process Injection
  • 🟢Lateral Movement
    • Lateral Movement
    • Windows Remote Management
    • PsExec
    • Windows Management Instrumentation (WMI)
    • The Curious Case of CoInitializeSecurity
    • DCOM
  • 🟢Session Passing
    • Session Passing
    • Beacon Passing
    • Foreign Listener
    • Spawn & Inject
  • 🟢Pivoting
    • SOCKS Proxies
    • Linux Tools
    • Windows Tools
    • Browsers
    • Reverse Port Forwards
    • NTLM Relaying
Powered by GitBook
On this page

Was this helpful?

  1. External Reconnaissance

Page 2

  • External Reconnaissance

  • DNS Records

  • Google Dorks

  • Social Media

PreviousRunning as a ServiceNextExternal Reconnaissance

Last updated 2 years ago

Was this helpful?

3️⃣