SpellBook

<- Back to main page
Welcome!

01. Passive Recon
02. Active Recon
- Port Scan
- Web Assets Enumeration
03. Enumeration
04. Initial Access
- Rdp
- Smb
- Timeroasting
- Win Rm
05. Defense Evasion
06. Privilege Escalation
- Linux
  - Cve
  - Privileged Groups
    - Adm
    - Docker
    - Lxc
  - Credential Search
  - Crontab
  - Enumeration
  - Kubernetes
  - Nfs
  - Path Injection
  - Python Library Hijack
  - Sudo
- Windows
07. Credential Looting
08. Discovery
09. Pivoting
- Chisel
- Dnscat2
- Ligolo Ng
- Metasploit
- Port Forward
- SSH
10. Lateral Movement
File Transfer
- Edge Cases
- Encrypted Transfer
- Linux Target
- Nginx
- Rdp
- Windows Target
- Win Rm
Misc
Password Crack
- Hashcat
- Hash ID
- John
Syntax Cheatsheets
- Cewl
- Metasploit
- Node Js
- Open Ssl
- Powershell
- Sed
- Shell Fu
- SQL Syntax
- Sqlmap

Public S3 Buckets

Public S3 buckets, Azure blobs#

Just GrayHatWarfare it

Otherwise, here is G(olden)G(low) dorks queries

inurl:amazonaws.com

inurl:blob.core.windows.net

DNS Source Code