Domain overview
This domain focuses on infrastructure, trust relationships and movement through enterprise environments. Enumeration quality, credential handling, lateral movement, pivoting and evidence discipline are central here.
Related certification context
These certifications are useful orientation points for this domain and are included as context, not as gatekeeping.
- OffSec OSCP+ / PEN-200Foundational penetration-testing workflow, exploitation discipline and reporting under pressure.
- OffSec OSEP / PEN-300Advanced internal operations, evasion, pivoting and mature operator tradecraft.
Curated public references
- Nmap · Man.htmlnmap.org/book/man.html
- BloodHound Documentationbloodhound.specterops.io/
- GitHub · fortra / impacketgithub.com/fortra/impacket
- MITRE ATT&CKattack.mitre.org/
- NetExec Wikinetexec.wiki/
Brief index
Introduction
Infrastructure-facing techniques for enumeration, access, movement and evidence-led validation.
Network Pentesting Theory
Infrastructure-facing techniques for enumeration, access, movement and evidence-led validation.
Network Pentesting Practice
Hands-on internal testing patterns for enumeration, footholds, validation and targeted exploitation.
Password Cracking
Wordlists, profiling, hash formats and the trade-offs between offline cracking and online guessing.
Active Directory Pentesting
Trust mapping, attack-path discovery, authentication abuse and post-compromise movement inside Windows domains.
Active Directory Pentesting Quick Reference
Trust mapping, attack-path discovery, authentication abuse and post-compromise movement inside Windows domains.
C2 Frameworks
Infrastructure-facing techniques for enumeration, access, movement and evidence-led validation.
Thick Client Pentesting
Client-side review of rich applications, local storage, protocol handling and trust assumptions.
Exploit Pack
Infrastructure-facing techniques for enumeration, access, movement and evidence-led validation.
Persistence
Infrastructure-facing techniques for enumeration, access, movement and evidence-led validation.
Pivoting & Portforwarding
Industrial protocols, safety constraints and legacy trust assumptions in operational environments.
Powerview Quick Reference
Infrastructure-facing techniques for enumeration, access, movement and evidence-led validation.
Cobalt Strike Quick Reference
Infrastructure-facing techniques for enumeration, access, movement and evidence-led validation.
Quick Reference
Infrastructure-facing techniques for enumeration, access, movement and evidence-led validation.
Eptp - Pentesting Certification
Public certification references relevant to the surrounding discipline.