# 7MinSec Wiki

> This is the 7 Minute Security wiki - a place where 7 Minute Security jots down notes and how-tos about all things pentesting!

- [7MinSec Wiki](https://7minsec.wiki/index.md): 7MinSec Wiki
- [Blue Team](https://7minsec.wiki/blueteam/index.md): Some bleed red. Others? Blue.
- [CMD Kung Fu](https://7minsec.wiki/cmd/index.md): This section has some cool cmd-line kung fu you can do.
- [Hardware](https://7minsec.wiki/hardware/index.md): Info about hardware related to pentesting.
- [Pentesting](https://7minsec.wiki/pentesting/index.md): "Pen, pentesting is good for me. It gives me the giggidies. Tee hee hee." -Brian
- [Software](https://7minsec.wiki/software/index.md): Software!
- [Scripts](https://7minsec.wiki/scripts/index.md): They're now in this dedicated repo: https://github.com/7MinSec/7MinSecWikiScripts!
- [Support](https://7minsec.wiki/support/index.md): Are you enjoying this and other free resources 7 Minute Security shares with the security community? In addition to this wiki project, we offer:

## Blue Team

- [Egress filtering](https://7minsec.wiki/blueteam/egressfiltering.md): Below is info from a really old internal doc I kept at one of my past jobs, but it gave our customers some ideas for traffic they might want to filter on their egress Internet connection to keep potentially bad stuff away.
- [Kerberoasting](https://7minsec.wiki/blueteam/kerberoasting.md): _wald0 has a helpful tweet on preventing Kerberoasting. Also, this article from MS shares "a practical way to clean up dead SPNs in Active Directory," and authored a script to help in the cleanup efforts as well.
- [LAPS](https://7minsec.wiki/blueteam/laps.md): Local Administrator Password Solution (LAPS) "is a Windows feature that automatically manages and backs up the password of a local administrator account on your Microsoft Entra joined or Windows Server Active Directory-joined devices.
- [Pwned Passwords](https://7minsec.wiki/blueteam/pwnedpasswords.md): This document hasn't been updated for a few years but I pulled it over from the original BPATTY because I think it has some great info that is hopefully still relevant as far as integrating the Pwned Passwords database into your authentication workflow.
- [SQL server defense](https://7minsec.wiki/blueteam/sql.md): A 7MinSec customer reported this was an effective way to remove the ability for attackers to play games with stored procedures:
- [Velociraptor](https://7minsec.wiki/blueteam/velociraptor.md): Lifted from Velociraptor quick start guide. Nice sample hunt in about an hour by Eric Capuano, and a gist to go along with it!
- [WEFFLES](https://7minsec.wiki/blueteam/weffles.md): At the time of this writing, it doesn't look like the Microsoft WEFFLES is getting updates any more, but I wanted to preserve my install instructions from the old BPATTY anyways.

## CMD Kung Fu

### Linux

- [apt-rdepends](https://7minsec.wiki/cmd/linux/apt-rdepends.md): This helps download apt dependencies and is pretty neat! I was on a pentest where the Ubuntu box we had did not have general Internet access and I needed to install the nfs-common package.
- [awk](https://7minsec.wiki/cmd/linux/awk.md): Awk...you know...awks stuff.
- [curl](https://7minsec.wiki/cmd/linux/curl.md): Command line tool to interact with Web sites.
- [exiftool](https://7minsec.wiki/cmd/linux/exiftool.md): Good for pulling metadata out of files
- [fc](https://7minsec.wiki/cmd/linux/fc.md): Stands for "fix command."
- [find](https://7minsec.wiki/cmd/linux/find.md): (While ignoring errors about you not having permissions to see certain folders:
- [grep](https://7minsec.wiki/cmd/linux/grep.md): -r is recursive
- [iptables](https://7minsec.wiki/cmd/linux/iptables.md): Software based firewall for...you know...firewalling things.
- [iscsiadm](https://7minsec.wiki/cmd/linux/iscsiadm.md): For messing around with ISCSI stuff. These sites were super helpful in researching this:
- [iw](https://7minsec.wiki/cmd/linux/iw.md): Command for interacting with a wifi interface.
- [jq](https://7minsec.wiki/cmd/linux/jq.md)
- [ls](https://7minsec.wiki/cmd/linux/ls.md): Good for listing stuff!
- [lvresize](https://7minsec.wiki/cmd/linux/lvresize.md): Know what's annoying? I'll tell you: default Ubuntu server installs from I-don't-know-when don't actually use 100% of the disk space you allocate to them. Neat right?
- [nslookup](https://7minsec.wiki/cmd/linux/nslookup.md): A Swiss army knife of a tool for finding internal/external network resources
- [snap](https://7minsec.wiki/cmd/linux/snap.md): After one of my Ubuntu VMs kept filling up its hard drive, I did some investigation and learned my /var/snap folder was bloated at like 100 gig. This was
- [sort](https://7minsec.wiki/cmd/linux/sort.md)
- [systemctl](https://7minsec.wiki/cmd/linux/systemctl.md): Change the name of your Linux system the right way!
- [tail](https://7minsec.wiki/cmd/linux/tail.md): Tail helps you keep track of the end of files and stuff!
- [tar](https://7minsec.wiki/cmd/linux/tar.md): If you get a .tar.gz file you can extract with:
- [timedatectl](https://7minsec.wiki/cmd/linux/timedatectl.md): I ran into the same issue this person did while Kerberoasting, and I had to force-sync my Linux VM to that of my target machine:
- [tmux](https://7minsec.wiki/cmd/linux/tmux.md): I learned everything I know at tmuxcheatsheet.com but here's some stuff I always forget:
- [venv](https://7minsec.wiki/cmd/linux/venv.md): Good for creating virtual environments when you want to install a nightmare of python tools/dependencies but don't want it to jack up your normal user account installs.
- [zip](https://7minsec.wiki/cmd/linux/zip.md): Where wme.zip is the name of the zip you wanna zip, and scan_folder is the name of the folder you want to recursively zip.

### Mac

- [createinstallmedia](https://7minsec.wiki/cmd/mac/createinstallmedia.md): This command is handy for creating bootable OSX media.
- [defaults](https://7minsec.wiki/cmd/mac/defaults.md): From the man page: access the Mac OS X user defaults system
- [diskutil](https://7minsec.wiki/cmd/mac/diskutil.md): Following instructions details here.
- [fdesetup](https://7minsec.wiki/cmd/mac/fdesetup.md): fdesetup is handy for rebooting and skipping FileVault password prompting - great for headless systems!
- [md5](https://7minsec.wiki/cmd/mac/md5.md): Good for generating MD5 hashes.
- [mkfile](https://7minsec.wiki/cmd/mac/mkfile.md): Mkfile is handy for...making files!
- [open](https://7minsec.wiki/cmd/mac/open.md): This command is handy for popping a Finder window from terminal, as well as opening files, folders, URLs, and applications straight from the command line.
- [openssl](https://7minsec.wiki/cmd/mac/openssl.md): Used for a lot of...you know...openssl stuff.
- [route](https://7minsec.wiki/cmd/mac/route.md): The example above is one I ran into when I was using OpenVPN and by default it was sending all traffic (even local) to through the VPN. Basically anytime I tried to get to my 192.168.200.x subnet on my local network, it would come back as unavailable.

### Windows

- [certutil](https://7minsec.wiki/cmd/windows/certutil.md): In this tale of pentest pwnage I used certutil.exe to coerce authentication to my attacking system:
- [diskpart](https://7minsec.wiki/cmd/windows/diskpart.md): Taken from this great writeup
- [dism](https://7minsec.wiki/cmd/windows/dism.md): Dism, according to Microsoft:
- [Enter-PSSession](https://7minsec.wiki/cmd/windows/enter-pssession.md): Handy for PowerShell remoting!
- [Get-ADComputer](https://7minsec.wiki/cmd/windows/get-adcomputer.md): PowerShell command to find Active Directory computers and their properties.
- [Get-ADObject](https://7minsec.wiki/cmd/windows/get-adobject.md): Perfect for if you have pwnage on one domain and the two domains trust each other!
- [Get-ADUser](https://7minsec.wiki/cmd/windows/get-aduser.md): PowerShell command to find Active Directory users and their properties.
- [get-content](https://7minsec.wiki/cmd/windows/get-content.md): Get-Content helps you, you know, get content.
- [Get-Process](https://7minsec.wiki/cmd/windows/get-process.md): Handy for finding if, for example, domain admins are logged in interactively (covered in this podcast episode):
- [Get-ScheduledTask](https://7minsec.wiki/cmd/windows/get-scheduledtask.md): ...specifically that exclude Microsoft or OneDrive in the name, and also shows tasks that are not disabled:
- [Get-WinEvent](https://7minsec.wiki/cmd/windows/get-winevent.md)
- [Get-WmiObject](https://7minsec.wiki/cmd/windows/get-wmiobject.md): Handy for enumerating info from a box!
- [invoke-webrequest](https://7minsec.wiki/cmd/windows/invoke-webrequest.md): Good for...well...invoking Web requests.
- [iwr](https://7minsec.wiki/cmd/windows/iwr.md): This is handy for grabbing tools off of machines using Web requests. Another name for invoke-webrequest.
- [klist](https://7minsec.wiki/cmd/windows/klist.md): klist displays a list of cached kerberos tickets.
- [mklink](https://7minsec.wiki/cmd/windows/mklink.md): mklink is good for making directory/file symbolic (or hard) links.
- [net](https://7minsec.wiki/cmd/windows/net.md): Very helpful in the Windows world for mapping drives, changing local/domain group memberships, and much more!
- [nslookup](https://7minsec.wiki/cmd/windows/nslookup.md): Handy for finding resources on internal/external networks.
- [ping](https://7minsec.wiki/cmd/windows/ping.md)
- [reg](https://7minsec.wiki/cmd/windows/reg.md): Handy for manipulating the registry!
- [robocopy](https://7minsec.wiki/cmd/windows/robocopy.md): Sometimes I have trouble copying things from my local drive to the network shares. I found out this has to do with virus scanning on the server - it kills one of the files on the fly and thus mucks up my file-copying efforts.
- [runas](https://7minsec.wiki/cmd/windows/runas.md): Helpful for running something on a Windows machine in another user's context.
- [schtasks](https://7minsec.wiki/cmd/windows/schtasks.md): Can be used for privesc LOL! This article covers it pretty well.
- [start](https://7minsec.wiki/cmd/windows/start.md): Just type this from wherever you are:
- [sysprep](https://7minsec.wiki/cmd/windows/sysprep.md): Sysprep is for preppin'....systems I guess.
- [tasklist](https://7minsec.wiki/cmd/windows/tasklist.md): This shows all the running processes and the domain account they're running under (if applicable):
- [telnet](https://7minsec.wiki/cmd/windows/telnet.md): (Last line is just a period and then press Enter)
- [vssadmin](https://7minsec.wiki/cmd/windows/vssadmin.md): For working with shadow copies!
- [winrm](https://7minsec.wiki/cmd/windows/winrm.md): Do this remotely using something like netexec by adding -x winrm quickconfig -quiet to your command.

## Hardware

- [Pentest dropboxes](https://7minsec.wiki/hardware/pentestdropbox.md): Right now the best source I have for this is the pentest dropbox episodes for the 7 Minute Security podcast. I'll start moving over cmd-line snippets and other tips from those episodes over time.
- [Printers](https://7minsec.wiki/hardware/printers.md): A great way to get access to sensitive information in an environment is to log into printers that have default/weak creds and steal SMTP/SMB credentials. To find good interfaces for pwning, I like to run gowitness first and then look at the report output (gowitness report list).
- [USB wifi adapter setup](https://7minsec.wiki/hardware/usb-adapters.md): I'm in the market for a new USB wifi pentest adapter (TLDR: I really like the Panda PAU09 N600), and these resources helped me zero-in on good options:

## Pentesting

### External

- [azurehound](https://7minsec.wiki/pentesting/external/azurehound.md): Azurehound is great for...hounding around in...Azure. Here's a good doc on collecting data.
- [baddns](https://7minsec.wiki/pentesting/external/baddns.md): baddns will "check subdomains for subdomain takeovers and other DNS tomfoolery."
- [bbot](https://7minsec.wiki/pentesting/external/bbot.md): bbot "is a multipurpose scanner inspired by Spiderfoot, built to automate your Recon, Bug Bounties, and ASM!"
- [dehashed-API](https://7minsec.wiki/pentesting/external/dehashed-api.md): dehashed-API is awesome for parsing creds snagged with dehashed.com.
- [dehashed](https://7minsec.wiki/pentesting/external/dehashed.md): Dehashed is pretty handy for finding creds from various leaks/breaches.
- [FOCA](https://7minsec.wiki/pentesting/external/foca.md): FOCA is cool tool to "find metadata and hidden information in the documents."
- [go365](https://7minsec.wiki/pentesting/external/go365.md): A tool for attacking O365 users with password stuffing/spraying.
- [GraphRunner](https://7minsec.wiki/pentesting/external/graphrunner.md): Awesome tool for enumerating/attacking Azure. This page has some practical attacks. And this blog had some nice tips as well. I also enjoyed this presentation.
- [MicroBurst](https://7minsec.wiki/pentesting/external/microburst.md): Awesome tool for "assessing Microsoft Azure security." This is a great video on how to use MicroBurst effectively.
- [nmap](https://7minsec.wiki/pentesting/external/nmap.md): I put all nmap information in the Internal pentesting area.
- [nmap-xml-to-csv](https://7minsec.wiki/pentesting/external/nmap-xml-to-csv.md): nmap-xml-to-csv takes nmap output and turns it into pretty CSV files!
- [subsnipe](https://7minsec.wiki/pentesting/external/subsnipe.md): A tool for sniping subdomains.
- [testssl](https://7minsec.wiki/pentesting/external/testssl.md): Good tool for testing TLS/SSL configs.
- [wfuzz](https://7minsec.wiki/pentesting/external/wfuzz.md): wfuzz fuzzes things.
- [wpscan](https://7minsec.wiki/pentesting/external/wpscan.md): wpscan is good for scanning WordPress sites for security issues and out-of-date plugins and themes and more!

### Internal

- [adconnectdump](https://7minsec.wiki/pentesting/internal/adconnectdump.md): Some notes about running adconnectdump.
- [addcomputer](https://7minsec.wiki/pentesting/internal/addcomputer.md): Part of impacket and awesome for adding computers to the domain
- [adeleg](https://7minsec.wiki/pentesting/internal/adeleg.md): adeleg "allows you to make a detailed inventory of delegations set up so far in a forest, along with their potential issues."
- [adeleginator](https://7minsec.wiki/pentesting/internal/adeleginator.md): ADeleginator uses adeleg to "find insecure trustee and resource delegations in Active Directory."
- [atexec](https://7minsec.wiki/pentesting/internal/atexec.md): Can setup evil scheduled things to run :-)
- [axiomsecrets](https://7minsec.wiki/pentesting/internal/axiomsecrets.md): Under construction. Note to self:
- [bloodhound-ce](https://7minsec.wiki/pentesting/internal/bloodhound-ce.md): Syntax for grabbing a Python-based BloodHound collection.
- [bloodhoundcli](https://7minsec.wiki/pentesting/internal/bloodhoundcli.md): Lets you quickly spin up BloodHound CE instances.
- [bloodyAD](https://7minsec.wiki/pentesting/internal/bloodyad.md): A tool for automating AD tasks (user management, password changes, and privesc) - great guide/cheatsheet here.
- [certify](https://7minsec.wiki/pentesting/internal/certify.md): A cool tool for investigating Active Directory certificate abuse.
- [certipy](https://7minsec.wiki/pentesting/internal/certipy.md): An awesome tool for abusing ADCS. Check out the awesome accompanying wiki for attack syntax.
- [coercer.py](https://7minsec.wiki/pentesting/internal/coercer.md): Coercer coerces things to talk to other things!
- [dacledit.py](https://7minsec.wiki/pentesting/internal/dacledit.md): This helps read/write DACLs!
- [dcomexec](https://7minsec.wiki/pentesting/internal/dcomexec.md): This can provide an interactive shell on Windows hosts similar to wmiexec. More info at wadcoms and Riccardo Ancarani's Red Team Adventures.
- [dnstool.py](https://7minsec.wiki/pentesting/internal/dnstool.md): This script helps you add DNS records to the domain (which members of Domain Users can by default):
- [efflanrs.py](https://7minsec.wiki/pentesting/internal/efflanrs.md): efflanrs wraps a pretty Web interface around a snaffler log.
- [evil-winrm](https://7minsec.wiki/pentesting/internal/evilwinrm.md): evil-winrm is awesome for PowerShell remoting into devices - even with just a local admin hash!
- [eyewitness](https://7minsec.wiki/pentesting/internal/eyewitness.md): A great tool for screenshotting things!
- [farmer](https://7minsec.wiki/pentesting/internal/farmer.md): It farms stuff, like creds! Read more here.
- [getnthash.py](https://7minsec.wiki/pentesting/internal/getnthash.md): Helps to get the NT hash of things (after using gettgtpkinit.py to get the AS-REP key that accompanies a TGT, for example).
- [getst.py](https://7minsec.wiki/pentesting/internal/getst.md): If you've managed to coerce some creds and done a successful privesc via relay (see the Escalate privs via relay section), you might've seen something like
- [gettgt.py](https://7minsec.wiki/pentesting/internal/gettgt.md): Part of impacket and is helpful in getting Kerberos TGTs!
- [gettgtpkinit.py](https://7minsec.wiki/pentesting/internal/gettgtpkinit.md): Part of pkinittools which "contains some utilities for playing with PKINIT and certificates."
- [GetUserSPNs.py](https://7minsec.wiki/pentesting/internal/getuserspns.md): GetUserSPNs is good for, you know....getting user SPNs.
- [go-out](https://7minsec.wiki/pentesting/internal/go-out.md): A cool tool for checking egress filtering.
- [gowitness](https://7minsec.wiki/pentesting/internal/gowitness.md): A cool tool to grab screengrabs of interfaces/services.
- [group3r](https://7minsec.wiki/pentesting/internal/group3r.md): group3r helps you "...find vulnerabilities in AD Group Policy, but do it better than Grouper2 did."
- [hashcat](https://7minsec.wiki/pentesting/internal/hashcat.md): hashcat is good at cracking passwords. Check out the BHIS cheat sheet on this topic.
- [hashcat-utils](https://7minsec.wiki/pentesting/internal/hashcat-utils.md): Utils that play nice with hashcat
- [impacket](https://7minsec.wiki/pentesting/internal/impacket.md): impacket "is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g.
- [lookupsid](https://7minsec.wiki/pentesting/internal/lookupsid.md): Good for looking up SIDs!
- [massscan](https://7minsec.wiki/pentesting/internal/masscan.md): A tool for when you absolutely, positively, must scan everything.
- [metasploit](https://7minsec.wiki/pentesting/internal/metasploit.md): If you get errors like:
- [mimikatz](https://7minsec.wiki/pentesting/internal/mimikatz.md): A little tool to play with Windows security.
- [mitm6](https://7minsec.wiki/pentesting/internal/mitm6.md): mitm6 "is a pentesting tool that exploits the default configuration of Windows to take over the default DNS server."
- [mssqlclient](https://7minsec.wiki/pentesting/internal/mssqlclient.md): Great for enumerating/attacking SQL server. This article was very helpful in putting together this cheat sheet.
- [mssqlhound](https://7minsec.wiki/pentesting/internal/mssqlhound.md): Awsome tool to find cool attack paths via SQL!
- [mssqlkaren](https://7minsec.wiki/pentesting/internal/mssqlkaren.md): Awesome tool for stealing SCCM goodies from SQL databases.
- [net.py](https://7minsec.wiki/pentesting/internal/net.md): Maybe my favorite thing ever. It is kind of a Python-flavored version of net.exe. So if you get an account with local/domain admin rights (or a service
- [netdiscover](https://7minsec.wiki/pentesting/internal/netdiscover.md): Good for finding networks!!!
- [netexec](https://7minsec.wiki/pentesting/internal/netexec.md): nxc "is a network service exploitation tool that helps automate assessing the security of large networks." Check out the BHIS cheat sheet on this topic.
- [nxcdb](https://7minsec.wiki/pentesting/internal/nxcdb.md): Netexec database helps manage creds and other info you gather in your pentest travels
- [nmap](https://7minsec.wiki/pentesting/internal/nmap.md): It's fun to scan networks with nmap! Check out ths BHIS cheat sheet on this topic.
- [nmap-bootstrap-xsl](https://7minsec.wiki/pentesting/internal/nmap-bootstrap-xsl.md): A great tool to visualize nmap scans in pretty HTML files.
- [notify](https://7minsec.wiki/pentesting/internal/notify.md): This is a cool little script from projectnotify that lets you send yourself email/Slack/Discord/Teams/etc. notifications from output of tools, system events, and more!
- [ntlmrelayx](https://7minsec.wiki/pentesting/internal/ntlmrelayx.md): ntlmrelay is part of impacket.
- [ntlmv1-multi](https://7minsec.wiki/pentesting/internal/ntlmv1-multi.md): In January, Google/Mandiant released this fantastic article containing a public release of Net-NTLMv1 Rainbow Tables to "underscore the urgency of migrating away from this outdated protocol" and, to us hackers, make our crack jobs faster!
- [onesixtyone](https://7minsec.wiki/pentesting/internal/onesixtyone.md): A handy tool for enumerating snmp
- [PassTheCert](https://7minsec.wiki/pentesting/internal/passthecert.md): PassTheCert is awesome when you need to "authenticate to an LDAP/S server with a certificate through Schannel."
- [pcredz](https://7minsec.wiki/pentesting/internal/pcredz.md): It's a handy tool for parsing through pcaps and looking for juicy things like password hashes, credit card #s, etc.
- [potatoes](https://7minsec.wiki/pentesting/internal/potatoes.md): These can be real handy for local privesc. Some resources:
- [PowerHuntShares](https://7minsec.wiki/pentesting/internal/powerhuntshares.md): PowerHuntShares "is PowerShell tool designed to help cybersecurity teams and penetration testers better identify, understand, attack, and remediate SMB shares in the Active Directory environments they protect.
- [Powermad](https://7minsec.wiki/pentesting/internal/powermad.md): powermad helps you add computers to the domain!
- [PowerUpSQL](https://7minsec.wiki/pentesting/internal/powerupsql.md): PowerUpSQL "includes functions that support SQL Server discovery, weak configuration auditing, privilege escalation on scale, and post exploitation actions
- [pre2k](https://7minsec.wiki/pentesting/internal/pre2k.md): pre2k checks for the existence of pre-Windows 2000 objects.
- [Pretender](https://7minsec.wiki/pentesting/internal/pretender.md): An awesome tool designed "with the single purpose to obtain machine-in-the-middle positions combining the techniques of mitm6 and only the name resolution spoofing portion of Responder." (source: Pretender GitHub and blog).
- [proxychains](https://7minsec.wiki/pentesting/internal/proxychains.md): For most offsec tooling, on your Kali box you'll want to open /etc/proxychains4.conf and change the last line from socks4 127.0.0.1 9050 to 1080 like so:
- [pxethief](https://7minsec.wiki/pentesting/internal/pxethief.md): pxethief helps you get creds out of SCCM.
- [pxethiefy](https://7minsec.wiki/pentesting/internal/pxethiefy.md): pxethiefy is a tool to enumerate PXE boot media provided from an SCCM server in a target network by broadcasting for PXE servers, requesting offered boot media and trying to decrypt it.
- [pygpoabuse.py](https://7minsec.wiki/pentesting/internal/pygpoabuse.md): Very cool utility to abuse GPO objects where you have excessive permissions, such as GenericWrite. Here's an example:
- [pywhisker.py](https://7minsec.wiki/pentesting/internal/pywhisker.md): pywhisker "allows users to manipulate the msDS-KeyCredentialLink attribute of a target user/computer to obtain full control over that object."
- [rbcd.py](https://7minsec.wiki/pentesting/internal/rbcd.md): rbcd.py is part of impacket.
- [RelayKing](https://7minsec.wiki/pentesting/internal/relayking.md): RelayKing helps you relay all the things. Great blog post about it here.
- [Responder](https://7minsec.wiki/pentesting/internal/responder.md): Responder is awesome at tricking systems into talking to other systems.
- [rpc2efs.py](https://7minsec.wiki/pentesting/internal/rpc2efs.md): A cool tool for performing "Unauthenticated start EFS service on remote Windows host (make PetitPotam great again)."
- [rpcclient](https://7minsec.wiki/pentesting/internal/rpcclient.md): A neat tool for looking up domain stuff
- [rpcdump.py](https://7minsec.wiki/pentesting/internal/rpcdump.md): rpcdump is part of impacket.
- [rubeus2ccache.py](https://7minsec.wiki/pentesting/internal/rubeus2ccache.md): A cool tool to "convert Base64-encoded .kirbi tickets from Rubeus into .ccache files for Impacket".
- [rubeus](https://7minsec.wiki/pentesting/internal/rubeus.md): Rubeus is wonderful for playing with hashes and Kerberos tickets.
- [RunasCs](https://7minsec.wiki/pentesting/internal/runascs.md): So one time I found my runas command wasn't working and I couldn't authenticate to the domain. I found some articles indicating that AD passwords ending with % might have problems when using them from domain-joined machines.
- [sccmhunter.py](https://7minsec.wiki/pentesting/internal/sccmhunter.md): A rad tool for hunting SCCM!
- [scriptsentry](https://7minsec.wiki/pentesting/internal/scriptsentry.md): ScriptSentry finds misconfigured and dangerous logon scripts.
- [secretsdump](https://7minsec.wiki/pentesting/internal/secretsdump.md): secretsdump is part of impacket.
- [sharpgpoabuse](https://7minsec.wiki/pentesting/internal/sharpgpoabuse.md): An awesome tool for abusing "generic write" access to GPOs (which you might identify after running BloodHound). Here’s a sample syntax you could run:
- [SharpHound](https://7minsec.wiki/pentesting/internal/sharphound.md): SharpHound gathers important info about Active Directory and potential misconfigs and security problems!
- [smbclient-ng](https://7minsec.wiki/pentesting/internal/smbclient-ng.md): Awesome tool to interact with SMB shares
- [smbclient.py](https://7minsec.wiki/pentesting/internal/smbclient.md): smbclient is part of impacket.
- [smbserver.py](https://7minsec.wiki/pentesting/internal/smbserver.md): smbserver is part of impacket.
- [snaffler](https://7minsec.wiki/pentesting/internal/snaffler.md): snaffler absolutely rules and finding good SMB share treasures!
- [snmpbulkwalk](https://7minsec.wiki/pentesting/internal/snmpbulkwalk.md): -Cr1000 indicates how many requests are sent
- [snmpwalk](https://7minsec.wiki/pentesting/internal/snmpwalk.md): snmpwalk helps you...you know, walk the SNMP.
- [tcpdump](https://7minsec.wiki/pentesting/internal/tcpdump.md): tcpdump helps you sniff and capture packets!
- [ticketConverter.py](https://7minsec.wiki/pentesting/internal/ticketconverter.md): This is part of impacket and awesome for manipulating Kerberos tickets.
- [ticketer.py](https://7minsec.wiki/pentesting/internal/ticketer.md): Great for forging tickets!
- [tshark](https://7minsec.wiki/pentesting/internal/tshark.md): tshark is for chomping information out of pcaps.
- [webclientservicescanner](https://7minsec.wiki/pentesting/internal/webclientservicescanner.md): A cool tool for checking whether WebClient service is running.
- [whisker](https://7minsec.wiki/pentesting/internal/whisker.md): This tool is "for taking over Active Directory user and computer accounts by manipulating their msDS-KeyCredentialLink attribute, effectively adding
- [wmiexec.py](https://7minsec.wiki/pentesting/internal/wmiexec.md): wmiexec is part of impacket.
- [wspcoerce](https://7minsec.wiki/pentesting/internal/wspcoerce.md): I believe this only coerces an SMB connection. More info here.
- [xfreerdp3](https://7minsec.wiki/pentesting/internal/xfreerdp3.md): Good for RDPing...especially if you want to RDP via pass-the-hash!
- [xml2csv.py](https://7minsec.wiki/pentesting/internal/xml2csv.md): This script makes it easy to take an nmap XML file and convert to CSV to see what ports/services are open.

### Wifi

- [aircrack-ng](https://7minsec.wiki/pentesting/wifi/aircrack-ng.md): aircrack-ng does neat stuff with wifi.
- [aireplay-ng](https://7minsec.wiki/pentesting/wifi/aireplay-ng.md): aireplay-ng "is used to inject frames."
- [airmon-ng](https://7minsec.wiki/pentesting/wifi/airmon-ng.md): airmon-ng "...can be used to enable monitor mode on wireless interfaces. It may also be used to kill network managers, or go back from monitor mode to managed mode.
- [airodump-ng](https://7minsec.wiki/pentesting/wifi/airodump-ng.md): airodump-ng "is used for packet capture, capturing raw 802.11 frames."
- [bettercap](https://7minsec.wiki/pentesting/wifi/bettercap.md): bettercap is "The Swiss Army knife for WiFi, Bluetooth Low Energy, wireless HID hijacking, CAN-bus and IPv4 and IPv6 networks reconnaissance and MITM
- [dragonshift](https://7minsec.wiki/pentesting/wifi/dragonshift.md): "This tool automates the execution of a WPA3-Transition Mode downgrade attack, specifically leveraging the Dragonblood vulnerability. In WPA3-Transition Mode, networks are configured to support both WPA2 and WPA3 connections to maintain compatibility with older devices.
- [eaphammer](https://7minsec.wiki/pentesting/wifi/eaphammer.md): Hammers the EAP!
- [hcxdumptool](https://7minsec.wiki/pentesting/wifi/hcxdumptool.md): This tool is awesome for wifi shenanigans.
- [hcxeiutool](https://7minsec.wiki/pentesting/wifi/hcxeiutool.md): Good for building hacking wordlists
- [hcxlabtool](https://7minsec.wiki/pentesting/wifi/hcxlabtool.md): This is an awesome tool for doing WPA3 downgrade attacks! Booyah!
- [hcxpcapngtool](https://7minsec.wiki/pentesting/wifi/hcxpcapngtool.md): This tools is handy for a bunch of things, but especially helpful when you've grabbed a WPA PSK using something like airodump-ng and you need to extract it
- [hcxtools](https://7minsec.wiki/pentesting/wifi/hcxtools.md): I wasted so much time massaging this export because I didn't understand that in this context, wordlist means a wordlist will be created with any wifi names that are contained in the output.pcapng.
- [hostapd-mana](https://7minsec.wiki/pentesting/wifi/hostapd-mana.md): hostapd-mana is great for pentesting WPA enterprise networks.
- [nmcli](https://7minsec.wiki/pentesting/wifi/nmcli.md): Might look like this:
- [WiFiForge](https://7minsec.wiki/pentesting/wifi/wififorge.md): WifiForge is an awesome tool for learning how to hack wifi...without any wifi hardware! Here's my cheat sheet for getting started, which is pretty much
- [wifite2](https://7minsec.wiki/pentesting/wifi/wifite2.md): wifite2 is great for snagging wifi handshakes.

## Software

- [AdGuard Home](https://7minsec.wiki/software/adguardhome.md): Great for blocking ads, icky stuff, inappropriate sites, etc.
- [ansible](https://7minsec.wiki/software/ansible.md)
- [Bitwarden](https://7minsec.wiki/software/bitwarden.md): A quick guide that condenses the Linux Standard Deployment instructions
- [bloodhound](https://7minsec.wiki/software/bloodhound.md): Lately I've found that using bloodhoundcli is really easy to use. But below I've included some instructions to manually get BloodHound Community up and running.
- [Burp](https://7minsec.wiki/software/burp.md): Web proxy for pentesting. Check out the BHIS cheat sheet on this topic.
- [caddy](https://7minsec.wiki/software/caddy.md): A cool reverse Web proxy for Web things.
- [chimas](https://7minsec.wiki/software/chimas.md): chimas makes Snaffler output snaff-tastic!
- [docker](https://7minsec.wiki/software/docker.md): Check here for instructions.
- [docusaurus](https://7minsec.wiki/software/docusaurus.md): That's what this site is built on, dude/dudette!
- [DRACARYS](https://7minsec.wiki/software/dracarys.md): DRACARYS is an awesome pentest training challenge.
- [Eramba](https://7minsec.wiki/software/eramba.md): Eramba is a "community driven GRC solution that doesn't break the bank."
- [exegol](https://7minsec.wiki/software/exegol.md): When asked to accept the EULA, answer Y.
- [GOAD (Game of Active Directory)](https://7minsec.wiki/software/goad.md): This is my internal notes for getting GOAD - Game of Active Directory up and running on Proxmox.
- [gophish](https://7minsec.wiki/software/gophish.md): All about the open-source phishing framework Gophish, which you can grab here. We've got some good podcast episodes and notes about Gophish here and
- [hetzner](https://7minsec.wiki/software/hetzner.md): Here's my notes on getting the Ludus (or other OS) install started on a Hetzner box:
- [immich](https://7minsec.wiki/software/immich.md): A cool and private image gallery!
- [jellyfin](https://7minsec.wiki/software/jellyfin.md): Jellyfin doesn't have much to do with security but it is a self-hosted photo/video streaming/sharing service kind of like Plex. I had some issues getting
- [LetsEncrypt](https://7minsec.wiki/software/letsencrypt.md): LetsEncrypt is neat and lets you put certs on stuff.
- [Lithnet Password Protection for AD](https://7minsec.wiki/software/lithnetpp.md): A cool password filter to stop people from picking weak passwords in AD!
- [msg-reader](https://7minsec.wiki/software/msg-reader.md): A cool tool to let you view .msg files.
- [mythic](https://7minsec.wiki/software/mythic.md): A cool C2 framework I'm excited to get more into in my own testing.
- [NamicSoft](https://7minsec.wiki/software/namicsoft.md): NamicSoft is a software package that runs on Windows and helps you take vulnerability scans (from a variety of sources like Nessus, Burp, Nexpose, nmap, etc.) and slice/dice them into a variety of digestible reports.
- [Nessus](https://7minsec.wiki/software/nessus.md): To fire off a quick install on the Kali side, head to the Tenable downloads page and then copy the curl command to grab the installer, which will look
- [OpenClaw](https://7minsec.wiki/software/openclaw.md): This OpenClaw install guide was generated with Claude's help, with an emphasis on security and privacy. Substitute your own values for placeholders (user IDs, API keys, bot names, IP addresses, phone numbers, etc.) where appropriate.
- [OPNsense](https://7minsec.wiki/software/opnsense.md): I was a pfSense guy for years, but OPNsense is pretty rad.
- [Password Pusher (pwpush)](https://7minsec.wiki/software/pwpush.md): A cool tool (both commercial and self-hosted versions) for securely transfering text and files and URLs.
- [PeerTube](https://7minsec.wiki/software/peertube.md): Getting it going on Docker is pretty clear using this guide. Grab the docker-compose.yml and .env file and edit to using guidance from the article.
- [postfix](https://7minsec.wiki/software/postfix.md): This article covers it pretty well.
- [ProtonVPN](https://7minsec.wiki/software/protonvpn.md): For certain pentest tasks I've found it's handy to use ProtonVPN CLI on my Kali box.
- [Proxmox](https://7minsec.wiki/software/proxmox.md): I miss VMWare ESXi, but am quickly getting over the sadness because Proxmox rocks.
- [Proxmox Backups Server (PBS)](https://7minsec.wiki/software/proxmoxbackup.md): This guy's YouTube tutorial was very helpful!
- [retype](https://7minsec.wiki/software/retype.md): Those instructions are here but what I always forget how to do is the update process, which is...
- [SCCM](https://7minsec.wiki/software/sccm.md): SCCM is Microsoft Configuration Manager.
- [shlink](https://7minsec.wiki/software/shlink.md): A self-hosted URL shortener.
- [sliver C2](https://7minsec.wiki/software/sliver.md): Sliver's a rad C2
- [sysreptor](https://7minsec.wiki/software/sysreptor.md): Sysreptor is my favorite pentest report writing service.
- [transfer.zip](https://7minsec.wiki/software/transferzip.md): An awesome way to quickly and securely send/receive HUGE file transfers. Walkthrough here.
- [Twingate](https://7minsec.wiki/software/twingate.md): Awesome zero-trust VPN that several of our clients have. We're fans.
- [UptimeKuma](https://7minsec.wiki/software/uptimekuma.md): uptime-kuma is like UptimeRobot, except free :-)
- [wazuh](https://7minsec.wiki/software/wazuh.md): (Taken from the quick start guide)
- [xcaddy](https://7minsec.wiki/software/xcaddy.md): xcaddy is awesome for setting up your LetsEncrypt certs with a DNS challenge (handy if you don't often - or ever - want to expose port 80/443 to the www)

## Blog (change log)

- [Blog (change log)](https://7minsec.wiki/blog/index.md)
- [Scripts have a new home](https://7minsec.wiki/blog/2026-06-03-scripts-have-a-new-home.md): The scripts have moved! By popular request, they now live in a dedicated GitHub repo for versioning, suggestions, and peace of mind: 7MinSec/7MinSecWikiScripts.
- [Updates for April 28, 2026](https://7minsec.wiki/blog/2026-04-27-wiki-updates.md): Here's what's been added/edited on the 7MinSec wiki with this update:
- [Updates for April 15, 2026](https://7minsec.wiki/blog/2026-04-15-wiki-updates.md): Here's what's been added/edited on the 7MinSec wiki this week:
- [fc command added](https://7minsec.wiki/blog/2026-04-14-fc-command-added.md): The fc command is handy - especially when you want to clear command history on Linux!
- [Welcome to 7MinSec.wiki!](https://7minsec.wiki/blog/2026-03-20-welcome-to-7minsec-wiki.md): After years of feeling like "BPATTY.ROCKS" doesn't exactly roll of the tongue, I decided to start migrating over to this new domain name: 7MinSec.wiki (especially since we already have a .com and a .club).