> For the complete documentation index, see [llms.txt](https://wiki.pentestlist.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wiki.pentestlist.com/offensive-security.md).

# OFFENSIVE SECURITY

- [External Infrastructure](https://wiki.pentestlist.com/offensive-security/external-infrastructure.md)
- [Discovery](https://wiki.pentestlist.com/offensive-security/external-infrastructure/discovery.md)
- [Email Address Discovery](https://wiki.pentestlist.com/offensive-security/external-infrastructure/discovery/email-address-discovery.md): How to find email addresses.
- [Subdomain Discovery](https://wiki.pentestlist.com/offensive-security/external-infrastructure/discovery/subdomain-discovery.md): How to find subdomains.
- [Data Discovery](https://wiki.pentestlist.com/offensive-security/external-infrastructure/discovery/data-discovery.md): How to find sensitive data.
- [Port & Service Discovery](https://wiki.pentestlist.com/offensive-security/external-infrastructure/discovery/port-and-service-discovery.md): How to find open ports and services
- [Exploitation](https://wiki.pentestlist.com/offensive-security/external-infrastructure/exploitation.md)
- [Password Spraying](https://wiki.pentestlist.com/offensive-security/external-infrastructure/exploitation/password-spraying.md): How to password spray.
- [Vulnerability Scanning](https://wiki.pentestlist.com/offensive-security/external-infrastructure/exploitation/vulnerability-scanning.md): How to find security vulnerabilities.
- [Internal Infrastructure](https://wiki.pentestlist.com/offensive-security/internal-infrastructure.md)
- [General Discovery](https://wiki.pentestlist.com/offensive-security/internal-infrastructure/general-discovery.md)
- [AD Attack Path Discovery](https://wiki.pentestlist.com/offensive-security/internal-infrastructure/general-discovery/ad-attack-path-discovery.md): How to find exploitable active directory paths.
- [Port & Service Discovery](https://wiki.pentestlist.com/offensive-security/internal-infrastructure/general-discovery/port-and-service-discovery.md): How to find open ports and services on an internal network.
- [Credential Discovery](https://wiki.pentestlist.com/offensive-security/internal-infrastructure/credential-discovery.md)
- [Passwords and NetNTLM](https://wiki.pentestlist.com/offensive-security/internal-infrastructure/credential-discovery/passwords-and-netntlm.md): How to find cleartext passwords and NetNTLM hashes.
- [SAM & LSA secrets](https://wiki.pentestlist.com/offensive-security/internal-infrastructure/credential-discovery/sam-and-lsa-secrets.md): How to find local user passwords, hashes and secrets.
- [NTDS.dit secrets](https://wiki.pentestlist.com/offensive-security/internal-infrastructure/credential-discovery/ntds.dit-secrets.md): How to find sensitive data in NTDS.dit.
- [LSASS secrets](https://wiki.pentestlist.com/offensive-security/internal-infrastructure/credential-discovery/lsass-secrets.md): How to find sensitive data in the LSASS.
- [DCSync](https://wiki.pentestlist.com/offensive-security/internal-infrastructure/credential-discovery/dcsync.md): How to find sensitive data using a DCSync.
- [DPAPI secrets](https://wiki.pentestlist.com/offensive-security/internal-infrastructure/credential-discovery/dpapi-secrets.md): How to find local user sensitive data.
- [Movement](https://wiki.pentestlist.com/offensive-security/internal-infrastructure/movement.md)
- [Credential Spraying](https://wiki.pentestlist.com/offensive-security/internal-infrastructure/movement/credential-spraying.md): How to find and use internal credentials.
- [SMB Relaying](https://wiki.pentestlist.com/offensive-security/internal-infrastructure/movement/smb-relaying.md): How to relay credentials.
- [Pass The Hash](https://wiki.pentestlist.com/offensive-security/internal-infrastructure/movement/pass-the-hash.md): How to Pass The Hash Attack.
- [Infiltration/Exfiltration](https://wiki.pentestlist.com/offensive-security/internal-infrastructure/infiltration-exfiltration.md)
- [Pivoting (Proxying)](https://wiki.pentestlist.com/offensive-security/internal-infrastructure/infiltration-exfiltration/pivoting-proxying.md): How to pivot and proxy from an internal network
- [Web Application](https://wiki.pentestlist.com/offensive-security/web-application.md)
- [Discovery](https://wiki.pentestlist.com/offensive-security/web-application/discovery.md)
- [Testing API Keys](https://wiki.pentestlist.com/offensive-security/web-application/discovery/testing-api-keys.md): How to exploit an API key.
- [Vulnerability Scan](https://wiki.pentestlist.com/offensive-security/web-application/discovery/vulnerability-scan.md): How to vulnerability scan a web application and API.
- [Web Content Discovery](https://wiki.pentestlist.com/offensive-security/web-application/discovery/web-content-discovery.md): How to discover files and directories.
- [Parameter Discovery](https://wiki.pentestlist.com/offensive-security/web-application/discovery/parameter-discovery.md): How to discover web parameters.
- [VHOST Discovery](https://wiki.pentestlist.com/offensive-security/web-application/discovery/vhost-discovery.md): How to find virtual hosts on a web server.
- [CMS Scanners](https://wiki.pentestlist.com/offensive-security/web-application/discovery/cms-scanners.md): How to review a Content Management System.
- [Exploitation](https://wiki.pentestlist.com/offensive-security/web-application/exploitation.md)
- [Authentication](https://wiki.pentestlist.com/offensive-security/web-application/exploitation/authentication.md): How to exploit web application authentication
- [Email Address Forms](https://wiki.pentestlist.com/offensive-security/web-application/exploitation/authentication/email-address-forms.md): How to exploit login and forgotten password forms.
- [AWS Cognito](https://wiki.pentestlist.com/offensive-security/web-application/exploitation/authentication/aws-cognito.md): How to exploit AWS Cognito.
- [JSON Web Tokens](https://wiki.pentestlist.com/offensive-security/web-application/exploitation/json-web-tokens.md): How to exploit JSON Web Tokens.
- [Injection Attacks](https://wiki.pentestlist.com/offensive-security/web-application/exploitation/injection-attacks.md): How to exploit injection attacks.
- [SQL Injection](https://wiki.pentestlist.com/offensive-security/web-application/exploitation/injection-attacks/sql-injection.md): How to exploit SQL and noSQL Injection.
- [Cross-Site Scripting](https://wiki.pentestlist.com/offensive-security/web-application/exploitation/injection-attacks/cross-site-scripting.md): How to exploit cross-site scripting (XSS).
- [HTTP Headers](https://wiki.pentestlist.com/offensive-security/web-application/exploitation/injection-attacks/http-headers.md): How to exploit HTTP Headers.
- [Bypasses](https://wiki.pentestlist.com/offensive-security/web-application/bypasses.md)
- [Cloudflare Bypass](https://wiki.pentestlist.com/offensive-security/web-application/bypasses/cloudflare-bypass.md): How to bypass Cloudflare.
- [HTTP 403 Bypass](https://wiki.pentestlist.com/offensive-security/web-application/bypasses/http-403-bypass.md): How to bypass HTTP 403 statuses.
- [Mobile (iOS/Android)](https://wiki.pentestlist.com/offensive-security/mobile-ios-android.md)
- [iOS](https://wiki.pentestlist.com/offensive-security/mobile-ios-android/ios.md): How to perform an iOS Security Assessment
- [IPA Decryption](https://wiki.pentestlist.com/offensive-security/mobile-ios-android/ios/ipa-decryption.md): How to decrypt and IPA file.
- [Filesystem Analysis](https://wiki.pentestlist.com/offensive-security/mobile-ios-android/ios/filesystem-analysis.md): How to analyse an iOS filesystem.
- [Static Analysis](https://wiki.pentestlist.com/offensive-security/mobile-ios-android/ios/static-analysis.md): How to review an IPA file.
- [Cloud](https://wiki.pentestlist.com/offensive-security/cloud.md)
- [AWS](https://wiki.pentestlist.com/offensive-security/cloud/aws.md): How to perform an AWS security assessment
- [Vulnerability Scanners](https://wiki.pentestlist.com/offensive-security/cloud/aws/vulnerability-scanners.md): Tools to exploit AWS.
- [S3 Buckets](https://wiki.pentestlist.com/offensive-security/cloud/aws/s3-buckets.md): How to exploit S3 Buckets.
- [Azure](https://wiki.pentestlist.com/offensive-security/cloud/azure.md): How to perform an Azure security assessment
- [Vulnerability Scanners](https://wiki.pentestlist.com/offensive-security/cloud/azure/vulnerability-scanners.md): Tools to exploit Azure.
- [m365 & Entra ID](https://wiki.pentestlist.com/offensive-security/cloud/azure/m365-and-entra-id.md): Tools to exploit m365 and Entra ID.