> Deep-Dive Research Hub
Advanced attack chains, tool guides, and techniques beyond the standard modules. 15 topics covering the hardest CPTS exam concepts.
Active Directory
BloodHound Advanced Queries
Custom Cypher queries, shortest path to DA, Kerberoastable + DCSync targets, LAPS + GPO abuse paths.
→
Active Directory
Ligolo-ng Double Pivot
Multi-hop tunneling through segmented AD networks. Agent chaining, route injection, and traffic routing without proxychains.
→
Active Directory
AD CS ESC1–ESC8 Attack Chains
Complete Certipy-driven exploitation of all 8 ADCS misconfigurations — from enrollment abuse to CA key theft.
→
Active Directory
RBCD Full Walkthrough
Resource-Based Constrained Delegation from WriteProperty to S4U2Self/S4U2Proxy and impersonation to DA.
→
Privilege Escalation
Potato Attacks Comparison
PrintSpoofer vs JuicyPotato vs GodPotato vs SweetPotato — when to use which, OS compatibility, and current bypass status.
→
Active Directory
Responder + NTLMRelayx Chain
LLMNR/NBT-NS poisoning → relay → SMB signing disabled targets → shell or DA hash. Full attack chain with edge cases.
→
Evasion
AMSI Bypass Techniques (2026)
Working PowerShell AMSI patches, memory patching via reflection, CLM bypass, and constrained language mode escapes.
→
Active Directory
GPO Abuse for Persistence
Modifying GPOs with GenericWrite — scheduled tasks, startup scripts, registry keys, and immediate policy push.
→
Tools & Setup
SysReptor Complete Setup
Docker install, CPTS finding templates, CVSS calculator integration, screenshot embedding, and PDF export pipeline.
→
Tools & Setup
HTB Machines → CPTS Modules
Curated list of 30+ HTB machines mapped to specific CPTS exam objectives. Ordered by difficulty and topic coverage.
→
Active Directory
Certipy Complete Guide
Full Certipy workflow: find, req, auth, shadow, relay, forge — all subcommands with real-world output examples.
→
Active Directory
Shadow Credentials Attack
msDS-KeyCredentialLink manipulation via Whisker/Certipy → PKINIT → TGT → NT hash without password reset.
→
Infrastructure
NFS Exploitation
no_root_squash UID spoofing, SUID binary planting, squashfs tricks, and NFS version fingerprinting for privesc.
→
Privilege Escalation
Docker / LXD Container Escape
Privileged container escapes, cgroup release_agent, LXD image trick, socket mounts, and cap_sys_admin abuse.
→
Tools & Setup
Credential Hunting Scripts
Automated one-liners for Linux/Windows credential discovery — config files, env vars, history, browsers, keyrings.
→