
You have code execution on a Windows or Linux host and need to harvest credentials to move laterally or escalate privileges.

**Windows Credential Locations**
- What is the LSASS process and what credentials does it hold in memory?
- How does Mimikatz extract credentials from LSASS? What privileges are required?
- What is the difference between sekurlsa::logonpasswords and lsadump::sam?
- What does Protected Users group membership do to credential caching in LSASS?

**LSASS Dump Techniques**
- Why might you avoid running Mimikatz directly on a host?
- How does `comsvcs.dll MiniDump` work as an LOLBin for LSASS dumping?
- How do you extract credentials from an offline LSASS dump?

**Windows SAM & DPAPI**
- What is the SAM database and how do you extract it offline?
- What does DPAPI protect and where are DPAPI blobs stored?
- How do you decrypt browser-saved passwords using DPAPI?

**Linux Credential Locations**
- What does `/etc/shadow` contain and how do you crack it offline?
- Where do applications commonly store credentials on Linux? (config files, .env, history files, bash_history)
- How do you extract SSH private keys and assess their value?

**Browser & Application Credentials**
- How do you extract saved passwords from Chrome, Firefox, and Edge on Windows?
- What credentials are stored in Windows Credential Manager and how do you dump them?
- Where do common applications (FileZilla, WinSCP, PuTTY) store saved credentials?

Output:
- Credential harvesting priority list (by value and ease)
- LOLBin LSASS dump commands
- Linux credential hunt checklist


Credential Harvesting Post-Compromise


You have achieved persistent access to an internal network during an authorized penetration test. Plan a data exfiltration operation to demonstrate impact to the client.

**Data Identification**
- How do you identify high-value data without downloading everything?
- What file types and directories are highest priority in a corporate environment?
- How do you search for files containing keywords like "password", "confidential", "credit card" at scale?

**Egress Channel Selection**
- What outbound channels are typically allowed through enterprise firewalls? (HTTP/S, DNS, SMTP)
- How does DNS exfiltration work and what are its speed limitations?
- When is HTTPS the best egress channel vs when is it detectable?
- How do you use cloud services (S3, GitHub, Pastebin) as exfiltration endpoints?

**Data Staging**
- Why do you stage data before exfiltrating? What are the risks of exfiltrating directly?
- How do you compress and encrypt data before exfil to reduce size and avoid content inspection?
- Where on the target system is a safe staging location?

**Transfer Techniques**
- How do you exfiltrate data over an existing C2 channel vs setting up a separate channel?
- What is LOLBAS exfiltration? (certutil, bitsadmin, curl from Windows)
- How do you exfiltrate from an air-gapped or highly restricted network?

**Avoiding Detection**
- What size thresholds trigger DLP alerts in most environments?
- How do you time your exfiltration to blend with legitimate traffic patterns?
- What does SSL inspection catch and how do you avoid it?

Output:
- Exfiltration channel comparison (speed, detection risk, setup complexity)
- DNS exfiltration explanation with tool options
- Staging and encryption workflow


Data Exfiltration Planning


After completing authorized penetration test activities, reason through evidence cleanup to restore target systems to their pre-test state.

**Why Cleanup Matters**
- What is the difference between a red team cleanup and hiding attacker tracks?
- What documentation should you maintain during an engagement to enable complete cleanup?
- What happens if cleanup is incomplete and a third party discovers your artifacts?

**Windows Artifact Removal**
- What event logs contain evidence of your activity and how do you clear specific event IDs?
- How do you remove scheduled tasks, services, and registry keys you created?
- How do you securely delete files you wrote to disk?
- What are prefetch files, shimcache, and amcache and what do they record?

**Linux Artifact Removal**
- Which log files capture your activity? (/var/log/auth.log, syslog, wtmp, lastlog, bash_history)
- How do you clean bash history without deleting the entire file?
- How do you remove cron jobs, SSH keys, and user accounts you created?
- What file system timestamps should you restore and how?

**Network Artifact Cleanup**
- What network connections remain open after you stop your tools?
- How do you verify no listeners are still running on the target?
- What DNS cache entries might expose your C2 infrastructure?

**Verification**
- How do you verify cleanup is complete before leaving an engagement?
- What is the minimum checklist before closing out a penetration test?

Output:
- Pre-cleanup documentation template
- Windows cleanup command checklist
- Linux cleanup command checklist
- Final verification checklist


Evidence Cleanup & Anti-Forensics Assessment


You have a stable foothold on an internal host. Plan a thorough internal network enumeration campaign to discover targets for lateral movement.

**Host Discovery**
- How do you discover live hosts on the local subnet without running noisy port scans?
- What do ARP tables, DNS cache, and /etc/hosts or Windows hosts file reveal?
- How do you use native tools for host discovery? (ping, arp, nslookup, net commands)

**Service & Role Discovery**
- How do you identify servers by role? (file server, mail server, database, DC, backup server)
- What does examining DHCP leases reveal about the network?
- How do you find web servers, databases, and internal portals without a scanner?

**Active Directory Discovery from a Member Host**
- What can `net.exe` commands reveal without LDAP access?
- How do you identify the Domain Controller address, domain name, and domain SID from a domain-joined machine?
- What does `dsquery` provide on a domain-joined host?

**Network Shares & File Discovery**
- How do you enumerate accessible network shares from your foothold?
- What does a share named "IT$", "backup", or "ADMIN$" typically contain?
- How do you search shares for sensitive files quickly?

**Internal Services Discovery**
- How do you find internal web applications that are not externally accessible?
- What indicators suggest a host runs MSSQL, Oracle, or other database services?
- How do you identify internal certificate authorities?

Output:
- Native tool enumeration commands (Windows + Linux)
- High-value target identification checklist
- Scan approach for minimal network noise


Post Exploitation

Credential Harvesting Post-Compromise

Data Exfiltration Planning

Evidence Cleanup & Anti-Forensics Assessment

Internal Network Enumeration Post-Compromise