<?xml version="1.0" encoding="UTF-8" ?>
<rss version="2.0">
    <channel>
      <title>Field Manual</title>
      <link>https://enriquefolte.com</link>
      <description>Last 10 notes on Field Manual</description>
      <generator>Quartz -- quartz.jzhao.xyz</generator>
      <item>
    <title>Linux PrivEsc Groups Capabilities</title>
    <link>https://enriquefolte.com/manual/04_Post-Exploitation/Linux_Post_Exploitation/Linux_PrivEsc_Groups_Capabilities</link>
    <guid>https://enriquefolte.com/manual/04_Post-Exploitation/Linux_Post_Exploitation/Linux_PrivEsc_Groups_Capabilities</guid>
    <description><![CDATA[ 🛡️ Methodology Checklist Check group membership: id lxd group: import Alpine → create privileged container → mount host / docker group: escape via docker run -v /:/mnt --rm -it alpine chroot /mnt sh Writable /var/run/docker.sock (even without docker group): drive the API directly disk group: read r... ]]></description>
    <pubDate>Thu, 04 Jun 2026 05:43:54 GMT</pubDate>
  </item><item>
    <title>Linux PrivEsc Kernel Python</title>
    <link>https://enriquefolte.com/manual/04_Post-Exploitation/Linux_Post_Exploitation/Linux_PrivEsc_Kernel_Python</link>
    <guid>https://enriquefolte.com/manual/04_Post-Exploitation/Linux_Post_Exploitation/Linux_PrivEsc_Kernel_Python</guid>
    <description><![CDATA[ 🛡️ Methodology Checklist Kernel version: uname -r Search exploits: searchsploit linux kernel [version] Check PwnKit: pkexec is SUID-root and unpatched (CVE-2021-4034) Compile exploit NATIVELY on target — not cross-compiled Check Python library path order: python3 -c &quot;import sys; print(sys.path... ]]></description>
    <pubDate>Thu, 04 Jun 2026 05:43:54 GMT</pubDate>
  </item><item>
    <title>Linux PrivEsc Methodology</title>
    <link>https://enriquefolte.com/manual/04_Post-Exploitation/Linux_Post_Exploitation/Linux_PrivEsc_Methodology</link>
    <guid>https://enriquefolte.com/manual/04_Post-Exploitation/Linux_Post_Exploitation/Linux_PrivEsc_Methodology</guid>
    <description><![CDATA[ 🛡️ Methodology Checklist Global — run once per host Identify the Linux distribution and kernel version → Linux_PrivEsc_Enumeration Check for credentials in web application configuration files → Linux_PrivEsc_Enumeration Check interesting directories (/opt, /var/mail, /srv, web roots) → Linux_PrivEs... ]]></description>
    <pubDate>Thu, 04 Jun 2026 05:43:54 GMT</pubDate>
  </item><item>
    <title>Linux PrivEsc Misc NFS Logrotate</title>
    <link>https://enriquefolte.com/manual/04_Post-Exploitation/Linux_Post_Exploitation/Linux_PrivEsc_Misc_NFS_Logrotate</link>
    <guid>https://enriquefolte.com/manual/04_Post-Exploitation/Linux_Post_Exploitation/Linux_PrivEsc_Misc_NFS_Logrotate</guid>
    <description><![CDATA[ 🛡️ Methodology Checklist Check NFS exports: cat /etc/exports — look for no_root_squash Mount NFS share from attacker, compile SUID C binary, chmod u+s Execute SUID binary on target to get root shell Check logrotate version and find writable log file with config Use logrotten tool to race logrotate ... ]]></description>
    <pubDate>Thu, 04 Jun 2026 05:43:54 GMT</pubDate>
  </item><item>
    <title>NetExec SMB Recon</title>
    <link>https://enriquefolte.com/manual/06_NetExec/SMB/NetExec_SMB_Recon</link>
    <guid>https://enriquefolte.com/manual/06_NetExec/SMB/NetExec_SMB_Recon</guid>
    <description><![CDATA[ 🛡️ Methodology Checklist Subnet sweep: nxc smb [CIDR]/24 — identify live SMB hosts Check SMB signing (for relay targeting): nxc smb [CIDR]/24 --gen-relay-list unsigned.txt NULL session users: nxc smb [DC_IP] -u &#039;&#039; -p &#039;&#039; --users NULL session password policy: nxc smb [DC_IP] -u &#... ]]></description>
    <pubDate>Thu, 04 Jun 2026 01:46:54 GMT</pubDate>
  </item><item>
    <title>NetExec LDAP Kerberos</title>
    <link>https://enriquefolte.com/manual/06_NetExec/LDAP_RDP/NetExec_LDAP_Kerberos</link>
    <guid>https://enriquefolte.com/manual/06_NetExec/LDAP_RDP/NetExec_LDAP_Kerberos</guid>
    <description><![CDATA[ 🛡️ Methodology Checklist Add DC FQDN to /etc/hosts (required for LDAP/Kerberos) LDAP enum: nxc ldap [DC_FQDN] -u [USER] -p [PASS] --users ASREPRoast (authenticated): nxc ldap [DC_FQDN] -u [USER] -p [PASS] --asreproast hashes.txt ASREPRoast (unauthenticated, needs list): nxc ldap [DC_FQDN] -u users.... ]]></description>
    <pubDate>Thu, 04 Jun 2026 01:06:47 GMT</pubDate>
  </item><item>
    <title>HTB: StreamIO</title>
    <link>https://enriquefolte.com/write-ups/htb-cpts/streamio</link>
    <guid>https://enriquefolte.com/write-ups/htb-cpts/streamio</guid>
    <description><![CDATA[ 🎬 StreamIO Machine: StreamIO Difficulty: Medium Theme: Web enumeration → subdomain discovery → manual MSSQL injection → credential cracking → authenticated admin panel → PHP LFI/source disclosure → RFI/RCE → MSSQL backup database credential discovery → WinRM lateral movement → Firefox credential ex... ]]></description>
    <pubDate>Wed, 03 Jun 2026 00:00:00 GMT</pubDate>
  </item><item>
    <title>Master Cheatsheets</title>
    <link>https://enriquefolte.com/manual/_Cheatsheets/Master_Index</link>
    <guid>https://enriquefolte.com/manual/_Cheatsheets/Master_Index</guid>
    <description><![CDATA[ Quick-jump index to every master cheatsheet, ordered by engagement phase. Start here, then jump to the sheet for your current phase. ]]></description>
    <pubDate>Fri, 29 May 2026 22:48:08 GMT</pubDate>
  </item><item>
    <title>Master Web Commands</title>
    <link>https://enriquefolte.com/manual/_Cheatsheets/Master_Web_Commands</link>
    <guid>https://enriquefolte.com/manual/_Cheatsheets/Master_Web_Commands</guid>
    <description><![CDATA[ 🛡️ Methodology Checklist Fingerprint: server, framework, CMS, WAF Directory/file brute-force with ffuf (no extension, then .php/.txt/.bak) Test all input parameters: SQLi, XSS, command injection, LFI Check file upload: type restriction bypass, webshell Login brute-force (check lockout first) SQLMap... ]]></description>
    <pubDate>Fri, 29 May 2026 18:50:53 GMT</pubDate>
  </item><item>
    <title>Master Password Attacks</title>
    <link>https://enriquefolte.com/manual/_Cheatsheets/Master_Password_Attacks</link>
    <guid>https://enriquefolte.com/manual/_Cheatsheets/Master_Password_Attacks</guid>
    <description><![CDATA[ 🛡️ Methodology Checklist Identify hash type before cracking: hashid -m [HASH] / hashcat --identify Order of attack: default creds → credential stuffing → spray → targeted brute → full crack Check lockout policy before any spray: --pass-pol / net accounts Crack: John (CPU/format-auto) or Hashcat (GP... ]]></description>
    <pubDate>Fri, 29 May 2026 18:31:55 GMT</pubDate>
  </item>
    </channel>
  </rss>