[ FIELD NOTEBOOK ]
Pentest Handbook
Personal notes and field references, organized by technique series.
Revised from active labs and certifications.
Network Recon 4 topics
01
Passive Reconnaissance OSINT techniques: WHOIS, DNS lookups, subdomain discovery, and Shodan fingerprinting without touching the target.
› 02
Active Reconnaissance Directly probing targets to map live hosts, OS types, network paths, and open services using ping, traceroute, telnet, and netcat.
› 03
Common Network Protocols How Telnet, HTTP, FTP, SMTP, POP3, and IMAP work and why their cleartext design makes them useful during enumeration.
› 04
Sniffing, MITM & Password Attacks Intercepting cleartext traffic, ARP poisoning a switched network, and attacking authentication with Hydra and SSH keys.
› Web Authentication & Session Security 5 topics
01
Username & Password Attacks How username enumeration, brute force, and password reset flaws work - and why authentication is almost always the weakest link.
› 02
Session Management Flaws How sessions work at a fundamental level, what breaks at each phase, and the real-world impact of fixation, escalation, and improper termination.
› 03
JWT Attacks JWT internals, signing algorithms, and why self-contained tokens create a fundamentally different trust model - plus every major way that model breaks.
› 04
OAuth 2.0 Attacks How OAuth 2.0 actually works under the hood, why its complexity makes it prone to implementation bugs, and what happens when those bugs exist.
› 05
MFA Bypass How MFA mechanisms work at a technical level, why they fail, and which attacks defeat each type - from OTP logic flaws to AiTM phishing that bypasses everything short of passkeys.
›