Pentest tools and attack techniques, explained

Certipy explained for defenders: the AD CS paths ESC1 to ESC17 it targets, the event IDs that expose it, the fixes, and a $6,000 fixed-price AD test.

Cobalt Strike explained: how Beacon and its C2 work, why cracked copies fuel ransomware, the event IDs that expose it, and red team tests from $12,500.

DAST tools compared for 2026: 16 scanners from ZAP to Invicti, prices where published, API and pipeline support, and the flaws scanners still miss.

ffuf explained: what the Go web fuzzer finds, the log signals that expose a run, the fixes that leave it nothing to find, and web app tests from $5,200.

Golden ticket attack vs silver ticket: what each forged Kerberos ticket proves, the event IDs that expose it, and the fixes. AD testing from $6,000.

Hashcat explained for defenders: what the password cracker does, what its modes reveal about your password policy, and how to fix it. AD tests from $6,000.

IDOR vulnerability explained: real cases, IDOR vs BOLA, the fixes that work, how abuse shows in your logs, and how we test for it from $4,000.

Kerberoasting explained: why any domain user can crack service-account passwords offline, what changed with RC4 in 2026, and the fix. AD tests from $6,000.

Lateral movement explained: the nine MITRE ATT&CK techniques, the Windows event IDs that detect them, the controls that stop them, and testing from $6,000.

Mimikatz explained: how it pulls Windows credentials from memory and Active Directory, the event IDs that expose it, and the fixes. AD tests from $6,000.

Network vulnerabilities explained: the 15 most common weaknesses testers exploit, how to detect and fix each, and what a network pentest costs from $4,200.

Penetration testing tools pentesters use in 2026: 30 free and paid tools by phase, what each one finds, the logs that catch it, and what tools miss.

PetitPotam explained: how coerced NTLM relay to AD CS web enrollment gives up a domain, the event IDs that catch it, and the fixes in priority order.

Privilege escalation explained: the Windows and Linux techniques attackers use, the event IDs that expose them, and the fixes. Testing from $6,000.

Red team tools for 2026: C2 frameworks like Sliver and Cobalt Strike, phishing and evasion kit, the logs that catch each one, and testing from $12,500.

RCE (remote code execution) lets an attacker run code on your server. Root causes, 2026 examples, detection signals, fixes, and testing from $5,200.

Rubeus explained: what each Kerberos function does, what a success says about your domain, how to detect it, and the fixes. AD tests from $6,000.

XXE (XML external entity) injection explained: where it hides, what it exposes, the parser settings that stop it, and how we test for it from $5,200.

All 36 exploited vulnerabilities CISA added to KEV in October 2026, from Ivanti Connect Secure to FortiMail and PHP, ranked by risk, with what to patch first.

PHP2Shell (CVE-2026-109618, CVE-2026-109619) is an exploited, unauthenticated PHP RCE vulnerability. Fixed versions, why workers must restart and how to check.

sshhole (sshole, CVE-2026-123158) can let attackers into key-only accounts on Alpine and other musl-based OpenSSH servers. Who is affected and how to check.

BloodHound explained: how it maps Active Directory attack paths to Domain Admin, what Community Edition changed, and how defenders use it to cut paths.

Evil-WinRM explained: what the WinRM shell tool is, why it needs a valid password, hash or Kerberos ticket, and the Windows logs that detect it.

Gobuster explained: the dir, dns, vhost, s3 and gcs modes, the hidden directories and subdomains it finds, and how defenders detect and reduce it.