# Syslifters Handbook

> Syslifters is a specialized penetration testing company from Austria. Our specialisations are Microsoft-heavy enterprise environments (Active Directory), Microsoft Cloud (Entra ID, Azure, Microsoft 365) and web security.

## Table of Contents

- [👩‍💻 Secure Coding Policy](https://handbook.syslifters.com/organization/secure-coding.md): Secure coding requirements and OWASP checklist baseline for Syslifters projects.
- [📝 Information Security Policy](https://handbook.syslifters.com/organization/information-security-policy.md): Policy defining how Syslifters protects information and customer data.
- [🔥 Incident Response](https://handbook.syslifters.com/organization/incident-response.md): How Syslifters reports, contains, and notifies on security and privacy incidents, including CRA reporting for SysReptor and reptor.
- [About our organization](https://handbook.syslifters.com/organization.md): Overview of Syslifters’ organization, structure, and internal policies.
- [About the handbook](https://handbook.syslifters.com/about-the-handbook.md): What this handbook is, who it’s for, and how to contribute.
- [AD enumeration](https://handbook.syslifters.com/pentesting-manual/active-directory/enumeration/ad-enumeration.md): Tools and techniques for enumerating Active Directory and Entra ID environments.
- [ADCS](https://handbook.syslifters.com/pentesting-manual/active-directory/lateral-movement/adcs.md): Active Directory Certificate Services (AD CS) notes and references for common abuse paths.
- [Advisories](https://handbook.syslifters.com/advisories.md): Security advisories and disclosure reports published by Syslifters
- [Advisories](https://handbook.syslifters.com/de/advisories.md): Security Advisories und Disclosure-Berichte von Syslifters.
- [After our pentests](https://handbook.syslifters.com/after-pentests.md): What happens after a pentest - report delivery, retesting, and access deprovisioning guidance.
- [AMSI](https://handbook.syslifters.com/pentesting-manual/active-directory/defense-evasion/amsi.md): AMSI / ETW / Script Block Logging bypasses for PowerShell and .NET payloads.
- [Andere Lösungsvorschläge?](https://handbook.syslifters.com/de/microsoft-teams-status-disclosure.md): Wie der Microsoft-Teams-Status (Presence) sensible Gewohnheiten preisgeben kann und welche Admin-Optionen die Sichtbarkeit für Externe reduzieren.
- [Android emulation](https://handbook.syslifters.com/pentesting-manual/mobile/android-emulation.md): Set up Android Studio emulators for mobile testing, including proxying and CA certificates.
- [Ansible Automation Platform (AAP) audit](https://handbook.syslifters.com/pentesting-manual/ansible-automation-platform.md): How to assess Red Hat Ansible Automation Platform security using the aap-audit tool and Red Hat hardening guidance.
- [Antivirus & EDR](https://handbook.syslifters.com/pentesting-manual/active-directory/defense-evasion/antivirus-edr.md): Techniques for disabling, weakening or bypassing AV/EDR (Windows Defender and third-party products) on hosts during AD assessments.
- [API endpoints wordlists](https://handbook.syslifters.com/pentesting-manual/web-applications/wordlists/api-endpoints.md): Links and quick workflow for API route discovery wordlists/tools.
- [Aron Molnar](https://handbook.syslifters.com/about-us/aron.md): Profile page and CV for Aron Molnar with contact details, experience, and certifications.
- [Aron Molnar](https://handbook.syslifters.com/de/ueber-uns/aron.md): Profilseite und Lebenslauf von Aron Molnar mit Kontakt, Erfahrung und Zertifikaten.
- [ASP.NET endpoint checklist](https://handbook.syslifters.com/pentesting-manual/web-applications/dotnet-endpoints.md): Common ASP.NET MVC / Identity endpoints and files to probe during testing.
- [ASP.NET ViewState](https://handbook.syslifters.com/pentesting-manual/web-applications/viewstate.md): ViewState deserialization background and tooling references.
- [Attack-path data collection](https://handbook.syslifters.com/pentesting-manual/entraid-azure/enumeration/attack-path-data-collection.md): Collect Entra ID and Azure resource data for BloodHound attack-path enumeration with AzureHound.
- [Azure Arc](https://handbook.syslifters.com/pentesting-manual/entraid-azure/lateral-movement/azure-arc.md): Abusing Azure Arc as a bidirectional pivot between on-premises Active Directory and Azure, with an audit checklist for engagements.
- [Azure resource configuration audit](https://handbook.syslifters.com/pentesting-manual/entraid-azure/enumeration/azure-resource-configuration-audit.md): Audit Azure subscription (resource / control plane) configuration with ScoutSuite to surface storage, NSG, Key Vault, and SQL misconfigurations.
- [Before our pentests](https://handbook.syslifters.com/before-pentests.md): What to expect before a pentest - scoping, timeboxing, permission to attack, lead times, and preparation steps.
- [BitLocker](https://handbook.syslifters.com/pentesting-manual/active-directory/privilege-escalation/bitlocker.md): Local privilege escalation by booting into WinRE with a BitLocker recovery key and tampering with the OS.
- [Burp Proxy tips and tricks](https://handbook.syslifters.com/pentesting-manual/web-applications/burp-proxy-tips-and-tricks.md)
- [Canvas apps vs model-driven apps](https://handbook.syslifters.com/pentesting-manual/power-platform/difference-between-canvas-apps-and-model-driven-apps.md): Key differences between Power Apps canvas apps and model-driven apps, and when to use each.
- [Cheat sheets](https://handbook.syslifters.com/pentesting-manual/web-applications/cheat-sheets.md): Curated external cheat sheets referenced in our web application testing notes.
- [Checklist](https://handbook.syslifters.com/pentesting-manual/entraid-azure/checklist.md): Practical checklist for Entra ID and Azure assessments, including CA policy review, tooling, and common risk areas.
- [Christoph Mahrl](https://handbook.syslifters.com/about-us/christoph.md): Profile page for Christoph Mahrl with contact details, experience, and certifications.
- [Christoph Mahrl](https://handbook.syslifters.com/de/ueber-uns/christoph.md): Profilseite und Lebenslauf von Christoph Mahrl mit Kontakt, Erfahrung und Zertifikaten.
- [Common security issues in financial web apps](https://handbook.syslifters.com/pentesting-manual/web-applications/common-security-issues-financial-apps.md): Reference material for checkout/payment and financially oriented web application issues.
- [Conditional Access](https://handbook.syslifters.com/pentesting-manual/entraid-azure/defense-evasion/conditional-access.md): Auditing Entra ID Conditional Access policies and the built-in bypasses that apply to a tenant.
- [Contact us](https://handbook.syslifters.com/contact-us.md): How to contact Syslifters — get in touch with our team by email (S/MIME supported), Signal, phone, LinkedIn, or GitHub.
- [Corporate identity](https://handbook.syslifters.com/organization/corporate-identity.md): Brand assets and guidelines for Syslifters/SysReptor/SysLeaks - logos, colors, badges, and fonts.
- [Crassus](https://handbook.syslifters.com/pentesting-manual/active-directory/privilege-escalation/crassus.md): Using Crassus to discover LPE candidates (writable paths, missing DLLs) from a Process Monitor boot log and weaponise them via DLL hijacking.
- [Create security roles and set permissions](https://handbook.syslifters.com/pentesting-manual/power-platform/create-security-roles-and-set-permissions.md): Microsoft Learn references for Dataverse security roles, privileges, and user security configuration.
- [Credential dumping](https://handbook.syslifters.com/pentesting-manual/active-directory/credential-access/credential-dumping.md): Notes and commands for credential dumping in AD environments (e.g., Mimikatz, SCCM).
- [Credential Guard](https://handbook.syslifters.com/pentesting-manual/active-directory/defense-evasion/credential-guard.md): Tools and checklists for bypassing Credential Guard.
- [CRLF injection to add email CC](https://handbook.syslifters.com/pentesting-manual/web-applications/auth/crlf-email-cc.md): Steal password reset links by injecting new headers (CC) via newline injection.
- [Customer communication](https://handbook.syslifters.com/pentesting-manual/customer-communication.md): How we gather context during an engagement and how we handle unclear business impact.
- [Data protection and security](https://handbook.syslifters.com/data-protection.md): How we handle customer data and protect evidence, notes, and reports during pentests.
- [Datenschutzerklärung](https://handbook.syslifters.com/de/datenschutz.md): Datenschutzerklärung für handbook.syslifters.com
- [Datensicherheit](https://handbook.syslifters.com/de/datensicherheit.md): Wie wir Kundendaten behandeln und während Pentests Evidenzen, Notizen und Berichte schützen.
- [Default permissions and access](https://handbook.syslifters.com/pentesting-manual/power-platform/default-permissions-and-access.md): How default environment permissions and Dataverse security roles typically work, plus governance pitfalls and recommendations.
- [Delegations overview](https://handbook.syslifters.com/pentesting-manual/active-directory/lateral-movement/kerberos-delegation/delegations-overview.md): Overview page for Kerberos delegation topics.
- [DNS manipulation](https://handbook.syslifters.com/pentesting-manual/active-directory/lateral-movement/dns-manipulation.md): Notes and tooling references for DNS manipulation and related coercion setups.
- [Downloading m3u8 playlists](https://handbook.syslifters.com/pentesting-manual/web-applications/m3u8-playlist-download.md): Practical ways to download HLS streams using browser extensions, yt-dlp, or ffmpeg.
- [During our pentests](https://handbook.syslifters.com/during-pentests.md): How we work during a pentest, including communication, confidentiality, source IP, and retest policy.
- [Email setup](https://handbook.syslifters.com/organization/human-resources/email-setup.md): Configure email encryption (S/MIME) and legally required signatures/footers for eM Client, Nextcloud Mail, and Thunderbird. Configure Nextcloud calendar to use within eM Client.
- [Environment variables stored as plain text](https://handbook.syslifters.com/pentesting-manual/power-platform/environment-variables-stored-as-plain-text.md): Avoid storing secrets in text environment variables; use secret variables backed by Azure Key Vault.
- [Executive summaries](https://handbook.syslifters.com/pentesting-manual/reporting/executive-summaries.md): How to write the executive summary for CISOs and non-technical leadership.
- [Fileshare enumeration](https://handbook.syslifters.com/pentesting-manual/active-directory/enumeration/fileshare-enumeration.md): Techniques and tools for discovering and analyzing SMB file shares in AD environments.
- [Finding descriptions](https://handbook.syslifters.com/pentesting-manual/reporting/findings/descriptions.md): How to write technical finding descriptions that are complete, reproducible, and fair.
- [Finding recommendations](https://handbook.syslifters.com/pentesting-manual/reporting/findings/recommendations.md): How to write actionable finding recommendations as bullet points with full sentences.
- [Finding summaries](https://handbook.syslifters.com/pentesting-manual/reporting/findings/summaries.md): How to write finding summaries for management, department leaders, and CISOs, focused on business impact.
- [Finding titles](https://handbook.syslifters.com/pentesting-manual/reporting/findings/titles.md): How to write concise, concrete pentest finding titles that communicate impact and root cause.
- [Firefox Multi-Account Containers](https://handbook.syslifters.com/pentesting-manual/web-applications/firefox-multicontainer.md): Use Firefox Multi-Account Containers to test multiple user accounts and permission levels in one browser window.
- [Flutter app setup (proxy & TLS)](https://handbook.syslifters.com/pentesting-manual/mobile/flutter-app-setup.md): Practical steps to work around Flutter apps ignoring proxy settings and system trust stores.
- [Food vouchers](https://handbook.syslifters.com/organization/human-resources/food-vouchers.md): Quarterly Pluxee meal vouchers (€2/day, tax-exempt)—amounts, eligibility, and how payouts work for full- and part-time employees.
- [Framework-specific wordlists](https://handbook.syslifters.com/pentesting-manual/web-applications/wordlists/framework-specific.md): Starting points for framework and service endpoint discovery.
- [Hallo! Wir sind die Syslifters.](https://handbook.syslifters.com/de.md): Syslifters ist ein spezialisiertes Pentesting-Unternehmen aus Österreich mit Fokus auf Microsoft-lastige Unternehmensumgebungen, Microsoft Cloud und Web Security.
- [Hash cracking](https://handbook.syslifters.com/pentesting-manual/active-directory/credential-access/hash-cracking.md): Hash cracking workflows and references for AD passwords and Kerberos material.
- [Hijack RDP session](https://handbook.syslifters.com/pentesting-manual/active-directory/credential-access/hijack-rdp-session.md): Techniques for taking over existing RDP sessions for lateral movement or privilege escalation.
- [Host and service discovery](https://handbook.syslifters.com/pentesting-manual/active-directory/enumeration/network-enumeration/host-and-service-discovery.md): Host, port, and service discovery for AD engagements using SmartScanner.
- [Host enumeration](https://handbook.syslifters.com/pentesting-manual/active-directory/enumeration/host-enumeration.md): Tools and checklists for enumerating Windows hosts during Active Directory assessments.
- [HTTP / RPC relaying](https://handbook.syslifters.com/pentesting-manual/active-directory/lateral-movement/http-rpc-relaying.md): ntlmrelayx workflows for relaying to AD CS via HTTP and RPC interfaces.
- [HTTPS traffic decryption with Wireshark](https://handbook.syslifters.com/pentesting-manual/fat-clients/https-traffic-decryption-with-wireshark.md): Decrypt TLS traffic by logging ephemeral session keys with SSLKEYLOGFILE and loading them into Wireshark.
- [Human Resources](https://handbook.syslifters.com/organization/human-resources.md): Coming soon.
- [Identity & policy enumeration](https://handbook.syslifters.com/pentesting-manual/entraid-azure/enumeration/identity-and-policy-enumeration.md): Enumerate Entra ID identities, role assignments, and Conditional Access policies with ROADtools / ROADrecon.
- [Infos für den Einkauf](https://handbook.syslifters.com/de/fuer-den-einkauf.md): Hinweise für den Einkauf - Spesen/Barauslagen, Abrechnung, Storno-Regeln und Verweis auf AGB.
- [Internal Tools of a Pentesting company](https://handbook.syslifters.com/pentesting-manual/internal-toolset.md): Internal tools and providers we use to run the company, with a note about migrating toward European/open-source solutions.
- [IPv6 MitM](https://handbook.syslifters.com/pentesting-manual/active-directory/lateral-movement/ipv6-mitm.md): Abusing Windows IPv6 defaults with mitm6 to become DNS for a target host and chain into NTLM relaying.
- [Java RMI](https://handbook.syslifters.com/pentesting-manual/fat-clients/java-rmi.md): Quick primer on Java RMI, what to look for during testing, and tools/approaches for exploration.
- [JWT attacks](https://handbook.syslifters.com/pentesting-manual/web-applications/jwt-attacks.md): Quick usage snippet for jwt_tool playbook scanning.
- [Katana recon pipeline](https://handbook.syslifters.com/pentesting-manual/web-applications/recon/katana-pipeline.md): Crawl + archive URL collection, JS discovery, and secret scanning workflow.
- [Kontaktiert uns](https://handbook.syslifters.com/de/contact-us.md): Wie Sie Syslifters kontaktieren können — nehmen Sie Kontakt mit unserem Team per E-Mail (S/MIME unterstützt), Signal, Telefon, LinkedIn oder GitHub auf.
- [LDAP relaying](https://handbook.syslifters.com/pentesting-manual/active-directory/lateral-movement/ldap-relaying.md): Techniques for relaying NTLM authentication to LDAP, including WebClient coercion workflows.
- [Learn and practice](https://handbook.syslifters.com/pentesting-manual/web-applications/learn-and-practice.md): Curated resources for web application hacking practice and staying up to date.
- [License to role mapping risks](https://handbook.syslifters.com/pentesting-manual/power-platform/license-to-role-mapping-risks.md): How license assignment and app sharing can implicitly grant Dataverse roles and lead to unintended data access.
- [Limit environment creation for users](https://handbook.syslifters.com/pentesting-manual/power-platform/limit-environment-creation-for-users.md): Reference for controlling who can create Power Platform environments in a tenant.
- [Limited audit trail due to missing logging configuration](https://handbook.syslifters.com/pentesting-manual/power-platform/limited-audit-trail-missing-logging-configuration.md): Enable Dataverse auditing and review retention settings to avoid gaps in audit trails.
- [LPE via NTLM and Kerberos relaying](https://handbook.syslifters.com/pentesting-manual/active-directory/privilege-escalation/kerberos-relaying.md): Local privilege escalation on domain-joined Windows hosts by relaying machine-account authentication to LDAP and abusing RBCD or shadow credentials.
- [Making changes](https://handbook.syslifters.com/making-changes.md): Guidelines for contributing changes to the handbook, including sensitivity and review expectations.
- [Mass assignment in password resets](https://handbook.syslifters.com/pentesting-manual/web-applications/auth/mass-assignment-password-resets.md): Try adding extra parameters to change another user's password.
- [Matthäus Förster](https://handbook.syslifters.com/about-us/matthaeus.md): Profile page and CV for Matthäus Förster with contact details, experience, and certifications.
- [Matthäus Förster](https://handbook.syslifters.com/de/ueber-uns/matthaeus.md): Profilseite und Lebenslauf von Matthäus Förster mit Kontakt, Erfahrung und Zertifikaten.
- [Michael Wedl](https://handbook.syslifters.com/about-us/michael.md): Profile page and CV for Michael Wedl with contact details, experience, and certifications.
- [Michael Wedl](https://handbook.syslifters.com/de/ueber-uns/michael.md): Profilseite und Lebenslauf von Michael Wedl mit Kontakt, Erfahrung und Zertifikaten.
- [Microsoft 365 pillaging](https://handbook.syslifters.com/pentesting-manual/entraid-azure/enumeration/microsoft-365-pillaging.md): Post-exploitation enumeration and pillaging of Microsoft 365 (mail, SharePoint, OneDrive, Teams) via Microsoft Graph with GraphRunner.
- [Missing data policy (Data Loss Prevention)](https://handbook.syslifters.com/pentesting-manual/power-platform/missing-data-loss-prevention-policy.md): Missing DLP policies can enable unwanted connectors and data exfiltration from Power Platform environments.
- [Nach unseren Pentests](https://handbook.syslifters.com/de/nach-pentests.md): Nach dem Pentest - Bericht, kostenlose Nachtests (unter Bedingungen) und Hinweise zum Deprovisionieren von Zugängen.
- [Network access control (NAC)](https://handbook.syslifters.com/pentesting-manual/active-directory/enumeration/network-enumeration/nac.md): VLAN discovery, 802.1X / NAC assessment, and voice-VLAN pivoting on access ports.
- [Normalization and Unicode attacks (password resets)](https://handbook.syslifters.com/pentesting-manual/web-applications/auth/normalization-unicode-attacks.md): Use Unicode/punycode edge cases to redirect reset links or bypass validation.
- [Not found](https://handbook.syslifters.com/404.md): Page not found.
- [NTLM channel binding for web apps](https://handbook.syslifters.com/pentesting-manual/web-applications/ntlm-channel-binding.md): Notes on testing "Extended Protection for Authentication" (EPA) / channel binding for NTLM over HTTPS.
- [OIDC (quick note)](https://handbook.syslifters.com/pentesting-manual/web-applications/oidc.md): Flow choices and PKCE reminder.
- [Onboarding handout](https://handbook.syslifters.com/organization/human-resources/onboarding-handout.md): Copy-pasteable boilerplate for new hires covering equipment confirmation, usage rules, and setup checklists for accounts, laptop, smartphone, and YubiKey.
- [Open redirect via HTML file upload](https://handbook.syslifters.com/pentesting-manual/web-applications/file-upload/open-redirect.md): Upload an HTML file that instantly redirects users via meta refresh; prevent by blocking HTML or forcing safe download headers.
- [Our pentesters](https://handbook.syslifters.com/about-us.md): Meet our pentesters—highly qualified security professionals with strong academic backgrounds, industry certifications, and experience in top international cyber security competitions and exercises.
- [Our pentesting approach](https://handbook.syslifters.com/pentesting-approach.md): How timeboxing and available knowledge affect pentest efficiency, and when we prefer grey/white-box approaches.
- [Overview of Microsoft Power Platform](https://handbook.syslifters.com/pentesting-manual/power-platform/overview-of-microsoft-power-platform.md): A quick overview of the Power Platform components and how they relate (Power BI, Power Apps, Power Automate, Power Virtual Agents, Dataverse, connectors).
- [Overview of our pentesting procedure](https://handbook.syslifters.com/pentesting-procedure.md): Our pentesting approach from kickoff and execution to reporting, remediation, and a free retest within eight weeks.
- [Parameter pollution (password resets)](https://handbook.syslifters.com/pentesting-manual/web-applications/auth/parameter-pollution.md): Account takeover patterns when duplicate parameters are interpreted in surprising ways.
- [Password managers](https://handbook.syslifters.com/pentesting-manual/active-directory/credential-access/password-managers.md): Post-compromise credential extraction from enterprise password-manager / vault solutions encountered on internal engagements.
- [Password spraying](https://handbook.syslifters.com/pentesting-manual/active-directory/credential-access/password-spraying.md): Password spraying starting points for AD environments.
- [Patrick Pirker](https://handbook.syslifters.com/about-us/patrick.md): Profile page and CV for Patrick Pirker with contact details, experience, and certifications.
- [Patrick Pirker](https://handbook.syslifters.com/de/ueber-uns/patrick.md): Profilseite und Lebenslauf von Patrick Pirker mit Kontakt, Erfahrung und Zertifikaten.
- [Penetration Testing-Praktikum](https://handbook.syslifters.com/de/pentesting-praktikum.md): Praktikumsstelle im Penetration Testing (remote) mit Aufgaben, Anforderungen, Rahmenbedingungen und Bewerbung.
- [Pentest operation rules](https://handbook.syslifters.com/pentesting-manual/operation-rules.md): A practical checklist for prep, collaboration, evidence hygiene, and secure handling of customer data during pentests.
- [Pentest planning process](https://handbook.syslifters.com/pentesting-manual/pentest-planning-process.md): This document describes the Syslifters pentest planning process and the kanban-style Pentest Planning Board we use to run it.
- [Pentestbox setup](https://handbook.syslifters.com/organization/human-resources/pentestbox-setup.md): Setup guide for running offensive tooling in an isolated, capability-restricted Kali container from our internal registry instead of installing it on your host.
- [Pentesting Demo-Berichte](https://handbook.syslifters.com/de/pentesting-demo-reports.md): Demo-Pentestberichte (AD, Web, Extern) zum Einblick in Aufbau und Qualität unserer Reports.
- [Pentesting Manual](https://handbook.syslifters.com/pentesting-manual.md): Overview and entry point to our pentesting notes, playbooks, and reporting guidance.
- [Pentesting Sample Reports](https://handbook.syslifters.com/pentesting-sample-reports.md): Downloadable pentest sample reports (AD, web, external) showcasing our reporting style.
- [Physical security](https://handbook.syslifters.com/pentesting-manual/physical-security.md): A collection of ideas for assessing physical security around offices, devices, documents, and access control.
- [Power Platform dataverse](https://handbook.syslifters.com/pentesting-manual/power-platform/power-platform-dataverse.md): What Dataverse is, when to use it, and a practical overview of the Dataverse security model and common pitfalls.
- [Power Platform environments](https://handbook.syslifters.com/pentesting-manual/power-platform/power-platform-environments.md): What environments are, how they relate to Dataverse, and common environment types and governance notes.
- [Pre-mortem exercise](https://handbook.syslifters.com/organization/human-resources/pre-mortem.md): Imagine leaving Syslifters one year from now and surface risks, blind spots, and improvements before they become real problems.
- [Pricing](https://handbook.syslifters.com/de/pricing.md): Preisgestaltung für Pentests inkl. Tagsatz, Richtwerte, Rabatte und Partnerhinweise.
- [Pricing](https://handbook.syslifters.com/pricing.md): Pricing model for pentests, including day rates, typical project ranges, and discount rules.
- [PrivescCheck](https://handbook.syslifters.com/pentesting-manual/active-directory/privilege-escalation/privesc-check.md): Running PrivescCheck to enumerate local privilege escalation opportunities on a Windows host.
- [Pro Bono Pentests](https://handbook.syslifters.com/de/pro-bono-pentests.md): Pro-Bono-Pentestprogramm - Voraussetzungen, Erwartungen, verpflichtende Retests und Kontakt.
- [Pro Bono Pentests](https://handbook.syslifters.com/pro-bono-pentests.md): Pro bono pentest program - eligibility, expectations, retesting requirements, and how to apply.
- [Project retention](https://handbook.syslifters.com/organization/human-resources/project-retention.md): Keep local pentest project files only as long as needed. Set up Project Sense to delete stale data after 90 days.
- [Projektförderung für Web-Pentests](https://handbook.syslifters.com/de/kmu-cybersecurity-web-pentest.md): CC BY Vorlage für einen Projektantrag zur AWS-Förderung KMU.Cybersecurity für einen Web-Pentest.
- [PXE boot](https://handbook.syslifters.com/pentesting-manual/active-directory/credential-access/pxe-boot.md): PXE boot attack chain notes for extracting SCCM secrets and certificates.
- [Read access to tables with compiled assemblies](https://handbook.syslifters.com/pentesting-manual/power-platform/read-access-to-tables-with-compiled-assemblies.md): How overly broad table permissions can allow users to list and download compiled Dataverse/D365 plugin assemblies.
- [Reinhard Widmeyer](https://handbook.syslifters.com/about-us/reinhard.md): Profile page and CV for Reinhard Widmeyer with contact details, experience, and certifications.
- [Reinhard Widmeyer](https://handbook.syslifters.com/de/ueber-uns/reinhard.md): Profilseite und Lebenslauf von Reinhard Widmeyer mit Kontakt, Erfahrung und Zertifikaten.
- [Remote debugging on mobile](https://handbook.syslifters.com/pentesting-manual/mobile/remote-debugging.md): Use Chrome remote debugging when TLS interception breaks on-device traffic inspection.
- [Report writing](https://handbook.syslifters.com/pentesting-manual/reporting/report-writing.md): Style and clarity guidelines for pentest reports (voice, tense, recommendations, and redaction).
- [Resource-Based Constrained Delegation (RBCD)](https://handbook.syslifters.com/pentesting-manual/active-directory/lateral-movement/kerberos-delegation/rbcd.md): Abusing msDS-AllowedToActOnBehalfOfOtherIdentity to impersonate any user against a target computer.
- [Samuel Haim](https://handbook.syslifters.com/about-us/samuel.md): Profile page and CV for Samuel Haim with contact details, experience, and certifications.
- [Samuel Haim](https://handbook.syslifters.com/de/ueber-uns/samuel.md): Profilseite und Lebenslauf von Samuel Haim mit Kontakt, Erfahrung und Zertifikaten.
- [Screenshots](https://handbook.syslifters.com/pentesting-manual/reporting/screenshots.md): How to take clear, useful, and properly redacted screenshots for pentest reports.
- [Search Shodan for SSH keys](https://handbook.syslifters.com/pentesting-manual/external/search-shodan-for-ssh-keys.md): Get an SSH host key fingerprint and use it to find reused keys across hosts via Shodan.
- [Self-evaluation questionnaire](https://handbook.syslifters.com/organization/human-resources/self-evaluation.md): Reflect on your technical and social skills as a pentester. Results are for personal development only—not used for salary, bonuses, or job classification.
- [Sending reports](https://handbook.syslifters.com/pentesting-manual/reporting/sending-reports.md): Guidance for securely sharing pentest reports - encrypted PDFs, password-protected links, expiry dates, and secondary-channel password delivery.
- [Sensitive data discovery](https://handbook.syslifters.com/pentesting-manual/entraid-azure/enumeration/sensitive-data-discovery.md): Hunt credential stores, secrets, and high-risk file types across SharePoint, OneDrive, and Exchange Online using Microsoft Purview eDiscovery content search.
- [Service description of penetration tests](https://handbook.syslifters.com/service-description.md): Service description (terms) for offensive security services.
- [Servicebeschreibung Penetration-Tests](https://handbook.syslifters.com/de/servicebeschreibung.md): Servicebeschreibung für Penetration-Tests und Phishing-Simulationen inkl. Umfang, Mitwirkungspflichten, Geheimhaltung, Haftung und Reporting.
- [Shadow credentials](https://handbook.syslifters.com/pentesting-manual/active-directory/lateral-movement/shadow-credentials.md): Abusing msDS-KeyCredentialLink (key trust) to request TGTs for target objects.
- [Small brute force password lists](https://handbook.syslifters.com/pentesting-manual/web-applications/wordlists/small-bruteforce-lists.md): Compact default credential lists for quick checks across common services.
- [SMB relaying](https://handbook.syslifters.com/pentesting-manual/active-directory/lateral-movement/smb-relaying.md): Methodology and tooling for NTLM relaying attacks over SMB in AD environments.
- [Social security numbers generator](https://handbook.syslifters.com/pentesting-manual/socialsecuritynumbersgenerator.md): Client-side generator for valid-format Austrian social security numbers.
- [Solutions in Power Platform](https://handbook.syslifters.com/pentesting-manual/power-platform/solutions-in-power-platform.md): How solutions bundle apps, flows, tables, and security components for deployment and governance across environments.
- [SQLi and XSS payloads in filenames](https://handbook.syslifters.com/pentesting-manual/web-applications/file-upload/sqli-xss-in-filename.md): Basic payload examples when filenames are concatenated into SQL/HTML contexts.
- [Starting and closing the day](https://handbook.syslifters.com/organization/human-resources/starting-and-closing-the-day.md): Optional morning set-up and evening tear-down. Calendar, urgent mail, and a todo list so unfinished work does not follow you home (Zeigarnik effect).
- [Stellenausschreibung: Senior Penetrationtester](https://handbook.syslifters.com/de/pentesting-senior.md): Stellenausschreibung für einen Senior-Penetrationtester (remote, unbefristet) inkl. Aufgaben, Anforderungen und Bewerbung.
- [This could be important for procurement](https://handbook.syslifters.com/for-procurement.md): Procurement notes - billable expenses, time-based billing, cancellation terms, and where to find formal terms.
- [Tool cheat sheet](https://handbook.syslifters.com/pentesting-manual/active-directory/tool-cheat-sheet.md): Quick-reference commands for common Active Directory tooling.
- [Toolset for Security Penetration Tests](https://handbook.syslifters.com/pentesting-manual/pentesting-toolset.md): Recommended tools and plugins we use for pentesting across web, AD/Windows, and reporting workflows.
- [Travel expenses](https://handbook.syslifters.com/organization/human-resources/travel-expenses.md): General guide for business travel - choosing a hotel, picking the right transportation (ÖBB or car), tracking costs and getting compensation.
- [Überblick zu unserem Vorgehen bei Pentests](https://handbook.syslifters.com/de/pentesting-vorgehen.md): Unser Vorgehen beim Pentest – von Vorbesprechung und Durchführung bis Bericht, Behebung und kostenlosem Re-Test innerhalb von 8 Wochen.
- [Unconstrained Kerberos delegation](https://handbook.syslifters.com/pentesting-manual/active-directory/lateral-movement/kerberos-delegation/unconstrained-delegation.md): Abusing TRUSTED_FOR_DELEGATION to capture forwardable TGTs and impersonate users who authenticate to a compromised host.
- [Universal WAF bypass (request padding)](https://handbook.syslifters.com/pentesting-manual/web-applications/universal-waf-bypass.md): Many WAFs inspect only the first N KB of a request body; prepend junk to push payload past inspection limits.
- [Unser Pentesting-Ansatz](https://handbook.syslifters.com/de/pentesting-ansatz.md): Wie sich Zeit und Wissen auf die Effizienz von Penetrationstests auswirken und wann wir Grey- oder White-Box-Ansätze bevorzugen.
- [Unser Vesting-Vertrag](https://handbook.syslifters.com/de/vesting-vertrag.md): Erklärung und Auszug der Vesting-Vereinbarung der Syslifters-Gründer (Vesting-Zeitraum, Einziehung/Clawback bei vorzeitigem Ausstieg).
- [Unsere Pentester](https://handbook.syslifters.com/de/ueber-uns.md): Lernt unsere Pentester kennen – hochqualifizierte Security-Profis mit fundiertem akademischem Hintergrund, relevanten Zertifizierungen sowie Erfahrung aus internationalen Cybersecurity-Wettbewerben und Übungen.
- [Unsere Skill-Matrix](https://handbook.syslifters.com/de/skill-matrix.md): Skill-Matrix mit Selbsteinschätzung unserer Stärken in Pentesting- und Security-Bereichen.
- [Untitled](https://handbook.syslifters.com/privacy.md): Privacy notice for handbook.syslifters.com.
- [User agent wordlists](https://handbook.syslifters.com/pentesting-manual/web-applications/wordlists/user-agents.md): Links and exported UA lists for fuzzing / WAF behavior checks.
- [Using AI](https://handbook.syslifters.com/organization/human-resources/ai-tool-setup.md)
- [UUID v1 sandwich attack](https://handbook.syslifters.com/pentesting-manual/web-applications/auth/uuidv1-sandwich-attack.md): If password reset links use UUIDv1, try a sandwich attack to guess adjacent UUIDs.
- [Vor unseren Pentests](https://handbook.syslifters.com/de/vor-pentests.md): Ablauf vor dem Pentest - Scoping, Timebox, Permission to Attack, Vorlaufzeit und organisatorische Vorbereitung.
- [Vulnerability Disclosure](https://handbook.syslifters.com/de/vulnerability-disclosure.md): Wie du Schwachstellen meldest und unsere Vulnerability-Disclosure-Policy (Scope, Safe Harbour, Regeln).
- [Vulnerability Disclosure](https://handbook.syslifters.com/vulnerability-disclosure.md): How to report vulnerabilities to Syslifters and our vulnerability disclosure policy (including scope and safe harbour).
- [Während unserer Pentests](https://handbook.syslifters.com/de/waehrend-pentests.md): Zusammenarbeit während des Pentests inkl. Austausch, Vertraulichkeit, Quell-IP und Nachtest-Regelung.
- [Was kostet die Gründung einer Pentesting-Firma?](https://handbook.syslifters.com/de/gruendungskosten.md): Aufschlüsselung der Gründungskosten einer Pentesting-Firma in Österreich (2022) inkl. laufender Kosten und Lizenzen.
- [Was wir anbieten](https://handbook.syslifters.com/de/was-wir-anbieten.md): Überblick über unsere offensiven Security-Services, unseren effizienten Pentest-Ansatz und Leistungen, die wir nicht anbieten.
- [WDAC & AppLocker](https://handbook.syslifters.com/pentesting-manual/active-directory/defense-evasion/wdac-applocker.md): Bypassing WDAC and concept and implementation notes for restricting PowerShell capabilities via WDAC and AppLocker.
- [WebSocket hijacking (origin/SOP note)](https://handbook.syslifters.com/pentesting-manual/web-applications/websocket-hijacking.md): WebSockets bypass some expectations of SOP; validate Origin and authenticate the channel.
- [What we provide](https://handbook.syslifters.com/what-we-provide.md): Overview of Syslifters offensive security services, our efficient pentesting approach, and services we do not offer.
- [Working together in projects](https://handbook.syslifters.com/pentesting-manual/working-together.md): How we collaborate during pentests depending on the timebox.
- [WSUS](https://handbook.syslifters.com/pentesting-manual/active-directory/lateral-movement/wsus.md): Abusing legitimate WSUS admin access to push SYSTEM-level code to downstream clients via SharpWSUS.
- [WSUS](https://handbook.syslifters.com/pentesting-manual/active-directory/privilege-escalation/wsus.md): Local privilege escalation by MitM-ing an HTTP WSUS feed and injecting a fake Microsoft-signed update that runs as SYSTEM.
- [XMP metadata injection in PNG uploads](https://handbook.syslifters.com/pentesting-manual/web-applications/file-upload/xmp-metadata-injection-png.md): Embed XML/HTML payloads in PNG XMP metadata to exploit downstream processing or unsafe rendering.
- [XSS via SVG file upload](https://handbook.syslifters.com/pentesting-manual/web-applications/file-upload/svg-xss.md): SVG can embed scripts that execute when rendered; validate content and serve safely.
- [XXE payloads](https://handbook.syslifters.com/pentesting-manual/web-applications/xxe-payloads.md): Payloads and techniques for in-band and blind XXE testing and exfiltration.
- [YubiKey PC setup](https://handbook.syslifters.com/organization/human-resources/yubikey-pc-setup.md): Configure a PC to use an already provisioned YubiKey for PIV/SSH (Windows) and basic GPG/SSH agent use.
- [YubiKey setup](https://handbook.syslifters.com/organization/human-resources/yubikey-setup.md): One-time setup of a YubiKey for PIV/SSH (key generation and certificate).