--- title: "VORNAC Research · Curated reference index for offensive security." description: "A curated, hand-titled index of reference notes on offensive security: methodologies, tooling, and per-service exploitation patterns, mapped to engagement phases." url: https://www.vornac.com/en/research lang: en published: 2026-06-02 updated: 2026-09-07 alternate_de: https://www.vornac.com/research --- # The Research Index. Reference notes on offensive security: methodologies, tooling, and per-service exploitation matrices. Hand-titled, cross-mapped to engagement phases, kept free of dated artifacts. Looking up an acronym? [Open the Glossary](https://www.vornac.com/en/glossary) 45 Notes 13 Featured 8 Domains 22 Engagement phases Jump to: 1 2 3 4 5 6 7 8 1 ## [Offensive Tradecraft](https://www.vornac.com/en/research/offensive-tradecraft) Methodologies, frameworks, and red-team playbooks. The how-we-test layer. **12** notes Featured Featured 8 phases ### [Comprehensive Pentest Reference](https://www.vornac.com/en/research/offensive-tradecraft/comprehensive-pentest-reference) Three-column reference combining a tooling catalog, a vulnerability-class checklist, and a per-service CVE matrix. The most concrete tooling reference in the index. Recon Fingerprinting XSS SQL Injection Command Injection SSRF File Upload Known CVEs Featured 3 phases ### [Pentest Methodology — Canonical Reference](https://www.vornac.com/en/research/offensive-tradecraft/pentest-methodology-canon) PTES, the craft notes on engagement sequencing, and the web-application methodology variants — consolidated into one navigable reference. Methodology Recon Reporting Featured 3 phases ### [Advanced Penetration Testing & Red Team](https://www.vornac.com/en/research/offensive-tradecraft/advanced-pentest-and-redteam) Past the OWASP basics: chained exploitation, air-gapped lab setup for payload trials, and the operating notes for full-scope adversary simulation. Methodology Known CVEs Reporting Featured 3 phases ### [Recon & Discovery](https://www.vornac.com/en/research/offensive-tradecraft/recon-and-discovery) The recon catalog end-to-end: passive vs. active modes, subdomain discovery across CT logs and DNS, web-stack fingerprinting, and port-to-service mapping. Recon OSINT Fingerprinting Featured 4 phases ### [Web Server — Attack & Defense](https://www.vornac.com/en/research/offensive-tradecraft/web-server-attack-defense) Per-server-class attack chains paired with the corresponding hardening — Apache, nginx, IIS, Tomcat, JBoss — and the decision tree from first 200 OK to authenticated context. Fingerprinting Command Injection Recon Authentication Featured 4 phases ### [Active Directory Pentest](https://www.vornac.com/en/research/offensive-tradecraft/active-directory-pentest) AD attack surface end-to-end: enumeration, Kerberos, ACL abuse, GPO weaponization, the Tier-0 chase — including the internal-engagement playbook from foothold to domain dominance. Recon Authentication Fingerprinting Business Logic Featured 4 phases ### [Internal Pivoting & Lateral Movement](https://www.vornac.com/en/research/offensive-tradecraft/internal-pivoting) Tunnel topologies, port-forwarding patterns, the handoff from web compromise to internal foothold, and a worked JBoss-to-domain case. Fingerprinting Authentication Deserialization Methodology Reference Reference ### [Recon Tooling — Operator Reference](https://www.vornac.com/en/research/offensive-tradecraft/recon-tooling) nmap scan templates by goal, transform-driven entity discovery in Maltego, and the timing-vs-stealth tradeoffs that decide when to use what. ReconFingerprintingAuthentication Reference ### [Operator Toolkits — Catalog & Reference](https://www.vornac.com/en/research/offensive-tradecraft/operator-toolkits) Meterpreter, PowerShell, and the broader pentest toolkit catalog — recommended defaults per slot, with the Linux and Python operator notes that round out the kit. Methodology Reference ### [Automation vs. Manual Testing](https://www.vornac.com/en/research/offensive-tradecraft/automation-vs-manual) Where automation earns its keep, where it misses by design, and the seams where a human reviewer must take over — paired against the manual techniques that resist tooling. ReconDirectory FuzzingXSSSQL InjectionBusiness Logic Background - [Social Engineering & Phishing](https://www.vornac.com/en/research/offensive-tradecraft/social-engineering-phishing) Pretext design, channel selection, and the patterns specific to phishing privileged users — including the failure modes that turn a campaign into an internal incident on your side. Authentication - [Pentester Foundations & CTF Practice](https://www.vornac.com/en/research/offensive-tradecraft/pentester-foundations) Senior-tester skill rubric, repo-archaeology techniques for security engineers, and the CTF tooling and infrastructure references that keep practice sharp. Recon · Methodology 2 ## [Application & Identity Security](https://www.vornac.com/en/research/application-identity) OWASP-adjacent vulnerability classes — from XSS to business logic flaws. **7** notes Featured Featured 9 phases ### [Common Web Vulnerabilities](https://www.vornac.com/en/research/application-identity/common-web-vulnerabilities) The canonical vulnerability catalog: every class with at least one concrete proof-pattern. The single most-cited entry in the index. XSS SQL Injection CSRF Command Injection SSRF Deserialization File Upload IDOR XXE / Path Traversal Featured 7 phases ### [Web Attack & Defense — Canonical Reference](https://www.vornac.com/en/research/application-identity/web-attack-defense-canon) Each vulnerability class presented as an attack/defense pair, with the briefing-level overview and the protocol/header/encoding points where weaknesses recur. XSS SQL Injection CSRF SSRF Command Injection File Upload IDOR Featured 2 phases ### [XSS — Comprehensive Reference](https://www.vornac.com/en/research/application-identity/xss-comprehensive) The full XSS landscape: reflected, stored, DOM, mutation. Sink-versus-source structuring, CSP/WAF bypass, hook-and-control patterns, and the conditions under which payloads become worm-like. XSS DOM XSS Featured 2 phases ### [Injection, SSRF & XXE](https://www.vornac.com/en/research/application-identity/injection-and-traversal) Server-side request forgery, XML external entity weaponization, and path-traversal cousins — vector enumeration, blind-channel exfiltration, parser-quirk routing. SSRF XXE / Path Traversal Featured 5 phases ### [Authentication, Logic & Architecture Flaws](https://www.vornac.com/en/research/application-identity/authentication-and-logic) Password-recovery logic flaws, JWT/CORS/TLS architecture issues, the working top-10 business-logic patterns, and how a real intrusion looks in logs vs. test traffic. Business Logic Session Mgmt CORS / TLS / JWT API Security Authentication Reference Reference ### [Server-Side Language Audits — Java, PHP, SQLmap](https://www.vornac.com/en/research/application-identity/server-side-language-audits) Stack-specific notes for Java and PHP — deserialization gadgets, expression-language injection, tainted-input flow — paired with SQLmap operator flags and the OWASP testing checklist. SQL InjectionDeserializationFile UploadXXE / Path TraversalCommand InjectionXSSCSRFIDORMethodology Background - [Mobile Platform Security — Android, iOS, macOS](https://www.vornac.com/en/research/application-identity/mobile-platform-security) Per-platform attack surface and skills reference: Android permission model and APK static/dynamic attacks, iOS entitlement reasoning, macOS TCC and codesign. — 3 ## [Cloud & Modern Infrastructure](https://www.vornac.com/en/research/cloud-infrastructure) Public-cloud security models and enterprise architecture patterns. **4** notes Reference Reference ### [AWS Security Reference](https://www.vornac.com/en/research/cloud-infrastructure/aws-security-reference) IAM modeling, cross-account boundaries, and the highest-leverage misconfigurations to look for first on AWS. ReconKnown CVEsReporting Reference ### [Cloud Security — Generalist Reference](https://www.vornac.com/en/research/cloud-infrastructure/cloud-security-generalist) Cross-provider security concepts that survive cloud-vendor differences: identity, network, data, control plane vs. data plane. ReconFingerprintingKnown CVEs Reference ### [Enterprise Security Architecture](https://www.vornac.com/en/research/cloud-infrastructure/enterprise-security-architecture) Reference architecture patterns for security at enterprise scale, paired with the cross-industry view of which platform choices the field is moving toward. ReconReporting Background - [Python for Security Automation](https://www.vornac.com/en/research/cloud-infrastructure/python-and-tooling-scripting) Python idioms specific to security work: subprocess discipline, robust HTTP, async scanners, and the regex patterns recurring in log triage. — 4 ## [Operational Technology & Embedded](https://www.vornac.com/en/research/ot-embedded) Surfaces outside conventional IT: ICS/SCADA, IoT, automotive, wireless. **3** notes Reference Reference ### [Wi-Fi Attack & Detection](https://www.vornac.com/en/research/ot-embedded/wifi-attack-mindmap) Wireless attack surface across WPA2/WPA3 and enterprise EAP variants, with the practical detection telltales for each technique. Recon Background - [ICS & IoT — Security Reference](https://www.vornac.com/en/research/ot-embedded/ics-and-iot-security) Where industrial control systems and IoT surface meet, where their threat models diverge, and the CSA-aligned reference for device, edge, network, cloud, and lifecycle. Recon · Known CVEs · Reporting - [Automotive Security — Reference](https://www.vornac.com/en/research/ot-embedded/automotive-security) Vehicle attack surface map: in-cabin networks, telematics gateway, software-update channel, supplier dependency graph. Reporting 5 ## [Threat Intelligence & Adversary Modeling](https://www.vornac.com/en/research/threat-intelligence) Diamond model, kill chains, attribution, and threat modeling. **5** notes Featured Featured 2 phases ### [OSINT — Recon Mindmap](https://www.vornac.com/en/research/threat-intelligence/osint-mindmap) Open-source intelligence routes by entity type: people, organizations, infrastructure, code, leaks. The recon companion to engagement scoping. Recon OSINT Background - [Threat Modeling — Canonical Reference](https://www.vornac.com/en/research/threat-intelligence/threat-modeling-canon) STRIDE, LINDDUN, attack-tree, and the Diamond model as a structured note-taking template — paired with the preventive and responsive control maps over the attack lifecycle. Recon · Known CVEs - [APT Operations — Reference](https://www.vornac.com/en/research/threat-intelligence/apt-operations) How sustained adversaries operate end-to-end: initial-access patterns, tooling and TTP overlap, Windows persistence ranking, and the discovery/impact assessment workflow. — - [Red Team Planning & Intel Analysis](https://www.vornac.com/en/research/threat-intelligence/red-team-planning) Adversary-simulation planning tree (objective, profile, infrastructure, evasion, deconfliction) and the source-rating discipline that keeps a threat-intel report honest about confidence. — - [Email & Fraud — Investigation Reference](https://www.vornac.com/en/research/threat-intelligence/email-and-fraud-forensics) Triage workflow for a suspicious email (header reasoning, detonation, URL pivot) and the investigative routes for transaction fraud across account, device, and payment dimensions. Recon 6 ## [Reverse Engineering, Binary & Malware](https://www.vornac.com/en/research/reverse-malware) Low-level attack surfaces — exploitation, fuzzing, and malware behavior. **4** notes Background - [Binary Exploitation — Fuzz to Working Exploit](https://www.vornac.com/en/research/reverse-malware/binary-exploitation-pipeline) End-to-end memory-corruption pipeline: corruption classes, fuzzing-driven crash discovery, mitigation tradeoffs per stage, and the Windows internals that earn offensive relevance. — - [Reverse Engineering Fundamentals](https://www.vornac.com/en/research/reverse-malware/reverse-engineering-fundamentals) Quick-reference for disassemblers, debuggers, and the signatures to look for first — including an ARM reference for analysts moving from x86 and the modern browser as an attack surface. — - [Malware Analysis — Canonical Reference](https://www.vornac.com/en/research/reverse-malware/malware-analysis-canon) Triage workflow, packer recognition, behavioral exploit profile, RAT family-behavior reference, and the template for documenting a sustained adversary group. — - [Document & Runtime Exploits](https://www.vornac.com/en/research/reverse-malware/document-and-runtime-exploits) PDF as a delivery vehicle (structure, script extraction, parser quirks) and the Java-runtime exploit reference — historical and current patterns, with what each reveals about the deployed JRE. — 7 ## [AI, Data & Emerging Risk](https://www.vornac.com/en/research/ai-emerging) Machine-learning security, blockchain, and data-layer threats. **4** notes Background - [ML & Cyber Analytics](https://www.vornac.com/en/research/ai-emerging/ml-and-analytics) Vendor-neutral landscape map: model families, training pipelines, deployment patterns — plus which statistical/ML models fit which security-analytics problems and where they reliably fail. Known CVEs - [NLP in Security — Reference](https://www.vornac.com/en/research/ai-emerging/nlp-in-security) Natural-language processing applied to security work: log clustering, phishing detection, report summarization, and where modern LLM-driven techniques fit (and don't). — - [Blockchain Security — Reference](https://www.vornac.com/en/research/ai-emerging/blockchain-security-reference) Smart-contract, bridge, and consensus-layer threat classes — where the field's actual losses cluster, and the audit patterns that catch them. — - [Cryptographic Hashing — Reference](https://www.vornac.com/en/research/ai-emerging/cryptographic-hashing-reference) Practitioner-level hashing reference: when collision resistance matters, when length-extension bites, and what to pick today. — 8 ## [Defensive Operations & Governance](https://www.vornac.com/en/research/defensive-ops) Blue-team operations, the security-product landscape, and compliance posture. **6** notes Reference Reference ### [SIEM Architecture — Reference](https://www.vornac.com/en/research/defensive-ops/siem-architecture) Reference architecture for a working SIEM: ingestion, normalization, detection layer, response loop — with the cost and quality trade-offs at each junction. ReportingRecon Reference ### [SSL/TLS Threat Model](https://www.vornac.com/en/research/defensive-ops/ssl-tls-threat-model) TLS attack surface organized by ceremony stage: handshake, certificate path, cipher choice, record layer — with the deprecation and mitigation timeline. Reference ### [DDoS Defense — Reference](https://www.vornac.com/en/research/defensive-ops/ddos-defense-reference) DDoS attack-class taxonomy with the corresponding mitigation layers — anycast, scrubbing, app-layer rate logic. Reference ### [Host & Network Hardening](https://www.vornac.com/en/research/defensive-ops/host-and-network-hardening) Linux operator hardening, TCP/IP operational notes for detection engineers, AD defense from the defender's perspective, and data-center host hardening where physical access intersects vendor patches. Reporting Background - [Perimeter, Office & Database Security](https://www.vornac.com/en/research/defensive-ops/perimeter-and-database-security) What changes at the perimeter, the realities of office network hardening (BYOD, printers, guest segmentation), and database security beyond SQL injection — replication, backup, encryption-at-rest. Reporting · Known CVEs - [Compliance, Risk & Information Security Landscape](https://www.vornac.com/en/research/defensive-ops/compliance-and-governance) Cross-walk between common control frameworks, the reference architecture for an in-house risk-control platform, and the field-level orientation map of the discipline. — Methodology ## How the index is curated Every entry is fingerprinted by SHA-256 against the source corpus, deduplicated, machine-extracted from diagrammatic form, and manually re-titled in neutral English. Where a topic has aged out (dated tooling, year-stamped surveys), it is removed rather than rebranded. Entries are mapped to the engagement phase they support, so a tester reading a finding in our report can land on the exact reference that informed it. - **Stable identifiers.** Every note carries a content hash. Updates change the hash; the index is reproducible. - **One language.** Published in English. Titles and blurbs are neutral so they remain quotable. - **Phase-mapped.** Each note links to the engagement phases where it actually applies, not where it might. - **No advertising.** The index does not promote tools or vendors. Where a tool is named, it is named for technical specificity. Looking up an acronym? [Open the Glossary](https://www.vornac.com/en/glossary) From reference to evidence ## Validate these gaps in your own environment.