---
title: "Research · 1 Offensive Tradecraft · VORNAC"
description: "Methodologies, frameworks, and red-team playbooks. The how-we-test layer. 12 curated notes across featured, reference, and background tiers."
url: https://www.vornac.com/en/research/offensive-tradecraft
lang: en
published: 2026-06-02
updated: 2026-06-02
alternate_de: https://www.vornac.com/research/offensive-tradecraft
---

[Research Index](https://www.vornac.com/en/research) / 1 · Offensive Tradecraft

VORNAC RESEARCH

1

# Offensive Tradecraft.

Methodologies, frameworks, and red-team playbooks. The how-we-test layer.

12

Notes in this domain

7

Featured

3

Reference

2

Background

Featured

Featured

8 phases

### [Comprehensive Pentest Reference](https://www.vornac.com/en/research/offensive-tradecraft/comprehensive-pentest-reference)

Three-column reference combining a tooling catalog, a vulnerability-class checklist, and a per-service CVE matrix. The most concrete tooling reference in the index.

Recon Fingerprinting XSS SQL Injection Command Injection SSRF File Upload Known CVEs

Featured

3 phases

### [Pentest Methodology — Canonical Reference](https://www.vornac.com/en/research/offensive-tradecraft/pentest-methodology-canon)

PTES, the craft notes on engagement sequencing, and the web-application methodology variants — consolidated into one navigable reference.

Methodology Recon Reporting

Featured

3 phases

### [Advanced Penetration Testing & Red Team](https://www.vornac.com/en/research/offensive-tradecraft/advanced-pentest-and-redteam)

Past the OWASP basics: chained exploitation, air-gapped lab setup for payload trials, and the operating notes for full-scope adversary simulation.

Methodology Known CVEs Reporting

Featured

3 phases

### [Recon & Discovery](https://www.vornac.com/en/research/offensive-tradecraft/recon-and-discovery)

The recon catalog end-to-end: passive vs. active modes, subdomain discovery across CT logs and DNS, web-stack fingerprinting, and port-to-service mapping.

Recon OSINT Fingerprinting

Featured

4 phases

### [Web Server — Attack & Defense](https://www.vornac.com/en/research/offensive-tradecraft/web-server-attack-defense)

Per-server-class attack chains paired with the corresponding hardening — Apache, nginx, IIS, Tomcat, JBoss — and the decision tree from first 200 OK to authenticated context.

Fingerprinting Command Injection Recon Authentication

Featured

4 phases

### [Active Directory Pentest](https://www.vornac.com/en/research/offensive-tradecraft/active-directory-pentest)

AD attack surface end-to-end: enumeration, Kerberos, ACL abuse, GPO weaponization, the Tier-0 chase — including the internal-engagement playbook from foothold to domain dominance.

Recon Authentication Fingerprinting Business Logic

Featured

4 phases

### [Internal Pivoting & Lateral Movement](https://www.vornac.com/en/research/offensive-tradecraft/internal-pivoting)

Tunnel topologies, port-forwarding patterns, the handoff from web compromise to internal foothold, and a worked JBoss-to-domain case.

Fingerprinting Authentication Deserialization Methodology

Reference

Reference

### [Recon Tooling — Operator Reference](https://www.vornac.com/en/research/offensive-tradecraft/recon-tooling)

nmap scan templates by goal, transform-driven entity discovery in Maltego, and the timing-vs-stealth tradeoffs that decide when to use what.

ReconFingerprintingAuthentication

Reference

### [Operator Toolkits — Catalog & Reference](https://www.vornac.com/en/research/offensive-tradecraft/operator-toolkits)

Meterpreter, PowerShell, and the broader pentest toolkit catalog — recommended defaults per slot, with the Linux and Python operator notes that round out the kit.

Methodology

Reference

### [Automation vs. Manual Testing](https://www.vornac.com/en/research/offensive-tradecraft/automation-vs-manual)

Where automation earns its keep, where it misses by design, and the seams where a human reviewer must take over — paired against the manual techniques that resist tooling.

ReconDirectory FuzzingXSSSQL InjectionBusiness Logic

Background

-   [Social Engineering & Phishing](https://www.vornac.com/en/research/offensive-tradecraft/social-engineering-phishing)

    Pretext design, channel selection, and the patterns specific to phishing privileged users — including the failure modes that turn a campaign into an internal incident on your side.

    Authentication

-   [Pentester Foundations & CTF Practice](https://www.vornac.com/en/research/offensive-tradecraft/pentester-foundations)

    Senior-tester skill rubric, repo-archaeology techniques for security engineers, and the CTF tooling and infrastructure references that keep practice sharp.

    Recon · Methodology

[All eight domains](https://www.vornac.com/en/research) [Next domain 2 · Application & Identity Security](https://www.vornac.com/en/research/application-identity)

From reference to evidence

## Validate these gaps in your own environment.