--- title: "Comprehensive Pentest Reference · VORNAC Research" description: "Three-column reference combining a tooling catalog, a vulnerability-class checklist, and a per-service CVE matrix. The most concrete tooling reference in the index." url: https://www.vornac.com/en/research/offensive-tradecraft/comprehensive-pentest-reference lang: en published: 2026-06-02 updated: 2026-06-02 alternate_de: https://www.vornac.com/research/offensive-tradecraft/comprehensive-pentest-reference --- [Research Index](https://www.vornac.com/en/research) / [1 · Offensive Tradecraft](https://www.vornac.com/en/research/offensive-tradecraft) / Comprehensive Pentest Reference Featured · [1 Offensive Tradecraft](https://www.vornac.com/en/research/offensive-tradecraft) # Comprehensive Pentest Reference. Three-column reference combining a tooling catalog, a vulnerability-class checklist, and a per-service CVE matrix. The most concrete tooling reference in the index. ## Default tool per task - **Port discovery.** `nmap` for accuracy, `masscan` first when the IP range is >/22 to bound timing. - **Web content discovery.** `ffuf` with a tuned wordlist (SecLists `raft-large` as default), `katana` for JS-rendered routes, `waybackurls` for historic paths. - **Web vuln scan.** `nuclei` with the public template tree, scoped to fingerprinted tech. Never run the full tree blind. - **Authentication abuse.** `hydra` for service brute-force, `kerbrute` for AD username enum and password spray, `CrackMapExec` for SMB/LDAP/MSSQL. - **Web exploitation.** Burp Suite for manual, `sqlmap` for confirmed SQLi extraction. - **Post-exploitation.** `impacket` suite (secretsdump, wmiexec, smbexec) on Linux ops boxes; `Rubeus` + `SharpHound` on Windows footholds. ## Vulnerability classes worth memorizing OWASP Top 10 covers the highest-volume classes. Non-OWASP classes that recur in real engagements: - **Untrusted deserialization.** Java (ysoserial gadgets), .NET (ysoserial.net), Python pickle, PHP unserialize. - **SSRF chains.** Cloud metadata (`169.254.169.254`), internal Redis, gopher:// for protocol smuggling. - **JWT confusion.** `alg: none`, HS256 signed with RSA public key, key-ID directory traversal. - **Race conditions.** Single-request multi-packet (RFC 7230 §3.3.3), business-logic windows around money movement. - **Server-side template injection.** Jinja2, Twig, Velocity, FreeMarker — distinct payload syntax per engine. ## Banner → first-look CVE clusters - **Apache HTTPD < 2.4.50.** CVE-2021-41773 path traversal; instant win if mod-cgi enabled. - **Atlassian Confluence.** CVE-2022-26134 OGNL injection on any Confluence pre-7.18. - **Microsoft Exchange.** ProxyShell (CVE-2021-34473 et al.), ProxyNotShell (CVE-2022-41040 + 41082). - **VMware vCenter.** Log4Shell vectors on pre-patch builds; vSphere Client SSRF. - **Citrix NetScaler/Gateway.** CVE-2023-3519 unauthenticated RCE on internet-facing instances. - **Ivanti Connect Secure.** CVE-2024-21887 + 46805 auth bypass + command injection. **Rule of thumb**Banner first, exploit second. Confirm the version, confirm the patch level, then choose the chain. Skipping the confirmation step is how testers fire exploits at hardened targets and burn detection time for nothing. Domain [1 · Offensive Tradecraft](https://www.vornac.com/en/research/offensive-tradecraft) Tier Featured Engagement phases ReconFingerprintingXSSSQL InjectionCommand InjectionSSRFFile UploadKnown CVEs Published 2 June 2026 Looking up an acronym? [Open the Glossary](https://www.vornac.com/en/glossary) ## Related notes in this domain - [Featured Pentest Methodology — Canonical Reference](https://www.vornac.com/en/research/offensive-tradecraft/pentest-methodology-canon) - [Featured Advanced Penetration Testing & Red Team](https://www.vornac.com/en/research/offensive-tradecraft/advanced-pentest-and-redteam) - [Featured Recon & Discovery](https://www.vornac.com/en/research/offensive-tradecraft/recon-and-discovery) - [Featured Web Server — Attack & Defense](https://www.vornac.com/en/research/offensive-tradecraft/web-server-attack-defense) - [Featured Active Directory Pentest](https://www.vornac.com/en/research/offensive-tradecraft/active-directory-pentest) - [Featured Internal Pivoting & Lateral Movement](https://www.vornac.com/en/research/offensive-tradecraft/internal-pivoting) - [Reference Recon Tooling — Operator Reference](https://www.vornac.com/en/research/offensive-tradecraft/recon-tooling) - [Reference Operator Toolkits — Catalog & Reference](https://www.vornac.com/en/research/offensive-tradecraft/operator-toolkits) - [Reference Automation vs. Manual Testing](https://www.vornac.com/en/research/offensive-tradecraft/automation-vs-manual) - [Background Social Engineering & Phishing](https://www.vornac.com/en/research/offensive-tradecraft/social-engineering-phishing) - [Background Pentester Foundations & CTF Practice](https://www.vornac.com/en/research/offensive-tradecraft/pentester-foundations) [Back to domain](https://www.vornac.com/en/research/offensive-tradecraft) [Next note Pentest Methodology — Canonical Reference](https://www.vornac.com/en/research/offensive-tradecraft/pentest-methodology-canon) From reference to evidence ## Run this against your own environment.