> For the complete documentation index, see [llms.txt](https://lyethar.gitbook.io/methodology/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://lyethar.gitbook.io/methodology/readme.md).
# Introduction
A hands-on penetration testing reference built from real-world experience across Hack The Box, Proving Grounds, and the PWK labs. Covers the full offensive cycle: reconnaissance, enumeration, exploita
### About me
My name is Fabian. I started my penetration testing journey in Fall 2021 and have since worked through Hack The Box, Offensive Security's PWK labs, and Proving Grounds. I currently work as a Consultant/Penetration Tester and hold the following certifications: OSEP, OSCP, eCPPTv2, eJPT, and CARTP. This wiki is where I document the methodology, tools, and techniques I've developed and refined along the way. I hope you find it useful.
### How to use this wiki
This wiki is organized around the standard penetration testing lifecycle. Each section represents a phase of an engagement, with dedicated pages covering tools, commands, and decision logic for that phase. Whether you are working a CTF box or a real assessment, you can navigate directly to the relevant phase and follow along.
### Methodology phases
Enumeration — Identify all open ports and services. Build your attack surface map before touching anything.
Exploitation — Leverage identified vulnerabilities to gain initial access. Covers vulnerable services, web attacks, and password attacks.
Privilege Escalation — Move from a low-privileged shell to SYSTEM or root. Covers Windows token abuse, misconfigured services, and Linux SUID/sudo/cron paths.
Post-Exploitation — Actions taken after gaining elevated access: credential dumping, lateral movement, and persistence.
Active Directory — AD-specific attack chains: user enumeration, Kerberoasting, ASREPRoasting, and domain privilege escalation.
