Guides
Concepts and tools, by phase of the work
Tool walkthroughs, checklists, and the concepts behind them — organized the way a real engagement actually unfolds, from getting started through post-exploitation.
Getting Started
25 CLI Commands Every Hacker Needs to Get the Job Done
The command-line tools that come up constantly across a real engagement, organized by phase — recon, web testing, credential attacks, exploitation, pivoting, privesc, and analysis.
Linux Fundamentals Every Beginner Hacker Needs
The Linux commands, permissions model, and habits that show up constantly in offensive security work — covered once, properly.
Lab & Engagement Infrastructure
Git for Security Work: Version Control Beyond Just Downloading Code
The git workflow behind every "git clone" on this site, and why version control matters in an engagement and in building your own tooling, not just for downloading someone else's repo.
Docker for Security Labs: Building and Running Isolated Targets
How pwnmi.com's own CVE labs and home lab setups use Docker — images, containers, compose, and the isolation pattern used across every lab on this site.
Give Your Home Lab a Real Domain (Without Opening Any Ports)
Why a domain is worth it for a home lab, the registrars I use, and how Cloudflare Tunnels plus Zero Trust let you reach internal services without port forwarding or a public IP.
Why I Run Every Engagement Through tmux
How and why to run pentest engagements inside tmux — session persistence, a consistent window layout per target, and the config that makes it fast.
Recon
OSINT Fundamentals: Recon Before You Touch the Target
A practical introduction to open-source intelligence gathering — domain and DNS enumeration, breach data, and username/social footprint discovery, before any active scanning starts.
Nmap Fundamentals: Your First Recon Tool
A practical introduction to Nmap — the commands you'll actually use for host discovery, port scanning, and service enumeration.
Web Application Testing
Privilege Escalation
Privilege Escalation Fundamentals: From a Foothold to Root or SYSTEM
What privilege escalation actually means, why it happens on every operating system for the same handful of underlying reasons, and how the Linux and Windows checklists on this site fit together.
The Active Directory Attack Chain: From Foothold to Domain Admin
How a single set of low-privileged domain credentials becomes Kerberoasting, AS-REP roasting, pass-the-hash, and eventually a full domain compromise — the enumeration-to-domain-admin path behind most internal penetration tests.
Windows Privilege Escalation: An Analysis Checklist
A repeatable checklist for local Windows privilege escalation — service misconfigurations, stored credentials, dangerous token privileges, and scheduled tasks.
Script Privilege Escalation: An Analysis Checklist
A repeatable checklist for finding the privesc vector in a script running as root via cron or sudo — command construction, PATH trust, file operations, and language-specific traps.
Post-Exploitation & Evasion
Maintaining Access: Persistence and Why Cleanup Isn't Optional
What persistence actually means as an engagement phase, the common technique categories, and the operational discipline of tracking and reverting exactly what you changed.
Pivoting and Tunneling Fundamentals: Reaching What You Can't Route To
What pivoting actually means, the SOCKS proxy concept behind most of it, and how to pick between SSH, Chisel, socat, and proxychains for a given situation.
Command and Control Fundamentals: How an Implant Actually Stays in Touch
The core mechanics of C2 — listeners, beacons, staging, and redirectors — and why the channel connecting operator to compromised host is its own discipline, separate from the exploit that got you there.
Defense Evasion: Reducing Noise Without Assuming You're Invisible
What defense evasion actually covers as an ATT&CK tactic — log handling, living-off-the-land binaries, AMSI awareness, and fileless execution — and the operational discipline of not mistaking silence for stealth.