TechDocs

Home Start Here Basics Backend OffSec Cheatsheets About

ThemeLightDark

OffSec OffSec

Reconnaissance

Passive

OSINT Introduction Social Media OSINT Breach Databases Code Repositories OSINT Archive Analysis

Active

Subdomain Enumeration DNS Enumeration Port Scanning Service Fingerprinting

Analysis

Technology Detection JavaScript Analysis Cloud Assets Screenshotting

Operations

Recon Checklist Recon Case Studies

Vulnerability Guides

Vulnerability Analysis & Exploitation Guides Vuln Checklist

Authentication-bypass

Authentication Bypass Authentication Bypass Attack Vectors Authentication Bypass Exploitation Authentication Bypass Case Studies Authentication Bypass Mitigations

Authorization-bypass

Authorization Bypass Authorization Bypass Attack Vectors Authorization Bypass Exploitation Authorization Bypass Case Studies Authorization Bypass Mitigations

Command-injection

Introduction to Command Injection Vulnerabilities Command Injection Attack Vectors: Real-World Scenarios Exploiting OS Command Injection Case Studies: Command Injection in the Wild Mitigating OS Command Injection

Csrf

Introduction to Cross-Site Request Forgery (CSRF) Vulnerabilities Exploitation Case Studies CSRF Mitigation Strategies and Best Practices

Deserialization

Intro Exploitation Case Studies Mitigations

File-upload

Intro Exploitation Bypasses Case Studies Mitigations

Http-request-smuggling

Intro Exploitation Case Studies Mitigations

Idor

Intro Exploitation Case Studies Mitigations

Lfi

Introduction to Local File Inclusion (LFI)Exploitation Case Studies: From LFI to RCE and Beyond Mitigations

Open-redirect

Intro Exploitation Mitigations

Race-conditions

Intro Exploitation Mitigations

Rce

Intro Exploitation Case Studies Mitigations

Rfi

Intro Exploitation Case Studies Mitigations

Sqli

Introduction to SQL Injection (SQLi)Union-Based SQL Injection Error-Based SQL Injection Introduction to Blind SQL Injection Boolean-Based Blind SQL Injection Time-Based Blind SQL Injection Advanced SQL Injection Techniques Case Study: SQLi in a Product Filtering Mechanism

Ssrf

Intro Exploitation Case Studies Mitigations

Template-injection

Intro Exploitation Mitigations

Xss

Intro Reflected Xss Stored Xss Dom Xss Blind Xss Mutation Xss Waf Bypass Case Studies

Misconfigurations

Active Directory

Active Directory Security , The Real-World Field Manual AD Enumeration , You Can't Hit What You Can't See NTLM Authentication - The Protocol That Won't Die Kerberos Authentication - The Three-Headed Dog of AD Common Active Directory Misconfigurations - Where Security Breaks Active Directory Security Best Practices - Building a Secure Foundation

Exploitation

Index

Binary-exploitation

Binary Case Studies Buffer Overflow Format Strings Heap Overflow Intro Ret2libc Rop Srop Use After Free

Client-side

Mobile Exploitation Social Engineering

Network

Iot Attacks Network Exploitation Wireless Attacks

Web

Api Exploitation Cloud Exploitation Web Exploitation

Payloads & Wordlists

Index

Payloads-library

Command Injection Deserialization Lfi Rfi Rce Smuggling Sqli Ssrf Upload Bypass Xss

Wordlists-collection

Cloud Enumeration Custom Wordlists Directories Fuzzing Parameters Passwords Subdomains

Payload Generation

Advanced Techniques

Index

Exploitation-internals

Container Escapes Heap Spraying Kernel Exploits Memory Corruption Sandbox Escapes

Post-exploitation

Evasion And Obfuscation Lateral Movement Mitm Attacks Persistence Techniques

Privilege-escalation

Docker Escalation Checklist Kubernetes Linux Windows

Android Pentest

Android Penetration Testing Documentation - The Complete Guide

Android Basics

Android Mastery ADB and Android Tooling Android Permissions Model Android Reverse Engineering

Android Component Testing - When Apps Talk Too Much Android Static Analysis - Reading Apps Like Books Android Dynamic Analysis - Watching Apps in Action Android Network Security Testing - Watching Apps Talk Android Storage Security Testing - Finding Data That Shouldn't Be There Android Runtime Instrumentation - Hooking Into Apps

Tools & Automation

Security Tools & Automation

Automation

Automation Scripts Custom ReconX Reporting Tools Zap Tricks

Exploit

Exploitation Tools Fuzzing Tools Metasploit Tricks Post Exploitation Tools

Recon

Burp Tricks Nmap Tricks Recon Tools

Reverse

Docker Tools Wireless Tools

Reporting & Writeups

Bounty

Bounty Tips Bug Bounty Case Studies Communication Tips

Reporting

Bug Report Template Disclosure Guidelines Report Checklist Writeup Examples

Ctf Writeups

Home/OffSec/Nmap Tricks

Nmap Tricks

Posted 2025-08-20 · Updated 2026-09-08

0x1RIS

Runnable security and backend notes. Labs, cheatsheets, and references.

Type to search the docs…