XUTS LABS / ACADEMY
Attack Nodes
Browse nodes by operator domain instead of hunting through one giant grid. Start with OT / ICS, Active Directory, web, SQL, privilege escalation, or lateral movement.
Node Section
OT / ICS
OT / ICS
OT Network Fundamentals
OT networks support physical processes through systems such as HMIs, engineering workstations, historians, PLCs, RTUs, safety systems, and control servers. Unlike enterprise IT, availability and process stability usually matter more than confidentiality.
OT / ICS
OT Segmentation Enumeration
OT segmentation enumeration is the process of identifying boundaries, conduits, jump paths, firewall rules, routing paths, and trust relationships between enterprise IT and industrial control networks.
OT / ICS
Engineering Workstation Enumeration
Engineering workstations are operator and engineer systems used to configure, program, troubleshoot, and sometimes directly communicate with controllers and industrial equipment.
OT / ICS
Modbus Fundamentals
Modbus is a common industrial protocol used for communication between clients and devices such as PLCs, RTUs, gateways, and simulators. Modbus/TCP commonly uses port 502.
OT / ICS
Historian Enumeration
Industrial historians collect and store process data from OT systems. They often provide long-term visibility into production, equipment behavior, alarms, trends, and operational states.
OT / ICS
PLC Enumeration
PLC enumeration is the process of identifying programmable logic controllers, their vendors, reachable services, communication paths, and operational role without changing controller state.
OT / ICS
OT Lateral Movement
OT lateral movement is the controlled movement from enterprise or OT-adjacent access toward systems that provide operational visibility or control, such as jump hosts, historians, HMIs, engineering workstations, or controller networks.
OT / ICS
Safety System Awareness
Safety system awareness means understanding the difference between operational control systems and systems designed to protect life, equipment, and the environment, such as Safety Instrumented Systems.
Node Section
Active Directory
Kerberos
ASREP Roast
ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.
Kerberos
Kerberoast
Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.
BloodHound Edge
GenericWrite
GenericWrite means you can modify certain attributes on the target AD object.
BloodHound Edge
GenericAll
GenericAll is effectively full control over the target AD object.
Domain Escalation
DCSync
DCSync abuses directory replication rights to request password data from a domain controller.
Enumeration
LDAP Enumeration
LDAP enumeration pulls users, groups, computers, SPNs, UAC flags, ACLs, and domain metadata.
Enumeration
Kerberos Enumeration
Kerberos enumeration checks domain validity, users, ASREP roastability, SPNs, and time-sensitive auth behavior.
Enumeration
BloodHound Collection
BloodHound collection gathers AD relationships, sessions, ACLs, local admin, and attack paths.
BloodHound Edge
CanPSRemote
CanPSRemote means the user can likely open a PowerShell Remoting session to the target.
BloodHound Edge
AdminTo
AdminTo means the principal has local administrator rights on a computer.
BloodHound Edge
WriteDACL
WriteDACL allows modifying the target object's security descriptor.
BloodHound Edge
ForceChangePassword
ForceChangePassword lets you reset the target user's password without knowing the old one.
DACL Abuse
Targeted Kerberoast
Targeted Kerberoast writes an SPN onto a user you control rights over, requests a TGS, then removes the SPN.
BloodHound Edge
SQLAdmin
SQLAdmin means a principal has administrative control over MSSQL service or server context.
Node Section
Web
Web
Web Enumeration
Web enumeration identifies technologies, routes, directories, vhosts, parameters, auth portals, upload points, and app behavior.
Web
Feroxbuster Content Discovery
Feroxbuster brute-forces web paths and extensions to find hidden content.
Web
Virtual Host Enumeration
VHost enumeration finds hostnames served by the same web server.
Web
SQL Injection Checks
SQLi checks test whether user-controlled input reaches backend SQL queries unsafely.
Web
File Upload Abuse
File upload abuse turns upload functionality into code execution or file write.
Web
Default Credentials
Testing known default credentials for discovered services and web apps.
Node Section
SQL
MSSQL
MSSQL Linked Servers
MSSQL linked servers allow one SQL server to query or execute against another configured SQL server.
Enumeration
MSSQL Enumeration
MSSQL enumeration checks auth, roles, linked servers, xp_cmdshell, impersonation, and coercion opportunities.
MSSQL
MSSQL xp_cmdshell
xp_cmdshell allows OS command execution from MSSQL when enabled and permitted.
Node Section
Privilege Escalation
Windows Privilege Escalation
SeImpersonatePrivilege
SeImpersonatePrivilege allows token impersonation. In vulnerable contexts, it can lead to SYSTEM.
Windows PrivEsc
Windows Local Privilege Escalation
Windows local privilege escalation is the process of turning a low-privilege shell into local administrator or SYSTEM.
Windows PrivEsc
Writable Windows Services
Writable service abuse occurs when a low-privileged user can modify a service binary path, replace a service executable, or write into a service directory.
Linux PrivEsc
Linux Local Privilege Escalation
Linux local privilege escalation turns a low-privileged shell into root by abusing sudo, SUID, capabilities, cron, PATH, weak permissions, credentials, or kernel issues.
Linux PrivEsc
Linux SUID and Capabilities
SUID and Linux capabilities can allow binaries to run with elevated privileges or special permissions.
Linux PrivEsc
Linux Sudo Abuse
Sudo abuse occurs when a user can run commands as another user or root in a way that can be escaped or abused.
Node Section
Lateral Movement
Lateral Movement
WinRM Access
WinRM provides remote PowerShell access when the user is allowed to log in remotely.
Enumeration
SMB Enumeration
SMB enumeration checks shares, permissions, signing, sessions, and whether credentials work against Windows hosts.
Finding
Readable SMB Shares
Readable shares are SMB shares where anonymous or valid users can list/download files.
Lateral Movement
SMBExec / PsExec
SMBExec and PsExec use admin rights over SMB to execute commands remotely.
Pivoting
SSH Local Port Forward
SSH local port forwarding maps a local Kali port to a remote/internal service through an SSH-accessible host.
Pivoting
SSH Dynamic SOCKS Proxy
SSH dynamic forwarding creates a SOCKS proxy that can route multiple tools through an SSH pivot.
Pivoting
Chisel Tunneling
Chisel creates TCP tunnels and SOCKS proxies over HTTP-like transport between Kali and a compromised host.
Pivoting
sshuttle
sshuttle creates transparent routes through SSH, making internal subnets feel locally reachable.
Node Section
General
Active Directory
Resource-Based Constrained Delegation
RBCD lets a controlled machine account impersonate users to a target computer when msDS-AllowedToActOnBehalfOfOtherIdentity is writable.
ADCS
ADCS ESC1
ESC1 is an ADCS template misconfiguration where a requester can supply an arbitrary subject alternative name and obtain a certificate usable for authentication.
Finding
User Enumeration
User enumeration means you have valid domain usernames to test against Kerberos, SMB, LDAP, or password attacks.
Credential Discovery
Passwords in Files
Passwords in files means discovered plaintext, encoded, or reusable secrets in shares, web roots, backups, scripts, or config files.
Finding
DONT_REQ_PREAUTH Found
This flag means a user does not require Kerberos pre-authentication and may be ASREP roastable.
Finding
SPN Found
An SPN on a user account usually means the account is Kerberoastable.
DACL Abuse
Shadow Credentials
Shadow Credentials abuses write access to msDS-KeyCredentialLink to authenticate as a target user/computer using certificate-based Kerberos.
Enumeration
ADCS Discovery
ADCS discovery finds enterprise CAs and vulnerable certificate templates.
OSCP Workflow
Nmap Full Scan
Initial broad TCP scan to identify attack surface.
OSCP Workflow
Credential Validation
Validate creds everywhere.
Post Exploitation
Post-Exploitation Triage
Post-exploitation triage is the immediate checklist after landing a shell: identity, host info, network, privileges, files, credentials, and pivot potential.
Reporting
Proof Collection
Proof collection captures local.txt/proof.txt, whoami, hostname, IP, and enough evidence to support the report.
Reporting
Screenshot Evidence
Screenshot evidence captures proof, exploit success, privilege context, and commands in a report-friendly way.
Reporting
Command Log
A command log records commands, outputs, timestamps, and notes so the exploit path is reproducible.
Reporting
Reporting Checklist
The reporting checklist ensures every compromised host has clear findings, steps, screenshots, proof, and remediation.