← Back to Academy

Academy Node

Proof Collection

Proof collection captures local.txt/proof.txt, whoami, hostname, IP, and enough evidence to support the report.

Intermediate100 XPReporting

Why it matters

PEN-200 emphasizes report writing and exam reporting, including clear technical evidence and reproducible steps.

How to identify it

  • You have access to a user or admin proof file

Linux commands

whoami && hostname && ip addr
cat local.txt 2>/dev/null; cat proof.txt 2>/dev/null
whoami /all && hostname && ipconfig
type C:\\Users\\*\\Desktop\\local.txt 2>nul
type C:\\Users\\*\\Desktop\\proof.txt 2>nul

Expected output

  • Current user
  • Hostname
  • IP address
  • Proof hash

Success looks like

  • Proof captured with contextual screenshot/output

Failure looks like

  • Proof missing
  • Wrong user context
  • No screenshot

Troubleshooting

  • Search for proof files
  • Check user desktop
  • Check administrator/root desktop

Common mistakes

  • Only copying hash without context
  • Not documenting exact path

Alternative attacks

  • Continue privesc
  • Credential hunting

What to try next

  • Screenshot evidence
  • Command log
  • Report checklist

Recommended next lessons

ASREP Roast

ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.

Kerberoast

Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.

GenericWrite

GenericWrite means you can modify certain attributes on the target AD object.

GenericAll

GenericAll is effectively full control over the target AD object.