Academy Node
Screenshot Evidence
Screenshot evidence captures proof, exploit success, privilege context, and commands in a report-friendly way.
Intermediate100 XPReporting
Why it matters
PEN-200 report-writing guidance emphasizes clear technical reporting and evidence.
How to identify it
- Any important step should be screenshot-worthy
Linux commands
flameshot guignome-screenshot -ascript -a exam-session.logExpected output
- Screenshot showing command and result
Success looks like
- Evidence supports report without ambiguity
Failure looks like
- Screenshot lacks command, host, or user context
Troubleshooting
- Repeat command with whoami/hostname nearby
Common mistakes
- Cropping too tightly
- No hostname/user visible
Alternative attacks
- Command log
What to try next
- Command log
- Reporting checklist
Recommended next lessons
ASREP Roast
ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.
Kerberoast
Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.
GenericWrite
GenericWrite means you can modify certain attributes on the target AD object.
GenericAll
GenericAll is effectively full control over the target AD object.