Skip to content
ATARUS. OFFENSIVE SECURITY

Atarus Learn

Engagement Reference

The notes we keep open during tests, one situation per page, arranged by what we test and by the stage of the kill chain. Each step has the command or request we run and the change that stops it. Use them only on systems you are authorized to test.

Tracks

Six marks per track, one for each stage: Recon, Access, Escalation, Persistence, Impact, Report. A filled mark has a page.

Pages

14 pages

Network

  • External recon and subdomain enumeration

    Map everything a domain exposes on the internet: names from DNS and certificate logs, dangling records, open ports and edge devices, each with its fix.

    Recon Exam prep: eJPT, OSCP, PNPT Reviewed

  • Internal pentest: Active Directory recon

    Turn one domain account into a map of attack paths: password policy, unsigned SMB, LLMNR fallbacks, BloodHound paths and vulnerable AD CS templates.

    Recon Exam prep: OSCP, PNPT, CRTP Reviewed

  • Prove network impact without causing damage

    Show what a compromised position can reach without harming it: counts instead of copies, screenshots of consoles, one marker file and a clean action log.

    Impact Exam prep: OSCP, PNPT Reviewed

Web and API

  • Web app recon: the first hour of a pentest

    Map a web app before attacking it: proxy every request, read the headers, pull API routes from JavaScript bundles and list every input worth testing.

    Recon Exam prep: eJPT, OSCP Reviewed

  • Authentication and session testing

    Find the weakest way into an account: username enumeration, session fixation, logout, JWT handling, password reset poisoning and code attempt limits.

    Access Reviewed

  • IDOR and broken access control testing

    Prove who can read and change what: swap object IDs, tamper with HTTP methods, call admin routes, and test mass assignment and tenant boundaries.

    Escalation Reviewed

  • Prove a web finding's business impact

    Prove what a web or API finding costs the business: one record, two test tenants, an agreed zero-value transaction and an impact paragraph that holds up.

    Impact Reviewed

Cloud

  • Cloud pentest: AWS and Azure IAM enumeration

    Work out what a set of cloud credentials can reach: the identity, its escalation paths, secrets in functions and settings, public exposure and logging.

    Escalation Reviewed

Identity

  • SPF, DKIM and DMARC: test email spoofing

    Find out whether anyone can send mail as a domain: read DMARC, SPF and DKIM as a tester does, run one spoof test, and publish the records that close it.

    Recon Reviewed

  • Password spraying and MFA fatigue testing

    Test password spraying and MFA push fatigue without locking anyone out, then put in the lockout, Conditional Access and KQL detections that stop both.

    Access Exam prep: OSCP, PNPT Reviewed

AI and LLM

  • LLM app recon: mapping an AI feature

    Map an AI feature before testing it: where the model sits, which tools and data it reaches, its rate limits, its logging and the model behind it.

    Recon Reviewed

  • How to write up an AI or LLM finding

    Write an AI or agent finding a product team can act on: exact input and output, severity by what the action could do, and controls that hold.

    Report Reviewed

Physical

  • Badge cloning and physical access testing

    Find out whether someone without a badge can get in: identify the card technology, test readers, doors and tailgating, and close each gap.

    Access Reviewed

Reporting

  • How to write a pentest finding

    Write a security finding an engineer can reproduce and fix without a call: impact title, severity reasoning, rerunnable steps, the fix, the retest.

    Report Exam prep: OSCP, PNPT Reviewed