> For the complete documentation index, see [llms.txt](https://alexdhital.gitbook.io/pentesting-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alexdhital.gitbook.io/pentesting-notes/pentesting-and-red-teaming-cheatsheet.md).

# Pentesting and Red Teaming Cheatsheet

## What's Inside

🎯 **Web Application Pentesting**\
OWASP Top 10 exploitation, auth bypass and injection techniques.

🏰 **Infrastructure Pentesting**\
Network enumeration, privilege escalation and lateral movement.

🔑 **Active Directory Pentesting**\
Kerberoasting, DCSync, golden and silver tickets and full AD attack chains.

📱 **Android Pentesting**\
Mobile app analysis, APK reversing and runtime manipulation.

☁️ **Cloud Pentesting**\
AWS, Azure and GCP misconfig hunting and privilege escalation paths.

🕵️ **Reconnaissance Techniques**\
OSINT, subdomain enumeration and attack surface mapping.

🛡️ **Defense Evasion Techniques**\
AV and EDR bypass, obfuscation and living off the land techniques.

{% hint style="info" %}
💡 These notes come from real engagements, labs and certification prep. Everything here is meant to be copied, adapted and used, not just read.
{% endhint %}

📌 New here? Start with **Web Application Pentesting** and work your way through the kill chain from there.