howto:exploit.md

Exploiting

Here's my thought process for web exploitation

1. nmap --> What's open?
2. Subdomain brute force
3. Path brute force & /robots.txt
4. Are there input boxes? Possible injection
5. Does the input stay on the page? XSS
6. Does it look like theres a database? SQL Injection
7. Is there a ? in the url? Query String Injection

Here's my thought process for shell exploits (when given a ip and port)

1. netcat it --> What did it say/What happens?
2. What does it look like we have to do? Break it or exploit it
3. Buffer overflow
4. Try Empty Characters, NULL Character Input, ... etc