Hashcat

A Linux box where the attack surface is the air between three VLANs. A password leaked over SNMP opens a consultant laptop stocked with Wi-Fi radios, and the route to root runs through the networks it can hear: crack the tablets’ WPA2-PSK, decrypt the capture to hijack a cookie-trusting router panel, pivot through a .phtml upload, then clone the corporate WPA2-Enterprise AP with its own stolen certificate to crack an EAP identity and reach root.

Mapping an Active Directory domain with BloodHound, then walking the permission chain it exposes from a low-privilege account to domain administrator. Olivia → BloodHound ACL chain (ForceChangePassword) → Benjamin → FTP .psafe3 → hashcat → password spray to Emily → targetedKerberoast on Ethan → DCSync Administrator.