Post-Exploitation¶

Post-exploitation material exists for tightly controlled engagements where the authorization explicitly allows deeper validation after initial access.

Focus areas¶

• Privilege boundaries that can be crossed safely
• Reachability to adjacent systems or data stores
• Secrets, tokens, and trust relationships exposed by the foothold
• Cleanup actions needed to return the environment to its prior state

Guardrails¶

• Do not assume post-exploitation is allowed just because exploitation was allowed.
• Prefer simulation over persistence when the same conclusion can be shown safely.
• Keep an exact record of every created file, user, token, process, or service.
• Remove or disable every artifact you introduced before closing the task.

Deliverables¶

• Scope-appropriate blast radius summary
• Cleanup notes
• Residual risk that remains after the demonstrated path