The Toolkit

Post Exploitation

Getting a foothold is the beginning, not the end. Post-exploitation is everything that comes after: harvesting credentials, moving laterally to other machines, escalating privilege, maintaining access, and — in a real assessment — proving how far an attacker could get. This category is heavily oriented toward Windows and Active Directory, where most enterprise post-exploitation happens, plus modern command-and-control frameworks for managing implants across a compromised environment.

All live under Security → Post Exploitation. The reverse-shell listener in Quick Attack Actions is the simplest way to catch a shell before you graduate to a full C2.