Post-Exploitation covers actions after initial access: persistence, reconnaissance, lateral movement, data exfiltration.
Tasks
- Persistence: crontab, autorun, systemd service.
- Lateral Movement: pass-the-hash, SSH keys, WMI.
- Data Exfiltration: DNS tunnelling, HTTPS C2.
Frameworks
Metasploit, Cobalt Strike, Sliver, Havoc.