Domain overview
Escalation decides whether a low-privilege foothold stays marginal or becomes operationally meaningful. The useful work is in proving why the path exists, what it grants and how it should be fixed.
Related certification context
Privilege escalation is not its own certification lane here, but these OffSec tracks strongly support the host-level work in this domain.
- OffSec OSCP+ / PEN-200Foundational Linux and Windows escalation logic inside real attack chains.
- OffSec OSEP / PEN-300Deeper operator context for mature privilege paths, evasion and multi-stage internal work.
Selected public references
- GTFOBinsgtfobins.org/
- LOLBASlolbas-project.github.io/
- book.hacktricks.wiki · Linux Privilege Escalation Checklist.htmlbook.hacktricks.wiki/en/linux-hardening/linux-privilege-escalation-checklist.html
- book.hacktricks.wiki · Checklist Windows Privilege Escalation.htmlbook.hacktricks.wiki/en/windows-hardening/checklist-windows-privilege-escalation.html
- GitHub · carlospolop / PEASS-nggithub.com/carlospolop/PEASS-ng
Topic index
Introduction
Introduction: privilege escalation assessment context, validation priorities and evidence that supports a defensible finding.
The Goal Of Privilege Escalation
The Goal Of Privilege Escalation: local trust, execution rights, credential material and misconfiguration paths from foothold to stronger control.
Linux Privilege Escalation
Linux Privilege Escalation: local trust, execution rights, credential material and misconfiguration paths from foothold to stronger control.
Windows Privilege Escalation
Windows Privilege Escalation: local trust, execution rights, credential material and misconfiguration paths from foothold to stronger control.
macOS Privilege Escalation
macOS Privilege Escalation: local trust, execution rights, credential material and misconfiguration paths from foothold to stronger control.