This repository contains my personal penetration testing notes, cheat sheets, and practical references compiled during my security studies and research.

It started as a study resource for CPTS and CBBH, and has grown into a broader offensive security handbook covering web, Active Directory, enumeration, exploitation methodology, privilege escalation, reporting, and practical testing workflows.

The notes are updated regularly and are meant to serve as a quick reference and collection of actionable techniques for authorized penetration testing, bug bounty, labs, and security research.

This handbook is the public foundation of a larger workflow I am building with xLimit.

xLimit is an authorized-use AI security research assistant built for pentesters, bug bounty hunters, security researchers, and advanced students. It helps with methodology, triage, validation planning, and report writing, not blind automation.

Its guidance combines real-world methodology with patterns and failure-mode experience gathered from authorized engagements, so responses reflect what tends to work in practice rather than acting as a simple knowledge-base lookup.

Access the hosted xLimit assistant at:

app.xlimit.org

The xlimit-client repository includes an MCP server. Register it once with tools such as Claude Code or Codex, and they can automatically call xLimit during active sessions to retrieve synthesized guidance, no copy-pasting required.

For full setup instructions, see the step-by-step deployment guide.

The same repository includes shell scripts such as xlimit_context.sh that let you pull raw reference snippets into any terminal-based assistant, whether MCP-compatible or not.

The goal is simple: make these notes more usable during real authorized security work, whether you are:

• Studying security methodology
• Testing a lab environment
• Working on an internal assessment
• Triaging an approved bug bounty target

Signup now app.xlimit.org

Learn more at xlimit.org

Built for guided security research, not blind automation.

xLimit and this handbook are intended only for lawful, authorized, and in-scope security testing, research, and education.

• Active Directory Mindmap (PDF): A comprehensive mindmap covering enumeration, attacks, and common tools.
  Highly recommended for anyone studying or working with AD.
• Active Directory Written Notes: The mindmap is now fully expanded into organized, in-depth written notes and practical walkthroughs.
  Browse individual topics and techniques in detail.

Disclaimer: For educational and authorized testing purposes only.