> For the complete documentation index, see [llms.txt](https://book.turbosec.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://book.turbosec.net/hacking-methodologies/layers.md).

# Kill Chain

## Kill chain Overview

Lockheed martin developed the first kill chain map but a few iteration have come along the way. The following cyber kill chains are made by Varonis and Cytomic. Both are good.

![](/files/a8SoXN50xvAhbrsPPNPn)

Or even this one which divides **External** and **Internal** kill chains.

![](/files/PYlCVdMmdWgDed1sw3TL)

## [Physical access & Hardware hacking](/hacking-methodologies/layer-0-phyisical-and-hardware.md)

All you need is access\
\
**Note**: Not my favorite way of hacking but it still is very interesting. It can always be fun to phish with malware/trollware infected usb or keylog/tap into a line. In reality, this will happen probably never while doing a pentest, at least not a web-application/infrastructure test. I would assume that government-based hacking groups are very into hardware hacking for very obvious reasons, when you have a good amount of money and your hands in major electronic/distribution companies, it becomes a very scalable and scary attack vector

## [External Recon](/all-the-other-layers-recon.md)

Don't peek, don't peek !\
\&#xNAN;***proceeds to peek***

There is no penetration testing without recon. Learn to scan properly to avoid getting blacklisted or detected by an IDS.

Network scanning is an integral part of hacking. I would say that 95% of penetration tests will have any kind of scan involved, ranging from port scans, directory fuzzing, to intrusive SQL injection scans.

## [Internal Recon](/internal-recon.md)

**Let's have a look inside.**

\
Having a foot in a box is good but usually pretty limited, it is always a nice thing to elevate our privileges and capabilities.

## [Privilege Escalation](/post-exploitation/privilege-escalation.md)

**root**

\
Having a foot in a box is good but usually pretty limited, it is always a nice thing to elevate our privileges and capabilities.

## [Post Exploitation](/post-exploitation.md)

**Persistence, C2, exfiltration, all the good stuff**

\
Depending on the scenario, you might want to implement some form of backdoor and be able to come back whenever you want or can.

###