Active Directory Exploitation
The complete Active Directory attack path — enumeration, credential access, ACL and delegation abuse, Kerberos ticket attacks, ADCS, trusts and cross-forest, through to full domain and enterprise compromise, each explained component by component. Follow it top to bottom — foundational first (23 tutorials).
Active Directory ExploitationBloodHound and SharpHound: Collection Methods, Edges, and Cypher Hunting for Attack PathsLearn how SharpHound collects Active Directory data over LDAP and SMB, how BloodHound models it as a directed attack-path graph, and how…Read →Active Directory ExploitationACL and DACL Enumeration: Finding Abusable Object Permissions (GenericAll, WriteDacl, ForceChangePassword, DCSync rights)A low-privilege domain account can become Domain Admin through misconfigured ACLs alone. This guide covers AD DACL enumeration, abusing GenericAll, WriteDacl, WriteOwner,…Read →Active Directory ExploitationSession, Logged-On User, and Local Admin Hunting: Finding Where Domain Admins Are Logged InDiscover how low-privileged domain users enumerate active sessions, interactive logons, and local admin membership to pinpoint where Domain Admins are authenticated -…Read →Active Directory ExploitationSPN and Delegation Enumeration: Kerberoastable Accounts, Unconstrained, Constrained, and Resource-Based DelegationMaster SPN enumeration and all three Kerberos delegation models - Kerberoasting weak service accounts, stealing DC TGTs via unconstrained delegation, S4U protocol…Read →Active Directory ExploitationTrust, Share, and File Hunting: Mapping the Forest and Finding Credentials in DataLearn to enumerate AD forest trusts, discover misconfigured SMB shares, and harvest credentials from files using BloodHound, Snaffler, and GPP decryption -…Read →Active Directory ExploitationAnonymous and Null-Session Enumeration: SMB, LDAP Anonymous Binds, and RID CyclingNo credentials? No problem. SMB null sessions, LDAP anonymous binds, and RID cycling can expose your entire Active Directory user roster before…Read →Active Directory ExploitationUsername Enumeration and Validation with Kerbrute: Abusing Kerberos Pre-AuthenticationLearn how Kerbrute abuses Kerberos AS-REQ error differentials to enumerate valid Active Directory usernames without triggering lockouts, harvest AS-REP hashes from pre-auth-disabled…Read →Active Directory ExploitationLLMNR, NBT-NS, and mDNS Poisoning with Responder: Capturing Net-NTLMv2 from ZeroLearn how Responder exploits Windows multicast name resolution fallback to capture Net-NTLMv2 credentials, relay them with ntlmrelayx, and how to shut the…Read →Active Directory ExploitationIPv6 and DHCPv6 Takeover with mitm6 and ntlmrelayx: From Passive Listener to Domain FootholdAn unauthenticated Linux box, two tools, and Windows' silent IPv6 preference are all it takes. This walkthrough covers the full mitm6 +…Read →Active Directory ExploitationPassword Spraying Active Directory: Policy Enumeration First, Lockouts NeverBefore you spray a single credential, read the domain lockout policy and every Fine-Grained Password Policy. This guide shows how to enumerate…Read →Active Directory ExploitationFrom-Zero AS-REP Roasting and Password Spraying: Getting Your First Credential with No CredsNo username, no password, no problem. Learn how to chain unauthenticated Kerberos enumeration, password spraying, and AS-REP roasting to get your first…Read →