Tutorials
Active Directory ExploitationBuilding a Realistic AD Attack Lab and the Attacker Toolkit with OPSEC BasicsStand up an intentionally misconfigured corp.lab domain, install Impacket, BloodHound, Responder, and Kerbrute on Kali, then run a full recon-to-foothold chain and…Read →Active Directory ExploitationTier-0 Asset Mapping and the AD Administrative Tier Model: Defining the Real Attack SurfaceDiscover how to enumerate every explicit and hidden Tier-0 asset in Active Directory using BloodHound CE and SharpHound, exploit DCSync, unconstrained delegation,…Read →Active Directory ExploitationKerberos Hardening Internals: FAST/Armoring, Pre-Auth, PAC Validation, and Encryption-Type PolicyDissect the four hardening dimensions of Windows Kerberos - pre-authentication, encryption-type policy, FAST/armoring, and PAC validation - then build a weak lab…Read →Active Directory ExploitationKerberos Authentication Internals: AS-REQ to TGS-REP, the PAC, SPNs, and the krbtgt AccountTrace every Kerberos message from AS-REQ to TGS-REP, dissect the PAC field by field, and understand exactly why Kerberoasting, AS-REP Roasting, and…Read →Active Directory ExploitationNTLM Authentication Internals: Challenge-Response, Hashes, and Why Relay WorksUnderstand exactly why NTLM relay is possible at the protocol level - from MD4 NT hashes and NTLMv2 HMAC mechanics to the…Read →Active Directory ExploitationReading AD Object Security: DACLs, ACEs, and Rights on Every ObjectLearn how every AD object's DACL encodes exploitable rights - GenericAll, WriteDACL, ForceChangePassword - and walk a helpdesk-to-DCSync escalation chain with full…Read →Active Directory ExploitationSecurity Principals, SIDs, Tokens, and Trusts: How Identity and Authorization Really Work in ADUnderstand how Active Directory authorization really works - from SID binary format and kernel access tokens to SeImpersonatePrivilege exploitation, SIDHistory injection, and…Read →Active Directory ExploitationLDAP and the Active Directory Schema: How the Directory Stores Everything You Will AttackEvery Active Directory attack path traces to a specific schema attribute. Learn how the LDAP schema, naming contexts, and key attributes like…Read →Active Directory ExploitationActive Directory Architecture: Domains, Forests, Trees, OUs, Sites, and GPOsMaster Active Directory's logical and physical architecture before your first exploit. Covers forests, domains, OUs, sites, GPOs, FSMO roles, and trust boundaries…Read →Windows InternalsACLs, DACLs, and SACLs: Access Control InternalsUnderstand the kernel-level structures behind every Windows access check - SECURITY_DESCRIPTOR, DACL, SACL, and ACE types - then learn how attackers exploit…Read →Exploit DevelopmentSEH Overwrite Exploits: Hijacking Exception DispatchLearn how SEH overwrite exploits corrupt the on-stack exception registration record and use POP/POP/RET gadgets to hijack Windows exception dispatch - with…Read →Adversary EmulationAtomic Red Team Deep Dive: Writing Custom Atomics and Contributing to the LibraryLearn to write schema-valid custom Atomic Red Team tests for T1547.001 Registry Run Key persistence, capture Sysmon telemetry, build a paired Sigma…Read →