Tutorials
Active Directory ExploitationAnonymous and Null-Session Enumeration: SMB, LDAP Anonymous Binds, and RID CyclingNo credentials? No problem. SMB null sessions, LDAP anonymous binds, and RID cycling can expose your entire Active Directory user roster before…Read →Active Directory ExploitationTrust, Share, and File Hunting: Mapping the Forest and Finding Credentials in DataLearn to enumerate AD forest trusts, discover misconfigured SMB shares, and harvest credentials from files using BloodHound, Snaffler, and GPP decryption -…Read →Active Directory ExploitationSPN and Delegation Enumeration: Kerberoastable Accounts, Unconstrained, Constrained, and Resource-Based DelegationMaster SPN enumeration and all three Kerberos delegation models - Kerberoasting weak service accounts, stealing DC TGTs via unconstrained delegation, S4U protocol…Read →Active Directory ExploitationSession, Logged-On User, and Local Admin Hunting: Finding Where Domain Admins Are Logged InDiscover how low-privileged domain users enumerate active sessions, interactive logons, and local admin membership to pinpoint where Domain Admins are authenticated -…Read →Active Directory ExploitationACL and DACL Enumeration: Finding Abusable Object Permissions (GenericAll, WriteDacl, ForceChangePassword, DCSync rights)A low-privilege domain account can become Domain Admin through misconfigured ACLs alone. This guide covers AD DACL enumeration, abusing GenericAll, WriteDacl, WriteOwner,…Read →Active Directory ExploitationBloodHound and SharpHound: Collection Methods, Edges, and Cypher Hunting for Attack PathsLearn how SharpHound collects Active Directory data over LDAP and SMB, how BloodHound models it as a directed attack-path graph, and how…Read →Active Directory ExploitationAD PowerShell Module Enumeration: The Microsoft-Signed Get-AD* Equivalents to PowerViewThe Microsoft-signed AD PowerShell module replicates most of PowerView's recon capability while routing traffic over encrypted ADWS on port 9389 - invisible…Read →Active Directory ExploitationDomain Enumeration with PowerView: Users, Groups, Computers, OUs, GPOs, Shares, LAPS and the Full Object GraphOne low-privilege domain account is all PowerView needs to map Active Directory attack paths. This tutorial covers users, groups, computers, OUs, GPOs,…Read →Active Directory ExploitationManual Active Directory Enumeration: Raw LDAP, .NET DirectorySearcher, net.exe and dsquery (No Tools, No AMSI)Learn to enumerate Active Directory using only Windows-native tools: raw LDAP filters, .NET DirectorySearcher, net.exe, and dsquery. Discover Kerberoastable accounts, unconstrained delegation,…Read →Active Directory ExploitationBuilding a Realistic AD Attack Lab and the Attacker Toolkit with OPSEC BasicsStand up an intentionally misconfigured corp.lab domain, install Impacket, BloodHound, Responder, and Kerbrute on Kali, then run a full recon-to-foothold chain and…Read →Active Directory ExploitationTier-0 Asset Mapping and the AD Administrative Tier Model: Defining the Real Attack SurfaceDiscover how to enumerate every explicit and hidden Tier-0 asset in Active Directory using BloodHound CE and SharpHound, exploit DCSync, unconstrained delegation,…Read →Active Directory ExploitationKerberos Hardening Internals: FAST/Armoring, Pre-Auth, PAC Validation, and Encryption-Type PolicyDissect the four hardening dimensions of Windows Kerberos - pre-authentication, encryption-type policy, FAST/armoring, and PAC validation - then build a weak lab…Read →