Skill UI

Compilation of red-team techniques for penetrating Microsoft Active Directory, covering reconnaissance with BloodHound/PowerView, credential harvesting, Kerberos ticket abuse, NTLM relays, and AD CS exploits to gain domain dominance.

Use BloodHound CE for internal Active Directory reconnaissance to map attack paths, prioritize escalation chains, and document AD misconfigurations during red-team engagements.

Simulates authorized Active Directory attack paths using BloodHound, Mimikatz, Impacket and related tools to surface misconfigurations, weak credentials, Kerberos flaws and privilege paths before adversaries exploit them; ideal for AD pentests, SOC/EDR validation, and privilege escalation resistance checks.

BloodHound leverages graph theory on Active Directory data to expose hidden relationships, letting red teams visualize attack paths from compromised accounts to Domain Admins, spot ACL and delegation flaws, and plan privilege escalation.

Guides red-teamers through collecting Active Directory data with SharpHound/AzureHound, importing it into BloodHound CE or Legacy, and using Cypher queries to map attack paths from compromised users to Domain Admin.

Focused Active Directory penetration testing workflow that enumerates domain objects, maps BloodHound attack paths, exploits Kerberos weaknesses, leverages ADCS/DCSync, and demonstrates full domain compromise scenarios for red teams.

Assess Active Directory security posture with PingCastle, BloodHound, and Purple Knight to identify misconfigurations, privilege escalation paths, Kerberos weaknesses, and lateral movement risks so remediation can be prioritized.