Skill UI

A comprehensive guide detailing advanced techniques for attacking Microsoft Active Directory (AD) environments. It covers the entire red team lifecycle, including reconnaissance (BloodHound, PowerView), credential harvesting (Mimikatz, AS-REP Roasting), and critical attacks such as Kerberos exploitation, Pass-the-Ticket/Hash, and NTLM relay attacks. Essential for penetration testing and defensive validation.

Utilize BloodHound Community Edition to conduct deep internal Active Directory reconnaissance using graph theory. This skill maps complex relationships, including ACLs, group memberships, and trust links, to visualize potential attack paths. It is crucial in red-teaming engagements to identify the shortest path from a low-privileged foothold to high-value targets like Domain Admins, or to validate security hardening efforts.

Executes authorized, advanced attack simulations against Active Directory environments to identify critical misconfigurations, weak credentials, and exploitable trust relationships. Utilizing industry tools like BloodHound, Mimikatz, and Impacket, this process simulates complex attacks such as Kerberoasting, Golden Ticket forging, and domain compromise path analysis, helping organizations validate their security posture against real-world threats.

BloodHound is a powerful, graph-based reconnaissance tool specifically designed for Active Directory environments. It utilizes graph theory to map deep, hidden relationships and potential attack paths—such as privilege escalation chains—from compromised low-value accounts to high-value targets like Domain Admins. This tool is essential for authorized red team exercises and penetration testing engagements.

This guide details the process of performing Active Directory reconnaissance using BloodHound and SharpHound. It leverages graph theory to visualize hidden trust relationships, group memberships, and ACLs, mapping the shortest attack paths from a low-privilege compromised user all the way to Domain Admin rights. This is essential for red-teaming, security auditing, and identifying critical misconfigurations.

This comprehensive guide details the methodology for Active Directory (AD) penetration testing. It covers deep domain enumeration, utilizing tools like BloodHound and Impacket, and executing advanced attacks such as Kerberoasting, AS-REP Roasting, and privilege escalation via delegation abuse. Use this when conducting authorized security assessments to discover and exploit misconfigurations to achieve domain compromise.

This skill guides comprehensive Active Directory (AD) security assessment using industry-standard tools like PingCastle, BloodHound, and Purple Knight. It helps identify critical misconfigurations, excessive privileges, weak Kerberos settings, and potential lateral movement paths. Ideal for penetration testing, security audits, and incident response to proactively secure enterprise identity management systems.

A comprehensive playbook detailing advanced techniques for exploiting misconfigured Active Directory Access Control Lists (ACLs). It covers BloodHound enumeration, abusing dangerous ACE types (GenericAll, WriteDACL), conducting DCSync attacks, leveraging shadow credentials, and exploiting GPO/LAPS weaknesses for privilege escalation and lateral movement in a deep dive for security professionals.

This technique abuses the Active Directory's `msDS-KeyCredentialLink` attribute to inject attacker-controlled public keys (Shadow Credentials). After gaining write access (e.g., via BloodHound), the attacker uses tools like pyWhisker or Certipy to append their key. They then authenticate via PKINIT to recover the target's NT hash, achieving complete account takeover without the disruptive step of a password reset. Ideal for stealthy red-teaming engagements.

A comprehensive tool for authorized red-team engagements, designed to map complex on-prem Active Directory and cloud Entra ID attack paths. It uses SharpHound and AzureHound to collect rich data, ingesting it into BloodHound CE for analysis using built-in queries and custom Cypher. Effectively identifies privilege escalation chains leading to domain or tenant compromise, especially in hybrid identity environments.

A comprehensive guide detailing advanced, authorized techniques for Active Directory security testing and red teaming. It covers critical attack vectors such as Kerberos exploitation, BloodHound path analysis, NTLM relay, and domain privilege escalation. Designed for security professionals to systematically map and exploit domain weaknesses.

Enables authorized offensive security assessments on Windows Active Directory environments. Covers Kerberos abuse, AD CS escalation, BloodHound path analysis, NTLM relay, and domain privilege escalation techniques. Requires explicit written permission and strict authorization gates before execution. Designed for educational purposes or authorized security assessments only.