AD- AD_PORT_FORWARDING_Configuring Port Forwarding in Windows | Windows OS Hub
- ADCS
ESC14 Abuse Technique. The altSecurityIdentities attribute of… | by
Jonas Bülow Knudsen | Feb, 2024 | Posts By SpecterOps Team Members
- ADCS ESC8 – NTLM Relay to AD CS HTTP Endpoints
- Golden dMSA: What Is dMSA Authentication Bypass? | Semperis Research
- GOOD_ADCS_Common ADCS Vulnerabilities: Logging, Exploitation, and Investigation - Part 2
- GOOD_ATTACK_GRAPH_Attack Graph Model Design Requirements and Examples - SpecterOps
- GOOD_ATTACK_KERBEROS_TICKET_Precious Gemstones: The New Generation of Kerberos Attacks
- GOOD_BLUE_Ad_MHaggis/ADTrapper: Hunt Smarter, Hunt Harder
- GOOD_CHEAT_SHEET_AD_LINUX_PENTEST_GitHub - H4CK3RT3CH/RedTeaming_CheatSheet
- GOOD_DETECT_BLUE_ADCS_Securing AD CS: Microsoft Defender for Identity's Sensor Unveiled - Microsoft Community Hub
- GOOD_DPAPI - Extracting Passwords - HackTricks
- GOOD_DPAPI_INTERNAL_Windows Data Protection | Microsoft Learn
- GOOD_EXPLOIT_WINDOWS_GitHub
- yehia-mamdouh/ZeroProbe: ZeroProbe is an advanced enumeration and
analysis framework designed for exploit developers, security
researchers, and red teamers. It provides a set of enumeration tools to
identify security vulnerabilities, analyze system protections, and
facilitate exploit development.
- GOOD_FAST_KERBEROS_Securing The Chink in Kerberos’ Armor, FAST! Understanding The Need For Kerberos Armoring
- GOOD_GMSA_How Managed Service Accounts in Active Directory Work
- GOOD_HTB_ADCS_HackTheBox Authority Write-Up. Authority is a medium HackTheBox… | by arth0s | Medium
- GOOD_KERBEROS_COURS_La
sécurité des protocoles d’authentification NTLM et Kerberos en
environnement Active Directory | wwwGeneral
- GOOD_KERBEROS_OVERVIEW_Kerberos I - Overview
- GOOD_KERBEROS_Unconstrained Delegation – Penetration Testing Lab
- GOOD_KRB_TGT_TIPS_KRBUACBypass: UAC Bypass By Abusing Kerberos Tickets
- GOOD_LAB_AD_CLOUD_Deploy an Active Directory Lab Within Minutes - Black Hills Information Security
- GOOD_LAPS_AD_CONFIG_Deploying Windows LAPS - theDXT
- GOOD_LDAP_AD_An
Introduction to Manual Active Directory Querying with Dsquery and
Ldapsearch | by Hope Walker | Posts By SpecterOps Team Members
- GOOD_LDAP_AD_LDAPSearch Reference - Malicious Link - Blog by mubix - Rob Fuller
- GOOD_LDAP_AD_PRINTER_Attaque par rétro-passage LDAP - ACCEIS
- GOOD_MAJ_ADCS_TrustedSec | EKUwu: Not just another AD CS ESC
- GOOD_Methods For Fileless Execution
- GOOD_NOTEBOOK_TIPS_AD_PENTEST_README - Pentester's Promiscuous Notebook
- GOOD_PROTECTED_USERS_Protected Users Security Group | Microsoft Learn
- GOOD_RBCD_Domain Escalation: Resource Based Constrained Delegation - Hacking Articles
- GOOD_SMB_AD_PENTEST_SySS-Research/smbcrawler:
smbcrawler is no-nonsense tool that takes credentials and a list of
hosts and 'crawls' (or 'spiders') through those shares
- GOOD_SOCKS_PROXY_RELAY_AD_IMPACKET
- GOOD_TIPS_NETEXEC_TOOL_Active Directory Pentesting Using Netexec Tool: A Complete Guide - Hacking Articles
- GOOD_TIPS_PORTPROXY_WINDOWS_Windows Netsh Interface Portproxy
- GOOD_TOOL_AD_KERBEROS_GitHub - foxlox/GIUDA: Ask a TGS on behalf of another user without password
- GOOD_TOOL_ADCS_LAB_Common ADCS Vulnerabilities: Logging, Exploitation, and Investigation - Part 1
- GOOD_TOOL_POST_AD_PS_GitHub
- Leo4j/Amnesiac: Amnesiac is a post-exploitation framework entirely
written in PowerShell and designed to assist with lateral movement
within Active Directory environments
- GOOD_TOOL_PRIVESC_WINDOWS_GitHub - Ignitetechnologies/Windows-Privilege-Escalation
- GOOD_TOOL_SHADOW_SPRAY_Dec0ne/ShadowSpray:
A tool to spray Shadow Credentials across an entire domain in hopes of
abusing long forgotten GenericWrite/GenericAll DACLs over other objects
in the domain.
- GOOD_TOOL_TEST_AD_CLIENT_Pentest-Tools-Collection/tools/Client-Checker at main · LuemmelSec/Pentest-Tools-Collection · GitHub
- GOOD_TOOL_TOKEN_TEST_AD_GitHub - daem0nc0re/PrivFu: Kernel mode WinDbg extension and PoCs for token privilege investigation.
- GOOD_WMI_Ad_TrustedSec | WMI Providers for Script Kiddies
- LDAP_AD_Pentesting with Secure LDAP and LDAP Channel Binding | by Root ♊ | Dec, 2023 | Medium
- Microsoft Defender for Identity expands its coverage with new AD CS sensor! - Microsoft Community Hub
- PINGCASTLE_AUTO_How
we automated our PingCastle security audit reports for our Active
Directory | by Romain TIENNOT | ManoMano Tech team | Medium
- POTATO_TOOL_TIPS_AD_PRIVESC_Coerced Potato
- The ultimate tag team: PetitPotam and ADCS pwnage from Linux | Sprocket Security
- TOP_AD_AD-CS_PKI_WINDOWS_Certified
Pre-Owned. Active Directory Certificate Services… | by Will Schroeder |
Posts By SpecterOps Team Members
- TOP_AD_AUTH_GUIDE_A Windows Authorization Guide · csandker.io
- TOP_AD_CHEAT_SHEET_CNFPT_tiyeuse/Active-Directory-Cheatsheet - bytemeta
- TOP_AD_CS_CERTIPY_PFX_Certifried:
Active Directory Domain Privilege Escalation (CVE-2022–26923) | by
Oliver Lyak | May, 2022 | IFCR
- TOP_AD_CS_LAB_activedirectory - Lares Labs
- TOP_AD_CS_NTLM relaying to AD CS - On certificates, printers and a little hippo - dirkjanm.io
- TOP_AD_CS_PetitPotam – NTLM Relay to AD CS – Penetration Testing Lab
- TOP_AD_DCSHADOW_ShutdownRepo/dcshadow: Python alternative to Mimikatz lsadump::dcshadow
- TOP_AD_KERBEROS_Active Directory – Delegation Based Attacks – Security Café
- TOP_AD_KERBEROS_DELEGATION_Délégation Kerberos - Fonctionnement - hackndo
- TOP_AD_KERBEROS_DELGATIONS_S4fuckMe2selfAndUAndU2proxy
- A low dive into Kerberos delegations – LuemmelSec – Just an admin on
someone else´s computer
- TOP_AD_KRB_COURSE_Posts | zer1t0
- TOP_AD_LAB_GOAD_Game Of Active Directory v2 | Mayfly
- TOP_AD_LAB_NOTES_PENTEST_myexploit/living_off_the_land
- TOP_AD_LDAP_QUERY_Manual
LDAP Querying: Part 2. This post is a follow-up to my previous… | by
Hope Walker | May, 2024 | Posts By SpecterOps Team Members
- TOP_AD_PENTEST_Attacking Active Directory: 0 to 0.9 | zer1t0
- TOP_AD_POWN_LINPEAS_lefayjey/linWinPwn:
linWinPwn is a bash script that streamlines the use of a number of
Active Directory tools
- TOP_AD_PS_Active Directory | HideAndSec
- TOP_AD_RECON_EXPLOIT_CHEAT_SHEET_Active Directory & Kerberos Abuse - Red Team Notes
- TOP_AD_SECU_BEST_PRACTICES_Best Practices for Securing Active Directory | Microsoft Learn
- TOP_AD_SSCM_ATTACK_GitHub
- subat0mik/Misconfiguration-Manager: Misconfiguration Manager is a
central knowledge base for all known Microsoft Configuration Manager
tradecraft and associated defensive and hardening guidance.
- TOP_AD_TIPS_INITIAL_ACCESS_The Path To DA - Part 1: SysAdmins Love Generic Passwords - Shorsec Cyber Security
- TOP_AD_TOOL_POLICY_GPO_MITRE_Active_Directory_Advanced_Threat_Hunting/Security_compliance_toolkit_and_baselines/Analyze_group_policy_objects.md
at main · tomwechsler/Active_Directory_Advanced_Threat_Hunting · GitHub
- TOP_AD_TRUST_ATTACK_GOLDEN_SILVER_TICKET_SID
filter as security boundary between domains? (Part 2) – Known AD
attacks - from child to parent
- TOP_ADCS_ATTACK_Active and Certified: The hidden attack surface created by trusting AD CS – MWR CyberSec
- TOP_ADCS_ESCx_ATTACK_PART1_Abusing Active Directory Certificate Services - Part One - Black Hills Information Security
- TOP_ADCS_ESCx_PART2_Abusing Active Directory Certificate Services – Part 2 - Black Hills Information Security
- TOP_ADCS_EXPLOIT_Exploiting AD Certificate Templates - Chrollo
- TOP_ADCS_Hello: I’m your ADCS server and I want to authenticate against you – Decoder's Blog
- TOP_ADCS_PATH_BLOODHOUND_Jonas Bülow Knudsen – Medium
- TOP_ADCS_TRUST_DOMAIN_Outbound Trusts, AD CS, and Tool Adaptation, Adventures in Cross-Domain Pivoting - Red Team SNCF
- TOP_BAD_AD_2025_GitHub - cybrly/badsuccessor
- TOP_CERTIPY_AD_Certipy
4.0: ESC9 & ESC10, BloodHound GUI, New Authentication and Request
Methods — and more! | by Oliver Lyak | IFCR
- TOP_CERTIPY_AD_TOOL_KERBEROS_ADCS_ESC_LYAK_Certipy
2.0: BloodHound, New Escalations, Shadow Credentials, Golden
Certificates, and more! | by Oliver Lyak | IFCR
- TOP_Chasing the Silver Petit Potam to Domain Admin | ZeroSec - Adventures In Information Security
- TOP_CHEAT_SHEET_AD_GitHub
- S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet: A cheat sheet
that contains common enumeration and attack methods for Windows Active
Directory.
- TOP_CHEAT_SHEET_AD_RistBS/Awesome-RedTeam-Cheatsheet: Active Directory & Red-Team Cheat-Sheet in constant expansion.
- TOP_CHEAT_SHEET_CME_NXC_TOOL_CrackMapExec and NetExec Cheat Sheet | serioton
- TOP_CME_EXEMPLE_CRACKMAP_Workshop CrackMapExec LeHack 2023 Writeup
- TOP_CNFPT_AD_RELAY_Quick Note on Active Directory Attacks by Relaying and Spoofing – Cyber Security Corner
- TOP_DACL_ACE_SACL_Winfows_The Phantom Menace: Exposing hidden risks through ACLs in Active Directory
- TOP_ESCx_KRB_AD_Attacking
AD CS ESC Vulnerabilities Using Metasploit | Metasploit Documentation
Penetration Testing Software, Pen Testing Security
- TOP_GOOD_Active Directory Enumeration – ADWS – Purple Team
- TOP_GOOD_AD_CS_ATTACK_Abusing CVE-2022-26923 through SOCKS5 on a Mythic C2 agent — MacroSEC
- TOP_GOOD_AD_EXPLOIT_RECON_ENUM_Domain Enumeration + Exploitation - burmat / nathan burchfield
- TOP_GOOD_Ad_MISCONF_Most
common Active Directory misconfigurations and default settings that put
your organization at risk – NVISO Labs
- TOP_GOOD_AD_UNSCONSTRAINED_Unconstrained Delegation – Penetration Testing Lab
- TOP_GOOD_ADCS_Active and Certified: The hidden attack surface created by trusting AD CS – MWR CyberSec
- TOP_GOOD_DELEGATION_KERBEROS_S4fuckMe2selfAndUAndU2proxy
- A low dive into Kerberos delegations – LuemmelSec – Just an admin on
someone else´s computer
- TOP_GOOD_DPAPI_DPAPI Secrets. Security analysis and data recovery in DPAPI
- TOP_GOOD_GPO_TOOL_GitHub
- synacktiv/GPOddity: The GPOddity project, aiming at automating GPO
attack vectors through NTLM relaying (and more).
- TOP_GOOD_KERBEROS_Another Word on Delegation - harmj0y
- TOP_GOOD_LSASS_Doppelganger: An Advanced LSASS Dumper with Process Cloning – YLabs
- TOP_GOOD_PRIVESC_WINDOWS_Windows Privileges for Fun and Profit
- TOP_GOOD_RELAY_AD_The Renaissance of NTLM Relay Attacks: Everything You Need to Know - SpecterOps
- TOP_GOOD_RELAY_SMB_Lateral Movement – NTLM Relay Attacks - Juggernaut-Sec
- TOP_GOOD_SMB Enumeration Cheatsheet | 0xdf hacks stuff
- TOP_GOOD_TOOL_AD_REMOTE_DCOM_RemoteMonologue: Weaponizing DCOM for NTLM authentication coercions | IBM
- TOP_GOOD_TOOL_PS_CRACKMAPEXEC_GitHub
- The-Viper-One/PsMapExec: A PowerShell tool that takes strong
inspiration from CrackMapExec.
- TOP_GOOD_TOOLS_TIPS_LSASS_GitHub - yo-yo-yo-jbo/dumping_lsass: The different ways to dump lsass
- TOP_GOOD_WU_NETEXEC_LEHACK_LeHack 2024 - NetExec workshop writeup
- TOP_GPO_ABUSE_RELAY_NTLM_AD_GPOddity: exploiting Active Directory GPOs through NTLM relaying, and
- TOP_HOW_KERBEROS_AD_Kerberos (I): How does Kerberos work? - Theory | Tarlogic
- TOP_KERBEROS_DELEGATION_(KUD) Unconstrained - The Hacker Recipes
- TOP_KERBEROS_DELEGATION_S4U_Kerberos Delegation – Cyber World
- TOP_KERBEROS_ERROR_Kerberos Errorism Index
- TOP_KERBEROS_KRBRELAY_GitHub - cube0x0/KrbRelay: Framework for Kerberos relaying
- TOP_KRB_S4U2SELF_PRIVESC_Abusing Kerberos S4U2self for local privilege escalation :: Cyberstoph's blog — Cyberstoph's Blog
- TOP_LPE_PRIVESC_LIST_TOOL_MzHmO/Exploit-Street: Complete list of LPE exploits for Windows (starting from 2023)
- TOP_LSASS_DUMP_Dumping Lsass with trusted processes - Lsass Dump
- TOP_LSASS_DUMP_TRICK_TOOL_AD_Obfuscated LSASS dump command | BadOption.eu
- TOP_NETEXEC_NetExec Workshop - LeHack 2025 (Part 1)
- TOP_NTDIS_EDR_Bypassing EDR NTDS.dit protection using BlueTeam tools. | by bilal al-qurneh | Jun, 2024 | Medium
- TOP_NULL_ANONYMOUS_SESSION_SensePost | Guest vs null session on windows
- TOP_POTAM_ATTACK_RELAY_ADCS_Petit Potam - NTLM Relay attack - More knowledge with ProSec GmbH
- TOP_PREZ_SPECTEROPS_presentations/Webinars at main · SpecterOps/presentations · GitHub
- TOP_PRIVESC_AD_TIPS_TOOL_GitHub - daem0nc0re/PrivFu: Kernel mode WinDbg extension and PoCs for token privilege investigation.
- TOP_PRIVESC_WINDOWS_nickvourd/Windows-Local-Privilege-Escalation-Cookbook: Windows Local Privilege Escalation Cookbook
- TOP_RBCD_ATTACK_NTLM_RELAY_TrustedSec | Practical Attacks against NTLMv1
- TOP_RBCD_METASPLOIT_Exploiting Resource Based Constrained Delegation (RBCD) with Pure Metasploit – n00py Blog
- TOP_RELAY_HASH_SMB_AD_ protocol - cheatsheet
- TOP_S4U_ATTACK_RBCD_Resource-based Constrained Delegation - HackTricks
- TOP_SESSION_ATTACK_KRB_RELAY_Blog Revisiting Cross Session Activation Attacks - r-tec Cyber Security
- TOP_SHADOW_CREDZ_DACL misconfiguration and exposure to Shadow Credentials
- TOP_SMB_CHEAT_SHEET_SMB Enumeration Cheatsheet | 0xdf hacks stuff
- TOP_SPN-jacking: An Edge Case in WriteSPN Abuse | Semperis
- TOP_START_EFS_COERCE_Hypnoze57/rpc2efs: Unauthenticated start EFS service on remote Windows host (make PetitPotam great again)
- TOP_TIPS_AD_TOOLS_GitHub - seriotonctf/AD-Tools: List of some AD tools I frequently use
- TOP_TOOL_AD_LDAP_EXPLOIT_ADWS_wh0amitz/SharpADWS:
Active Directory reconnaissance and exploitation for Red Teams via the
Active Directory Web Services (ADWS).
- TOP_TOOL_AD_LSASS_DUMP_An offensive Rust encore - hn security
- TOP_TOOL_ADCS_GitHub
- MWR-CyberSec/AD-CS-Forest-Exploiter: Exploit AD CS misconfiguration
allowing privilege escalation and persistence from any child domain to
full forest compromise
- TOP_TOOL_ADCS_logangoins/Stifle: .NET Post-Exploitation Utility for Abusing Explicit Certificate Mappings in ADCS
- TOP_TOP_Active directory Attacks .pdf - Google Drive
- TOP_TOP_AD_CHEAT_SHEET_Active Directory Certi... | HideAndSec
- TOP_TOP_AD_CHEAT_SHEET_GitHub - suljov/Windows-and-Active-Directory
- TOP_TOP_AD_LAB_SLIVER_OSEP_Passing the OSEP Exam Using Sliver | Bishop Fox
- TOP_TOP_AD_LUDUS_GOAT_LudusHound: Raising BloodHound Attack Paths to Life - SpecterOps
- TOP_TOP_AD_MINDMAP_https://orange-cyberdefense.github.io/ocd-mindmaps/img/mindmap_ad_dark_classic_2025.03.excalidraw.svg
- TOP_TOP_AD_PENTEST_Deployment - SCCM - Internal All The Things
- TOP_TOP_AD_PIVOT_Internal All The Things
- TOP_TOP_AD_PREZ_KERBEROS_TOKEN_Presentations and Recordings
- TOP_TOP_AD_RBCD_Wagging the Dog: Abusing Resource-Based Constrained Delegation to Attack Active Directory | Shenanigans Labs
- TOP_TOP_AD_WINDOWS_SERVER_BLUE_LIST_RED_Domain
of Thrones: Part I. When Adversaries Play for Keeps | by Nico Shyne |
Oct, 2023 | Posts By SpecterOps Team Members
- TOP_TOP_ADCS_Active Directory Certificate Services (AD CS) - A Beautifully Vulnerable and Mis-configurable Mess
- TOP_TOP_ADCS_AD_KERBEROS_Active Directory - Certificate Services - Internal All The Things
- TOP_TOP_ADCS_xbz0n@sh:~# Breaking ADCS: ESC1 to ESC16 Attack Techniques
- TOP_TOP_BLOODHOUND_The Ultimate Guide for BloodHound Community Edition (BHCE) | by Chris Haller | Medium
- TOP_TOP_EXPLOIT_KERBEROS_DELEGATION_Kerberos 102 - Delegation | I understand
- TOP_TOP_FR_RBCD_Resource-Based Constrained Delegation - Risques - hackndo
- TOP_TOP_TOP_GOOD_AD_DELEG_Abusing delegation with Impacket | hun.io
- TOP_TOP_GPO_AD_RELAY_GPOddity: exploiting Active Directory GPOs through NTLM relaying, and
- TOP_tOP_KERBEROS_DELEGATION_ Kerberos Bronze Bit Attack Theory | NetSPI
- TOP_TOP_KERBEROS_DETAIL_PAC_TICKET_Kerberos 102 - Overview | I understand
- TOP_TOP_KERBEROS_RELAY_Kerberos relay | The Hacker Recipes
- TOP_TOP_LOL_AD_WINDOWS_LOLAD
- TOP_TOP_NTLM_RELAY_2025_Beyond the Basics: Exploring Uncommon NTLM Relay Attack Techniques | GuidePoint Security
- TOP_TOP_PS_POWERSHELL_PowerShell for Hackers: Exploitation Essentials | hetmehta.com
- TOP_TOP_RBCD_Abusing Resource-Based Constrained Delegation | serioton
- TOP_TOP_RBCD_KERBEROS_Delegating Like a Boss: Abusing Kerberos Delegation in Active Directory | GuidePoint Security
- TOP_TOP_S4U_S4U2Pwnage | by Will Schroeder | Medium
- TOP_TOP_TIPS_AD_POWERSHELL_CHEAT_SHEET_Active Directory | HideAndSec
- TOP_TOP_WAGGING_KERBEROS_DELEG
- TOP_VM_WINDOWS_SOCKS_PROXY_TUNNEL_PENTEST_LOF_Living
Off the Foreign Land - Part 1/3: Setup Linux VM for SOCKS routing «
BITSADMIN Blog - Mystery guest in your IT infrastructure
- TOP_WINDOWS_HARDENING_Comparison of security benchmarks · HotCakeX/Harden-Windows-Security Wiki · GitHub
- TOP_WINDOWS_POWERSHELL_PS_AD_Windows Triaging with Powershell — Part 2: Artifacts Collection | by Aditya Pratap | Medium
- VERY_GOOD_ACL_ACE_AD_Abusing Active Directory ACLs/ACEs - HackTricks
- VERY_GOOD_AD_BLOODHOUND_MICROSOFT_Advanced
threat hunting within Active Directory Domain Services - Knowledge is
power! - Microsoft Community Hub
- VERY_GOOD_AD_C2_SLIVER_Hacking Active Directory with Sliver C2 | by Root ♊ | Jul, 2023 | Medium
- VERY_GOOD_AD_COERCE_RedTeam Pentesting - Blog - The Ultimate Guide to Windows Coercion Techniques in 2025
- VERY_GOOD_AD_CS_Microsoft ADCS – Abusing PKI in Active Directory Environment - RiskInsight
- VERY_GOOD_AD_CTF_WU_Write-up Barbhack – Challenge active directory – GOTHAM.CITY | Centre d'expertises en cybersécurité
- VERY_GOOD_AD_DUMP_GitHub - login-securite/DonPAPI: Dumping DPAPI credz remotely
- VERY_GOOD_AD_EDCS_Abusing Active Directory Certificate Services - Part One - Black Hills Information Security
- VERY_GOOD_AD_ESC1_AUTO_GitHub - JPG0mez/ADCSync: Use ESC1 to perform a makeshift DCSync and dump hashes
- VERY_GOOD_AD_KERBEROASTING_PREAUTH_New Attack Paths? AS Requested Service Tickets - Semperis
- VERY_GOOD_AD_MIND_MAP_Active Directory OSCP Edition | Youssef Saeed - Xmind
- VERY_GOOD_AD_NOOB_Active Directory for Script Kiddies - TrustedSec
- VERY_GOOD_AD_PENTEST_0xStarlight
- VERY_GOOD_AD_PERSISTENCE_Articles, News and Updates | Rindert Kramer
- VERY_GOOD_AD_POTATO_DCOM_Blog Windows is and always will be a Potatoland - r-tec Cyber Security
- VERY_GOOD_AD_PRIVESC_WINDOWS_Ali AK – Medium
- VERY_GOOD_AD_RELAY_NTLM_Exploitation - NTLM capture and relay - InfoSec Notes
- VERY_GOOD_AD_RUBEUS_TOOL_A Detailed Guide on Rubeus - Hacking Articles
- VERY_GOOD_AD_SVG_XMIND_https://raw.githubusercontent.com/esidate/pentesting-active-directory/a8e37705542720cb1f9b65ec9039f67b70b61ca6/v2/pentesting_active_directory.svg
- VERY_GOOD_AD_TOKEN_CERTIFICAT__eladshamir/Whisker:
Whisker is a C# tool for taking over Active Directory user and computer
accounts by manipulating their msDS-KeyCredentialLink attribute,
effectively adding "Shadow Credentials" to the target account.
- VERY_GOOD_AD_TYPE_LOG_Administrative tools and logon types reference - Windows Server | Microsoft Learn
- VERY_GOOD_ADCS Attack Paths in BloodHound — Part 2 | by Jonas Bülow Knudsen | Posts By SpecterOps Team Members
- VERY_GOOD_ADCS_Abusing Active Directory Certificate Services – Part 2 - Black Hills Information Security, Inc.
- VERY_GOOD_ADCS_AD CS - New Ways to Abuse ManageCA Permissions | WHOAMI
- VERY_GOOD_ADCS_LAB_GitHub
- arth0sz/Practice-AD-CS-Domain-Escalation: Introductory guide on the
configuration and subsequent exploitation of Active Directory
Certificate Services with Certipy. Based on the white paper Certified
Pre-Owned.
- VERY_GOOD_BLODHOUND_zblurx/BloodHoundCustomQueries: My BloodHound custom queries
- VERY_GOOD_BLOODHOUND_COMPLEMENT_ADDON_AD_GitHub
- Mazars-Tech/AD_Miner: AD Miner is an Active Directory audit tool that
leverages cypher queries to crunch data from the #Bloodhound graph
database to uncover security weaknesses
- VERY_GOOD_BLOODHOUND_EDGE_Edges — BloodHound 4.3.1 documentation
- VERY_GOOD_BLOODHOUND_PRIVILEGE_Important Active Directory Attribute for Red/Blue Teamer
- VERY_GOOD_BLOODHOUND_SOAP_ADWS_SOAPHound
— tool to collect Active Directory data via ADWS | by Nikos Karouzos |
FalconForce | Jan, 2024 | Medium
- VERY_GOOD_COERCE_AUTH_WINDOWS_TOOL_TIPS_RELAY_GitHub
- slemire/WSPCoerce: PoC to coerce authentication from Windows hosts
using MS-WSP
- VERY_GOOD_COERCE_TICKET_KERBERIOS_DELEGATION_r-tec Blog | Resource Based Constrained Delegation - r-tec Cyber Security
- VERY_GOOD_DACL_Abusing AD-DACL: AllExtendedRights - Hacking Articles
- VERY_GOOD_ESC_ADCS_ADCS Attack Paths in BloodHound — Part 1 | by Jonas Bülow Knudsen | Posts By SpecterOps Team Members
- VERY_GOOD_EXTENDED_RIGHTS_Extended Rights - Win32 apps | Microsoft Learn
- VERY_GOOD_HARDENED_WINDOWS_TOOLS_PS_GitHub
- HotCakeX/Harden-Windows-Security: Harden Windows Safely, Securely
using Official Supported Microsoft methods and proper explanation |
Always up-to-date and works with the latest build of Windows | Provides
tools and Guides for Personal, Enterprise, Government and Military
security levels | Read The Rationale
https://github.com/HotCakeX/Harden-Windows-Security/blob/main/Rationale.md
- VERY_GOOD_KERBEROS_AD_ESC1-4_ATTACK_FR_Présentation et exploitation d'ADCS
- VERY_GOOD_KRB_RELAY_GitHub - CICADA8-Research/RemoteKrbRelay: Remote Kerberos Relay made easy! Advanced Kerberos Relay Framework
- VERY_GOOD_LAB_ADCS_ADCS | Ludus
- VERY_GOOD_LAPS_POWNAGE_REVERSE_LAPS 2.0 Internals - XPN InfoSec Blog
- VERY_GOOD_MICROSOFT_AD_HARDENING_Tag:"adhardening" | Microsoft Community Hub
- VERY_GOOD_MIMIKATZ_64 Methods For Execute Mimikatz(RTC0003) | RedTeamRecipe
- VERY_GOOD_MULTIDUMP_LSASS_MultiDump - Xre0uS
- VERY_GOOD_NTLM_RELAY_NG_Escaping the Confines of Port 445 - SpecterOps
- VERY_GOOD_PENTEST_AD_TOOL_all_in_one_place/Windows at master · t0-git/all_in_one_place · GitHub
- VERY_GOOD_RELAY_KERBEROS_From NTLM relay to Kerberos relay: Everything you need to know – Decoder's Blog
- VERY_GOOD_RUBEUS_Recutting the Kerberos Diamond Ticket | Huntress
- VERY_GOOD_SAML_Golden SAML Attack | Netwrix
- VERY_GOOD_SERIES_Kerberos I - Overview
- VERY_GOOD_SERIES_Kerberos II - Credential Access
- VERY_GOOD_SID_Identificateurs de sécurité | Microsoft Learn
- VERY_GOOD_SMB_RELAY_SOCKS_ Relay - cheatsheet
- VERY_GOOD_TOMATO_PRIESC_KERBEROS_GitHub - wh0amitz/S4UTomato: Escalate Service Account To LocalSystem via Kerberos
- VERY_GOOD_TOOL_ACL_Forensics: Active Directory ACL investigation | Microsoft Learn
- VERY_GOOD_TOOL_AD_DELEGATION_GitHub
- techspence/ADeleginator: A companion tool that uses ADeleg to find
insecure trustee and resource delegations in Active Directory
- VERY_GOOD_TOOL_Ad_maxamin/AD-Mastertools-collection: This is an AD pentest tools collection
- VERY_GOOD_TOOL_AD_RECON_EXPLOIT_wh0amitz/SharpADWS:
Active Directory reconnaissance and exploitation for Red Teams via the
Active Directory Web Services (ADWS).
- VERY_GOOD_TOOL_AD_Visualizing ACLs with Adalanche
- VERY_GOOD_TOOL_NTLM_RECON
_GitHub - puzzlepeaches/NTLMRecon: Enumerate information from NTLM
authentication enabled web endpoints 🔎
- VERY_GOOD_TOP_RELAY_We Love Relaying Credentials: A Technical Guide to Relaying Credentials Everywhere – SecureAuth
- VERY_VERY_GOOD_AD_Decoder's Blog – IT Security Tips and Tricks
- VERY_VERY_GOOD_AD_PayloadsAllTheThings/Methodology
and Resources/Active Directory Attack.md at master ·
swisskyrepo/PayloadsAllTheThings · GitHub
- VERY_VERY_GOOD_GRAB_HASH_NTLM_RELAY_TOOL_GitHub - mdsecactivebreach/Farmer
- VERY_VERY_GOOD_KERBEROS_ROASTING_DETAIL_Kerberos: Key OPSEC Tactics for Red & Blue Teams - PART 1
- VERY_VERY_GOOD_LPE_WINDOWS_windows local privilege escalation :: xorond's security blog
- VERY_VERY_GOOD_PRIVESC_WINDOWS_splinter_code blog
- GOOD_PENTEST_AD CS relay attack - practical guide · Ex Android Dev
- VERY_GOOD_PTH_Pass the Hash - hackndo
- VERY_GOOD_AD_PROXY_TUNNEL_Proxy
Windows Tooling via SOCKS. Leveraging SOCKS to proxy tools from a… | by
Nick Powers | Jun, 2021 | Posts By SpecterOps Team Members
- VERY_GOOD_AD_PENTEST_What is ired.team? - Red Teaming Experiments
- VERY_VERY_GOOD_TOP_RELAY_POTAM_ADLateral Movement – WebClient – Penetration Testing Lab
- GOOD_POWERSHELL_SHELL_NISHANG_PowerShell for Pentester: Windows Reverse Shell
- GOOD_TOOL_EVIL_WINRM_Evil-Winrm : Winrm Pentesting Framework
- AD_PEAS_GitHub - 61106960/adPEAS: Powershell tool to automate Active Directory enumeration.
- GOOD_DUMPING_PASSWORD_WIN_GitHub
- Ignitetechnologies/Credential-Dumping: This cheatsheet is aimed at
the Red Teamers to help them understand the fundamentals of Credential
Dumping (Sub Technique of Credential Access) with examples. There are
multiple ways to perform the same tasks
- TOP_TOP_BIBLE_NTLMRELAY_MAQUETTE_AD_I’m bringing relaying back: A comprehensive guide on relaying anno 2022 - TrustedSec
- TOP_AD_TO_DA_EXEGOL_Thread by @_nwodtuhs on Thread Reader App – Thread Reader App
- TOP_GOOD_AD_PENTEST_Red Teaming - Hacking Articles
- VERY_GOOD_PRIVESC_WINDOWS_PrivFu/ArtsOfGetSystem at main · daem0nc0re/PrivFu · GitHub
- TOP_TIPS_TOOLS_WRITEUP_AD_LAB_README - SECURE_77_
- GOOD_AD_WRITEUP_A (not so) Gentle Intro to Active Directory: ØxＯＰＯＳɆＣ [0xF09F8EA3] Challenge
- TOP_PRIVESC_TOOL_CODE_WINDOWS_ElevationStation - A walk through the development process [PART 1] - G3tSyst3m’s Infosec Blog
- VERY_GOOD_AD_RTFM_Active Directory :: RTFM
- GOOD_PRINTER_AD_IoT Hacking: Abusing Printers to Compromise Active Directory - Hackers Arise
- TOP_WINDOWS_PRIVILEGE_Windows Privilege Abuse: Attackers' Path to Active Directory Compromise
- TOP_TOP_TOP_KERBEROS_ATTL4S
| Attaques_Web_CSRF_XSS_SQLiPentest IA MCP- TOP_IA_MCP_Automated Penetration Testing with Claude AI - Hacking Articles
- TOP_IA_MCP_Une IA pour devenir Domain Admin | Devoteam
- GOOD_IA_GOAD_NodeZero® vs. GOAD: Analysis
- GOOD_AI Active Directory Pentesting with Claude Explained - Hacking Articles
- GOOD_AI_REDTEAM_GitHub
- adithyan-ak/AgentHound: Offensive security framework for AI agent
infrastructure - recon, credential looting, model exfiltration,
poisoning, and attack-path analysis across MCP, A2A, gateways, and AI
services. BloodHound for the agentic stack. · GitHub
- VERY_GOOD_AD_IA_SKILL_AGENT_GitHub
- ADScanPro/Claude-AD: Active Directory pentest methodology for Claude
Code: skills, agents and slash commands for internal AD red-team work
(Kerberoasting, ADCS ESC1-17, DCSync, ACL abuse, NTLM relay,
delegation), OPSEC telemetry and DORA/NIS2/ENS mapping. Drives netexec,
impacket, certipy, bloodyAD, BloodHound CE. · GitHub
| tools- TOP_TOOL_AD_BLOOD_DotNetRussell/BloodBash:
A Bloodhound alternative. BloodBash will ingest the same files
bloodhound does but no server is required to use this tool. It's great
for quick AD enumeration.
- AI-Coded-scripts/ldap-ntlm.py at main · S3cur3Th1sSh1t/AI-Coded-scripts
- GOOD_CLICK_ONCE_TUNNEL_AZURE_dazzyddos/ClickOnceBlobber
- TOP_GOOD_TOOLS_PENTEST_Introduction :: RTFM
- GOOD_SPN_SPNLESS_jarnovandenbrink/getSPNless: Python tool to automatically perform SPN-less RBCD attacks.
- TOP_NXC_Netexec Mastery - Introduction | YL-Labs Blog
- TOP_TOP_TOP_NTLM_RELAY_COERCE_ Relaying to LDAP - The Hail Mary of Network Compromise
- TOP_BLOODY-AD_User Guide · CravateRouge/bloodyAD Wiki
- GOOD_AD_ADCS_TOOL_ZephrFish/LOLADCS: PowerShell implementation for AD CS
- AD_KERBEROS_UNIX_A broken marriage. Abusing mixed vendor Kerberos stacks | Pen Test Partners
- TOP_AD_PS_TOOL_MahmoudNoureddine/AD-Admin-PS-Toolkit: 20 production-ready PowerShell scripts for Active Directory administration
- TOP_PRIVESC_POTATOES_Potatoes - Windows Privilege Escalation · Jorge Lajara Website
- dievus/ADPulse: Active Directory Vulnerability Scanner
- ADCS. So u got certificate. Now i’ve got nine ways to abuse it | by CICADA8 | Medium
- TOP_AD_COERCE_Coercing
Authentication from a Domain System: Analyzing a New Test Case from the
2025 Threat Simulation Index - Security Risk Advisors
- TOP_GOOD_MITM6_Resecurity | MITM6 + NTLM Relay: How IPv6 Auto-Configuration Leads to Full Domain Compromise
- TOP_GOOD_TOKEN_AD_SensePost | Abusing Windows’ tokens to compromise Active Directory without touching LSASS
- TOP_TOP_RBCD_AD_Resource-Based Constrained Delegation (RBCD) Attack Explained | Active Directory Exploitation
- GOOD_
IMPACKET_C# - GitHub - trustedsec/Titanis: Windows protocol library,
including SMB and RPC implementations, among others. · GitHub
- TOP_TOP_CHEAT_SHEET_TOOL_IMPACKET_GitHub
- n00py/Outpacket: This cheatsheet maps common impacket workflows to
their modern alternatives · GitHub
- TOP_GO_IMPACKET_GO_GitHub
- mandiant/gopacket: Gopacket is a clean Go implementation of Impacket,
a library intended for working with network protocols. · GitHub
- TOP_TOP_TIPS_NOTES_TOOLS_My Hacking Notes
- TOP_TOOLS_NOTES_InfoSec Notes
- VERY_GOOD_WU_README - _Notes - Perlite
- TOP_GOOD_RELAY_2022_TrustedSec | I’m bringing relaying back: A comprehensive guide on…
- TOP_TOP_AD_PYTHON_Active Directory - Pyt... | HideAndSec
- TOP_TOP_TOP_KERBEROS_DELEG_ATTACK_Abusing delegation with Impacket | hun.io
- TOP_TOP_Abusing S4U2Self for Active Directory pivoting | hun.io
- TOP_JWT_Pingiskok
- GOOD_LPE_BLOODHOUND_GitHub
- dazzyddos/PrivHound: A BloodHound OpenGraph collector that models
Windows local privilege escalation as interconnected attack paths. ·
GitHub
- TOOL_GOOD_RPC_Rpcclient | Hackviser
- GOOD_WINDOWS_EXT_TOOL_Exploring search connectors and library files in Windows
- GOOD_LOLBINS_SCANNER_GitHub
- aaron-kidwell/goLoL: goLoL is a Windows host scanner that finds an
always up to date listing of LOLBAS binaries present on the current
machine and lists techniques you can run at your current privilege level
with MITRE ATT&CK mappings and example commands. · GitHub
- TOP_TOP_TOP_RELAY_GitHub - rootsecdev/relay_bible: Technical Reference to multiple relay techniques · GitHub
- TOP_ADCS_Inside AD CS Escalation: Unpacking Advanced Misuse Techniques and Tools
- TOP_ADCS_ESC8_s and Where to Find Them | Abduls Blog
- TOP_CHEAT_SHEET_ADCS Attack Techniques Cheatsheet - Google Sheets
- TOP_RELAY_TrustedSec | I’m bringing relaying back: A comprehensive guide on…
- TOP_GOOD_RBCD_Abusing
Delegation with Impacket (Part 3): Resource-Based Constrained
Delegation - Black Hills Information Security, Inc.
- TOP_TOP_ADCS_CERTIPY_AD CS Attack Emporium
- TOP_GOOD_AD_PEAS_GitHub - 61106960/adPEAS: Powershell tool to automate Active Directory enumeration. · GitHub
- TOP_GOOD_OSEP_GitHub
- darkness215/osep-tools: A collection of offensive tools I built and
used throughout my OSEP journey. · GitHub
- TOP_BLUE_PS_GitHub
- okanyildiz/WindowsSecurityAudit: A comprehensive Windows security
auditing and threat detection toolkit. Features 58 production-ready
PowerShell functions organized into 14 modules for enterprise-grade
security assessment, compliance validation, and incident response. ·
GitHub
- TOP_GOOD_REVERSE_SHELL_Penelope – A Modern Alternative to Netcat for Red Teamers - Hacking Articles
- TOP_GOOD_BLOODHOUND_A Practical Guide to BloodHound Data Collection - Black Hills Information Security, Inc.
- TOP_TOOL_ARSENAL_GitHub
- inflictx/Arsenal: Offline-first, searchable arsenal for pentesting
& bug bounty: payloads, a click-to-build command generator,
GTFOBins, wordlists, embedded CyberChef, reverse shells, checklists
& an engagement tracker. · GitHub
- TOP_TOP_ADCS_ONELINER_One liners for finding ADCS misconfigurations | by Devin Boyle | Medium
- TOP_GOOD_POWERSHELL_TIPS_Windows Powershell Pivoting and General Pentesting Tricks | Agr0 Hacks Stuff
- TOP_TOP_DOCKER_CHEAT_SHEET_My Docker Cheat Sheet | Agr0 Hacks Stuff
- GOOD_ADHAMMER_GitHub
- icedracon/adhammer: Active Directory security-assessment toolkit in
Rust — PingCastle-class audit + authorized red-team validation, on a
from-scratch DCE/RPC · NTLM · SMB2 · Kerberos stack. One static binary,
from Kali or Windows. · GitHub
- TOP_GOOD_CHEAT_SHEET_GitHub - r1cksec/cheatsheets: Collection of knowledge about information security · GitHub
- TOP_TOP_POWERSHELL_Maland | Offensive PowerShell for Red Teamer with Defense Evasion Techniques
- TOP_GOOD_LDAP_AD_Introduction to Manual Active Directory Querying | SpecterOps
- TOP_AD_PATH_FINDER_GitHub
- NetSPI/AD-PathFinder: Attack path mapping for Active Directory, ADCS,
SCCM, and MSSQL using BloodHound CE + OpenGraph data. · GitHub
|
