Active Directory Penetration Testing
Reference Poster — Full Attack Chain
① Reconnaissance
External
LinkedIn/Hunter.io
Dehashed
theHarvester
dnsrecon/dnsenum
amass/subfinder
Shodan/Censys
Internal Unauth
nmap/fping
netdiscover
Ports 88/389/636
Responder -A
LDAP anon bind
enum4linux-ng
rpcclient -U “”
Domain Info
FQDN
Forest trusts
Functional level
Naming context
② Initial Access
Poisoning / Coercion
Responder LLMNR/NBT-NS
mitm6 IPv6/WPAD
ntlmrelayx SMB relay
LDAP/LDAPS relay
PetitPotam
PrinterBug
DFSCoerce
ADCS ESC8 HTTP→LDAP
Pre-auth Kerberos
Kerbrute userenum
AS-REP Roasting
DONT_REQ_PREAUTH
Password Attacks
Kerbrute spray
NetExec spray
Check policy first
Season+Year
Company+123
CVEs / Anon Access
Zerologon CVE-2020-1472
PrintNightmare
noPac CVE-2021-42278
EternalBlue
ProxyShell/Logon
SMB null shares
Snaffler/MANSPIDER
③ Auth. Enumeration
BloodHound
SharpHound CE
bloodhound-python
RustHound/SOAPHound
Shortest path to DA
Kerberoastable users
Unconstrained delegation
Users / Groups
PowerView
ADSearch
ldapsearch
windapsearch
Descriptions → passwords
adminCount=1
Shares / Files
SMBMap
smbclient
Snaffler
SYSVOL Groups.xml
cpassword
Manspider
ACL / ADCS / GPO
GenericAll
GenericWrite
WriteOwner
WriteDACL
ReadLAPSPassword
ReadGMSAPassword
Certipy find
ESC1–ESC15
Get-DomainGPO
④ Credential Theft
Offline Roasting
Kerberoasting
Rubeus
GetUserSPNs.py
AS-REP Roasting
GetNPUsers.py
Hashcat 13100/18200
SPN via GenericWrite
On-host Dumping
Mimikatz sekurlsa
nanodump
pypykatz
comsvcs.dll MiniDump
SAM/SYSTEM hives
DPAPI master keys
SharpChromium/DPAPI
WDigest cleartext
Domain-wide
DCSync
lsadump::dcsync
NTDS.dit + SYSTEM
secretsdump.py
Special Sources
LAPS
ms-Mcs-AdmPwd
gMSA password
GPP Groups.xml
gpp-decrypt
KeePass/Bitwarden
PuTTY/WinSCP sessions
⑤ Privilege Escalation
Local Windows
winPEAS
PowerUp
Seatbelt
Unquoted svc paths
DLL hijack
AlwaysInstallElevated
JuicyPotato
RoguePotato
PrintSpoofer
GodPotato
UAC fodhelper/sdclt
ACL Abuse
GenericAll → reset pw
GenericAll group → AddMember
GenericWrite → SPN
WriteDACL → DCSync rights
WriteOwner → WriteDACL
Kerberos Delegation
Unconstrained → capture TGTs
Constrained S4U2Self/Proxy
RBCD
msDS-AllowedToActOnBehalf
MachineAccountQuota=10
ADCS Certipy
ESC1 SAN+clientAuth
ESC2 any-purpose EKU
ESC3 enrollment agent
ESC4 template ACL
ESC6 EDITF_ATTR
ESC8 HTTP NTLM relay
ESC9–ESC15
⑥ Lateral Movement
Pass-the-*
PtH: NetExec -H
Mimikatz sekurlsa::pth
PtT: Rubeus ptt
ccache KRB5CCNAME
Overpass-the-Hash
Pass-the-Certificate PKINIT
Shadow Creds Whisker
Remote Execution
PsExec
SMBExec
WMIExec
Evil-WinRM 5985/5986
DCOM MMC20
schtasks
sc.exe services
xfreerdp RDP+PtH
Pivoting
Chisel
Ligolo-ng
SOCKS SSH
proxychains
CS SMB/TCP beacons
⑦ Domain Dominance
DCSync
DS-Replication-Get-Changes-All
lsadump::dcsync
krbtgt hash
secretsdump -just-dc
DCShadow
Register rogue DC
Push changes
Deregister
Krbtgt / Trusts
Golden Ticket
krbtgt NT/AES
Reset krbtgt ×2
Inter-realm TGT
SID History ExtraSids
Trust key extraction
⑧ Persistence
Kerberos Tickets
Golden Ticket
Silver Ticket
Diamond Ticket
Sapphire Ticket
DC-resident
Skeleton Key
misc::skeleton
DSRM RID 500 logon
Custom SSP memssp
LSA password filter DLL
ACL Backdoors
AdminSDHolder ACE
DCSync low-priv user
Shadow Creds
msDS-KeyCredLink
Service / Object
Scheduled tasks
WMI event subscriptions
GPO modification
ADCS long-lived cert
⑨ Defense Evasion
AMSI / ETW
amsiInitFailed patch
HW breakpoint AMSI
EtwEventWrite patch
ETW provider GUID disable
Logging
ScriptBlock bypass
PS v2 downgrade
Sysmon rule gaps
EDR / Defender
SysWhispers
Hell’s Gate
Unhook ntdll
Early bird injection
BYOVD vuln driver
Defender exclusion abuse
LOLBAS / Obfusc.
rundll32/regsvr32/mshta
certutil decode/download
Invoke-Obfuscation
ConfuserEx .NET
AES payload encryption
⑩ Hybrid / Cloud
Entra Connect
MSOL account DCSync
ADSync svc abuse
Pass-through Auth agent
Federation
Golden SAML ADFS cert
ADFS DKM master key
Token Theft
ROADtools
AADInternals
TokenTactics
PRT theft
OAuth / Device Code
Device code phishing
Illicit consent grant
Recon & Enum Tools
BloodHound CE
SharpHound
bloodhound-python
PowerView
PowerSploit
ADRecon
PingCastle
enum4linux-ng
ldapsearch
windapsearch
NetExec
CrackMapExec
Creds & Kerberos Tools
Mimikatz
pypykatz
lsassy
Rubeus
secretsdump.py
GetUserSPNs.py
ntlmrelayx.py
Kerbrute
hashcat
john
ADCS & Coercion Tools
certipy-ad
Certify
ForgeCert
PSPKIAudit
PetitPotam.py
Coercer.py
DFSCoerce
PrinterBug
C2 & Post-Ex Tools
Cobalt Strike
Sliver
Mythic
Havoc
Brute Ratel
NightHawk
winPEAS
Seatbelt
GodPotato
SweetPotato
SharpDPAPI
SharpChromium
LAPSToolkit
gMSADumper
📬 Stay Ahead of Cyber Threats
Get the latest cybersecurity news, critical vulnerabilities, threat intelligence, tutorials, and exclusive giveaways delivered straight to your inbox. No spam. Unsubscribe anytime.
Subscribe to the Newsletter →
