⚠️ Authorized testing only. For systems you own or are explicitly permitted to test — labs, CTFs, sanctioned engagements. See Rules of Engagement and Authorization.
Active Directory (AD) runs most corporate networks, and its trust relationships are a hacker's playground. Practice in a lab AD (e.g. GOAD — Game of Active Directory) — never a real domain without authorization.
Map the domain
# collect AD data, then open in the BloodHound GUI to find attack paths
bloodhound-python -u user -p pass -d corp.local -c All -ns 10.10.10.10BloodHound graphs who can reach Domain Admin — often a surprising short path.
Classic techniques
| Attack | Idea |
|---|---|
| Kerberoasting | Request service tickets, crack them offline (Password Cracking) |
| AS-REP roasting | Crack accounts with pre-auth disabled |
| Pass-the-Hash | Authenticate with an NTLM hash, no password needed |
| DCSync | Impersonate a DC to dump all domain hashes |
# Kerberoast with Impacket
GetUserSPNs.py corp.local/user:pass -request -outputfile hashes.txtDefense: strong service-account passwords, tiered admin, LAPS, and monitoring (Log Analysis and SIEM).
Related: Password Cracking · Pivoting and Tunneling · Windows Privilege Escalation