Active Directory
Offensive and defensive reference for Active Directory: domain fundamentals, enumeration, authentication attacks, credential abuse, lateral movement, privilege escalation, and persistence.
This subcategory uses the two-track format (Offensive / Defensive). See the parent INFRASTRUCTURE README for the format skeleton.
Files
| # | File | Focus |
|---|---|---|
| 01 | AD Fundamentals | Domain, forest, OU, trusts, DNS, Kerberos basics |
| 02 | Enumeration | BloodHound, PowerView, LDAP, netexec |
| 03 | Authentication Attacks | Kerberoasting, AS-REP, NTLM relay, Pass-the-Hash |
| 04 | Credential Abuse | GPP cpassword, LAPS, DCSync, ACL abuse |
| 05 | Lateral Movement | WinRM, PsExec, WMI, SMB, RDP |
| 06 | Privilege Escalation | ADCS, delegation, trusts, AdminSDHolder |
| 07 | Persistence and Defense | Golden/Silver ticket, DCShadow, hardening, detection |
Scope
In scope:
- On-premise Active Directory (Windows Server 2016-2025 functional levels).
- Hybrid identity edge cases (Entra Connect, PHS/PTA) where they affect on-prem AD attack paths.
- Common misconfigurations exploited in HTB/OSCP-style labs and real enterprise environments.
Out of scope:
- Microsoft Entra ID (Azure AD) as a standalone cloud identity provider (covered in the CLOUD category).
- Non-Microsoft directory services (OpenLDAP, FreeIPA) - see Linux Infrastructure.