Active Directory

• An excellent practical reference
• A practical reference focused on powershell
• https://gist.github.com/TarlogicSecurity/2f221924fef8c14a1d8e29f3cb5c5c4a
• https://m0chan.github.io/2019/07/30/Windows-Notes-and-Cheatsheet.html
• https://casvancooten.com/posts/2020/11/windows-active-directory-exploitation-cheat-sheet-and-command-reference/
• https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
• https://wadcoms.github.io/
• https://www.blackhillsinfosec.com/webcast-attack-tactics-5-zero-to-hero-attack/
• https://byt3bl33d3r.github.io/practical-guide-to-ntlm-relaying-in-2017-aka-getting-a-foothold-in-under-5-minutes.html
• https://www.trustedsec.com/blog/a-comprehensive-guide-on-relaying-anno-2022/
• https://en.hackndo.com/ntlm-relay/
• https://s3cur3th1ssh1t.github.io/The-most-common-on-premise-vulnerabilities-and-misconfigurations/
• A very thorough technical background: https://zer1t0.gitlab.io/posts/attacking_ad/
• kerberos background: https://www.tarlogic.com/blog/how-kerberos-works/
• A good overview of different lateral movement techniques: https://hackmag.com/security/lateral-guide/
• https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet#active-directory-exploitation-cheat-sheet

Tools

• https://mpgn.gitbook.io/crackmapexec/
• https://www.secureauth.com/labs/open-source-tools/impacket/
• https://github.com/dirkjanm/mitm6
• https://github.com/lgandx/Responder
• https://github.com/FuzzySecurity/StandIn
• https://www.joeware.net/freetools/tools/adfind/
• https://github.com/CravateRouge/bloodyAD
• https://github.com/blacklanternsecurity/MANSPIDER
• https://github.com/login-securite/DonPAPI
• Powerview/Sharpview
• Bloodhound/Sharphound
• csvde -f domain.csv