01 AD Active Directory Attack Methodology 2026-08-09 02 AD Active-Directory_cheat_sheet 2026-08-10 03 AD AD Pentest Tools Workflow 2026-08-09 04 AD ADCS Attack Methodology 2026-08-09 05 AD Attack #1 — Password Spraying 2026-08-10 06 AD Attack #10 — Credential Hunting in Shares GPP Passwords 2026-08-10 07 AD Attack #11 — Golden Ticket Attack 2026-08-10 08 AD Attack #12 — Silver Ticket Attack 2026-08-10 09 AD Attack #13 — Diamond Ticket Attack 2026-08-10 10 AD Attack #14 — Sapphire Ticket Attack 2026-08-10 11 AD Attack #15 — Unconstrained Delegation Abuse 2026-08-10 12 AD Attack #16 — Constrained Delegation Abuse (S4U2Proxy) 2026-08-10 13 AD Attack #17 — Resource-Based Constrained Delegation (RBCD) 2026-08-10 14 AD Attack #18 — Bronze Bit Attack (CVE-2020-17049) 2026-08-10 15 AD Attack #19 — GenericAll Abuse 2026-08-10 16 AD Attack #2 — Kerberoasting 2026-08-10 17 AD Attack #20 — GenericWrite Abuse 2026-08-10 18 AD Attack #21 — WriteDACL Abuse 2026-08-10 19 AD Attack #22 — WriteOwner Abuse 2026-08-10 20 AD Attack #23 — ForceChangePassword Abuse 2026-08-10 21 AD Attack #24 — AllExtendedRights DCSync ACE Abuse 2026-08-10 22 AD Attack #25 — Shadow Credentials Attack (msDS-KeyCredentialLink) 2026-08-10 23 AD Attack #26 — AdminSDHolder Persistence via ACL 2026-08-10 24 AD Attack #27 — ESC1 SAN Specification in Template 2026-08-10 25 AD Attack #28 — ESC2 Any Purpose EKU No EKU 2026-08-10 26 AD Attack #29 — ESC3 Certificate Request Agent 2026-08-10 27 AD Attack #3 — AS-REP Roasting 2026-08-10 28 AD Attack #30 — ESC4 Template Write Permissions 2026-08-10 29 AD Attack #31 — ESC6 EDITF_ATTRIBUTESUBJECTALTNAME2 Flag 2026-08-10 30 AD Attack #32 — ESC7 Vulnerable CA Officer Permissions 2026-08-10 31 AD Attack #33 — ESC8 NTLM Relay to ADCS HTTP Endpoint 2026-08-10 32 AD Attack #34 — ESC11 NTLM Relay to ADCS RPC 2026-08-10 33 AD Attack #35 — Golden Certificate Attack 2026-08-10 34 AD Attack #36 — Certifried (CVE-2022-26923) 2026-08-10 35 AD Attack #37 — DCSync Attack 2026-08-10 36 AD Attack #38 — DCShadow Attack 2026-08-10 37 AD Attack #39 — NTDS.dit Extraction and Dumping 2026-08-10 38 AD Attack #4 — Pass-the-Hash (PtH) 2026-08-10 39 AD Attack #40 — Zerologon (CVE-2020-1472) 2026-08-10 40 AD Attack #41 — PetitPotam (CVE-2021-36942) 2026-08-10 41 AD Attack #42 — PrinterBug SpoolSample 2026-08-10 42 AD Attack #43 — PrintNightmare (CVE-2021-34527) 2026-08-10 43 AD Attack #44 — noPAC Sam-the-Admin (CVE-2021-42278 42287) 2026-08-10 44 AD Attack #45 — Token Impersonation (SeImpersonatePrivilege) 2026-08-10 45 AD Attack #46 — DNSAdmins DLL Injection 2026-08-10 46 AD Attack #47 — MachineAccountQuota (MAQ) Abuse 2026-08-10 47 AD Attack #48 — GPP Password Decryption 2026-08-10 48 AD Attack #49 — Abusing Backup Operators Group 2026-08-10 49 AD Attack #5 — Pass-the-Ticket (PtT) 2026-08-10 50 AD Attack #50 — Abusing Account Operators Group 2026-08-10 51 AD Attack #51 — Abusing Server Operators Group 2026-08-10 52 AD Attack #52 — Abusing Print Operators Group 2026-08-10 53 AD Attack #53 — Exchange Windows Permissions (WriteDACL to DCSync) 2026-08-10 54 AD Attack #54 — PsExec Remote Execution via SMB 2026-08-10 55 AD Attack #55 — WinRM Evil-WinRM Lateral Movement 2026-08-10 56 AD Attack #56 — RDP Lateral Movement and Hijacking 2026-08-10 57 AD Attack #57 — DCOM Lateral Movement 2026-08-10 58 AD Attack #58 — WMI Lateral Movement 2026-08-10 59 AD Attack #59 — SCM Service Manager Lateral Movement 2026-08-10 60 AD Attack #6 — Overpass-the-Hash (Pass-the-Key) 2026-08-10 61 AD Attack #60 — Token Stealing and Impersonation 2026-08-10 62 AD Attack #61 — Skeleton Key Attack 2026-08-10 63 AD Attack #62 — DSRM Backdoor Abuse 2026-08-10 64 AD Attack #63 — SID History Injection 2026-08-10 65 AD Attack #64 — Golden Ticket Persistence 2026-08-10 66 AD Attack #65 — ACL Backdooring (Persistence via DCSync ACE) 2026-08-10 67 AD Attack #66 — Malicious GPO Creation 2026-08-10 68 AD Attack #67 — ADCS Certificate-Based Persistence 2026-08-10 69 AD Attack #68 — Cross-Domain Trust Abuse (SID History) 2026-08-10 70 AD Attack #69 — Forest Trust Abuse Cross-Forest Ticket Forging 2026-08-10 71 AD Attack #7 — NTLM Relay Attacks 2026-08-10 72 AD Attack #70 — ADCS Cross-Domain Enrollment 2026-08-10 73 AD Attack #71 — PAM Trust Abuse (Bastion Forest) 2026-08-10 74 AD Attack #72 — LAPS Password Extraction 2026-08-10 75 AD Attack #73 — gMSA Password Extraction 2026-08-10 76 AD Attack #74 — Azure AD Connect Credential Extraction 2026-08-10 77 AD Attack #75 — SCCM MECM Exploitation 2026-08-10 78 AD Attack #76 — MSSQL Server and Linked Server Abuse 2026-08-10 79 AD Attack #77 — DFSCoerce MS-DFSNM Coercion 2026-08-10 80 AD Attack #78 — AD Recycle Bin Object Abuse 2026-08-10 81 AD Attack #8 — LLMNR NBT-NS mDNS Poisoning 2026-08-10 82 AD Attack #9 — mitm6 (IPv6 DNS Spoofing DHCPv6 Takeover) 2026-08-10 83 FLOW Attacking Enterprise Networks — Lateral Movement to Domain 2026-08-31 84 AD Autobloody 2026-08-11 85 AD BloodHound 2026-08-09 86 AD bloodhound-ce-python 2026-08-10 87 AD BloodHound-Python_ 2026-08-10 88 AD BloodyAD 2026-08-09 89 AD Certificate Persistence — Certifried (CVE-2022-26923) 2026-08-10 90 AD Certipy 2026-08-09 91 AD Certipy-ad 2026-08-10 92 AD DPERSIST2 — Rogue CA Certificate (NTAuth Injection) 2026-08-10 93 AD DPERSIST3 — Malicious Misconfiguration (ACL Backdoor) 2026-08-10 94 AD ESC1 — SAN Specification in Template 2026-08-10 95 AD ESC10 — Weak Certificate Mapping 2026-08-10 96 AD ESC11 — NTLM Relay to ADCS RPC (ICPR) 2026-08-10 97 AD ESC12 — Shell Access to CA with YubiHSM 2026-08-10 98 AD ESC13 — Issuance Policy OID Group Link 2026-08-10 99 AD ESC14 — Weak Explicit Certificate Mapping 2026-08-10 100 AD ESC15 — EKUwu (CVE-2024-49019) 2026-08-10 101 AD ESC16 — Security Extension Disabled on CA (Globally) 2026-08-10 102 AD ESC17 — ADCS Certificate Spoofing to Attack HTTPS-Enabled WSUS Clients 2026-08-10 103 AD ESC2 — Any Purpose EKU No EKU (The Swiss Certificate) 2026-08-10 104 AD ESC3 — Misconfigured Enrollment Agent Templates 2026-08-10 105 AD ESC4 — Vulnerable Certificate Template Access Control 2026-08-10 106 AD ESC5 — Vulnerable PKI Object Access Control 2026-08-10 107 AD ESC6 — EDITF_ATTRIBUTESUBJECTALTNAME2 Flag 2026-08-10 108 AD ESC7 — Vulnerable CA Access Control (ManageCA ManageCertificates) 2026-08-10 109 AD ESC8 — NTLM Relay to ADCS HTTP Web Enrollment 2026-08-10 110 AD ESC9 — No Security Extension (Template-Level) 2026-08-10 111 AD faketime 2026-08-10 112 AD Golden Certificate Attack — DPERSIST1 2026-08-10 113 AD Impacket 2026-08-09 114 AD Kerberoasting 2026-08-09 115 AD Kerberoasting — Local On-Host 2026-08-10 116 AD Kerbrute 2026-08-09 117 AD LDAP Enumeration 2026-08-09 118 AD LDAP Search 2026-08-10 119 AD ldapdomaindump 2026-08-10 120 AD Mimikatz 2026-08-09 121 AD NetExec (nxc) 2026-08-09 122 AD PERSIST1 — Active User Credential Theft via Certificates 2026-08-10 123 AD PERSIST2 — Machine Account Persistence via Certificates 2026-08-10 124 AD PERSIST3 — Account Persistence via Certificate Renewal 2026-08-10 125 AD PowerView and PowerUp Deep-Dive 2026-08-29 126 AD Rubeus 2026-08-09 127 AD Run as Another User from an Evil-WinRM Session 2026-08-29 128 AD RustHound-CE 2026-09-13 129 AD Shadow Credentials — msDS-KeyCredentialLink Abuse 2026-08-10 130 AD SharpHound_ 2026-08-10 131 AD THEFT1 — Exporting Certificates and Keys 2026-08-10 132 AD THEFT2 — User Certificate Theft via DPAPI 2026-08-10 133 AD THEFT3 — Machine Certificate Theft via DPAPI 2026-08-10 134 AD THEFT4 — Finding Certificate Files 2026-08-10 135 AD THEFT5 — NTLM Theft via PKINIT (UnPAC-the-Hash) 2026-08-10