01 ADActive Directory Attack Methodology 2026-08-0902 ADActive Directory Enumeration — Native Tooling 2026-09-2503 ADActive-Directory_cheat_sheet 2026-08-1004 ADAD Pentest Tools Workflow 2026-08-0905 ADAD Recycle Bin Enumeration & Deleted-Object Recovery 2026-09-2506 ADADCS Attack Methodology 2026-08-0907 ADADFSDump & ADFSpoof 2026-10-1108 ADAttack #1 — Password Spraying 2026-08-1009 ADAttack #10 — Credential Hunting in Shares GPP Passwords 2026-08-1010 ADAttack #11 — Golden Ticket Attack 2026-08-1011 ADAttack #12 — Silver Ticket Attack 2026-08-1012 ADAttack #13 — Diamond Ticket Attack 2026-08-1013 ADAttack #14 — Sapphire Ticket Attack 2026-08-1014 ADAttack #15 — Unconstrained Delegation Abuse 2026-08-1015 ADAttack #16 — Constrained Delegation Abuse (S4U2Proxy) 2026-08-1016 ADAttack #17 — Resource-Based Constrained Delegation (RBCD) 2026-08-1017 ADAttack #18 — Bronze Bit Attack (CVE-2020-17049) 2026-08-1018 ADAttack #19 — GenericAll Abuse 2026-08-1019 ADAttack #2 — Kerberoasting 2026-08-1020 ADAttack #20 — GenericWrite Abuse 2026-08-1021 ADAttack #21 — WriteDACL Abuse 2026-08-1022 ADAttack #22 — WriteOwner Abuse 2026-08-1023 ADAttack #23 — ForceChangePassword Abuse 2026-08-1024 ADAttack #24 — AllExtendedRights DCSync ACE Abuse 2026-08-1025 ADAttack #25 — Shadow Credentials Attack (msDS-KeyCredentialLink) 2026-08-1026 ADAttack #26 — AdminSDHolder Persistence via ACL 2026-08-1027 ADAttack #27 — ESC1 SAN Specification in Template 2026-08-1028 ADAttack #28 — ESC2 Any Purpose EKU No EKU 2026-08-1029 ADAttack #29 — ESC3 Certificate Request Agent 2026-08-1030 ADAttack #3 — AS-REP Roasting 2026-08-1031 ADAttack #30 — ESC4 Template Write Permissions 2026-08-1032 ADAttack #31 — ESC6 EDITF_ATTRIBUTESUBJECTALTNAME2 Flag 2026-08-1033 ADAttack #32 — ESC7 Vulnerable CA Officer Permissions 2026-08-1034 ADAttack #33 — ESC8 NTLM Relay to ADCS HTTP Endpoint 2026-08-1035 ADAttack #34 — ESC11 NTLM Relay to ADCS RPC 2026-08-1036 ADAttack #35 — Golden Certificate Attack 2026-08-1037 ADAttack #36 — Certifried (CVE-2022-26923) 2026-08-1038 ADAttack #37 — DCSync Attack 2026-08-1039 ADAttack #38 — DCShadow Attack 2026-08-1040 ADAttack #39 — NTDS.dit Extraction and Dumping 2026-08-1041 ADAttack #4 — Pass-the-Hash (PtH) 2026-08-1042 ADAttack #40 — Zerologon (CVE-2020-1472) 2026-08-1043 ADAttack #41 — PetitPotam (CVE-2021-36942) 2026-08-1044 ADAttack #42 — PrinterBug SpoolSample 2026-08-1045 ADAttack #43 — PrintNightmare (CVE-2021-34527) 2026-08-1046 ADAttack #44 — noPAC Sam-the-Admin (CVE-2021-42278 42287) 2026-08-1047 ADAttack #45 — Token Impersonation (SeImpersonatePrivilege) 2026-08-1048 ADAttack #46 — DNSAdmins DLL Injection 2026-08-1049 ADAttack #47 — MachineAccountQuota (MAQ) Abuse 2026-08-1050 ADAttack #48 — GPP Password Decryption 2026-08-1051 ADAttack #49 — Abusing Backup Operators Group 2026-08-1052 ADAttack #5 — Pass-the-Ticket (PtT) 2026-08-1053 ADAttack #50 — Abusing Account Operators Group 2026-08-1054 ADAttack #51 — Abusing Server Operators Group 2026-08-1055 ADAttack #52 — Abusing Print Operators Group 2026-08-1056 ADAttack #53 — Exchange Windows Permissions (WriteDACL to DCSync) 2026-08-1057 ADAttack #54 — PsExec Remote Execution via SMB 2026-08-1058 ADAttack #55 — WinRM Evil-WinRM Lateral Movement 2026-08-1059 ADAttack #56 — RDP Lateral Movement and Hijacking 2026-08-1060 ADAttack #57 — DCOM Lateral Movement 2026-08-1061 ADAttack #58 — WMI Lateral Movement 2026-08-1062 ADAttack #59 — SCM Service Manager Lateral Movement 2026-08-1063 ADAttack #6 — Overpass-the-Hash (Pass-the-Key) 2026-08-1064 ADAttack #60 — Token Stealing and Impersonation 2026-08-1065 ADAttack #61 — Skeleton Key Attack 2026-08-1066 ADAttack #62 — DSRM Backdoor Abuse 2026-08-1067 ADAttack #63 — SID History Injection 2026-08-1068 ADAttack #64 — Golden Ticket Persistence 2026-08-1069 ADAttack #65 — ACL Backdooring (Persistence via DCSync ACE) 2026-08-1070 ADAttack #66 — Malicious GPO Creation 2026-08-1071 ADAttack #67 — ADCS Certificate-Based Persistence 2026-08-1072 ADAttack #68 — Cross-Domain Trust Abuse (SID History) 2026-08-1073 ADAttack #69 — Forest Trust Abuse Cross-Forest Ticket Forging 2026-08-1074 ADAttack #7 — NTLM Relay Attacks 2026-08-1075 ADAttack #70 — ADCS Cross-Domain Enrollment 2026-08-1076 ADAttack #71 — PAM Trust Abuse (Bastion Forest) 2026-08-1077 ADAttack #72 — LAPS Password Extraction 2026-08-1078 ADAttack #73 — gMSA Password Extraction 2026-08-1079 ADAttack #74 — Azure AD Connect Credential Extraction 2026-08-1080 ADAttack #75 — SCCM MECM Exploitation 2026-08-1081 ADAttack #76 — MSSQL Server and Linked Server Abuse 2026-08-1082 ADAttack #77 — DFSCoerce MS-DFSNM Coercion 2026-08-1083 ADAttack #78 — AD Recycle Bin Object Abuse 2026-08-1084 ADAttack #8 — LLMNR NBT-NS mDNS Poisoning 2026-08-1085 ADAttack #9 — mitm6 (IPv6 DNS Spoofing DHCPv6 Takeover) 2026-08-1086 ADAutobloody 2026-08-1187 ADBloodHound 2026-08-0988 ADbloodhound-ce-python 2026-08-1089 ADBloodHound-Python_ 2026-08-1090 ADBloodyAD 2026-10-1291 ADCertificate Persistence — Certifried (CVE-2022-26923) 2026-08-1092 ADCertipy 2026-08-0993 ADCertipy-ad 2026-08-1094 ADdnstool & bloodyAD 2026-10-1195 ADDPERSIST2 — Rogue CA Certificate (NTAuth Injection) 2026-08-1096 ADDPERSIST3 — Malicious Misconfiguration (ACL Backdoor) 2026-08-1097 ADESC1 — SAN Specification in Template 2026-08-1098 ADESC10 — Weak Certificate Mapping 2026-08-1099 ADESC11 — NTLM Relay to ADCS RPC (ICPR) 2026-08-10100 ADESC12 — Shell Access to CA with YubiHSM 2026-08-10101 ADESC13 — Issuance Policy OID Group Link 2026-08-10102 ADESC14 — Weak Explicit Certificate Mapping 2026-08-10103 ADESC15 — EKUwu (CVE-2024-49019) 2026-08-10104 ADESC16 — Security Extension Disabled on CA (Globally) 2026-08-10105 ADESC17 — ADCS Certificate Spoofing to Attack HTTPS-Enabled WSUS Clients 2026-08-10106 ADESC2 — Any Purpose EKU No EKU (The Swiss Certificate) 2026-08-10107 ADESC3 — Misconfigured Enrollment Agent Templates 2026-08-10108 ADESC4 — Vulnerable Certificate Template Access Control 2026-08-10109 ADESC5 — Vulnerable PKI Object Access Control 2026-08-10110 ADESC6 — EDITF_ATTRIBUTESUBJECTALTNAME2 Flag 2026-08-10111 ADESC7 — Vulnerable CA Access Control (ManageCA ManageCertificates) 2026-08-10112 ADESC8 — NTLM Relay to ADCS HTTP Web Enrollment 2026-08-10113 ADESC9 — No Security Extension (Template-Level) 2026-08-10114 ADEvil-WinRM & evil-winrm-py 2026-10-12115 ADfaketime 2026-08-10116 ADGolden Certificate Attack — DPERSIST1 2026-08-10117 ADImpacket 2026-10-12118 ADImpacket dpapi 2026-10-11119 ADKerberoasting 2026-08-09120 ADKerberoasting — Local On-Host 2026-08-10121 ADKerbrute 2026-08-09122 ADkrbrelayx 2026-10-11123 ADLDAP Enumeration 2026-08-09124 ADLDAP Search 2026-10-12125 ADldapdomaindump 2026-08-10126 ADMimikatz 2026-08-09127 ADNetExec (nxc) 2026-10-12128 FLOWPentesting: How Attacks Work 2026-10-11129 ADPERSIST1 — Active User Credential Theft via Certificates 2026-08-10130 ADPERSIST2 — Machine Account Persistence via Certificates 2026-08-10131 ADPERSIST3 — Account Persistence via Certificate Renewal 2026-08-10132 ADPowerView and PowerUp Deep-Dive 2026-09-19133 ADRubeus 2026-10-12134 ADRun as Another User from an Evil-WinRM Session 2026-09-25135 ADRustHound-CE 2026-09-13136 ADShadow Credentials — msDS-KeyCredentialLink Abuse 2026-08-10137 ADSharpHound 2026-10-12138 ENUMsmbclient & smbclient.py 2026-10-12139 ADTHEFT1 — Exporting Certificates and Keys 2026-08-10140 ADTHEFT2 — User Certificate Theft via DPAPI 2026-08-10141 ADTHEFT3 — Machine Certificate Theft via DPAPI 2026-08-10142 ADTHEFT4 — Finding Certificate Files 2026-08-10143 ADTHEFT5 — NTLM Theft via PKINIT (UnPAC-the-Hash) 2026-08-10