NetExec
A practical NetExec guide: install it, verify it, enumerate one protocol at a time, validate credentials without locking accounts, read the output honestly, and keep a cheat sheet you will actually reuse.
Tagged “Active Directory”
9 entries tagged “Active Directory”. Browse all tags
All entries
ldapsearch
The ldapsearch quick reference: the flags, a modular copy-paste cheat sheet, and a worked breakdown of every real task. Find the base DN from the Root DSE, bind anonymously or with credentials, list users and groups, enumerate computers, hunt Kerberoastable accounts, page past a size limit, and query over LDAPS.
PowerView
A practical PowerView guide for authorized AD labs: load the module, enumerate users, groups, ACLs, and trusts from a domain-joined host, read the output, and understand the defenses that watch it.
Smbmap
The smbmap quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. List shares over a null session, read the READ/WRITE flags honestly, recurse a share, pull and push files, pass the hash, and run an authorized remote command.
BloodHound
A practical BloodHound guide: collect Active Directory graph data, ingest it, hunt attack paths to Domain Admin, and read the output without chasing dead ends.
Mimikatz
A practical Mimikatz guide for authorized AD labs: what it extracts, the core modules, how to read the output, and the defenses that stop it.
Evil-WinRM
A practical Evil-WinRM guide: get an interactive WinRM shell on Windows with a password, hash, or certificate, move files, load scripts, and stay inside scope.
Impacket
A practical Impacket guide: install it, verify it, pick the right script, handle credential and hash syntax cleanly, read protocol errors honestly, and keep a cheat sheet you will actually reuse.
Responder
A practical Responder guide: install it, pick the right interface, start in analyze mode, capture lab name-resolution traffic safely, read the output honestly, and keep a cheat sheet you will actually reuse.