> For the complete documentation index, see [llms.txt](https://red.infiltr8.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://red.infiltr8.io/ad.md).

# Active Directory Pentesting

- [Reconnaissance](https://red.infiltr8.io/ad/recon.md)
- [Tools ⚙️](https://red.infiltr8.io/ad/recon/tools.md)
- [PowerView ⚙️](https://red.infiltr8.io/ad/recon/tools/powerview.md)
- [Responder ⚙️](https://red.infiltr8.io/ad/recon/tools/responder.md)
- [BloodHound ⚙️](https://red.infiltr8.io/ad/recon/tools/bloodhound.md)
- [enum4linux ⚙️](https://red.infiltr8.io/ad/recon/tools/enum4linux.md)
- [Network](https://red.infiltr8.io/ad/recon/network.md)
- [DHCP](https://red.infiltr8.io/ad/recon/network/dhcp.md)
- [DNS](https://red.infiltr8.io/ad/recon/network/dns.md)
- [NBT-NS](https://red.infiltr8.io/ad/recon/network/nbt-ns.md)
- [Port scanning](https://red.infiltr8.io/ad/recon/network/port-scanning.md)
- [SMB](https://red.infiltr8.io/ad/recon/network/smb.md)
- [LDAP](https://red.infiltr8.io/ad/recon/network/ldap.md)
- [MS-RPC](https://red.infiltr8.io/ad/recon/network/ms-rpc.md)
- [Objects & Settings](https://red.infiltr8.io/ad/recon/objects-and-settings.md)
- [DACLs](https://red.infiltr8.io/ad/recon/objects-and-settings/dacls.md)
- [Group policies](https://red.infiltr8.io/ad/recon/objects-and-settings/group-policies.md)
- [Password policy](https://red.infiltr8.io/ad/recon/objects-and-settings/password-policy.md)
- [LAPS](https://red.infiltr8.io/ad/recon/objects-and-settings/laps.md)
- [Movement](https://red.infiltr8.io/ad/movement.md)
- [Credentials](https://red.infiltr8.io/ad/movement/credentials.md)
- [Dumping](https://red.infiltr8.io/ad/movement/credentials/dumping.md): MITRE ATT\&CK™ Techniques T1003 and T1552
- [Cracking](https://red.infiltr8.io/ad/movement/credentials/cracking.md): MITRE ATT\&CK™ Sub-technique T1110.002
- [Bruteforcing](https://red.infiltr8.io/ad/movement/credentials/bruteforcing.md)
- [Guessing](https://red.infiltr8.io/ad/movement/credentials/bruteforcing/guessing.md): MITRE ATT\&CK™ Sub-technique T1110.001
- [Spraying](https://red.infiltr8.io/ad/movement/credentials/bruteforcing/password-spraying.md): MITRE ATT\&CK™ Sub-technique T1110.003
- [Stuffing](https://red.infiltr8.io/ad/movement/credentials/bruteforcing/stuffing.md): MITRE ATT\&CK™ Sub-technique T1110.004
- [Shuffling](https://red.infiltr8.io/ad/movement/credentials/credential-shuffling.md): MITRE ATT\&CK™ Techniques T1003 and T1552 (kind of)
- [MITM and coerced auths](https://red.infiltr8.io/ad/movement/mitm-and-coerced-authentications.md)
- [ARP poisoning](https://red.infiltr8.io/ad/movement/mitm-and-coerced-authentications/arp-poisoning.md): MITRE ATT\&CK™ Sub-technique T1557.002
- [DNS spoofing](https://red.infiltr8.io/ad/movement/mitm-and-coerced-authentications/dns-spoofing.md)
- [DHCP poisoning](https://red.infiltr8.io/ad/movement/mitm-and-coerced-authentications/dhcp-poisoning.md)
- [DHCPv6 spoofing](https://red.infiltr8.io/ad/movement/mitm-and-coerced-authentications/dhcpv6-spoofing.md)
- [WSUS spoofing](https://red.infiltr8.io/ad/movement/mitm-and-coerced-authentications/wsus-spoofing.md)
- [LLMNR, NBT-NS, mDNS spoofing](https://red.infiltr8.io/ad/movement/mitm-and-coerced-authentications/llmnr-nbtns-mdns-spoofing.md): MITRE ATT\&CK™ Sub-technique T1557.001
- [ADIDNS poisoning](https://red.infiltr8.io/ad/movement/mitm-and-coerced-authentications/adidns-spoofing.md)
- [WPAD spoofing](https://red.infiltr8.io/ad/movement/mitm-and-coerced-authentications/wpad-spoofing.md)
- [MS-EFSR abuse (PetitPotam)](https://red.infiltr8.io/ad/movement/mitm-and-coerced-authentications/ms-efsr.md)
- [MS-RPRN abuse (PrinterBug)](https://red.infiltr8.io/ad/movement/mitm-and-coerced-authentications/ms-rprn.md)
- [MS-FSRVP abuse (ShadowCoerce)](https://red.infiltr8.io/ad/movement/mitm-and-coerced-authentications/ms-fsrvp.md)
- [MS-DFSNM abuse (DFSCoerce)](https://red.infiltr8.io/ad/movement/mitm-and-coerced-authentications/ms-dfsnm.md)
- [MS-EVEN abuse (CheeseOunce)](https://red.infiltr8.io/ad/movement/mitm-and-coerced-authentications/ms-even-abuse-cheeseounce.md)
- [PushSubscription abuse](https://red.infiltr8.io/ad/movement/mitm-and-coerced-authentications/pushsubscription-abuse.md)
- [WebClient abuse (WebDAV)](https://red.infiltr8.io/ad/movement/mitm-and-coerced-authentications/webclient.md)
- [Living off the land](https://red.infiltr8.io/ad/movement/mitm-and-coerced-authentications/living-off-the-land.md)
- [NBT Name Overwrite](https://red.infiltr8.io/ad/movement/mitm-and-coerced-authentications/nbt-name-overwrite.md)
- [ICMP Redirect](https://red.infiltr8.io/ad/movement/mitm-and-coerced-authentications/icmp-redirect.md)
- [NTLM](https://red.infiltr8.io/ad/movement/ntlm.md)
- [Capture](https://red.infiltr8.io/ad/movement/ntlm/capture.md)
- [Relay](https://red.infiltr8.io/ad/movement/ntlm/relay.md): MITRE ATT\&CK™ Sub-technique T1557.001
- [Pass the hash](https://red.infiltr8.io/ad/movement/ntlm/pth.md): MITRE ATT\&CK™ Sub-technique T1550.002
- [Kerberos](https://red.infiltr8.io/ad/movement/kerberos.md)
- [Pre-auth bruteforce](https://red.infiltr8.io/ad/movement/kerberos/pre-auth-bruteforce.md)
- [Pass the key](https://red.infiltr8.io/ad/movement/kerberos/ptk.md)
- [Overpass the hash](https://red.infiltr8.io/ad/movement/kerberos/opth.md)
- [Pass the ticket](https://red.infiltr8.io/ad/movement/kerberos/ptt.md): MITRE ATT\&CK™ Sub-technique T1550.003
- [Pass the cache](https://red.infiltr8.io/ad/movement/kerberos/ptc.md)
- [Forged tickets](https://red.infiltr8.io/ad/movement/kerberos/forged-tickets.md): MITRE ATT\&CK™ Sub-techniques T1558.001 and T1558.002
- [Silver tickets](https://red.infiltr8.io/ad/movement/kerberos/forged-tickets/silver.md)
- [Golden tickets](https://red.infiltr8.io/ad/movement/kerberos/forged-tickets/golden.md)
- [Diamond tickets](https://red.infiltr8.io/ad/movement/kerberos/forged-tickets/diamond.md)
- [Sapphire tickets](https://red.infiltr8.io/ad/movement/kerberos/forged-tickets/sapphire.md)
- [RODC Golden tickets](https://red.infiltr8.io/ad/movement/kerberos/forged-tickets/rodc-golden-tickets.md)
- [MS14-068](https://red.infiltr8.io/ad/movement/kerberos/forged-tickets/ms14-068.md): CVE-2014-6324
- [ASREQroast](https://red.infiltr8.io/ad/movement/kerberos/asreqroast.md)
- [ASREProast](https://red.infiltr8.io/ad/movement/kerberos/asreproast.md)
- [Kerberoast](https://red.infiltr8.io/ad/movement/kerberos/kerberoast.md): MITRE ATT\&CK™ Sub-technique T1558.003
- [Delegations](https://red.infiltr8.io/ad/movement/kerberos/delegations.md)
- [(KUD) Unconstrained](https://red.infiltr8.io/ad/movement/kerberos/delegations/unconstrained.md)
- [(KCD) Constrained](https://red.infiltr8.io/ad/movement/kerberos/delegations/constrained.md)
- [(RBCD) Resource-based constrained](https://red.infiltr8.io/ad/movement/kerberos/delegations/rbcd.md)
- [S4U2self abuse](https://red.infiltr8.io/ad/movement/kerberos/delegations/s4u2self-abuse.md)
- [Bronze Bit](https://red.infiltr8.io/ad/movement/kerberos/delegations/bronze-bit.md): CVE-2020-17049
- [Shadow Credentials](https://red.infiltr8.io/ad/movement/kerberos/shadow-credentials.md)
- [UnPAC the hash](https://red.infiltr8.io/ad/movement/kerberos/unpac-the-hash.md)
- [Pass the Certificate - PKINIT](https://red.infiltr8.io/ad/movement/kerberos/pass-the-certificate.md)
- [Kerberos relay](https://red.infiltr8.io/ad/movement/kerberos/kerberos-relay.md)
- [sAMAccountName spoofing](https://red.infiltr8.io/ad/movement/kerberos/samaccountname-spoofing.md): CVE-2021-42278 and CVE-2021-42287
- [SPN-jacking](https://red.infiltr8.io/ad/movement/kerberos/spn-jacking.md)
- [Netlogon](https://red.infiltr8.io/ad/movement/netlogon.md)
- [ZeroLogon](https://red.infiltr8.io/ad/movement/netlogon/zerologon.md): CVE-2020-1472
- [DACL abuse](https://red.infiltr8.io/ad/movement/dacl.md)
- [AddMember](https://red.infiltr8.io/ad/movement/dacl/addmember.md)
- [ForceChangePassword](https://red.infiltr8.io/ad/movement/dacl/forcechangepassword.md)
- [Targeted Kerberoasting](https://red.infiltr8.io/ad/movement/dacl/targeted-kerberoasting.md)
- [WriteOwner](https://red.infiltr8.io/ad/movement/dacl/writeowner.md)
- [ReadLAPSPassword](https://red.infiltr8.io/ad/movement/dacl/readlapspassword.md)
- [ReadGMSAPassword](https://red.infiltr8.io/ad/movement/dacl/readgmsapassword.md)
- [Grant ownership](https://red.infiltr8.io/ad/movement/dacl/grant-ownership.md)
- [Grant rights](https://red.infiltr8.io/ad/movement/dacl/grant-rights.md)
- [Logon script](https://red.infiltr8.io/ad/movement/dacl/logon-script.md)
- [Rights on RODC object](https://red.infiltr8.io/ad/movement/dacl/rights-on-rodc-object.md)
- [BadSuccessor (dMSA abuse)](https://red.infiltr8.io/ad/movement/dacl/badsuccessor-dmsa-abuse.md)
- [Group policies](https://red.infiltr8.io/ad/movement/group-policies.md)
- [Trusts](https://red.infiltr8.io/ad/movement/domain-trusts.md)
- [Certificate Services (AD-CS)](https://red.infiltr8.io/ad/movement/ad-cs.md)
- [Certificate templates](https://red.infiltr8.io/ad/movement/ad-cs/certificate-templates.md)
- [Certificate authority](https://red.infiltr8.io/ad/movement/ad-cs/certificate-authority.md)
- [Access controls](https://red.infiltr8.io/ad/movement/ad-cs/access-controls.md)
- [Unsigned endpoints](https://red.infiltr8.io/ad/movement/ad-cs/unsigned-endpoints.md)
- [Certifried](https://red.infiltr8.io/ad/movement/ad-cs/certifried.md): CVE-2022–26923
- [Schannel](https://red.infiltr8.io/ad/movement/schannel.md)
- [Pass the Certificate - Schannel](https://red.infiltr8.io/ad/movement/schannel/pass-the-certificate-schannel.md)
- [SCCM / MECM](https://red.infiltr8.io/ad/movement/sccm-mecm.md)
- [Privilege Escalation](https://red.infiltr8.io/ad/movement/sccm-mecm/privilege-escalation.md)
- [Post Exploitation](https://red.infiltr8.io/ad/movement/sccm-mecm/post-exploitation.md)
- [Exchange services](https://red.infiltr8.io/ad/movement/exchange-services.md)
- [PrivExchange](https://red.infiltr8.io/ad/movement/exchange-services/privexchange.md): CVE-2018-8581
- [ProxyLogon](https://red.infiltr8.io/ad/movement/exchange-services/proxylogon.md): Chained CVE-2021-26855 and CVE-2021-27065
- [ProxyShell](https://red.infiltr8.io/ad/movement/exchange-services/proxyshell.md): Chained CVE-2021-34473, CVE-2021-34523, CVE-2021-31207
- [ProxyNotShell](https://red.infiltr8.io/ad/movement/exchange-services/proxynotshell.md): Chained CVE-2022-41040, CVE-2022-41082
- [Print Spooler Service](https://red.infiltr8.io/ad/movement/print-spooler-service.md)
- [PrinterBug](https://red.infiltr8.io/ad/movement/print-spooler-service/printerbug.md)
- [PrintNightmare](https://red.infiltr8.io/ad/movement/print-spooler-service/printnightmare.md): CVE-2021-1675 & CVE-2021-34527
- [Built-ins & settings](https://red.infiltr8.io/ad/movement/domain-settings.md)
- [Builtin Groups](https://red.infiltr8.io/ad/movement/domain-settings/builtin-groups.md)
- [DNSAdmins](https://red.infiltr8.io/ad/movement/domain-settings/builtin-groups/dnsadmins.md)
- [AD Recycle Bin](https://red.infiltr8.io/ad/movement/domain-settings/builtin-groups/ad-recycle-bin.md)
- [MachineAccountQuota](https://red.infiltr8.io/ad/movement/domain-settings/machineaccountquota.md)
- [Pre-Windows 2000 computers](https://red.infiltr8.io/ad/movement/domain-settings/pre-windows-2000-computers.md)
- [RODC](https://red.infiltr8.io/ad/movement/domain-settings/rodc.md): Read-Only Domain Controller
- [Persistence](https://red.infiltr8.io/ad/persistence.md)
- [Skeleton key](https://red.infiltr8.io/ad/persistence/skeleton-key.md)
- [SID History](https://red.infiltr8.io/ad/persistence/sid-history.md)
- [AdminSDHolder](https://red.infiltr8.io/ad/persistence/adminsdholder.md)
- [GoldenGMSA](https://red.infiltr8.io/ad/persistence/goldengmsa.md)
- [Kerberos](https://red.infiltr8.io/ad/persistence/kerberos.md)
- [Forged tickets](https://red.infiltr8.io/ad/persistence/kerberos/forged-tickets.md)
- [Delegation to KRBTGT](https://red.infiltr8.io/ad/persistence/kerberos/delegation-to-krbtgt.md)
- [Certificate Services (AD-CS)](https://red.infiltr8.io/ad/persistence/ad-cs.md)
- [Certificate authority](https://red.infiltr8.io/ad/persistence/ad-cs/certificate-authority.md)
- [Access controls](https://red.infiltr8.io/ad/persistence/ad-cs/access-controls.md)
- [Golden certificate](https://red.infiltr8.io/ad/persistence/ad-cs/golden-certificate.md)
- [LAPS](https://red.infiltr8.io/ad/persistence/laps.md)
- [DC Shadow](https://red.infiltr8.io/ad/persistence/dcshadow.md)
- [Access controls](https://red.infiltr8.io/ad/persistence/access-controls.md)