> For the complete documentation index, see [llms.txt](https://notes.cavementech.com/pentesting-quick-reference/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting.md).

# Active Directory Pentesting

- [Active Directory](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory.md)
- [AD Basics](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/ad-basics.md)
- [AD Management Basics](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/ad-basics/ad-management-basics.md)
- [Initial Enumeration of  AD](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/initial-enumeration-of-ad.md)
- [Enumerating AD Users](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/initial-enumeration-of-ad/enumerating-ad-users.md)
- [Password Spraying](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/password-spraying.md)
- [Enumerating & Retrieving Password Policies](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/password-spraying/enumerating-and-retrieving-password-policies.md)
- [Password Spraying - Making a Target User List](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/password-spraying/password-spraying-making-a-target-user-list.md)
- [Internal Password Spraying - from Linux](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/password-spraying/internal-password-spraying-from-linux.md)
- [Internal Password Spraying - from Windows](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/password-spraying/internal-password-spraying-from-windows.md)
- [Enumerating Security Controls](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/password-spraying/enumerating-security-controls.md)
- [LLMNR Poisoning](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/llmnr-poisoning.md)
- [SMB/ NTLM Relay Attacks](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/smb-ntlm-relay-attacks.md)
- [IPv6 Attacks](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/ipv6-attacks.md)
- [IPV6 DNS takeover](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/ipv6-attacks/ipv6-dns-takeover.md)
- [WPAD](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/ipv6-attacks/wpad.md)
- [Passback Attacks](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/passback-attacks.md)
- [AS-REP roasting](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/as-rep-roasting.md)
- [Kerberoasting via AS-rep](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/kerberoasting-via-as-rep.md)
- [AD Shell](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/ad-shell.md)
- [BloodHound](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/bloodhound.md)
- [Bloodhound CE](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/bloodhound/bloodhound-ce.md): How to Install Bloodhound CE on Kali. Newest Sharphound collectors only work with bloodhound CE
- [Collecting the Loot](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/bloodhound/collecting-the-loot.md)
- [Analyzing Attack Paths](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/bloodhound/analyzing-attack-paths.md)
- [Plumhound](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/bloodhound/plumhound.md): bloddhound for purple and blue teams
- [AD Enumeration](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/ad-enumeration.md)
- [Credentialed Enumeration - from Linux](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/ad-enumeration/credentialed-enumeration-from-linux.md)
- [Credentialed Enumeration - from Windows](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/ad-enumeration/credentialed-enumeration-from-windows.md)
- [Living off the Land](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/ad-enumeration/living-off-the-land.md)
- [Powershell Additional Tricks](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/ad-enumeration/living-off-the-land/powershell-additional-tricks.md)
- [ldapdomaindump](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/ad-enumeration/ldapdomaindump.md): Good and easy tool for remote dumping AD stuff
- [PingCastle](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/ad-enumeration/pingcastle.md)
- [Post Compromise](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/post-compromise.md)
- [Kerberosting](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/post-compromise/kerberosting.md)
- [Kerberos "Double Hop" Problem](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/post-compromise/kerberosting/kerberos-double-hop-problem.md)
- [Pass Attacks](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/post-compromise/pass-attacks.md)
- [Pass the Hash](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/post-compromise/pass-attacks/pass-the-hash.md)
- [Pass the Ticket](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/post-compromise/pass-attacks/pass-the-ticket.md)
- [Pass the Ticket (PtT) from Windows](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/post-compromise/pass-attacks/pass-the-ticket/pass-the-ticket-ptt-from-windows.md)
- [Pass the Ticket (PtT) from Linux](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/post-compromise/pass-attacks/pass-the-ticket/pass-the-ticket-ptt-from-linux.md)
- [Token Impersonation](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/post-compromise/token-impersonation.md)
- [LNK File Attacks](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/post-compromise/lnk-file-attacks.md): If we have access to a share, we can put there a malicious file. On the other end we can have responder. Once the file is opened we get the hash
- [Miscellaneous Misconfigurations](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/post-compromise/miscellaneous-misconfigurations.md)
- [Group Policy Abuse](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/group-policy-abuse.md)
- [Active Directory Certificate Services (AD CS) attacks](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/active-directory-certificate-services-ad-cs-attacks.md)
- [Pivoting](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/pivoting.md)
- [Pivoting from Linux to Active Directory](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/pivoting-from-linux-to-active-directory.md)
- [Lateral Movement](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/lateral-movement.md)
- [Privilege Escalation](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/privilege-escalation.md)
- [Access Control List (ACL) Abuse Primer](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/access-control-list-acl-abuse-primer.md)
- [ACL Enumeration](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/access-control-list-acl-abuse-primer/acl-enumeration.md)
- [Abusing ACL - Generic All](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/access-control-list-acl-abuse-primer/abusing-acl-generic-all.md)
- [ACL Abuse Tactics](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/access-control-list-acl-abuse-primer/acl-abuse-tactics.md)
- [DCSync](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/access-control-list-acl-abuse-primer/dcsync.md): With SCSync attack we can dump the hashes of all users in the AD incl krbgt
- [DCSync Example Forest HTB](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/access-control-list-acl-abuse-primer/dcsync/dcsync-example-forest-htb.md)
- [Post Owning Domain](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/post-owning-domain.md)
- [Attacking Active Directory & NTDS.dit 1](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/post-owning-domain/attacking-active-directory-and-ntds.dit-1.md)
- [Golden Ticket Attacks](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/post-owning-domain/golden-ticket-attacks.md)
- [Silver Ticket](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/post-owning-domain/silver-ticket.md)
- [AD Common Vulnerablities](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/ad-common-vulnerablities.md)
- [Bleeding Edge Vulnerabilities](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/bleeding-edge-vulnerabilities.md)
- [Domain Trusts](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/domain-trusts.md)
- [Attacking Domain Trusts - Child -> Parent Trusts - from Windows](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/domain-trusts/attacking-domain-trusts-child-greater-than-parent-trusts-from-windows.md)
- [Attacking Domain Trusts - Child -> Parent Trusts - from Linux](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/domain-trusts/attacking-domain-trusts-child-greater-than-parent-trusts-from-linux.md)
- [Attacking Domain Trusts - Cross-Forest Trust Abuse - from Windows](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/domain-trusts/attacking-domain-trusts-cross-forest-trust-abuse-from-windows.md)
- [Attacking Domain Trusts - Cross-Forest Trust Abuse - from Linux](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/domain-trusts/attacking-domain-trusts-cross-forest-trust-abuse-from-linux.md)
- [Maintaining Access](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/maintaining-access.md)
- [Clean Up](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/clean-up.md)
- [Hardening Active Directory](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/hardening-active-directory.md)
- [Additional AD Auditing Techniques](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/additional-ad-auditing-techniques.md)
- [AD Machines Walkthroughs](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/ad-machines-walkthroughs.md)
- [Hacksmarter - Building Magic Walkthrough](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/ad-machines-walkthroughs/hacksmarter-building-magic-walkthrough.md)
- [Hacksmarter - Share the Pain](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/ad-machines-walkthroughs/hacksmarter-share-the-pain.md): "ShareThePain" is a medium-rated Active Directory lab.
- [Hacksmarter - Anomaly](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/ad-machines-walkthroughs/hacksmarter-anomaly.md): Ubuntu Web server and an AD Server
- [Hacksmarter - Sysco](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/ad-machines-walkthroughs/hacksmarter-sysco.md)
- [Hacksmarter - Odyssey](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/ad-machines-walkthroughs/hacksmarter-odyssey.md)
- [Hacksmarter - Triathlon](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/ad-machines-walkthroughs/hacksmarter-triathlon.md)
- [Hacksmarter - Lumon Industries](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/ad-machines-walkthroughs/hacksmarter-lumon-industries.md): Lumon Industries will soon be integrating a high-value employee into the organization. In accordance with internal security protocols, a comprehensive penetration test must be conducted.
- [HTB AD Enumeration & Attacks - Skills Assessment Part I](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/ad-machines-walkthroughs/htb-ad-enumeration-and-attacks-skills-assessment-part-i.md)
- [Game of Active Directory](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/ad-machines-walkthroughs/game-of-active-directory.md)
- [HTB Active](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/ad-machines-walkthroughs/htb-active.md): Active HTB Machine walkthrough 2023. Active directory Basics.
- [HTB Forest](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/ad-machines-walkthroughs/htb-forest.md): Forest HTB 2023 Walkthrough