Internal & Active Directory
Footholds, privilege escalation and the attack paths that lead to domain takeover.
AD privileges & permissions
The rights that matter, and why least privilege is everything.
intermediateLLMNR / NBT-NS poisoning
Answering broadcast name requests to capture auth. The classic first foothold.
intermediateKerberoasting
Abusing service tickets to crack service-account passwords offline.
intermediateAS-REP roasting
Cracking accounts that don’t require Kerberos pre-authentication.
intermediateNTLM relay & pass-the-hash
Why NTLM auth can be forwarded or replayed — and how to stop it.
intermediateAttack paths & BloodHound
Domain Admin is a chain of small permissions. Here’s how to see it.
intermediate