# active-directory

#active-directory#windows#certificate-abuse

Certipy

Active Directory Certificate Services enumeration and exploitation tool

#active-directory#windows#smb

CrackMapExec

Swiss army knife for pentesting Windows/Active Directory environments

#remote-access#windows#active-directory

Evil-WinRM

Windows Remote Management shell for penetration testing with pass-the-hash support

impacket-GetNPUsers

AS-REP Roasting tool to extract hashes for accounts with Kerberos pre-auth disabled

impacket-GetUserSPNs

Kerberoasting tool to request and extract service ticket hashes for offline cracking

impacket-lookupsid

SID brute-forcing tool to enumerate domain users and groups via RPC

impacket-mssqlclient

MSSQL client for interacting with Microsoft SQL servers using Windows authentication

impacket-psexec

Remote command execution tool using SMB/RPC for lateral movement in Windows environments

impacket-secretsdump

Extracts credentials and secrets from Windows systems including SAM, LSA, and NTDS.dit

impacket-wmiexec

Remote command execution using WMI for stealthy lateral movement without writing to disk

#active-directory#windows#av-evasion

InviShell

Bypasses PowerShell security features like logging and AMSI for stealthy script execution

#active-directory#windows#kerberos

Kerbrute

Kerberos brute-forcing tool for AD username enumeration and password spraying

#active-directory#enumeration#ldap

ldapsearch

LDAP query tool for enumerating Active Directory objects, users, and groups

#active-directory#windows#credential-dumping

Mimikatz

Windows credential extraction tool for dumping passwords, hashes, and Kerberos tickets

#active-directory#windows#smb

net rpc

Samba utility for managing Windows remote resources including password changes and group membership

#active-directory#windows#database

PowerUpSQL

PowerShell toolkit for attacking SQL Server instances in Active Directory environments

#active-directory#windows#enumeration

PowerView

PowerShell tool for Active Directory enumeration and domain reconnaissance

#active-directory#windows#credential-capture

Responder

LLMNR/NBT-NS/mDNS poisoner for capturing NTLMv2 hashes on the network

rpcclient

Samba RPC client for enumerating users, groups, and shares on Windows systems

#enumeration#windows#smb

#active-directory#windows#kerberos

Rubeus

C# Kerberos abuse toolkit for AS-REP roasting, Kerberoasting, and ticket manipulation