Active Directory Enumeration & Attacks
A full-lifecycle reference covering every major phase of an Active Directory penetration test, from initial recon to domain compromise. Tools, commands, context, and detection notes for each technique.
#red-team
4 writeup(s) tagged red-team.
BloodHound & Active Directory Enumeration : The Complete Reference
A practical cheatsheet and reference guide for using BloodHound, SharpHound, and AzureHound during Active Directory and Azure assessments.
Variatype
Complete walkthrough of the Variatype HackTheBox machine.
EDR & AV Bypass Techniques
Advanced techniques for bypassing the hardest EDR's and antivirus protections with AI protections , tamper protection , and kernel level protections.
Browse other tags
#active-directory 8
#post-exploitation 6
#enumeration 4
#pentest-reference 4
#red-team 4
#acl-abuse 3
#ad 3
#bloodhound 3
#certipy 3
#dcsync 3
#kerberoasting 3
#local-privilege-escalation 3
#reverse-shell 3
#certificate-abuse 2
#hackthebox 2
#impacket 2
#kerberos 2
#lateral-movement 2
#mitre-att&ck 2
#rid brute 2
#windows 2
#ACL-exploitation 1
#CVE-2025-24893 1
#CVE-2025-64714 1
#CVE-2026-23744 1
#SeBackupPrivilege 1
#adcs 1
#adsi 1
#aiohttp 1
#amsi-bypass 1
#antivirus-evasion 1
#arcane-api 1
#azure 1
#azurehound 1
#backup scripts 1
#blue-team 1
#certificaterequest 1
#cif 1
#cip 1
#cip-objects 1
#command-injection 1
#credential-leak 1
#credential-reuse 1
#cve-2024-23334 1
#cve-2024-23346 1
#cypher 1
#dacl 1
#delegation-abuse 1
#dll-injection 1
#docker 1
#docker-group-abuse 1
#domain-trusts 1
#dpapi 1
#eaphammer 1
#edr-bypass 1
#ethernet-ip 1
#etw-patching 1
#evil-twin 1
#fontforge 1
#gMSA 1
#git-exposure 1
#godpotato 1
#groovy-template-injection 1
#hashcat 1
#hibernate.cfg.xml 1
#htb-writeup 1
#ics 1
#identity-object 1
#industrial-control-systems 1
#keepass 1
#ldap 1
#ldapsearch 1
#lfi-template-cookie 1
#ligolo 1
#ligolo-ng 1
#linux 1
#linux-privilege-escalation 1
#llmnr-poisoning 1
#lolbas 1
#malware-development 1
#mcpjam-inspector 1
#message-router 1
#ms-sql 1
#mschapv2 1
#mysql-creds 1
#ndsudo 1
#neo4j 1
#netdata 1
#netntlm 1
#newgrp 1
#ntdll-unhooking 1
#ntlm-relay 1
#ot-security 1
#pass-the-hash 1
#password-spraying 1
#path-manipulation 1
#peap 1
#penetration-testing 1
#petitpotam 1
#php-webshell 1
#pivoting 1
#plc 1
#powershell 1
#powerview 1
#privatebin 1
#privilege-escalation 1
#privileged-container 1
#process-injection 1
#protocol-enumeration 1
#pymatgen 1
#python 1
#radius 1
#rbcd 1
#remotepotato 1
#rogue-ap 1
#rubeus 1
#rundll32 1
#s4u2proxy 1
#s4u2self 1
#secretsdump 1
#seimpersonate 1
#setuid-binary 1
#sharphound 1
#sharpview 1
#shellcode-encryption 1
#smb 1
#spn-jacking 1
#ssh 1
#ssh-key-injection 1
#ssh-login 1
#ssti 1
#sudo-misconfiguration 1
#suid 1
#timeroasting 1
#uac-bypass 1
#unauthenticated-rce 1
#utf-16le 1
#web-exploitation 1
#wifi-exploitation 1
#wireless 1
#wmi 1
#wpa-eap 1
#xp_dirtree 1
#xss 1
#xwiki 1