dcsync

Free Active Directory pentesting tool for Linux. Automates AD and LDAP enumeration, Kerberoasting, ASREPRoast, password spraying, ADCS/ESC1, DCSync, RBCD, gMSA, shadow credentials, NTLM relay and credential dumping across 104 techniques, mapping BloodHound-compatible attack paths to Domain Admin. NIS2 / ISO 27001 reports. No Windows needed.

Active Directory pentest methodology for Claude Code: skills, agents and slash commands for internal AD red-team work (Kerberoasting, ADCS ESC1-17, DCSync, ACL abuse, NTLM relay, delegation), with per-technique OPSEC/telemetry notes. Drives netexec, impacket, certipy, bloodyAD, BloodHound CE.

Perform DCSync operation without mimikatz

This script analyzes the DCSync output file from several tools (such as Mimikatz, Secretsdump and SharpKatz...)

All my walkthroughs for HTB Academy labs in the Active Directory Module ( CPTS path ). Includes folder of canvas files for Obsidian.

Cross-platform network execution toolkit (SMB/Kerberos/WMI/LDAP/DCSync) built on TrustedSec's Titanis - NetExec-style workflow in C#

Finds Domain Controller on a network, enumerates users, AS-REP Roasting and hash cracking, bruteforces password, dumps AD users, DRSUAPI, scans SMB/NFS shares for passwords, scans for remote accesses, dumps NTDS.dit.

HTB - Writeups

⚡ From zero to Domain Admin, automatically — Kerberos-first Active Directory pwnage framework (recon → loot → ACL abuse → DCSync) by c4sh3r

Full kill-chain pentest against GOAD — AS-REP roasting, Kerberoasting, constrained-delegation abuse, DCSync and Golden Ticket. Three independent paths to Domain Admin on north.sevenkingdoms.local. 41 findings mapped to MITRE ATT&CK with detection signals and mitigations. Graduation thesis.

This write-up documents my penetration testing methodology and red team approach to compromising the ghostlink machine

Pre2KfromDCSync detects machine accounts with Pre-Windows 2000 passwords and outputs the account name, stored NT hash, and potential password from DCSync output.

Active Directory DCSync Rights Auditor - Defensive security audit tool for identifying accounts with replication rights. Blue Team tool. For authorized security auditing only.

TryHackMe Boogeyman 3 write-up covering SOC investigation, PowerShell activity, credential discovery, lateral movement, hash dumping, DCSync activity, and ransomware execution analysis using Elastic/Kibana logs.

PowerShell script to DCSync NT-Hashes from an Active Directory Domain Controller (DC) using DSInternals

Tests whether DRS flag manipulation evades DCSync detection; spoiler: it doesn't. Results for Server 2016 and 2025.

Active Directory penetration testing: reconocimiento LDAP, Kerberoasting, AS-REP, Pass-the-Hash, DCSync, Golden Ticket. Enfoque 100% ofensivo / Red Team.

Complete Active Directory Red Team Lab — BloodHound, AS-REP Roasting, Kerberoasting, DCSync, Pass-the-Hash, Golden Ticket | Full Penetration Testing Methodology by Abdullah

Blue team detection lab — full AD kill chain (LDAP recon → Kerberoasting → DCSync) detected via Splunk, mapped to MITRE ATT&CK

Hands-on Active Directory Purple Team lab combining offensive techniques, Wazuh detections, Sysmon telemetry, and remediation guidance across 9 MITRE ATT&CK scenarios.