Welcome!

whoami

Why This Course

Course Expectations

Target Audience

Course Road Map

Module Introduction

What Is Penetration Testing

Why Penetration Testing

Penetration Testing Limitations

Penetration Testing Logistics

Attack Kill Chain

Module Summary

Module Introduction

Active Directory Simplified

Domain Trust Simplified

Kerberos Authentication Simplified

Module Summary

Active Directory Lab Setup Introduction

Lab Topology Overview

Lab Host Specs

Lab Host Tools Installations

Deploying Lab Virtual Machines

Pentest Engagement Introduction

Network Mapping - NetBIOSSMB Enumerations with NetExec and nbtscan

Network Mapping - Finding LDAP Servers with nmap

Network Mapping - Finding Domain Controllers with nslookup

Network Mapping - Active Network Scanning with nmap

Network Mapping - Taking Screenshots with gowitness

Network Mapping - Target Development

Password Spraying 101

SMB vs Kerberos Password Spray Traffic Analysis with Wireshark

Password Spray Attack with kerbrute

Local Administrator Access Checks

Initial Access Introduction

Dumping AD Users with NetExec, Impacket-GetADUsers and ldapsearch

NBNSLLMR 101

Abusing NBNSLLMR with Responder

Responder Tip

Cracking Responder Hashes with Hashcat

NTLM Relay 101

NTLM Relay Attack with NetExec, Responder and Impacket

AS-REP Roasting 101

AS-REP Roasting Attack with Impacket and Hashcat

Cracking AS-REP Roasting Hash with Hashcat

HOW TO Abusing IPv6 for Domain Enumeration wit mitm6 and Impacket

Module Summary

ANNOUNCEMENT Phonebook.cz Is Now A Paid Service

Username Enumerations via OSINT (Phonebook)

Username Enumerations via OSINT (CrossLinked)

Username Enumerations via OSINT (Default Service Accounts)

LDAP 101

Network Mapping - AD DS Enumerations with Dig

Network Propagation Introduction

PRIVILEGE ESCALATION

Kerberoasting 101

Privilege Escalation via Kerberoast Attack

Kerberos Delegations 101

Unconstrained Delegation Overview

Privilege Escalation via Unconstrained Delegation Attack

Constrained Delegation Overview

Privilege Escalation via Constrained Delegation Attack

Resource-Based Constrained Delegation (RBCD) Overview

Privilege Escalation via Resource-Based Constrained Delegation Attack

SITUATIONAL AWARENESS

Resource-Based Constrained Delegation Attack Clean Up

LATERAL MOVEMENT

Lateral Movement via PS-Remoting

Lateral Movement via Remote Desktop Protocol (RDP)

Lateral Movement via Pass-the-Ccache

DOMAIN DOMINANCE

Golden Ticket 101

Persistence via Golden Ticket Attack

Silver Ticket 101

Persistence via Silver Ticket Attack

Enumerations with NetExec

Diamond Ticket 101

Persistence via Diamond Ticket Attack (High Privileged Account)

Persistence via Diamond Ticket Attack (Low Privileged Account)

Sapphire Ticket 101

Persistence via Sapphire Ticket Attack

Domain Trust 101

Domain Trust Abuse via Golden Ticket Attack (Manual)

Domain Trust Abuse via Golden Ticket Attack (Automated)

Domain Trust Abuse via Trust Key Attack

Foreign Domain Group Membership 101 (I)

Vulnerability Checks with NetExec

Foreign Domain Group Membership 101 (II)

Domain Trust Abuse via Foreign Group Membership Attack

Domain Trust Abuse via Unconstrained Delegation Attack

Credential Hunting I

Credential Hunting II

Credential Hunting III

ACL Enumerations with BloodHound

Abusing ACL via ForceChangePassword Attack

Abusing ACL via GenericWrite Attack

Abusing ACL via WriteDACL Attack

BloodHound 101

Abusing ACL via AddSelf To Group Attack

DCSync Attack

Mapping Forest Trusts

Active Directory Certificate Service 101

AD CS Vulnerability Enumerations with Certipy

ESC1 Certificate Template Vulnerability Analysis 101

Forest Trust Abuse via AD CS ESC1 Attack

ESC2 Certificate Template Vulnerability Analysis 101

Forest Trust Abuse via AD CS ESC2 Attack

ESC4 Certificate Template Vulnerability Analysis 101

BloodHound Setup I

Forest Trust Abuse via AD CS ESC4 Attack

Forest Trust SID Hopping 101

Cross Forest Trust Abuse via Golden Ticket Attack

Cross Forest Trust Abuse via Trust Key Attack

Network Propagation Module Summary

BloodHound Setup II

BloodHound Data Ingestion

Enumerations with BloodHound

Module Introduction

Penetration Test Report Writing

Sample Penetration Test Report Walkthrough

Penetration Test Debriefing

Module Summary