SecurEnvoy Two Factor Authentication - LDAP Injection

Multiple LDAP injections vulnerabilities exist in SecurEnvoy MFA before 9.4.514 due to improper validation of user-supplied input. An unauthenticated remote attacker could exfiltrate data from Active Directory through blind LDAP injection attacks against the DESKTOP service exposed on the...

ADRecon

Download from https://github.com/adrecon/ADRecon ADRecon: Active Directory Recon ADRecon is a tool which extracts and combines various artefacts as highlighted below out of an AD environment. The information can be presented in a specially formatted Microsoft Excel report that includes summary...

LAPSToolkit

LAPSToolkit Functions written in PowerShell that leverage PowerView to audit and attack Active Directory environments that have deployed Microsoft's Local Administrator Password Solution LAPS. It includes finding groups specifically delegated by sysadmins, finding users with "All Extended Rights"...

cleanldap

CleanLdap BOF to perform stealthy LDAP queries over AD WS Arguments Just going to cut to the chase, here are the args and what they mean: Z: DC Hostname "dc01.example.com" Z: LDAP query "objectClass=" Z: Comma separated list of LDAP attributes "samaccountname,distinguishedName,cn" - if empty,...

Adaz

Adaz: Active Directory Hunting Lab in Azure This project allows you to easily spin up Active Directory labs in Azure with domain-joined workstations, Windows Event Forwarding, Kibana, and Sysmon using Terraform/Ansible. It exposes a high-level configuration file for your domain to allow you to...

Tritium

Tritium A tool to enumerate and spray valid Active Directory accounts through Kerberos Pre-Authentication. Background Although many Kerberos password spraying tools currently exist on the market, I found it difficult to find tools with the following built-in functionality: The ability to prevent...

pywhisker

pyWhisker pyWhisker is a Python equivalent of the original Whisker made by Elad Shamir and written in C. This tool allows users to manipulate the msDS-KeyCredentialLink attribute of a target user/computer to obtain full control over that object. It's based on Impacket and on a Python equivalent o...

adfly

adfly active directory query tool using LDAP Protocol , helps red teamer / penetration testers to validate users credentials , retrieve information about AD users , AD groups AD fly is Tool uses LDAP Protocol for users authentication access and queries of information ,since AD fly uses LDAP for...

Masky

Masky Masky is a python library providing an alternative way to remotely dump domain users' credentials thanks to an ADCS. A command line tool has been built on top of this library in order to easily gather PFX, NT hashes and TGT on a larger scope. This tool does not exploit any new vulnerability...

ad-password-protection

Lithnet Password Protection for Active Directory LPP enhances the options available to an organization wanting to ensure that all their Active Directory accounts have strong passwords. LPP is a module that you install on your Active Directory servers that uses a password filter to inspect passwor...

EDD

CodeFactor EDD Enumerate Domain Data is designed to be similar to PowerView but in .NET. PowerView is essentially the ultimate domain enumeration tool, and we wanted a .NET implementation that we worked on ourselves. This tool was largely put together by viewing implementations of different...

bloodyAD

⚠️ autobloody has been moved to its own repo bloodyAD bloodyAD is an Active Directory privilege escalation swiss army knife Description This tool can perform specific LDAP calls to a domain controller in order to perform AD privesc. bloodyAD supports authentication using cleartext passwords,...

autobloody

autobloody autobloody is a tool to automatically exploit Active Directory privilege escalation paths shown by BloodHound. Description This tool automates the AD privesc between two AD objects, the source the one we own and the target the one we want if a privesc path exists in BloodHound database...

Whisker

Whisker Whisker is a C tool for taking over Active Directory user and computer accounts by manipulating their msDS-KeyCredentialLink attribute, effectively adding "Shadow Credentials" to the target account. This tool is based on code from DSInternals by Michael Grafnetter @MGrafnetter. For this...

ADLab

ADLab PowerShell Module Introduction The purpose of this module is to automate the deployment of an Active Directory lab for practicing internal penetration testing. Credits to Joe Helle and his PowerShell for Pentesters course regarding the generation of the attack vectors. Instructions...

rbcd-attack

Abusing Kerberos Resource-Based Constrained Delegation TL;DR This repo is about a practical attack against Kerberos Resource-Based Constrained Delegation in a Windows Active Directory Domain. The difference from other common implementations is that we are launching the attack from outside of the...

KerberosRun

KerberosRun KerberosRun is a little tool I use to study AD security together with my ADCollector. KerberosRun uses the Kerberos.NET library built by Steve Syfuhs. Some code were taken and adapted from Harmj0y's Rubeus project. dev2null is the primary author of this project. My colleague Constanti...

spraykatz

Spraykatz Spray love around the world Index Title| Description ---|--- About| Brief Description about the tool Installation| Installation and Requirements Usage| How to use Spraykatz Changelog| Spraykatz changelog Acknowlegments| Acknowlegments About Spraykatz is a tool without any pretention abl...

adPEAS

adPEAS v2 — Active Directory Privilege Escalation Awesome Scripts Comprehensive Active Directory security assessment — zero dependencies, single file, ready to go. What is adPEAS? adPEAS is a PowerShell-based security assessment tool that identifies misconfigurations, vulnerabilities, and privile...

Invoke-ADEnum

Invoke-ADEnum Active Directory Auditing and Enumeration Invoke-ADEnum is an auditing and enumeration tool designed to automate the collection of information from an Active Directory environment. One of the features of Invoke-ADEnum is its ability to generate an Active Directory Audit Report in HT...