OSCP Notes and Custom Dashboard

OSCP Field Notebook Tags: ligolo hashcat Port-indexed pentest methodology notebook: decision trees, copy-paste command patterns, and lessons from authorized practice boxes HTB / PG / personal labs. Merged from the older finalnotes-vault into this single tree. A workflow you can run under time...

NoiseHound

NoiseHound Detection-aware Active Directory attack-path scoring. DreadHost Research | companion to OffsetInspect PowerShell and OffsetScan Rust BloodHound and PlumHound on top of it finds a path to the objective. NoiseHound ingests the same graph data and re-ranks paths by expected detection cost...

Kestrel

Kestrel BloodHound shows you the path. Kestrel shows you what's already inside. Everyone maps the same thing: the attack path - who can reach Domain Admin. It's the right question, and the tools that answer it are excellent. But a graph of "who can reach whom" is blind to an entire class of...

EUVD-2026-76915

SEP sesam before 5.2.0.24 mishandles User Authorization with MFA. If AD authentication is configured and MFA is enforced, an attacker can create a second OTP access capability. SEP sesam and Active Directory handle username capitalization differently, which may allow multiple SEP sesam user...

printnightmare-detection-mitigation-lab

PrintNightmare Detection and Mitigation Lab A sanitised academic case study demonstrating how a Windows domain lab was designed, monitored and hardened while investigating CVE-2021-34527 PrintNightmare in a controlled virtual environment. Safety note: This repository focuses on systems...

CVE-2021-3262

CVE-2021-3262 TripSpark VEO Transportation / NovusEDU 中的 SQL 注入 随 TripSpark VEO Transportation 一起提供的公开“学生班车信息”查询页面接收未经验证的 POST 正文输入，并将其直接拼接进 SQL Server 查询，既未使用参数化查询，也未进行服务端校验。editOEN 参数（学号字段）可被注入。 该注入为盲注：应用程序不会返回数据库错误，也没有值得读取的差异内容。但它仍然可以通过带外方式完全利用，因为数据库连接可以访问 master.dbo.xpdirtree，这会强制 SQL Server...

CVE-2026-79300

SEP sesam before 5.2.0.24 mishandles User Authorization with MFA. If AD authentication is configured and MFA is enforced, an attacker can create a second OTP access capability. SEP sesam and Active Directory handle username capitalization differently, which may allow multiple SEP sesam user...

CVE-2026-79300

SEP sesam before 5.2.0.24 mishandles User Authorization with MFA. If AD authentication is configured and MFA is enforced, an attacker can create a second OTP access capability. SEP sesam and Active Directory handle username capitalization differently, which may allow multiple SEP sesam user...

Detailed-Analysis-and-Mitigation-Strategies-for-CVE-2024-38124-and-CVE-2024-43468

CVE-2024-38124 和 CVE-2024-43468 的详细分析与缓解策略 CVE-2024-38124 和 CVE-2024-43468 的详细分析与脚本缓解策略 CVE-2024-38124：Windows Netlogon 技术利用背景： 在实际场景中，拥有网络访问权限的攻击者可以通过向域控制器发送特制的 Netlogon 消息来利用 CVE-2024-38124。这使他们能够冒充网络上的任何计算机，包括域控制器本身。攻击者可以提升权限，从而可能完全控制 Active Directory AD 环境，进而未经授权访问敏感信息或在整个网络部署恶意软件。 攻击路径示例： 1...

gpp-encrypt

gpp-encrypt Description This little script encrypts password to gpp cpassword. It useful to create vulnerable lab AD. Requirements This package require: python3 python3 Standard Library Installation root@kitploit: git clone "https://github.com/mauricelambert/gpp-encrypt.git" cd "gpp-encrypt"...

CVE-2026-54121-Certighost

🛡 AI Security Tool Module CVE-2026-54121: Active Directory Certificate Services Impersonation Certighost Official Security Audit Module for AI Security Tool Ecosystem 🌐 Web Demo • 📚 Project Website • 💬 Community Chat Website Navigation: Home • Updates • Downloads • Modules 🧠 Conceptual Overview...

caOptics

Note Project archived due to shifting development priorities and refocusing my community efforts to other areas PoCs, other tools and demos/presentation, project is set to read-only. CA Optics - Azure AD Conditional Access Gap Analyzer What is Conditional Access? Notes for early testers Release...

BOF_Collection

BOFCollection Various Cobalt Strike BOFs Requirements beacon.h For compilation instructions and BOF overview help-bof ActiveDirectory GetDomainInfo.c Returns information on the current domain and domain controller. inline-execute GetDomainInfo.o Collection GetClipboard.c Prints any text on the...

impersonate

Impersonate 描述 该仓库包含在撰写以下博客文章时开发的工具：https://sensepost.com/blog/2022/abusing-windows-tokens-to-compromise-active-directory-without-touching-lsass/ 。该博客文章包含理解令牌操作内部机制以及如何利用其为我们所用所需的所有必要信息。 内容 该仓库包含四个工具： 一个独立二进制文件（Impersonate/），可用于远程（PsExec/WmiExec）或交互式地操控 Windows 计算机上的令牌 带有嵌入式 Impersonate 二进制文件的...

PT-2026-90723

SEP sesam before 5.2.0.24 mishandles User Authorization with MFA. If AD authentication is configured and MFA is enforced, an attacker can create a second OTP access capability. SEP sesam and Active Directory handle username capitalization differently, which may allow multiple SEP sesam user...

CVE-2025-33073

Obscura$ DNS Relay Injector + NTLM Coercion Tool A stealthy proof-of-concept that chains DNS injection, NTLM relay, and RPC-based coercion to test authentication relay paths in Windows Active Directory environments. ⚠️ DISCLAIMER: For authorized security testing and educational use only. ❌...

ntdsdotsqlite

NTDS.Sqlite This software can be used either directly as a CLI utility or as a library to get an SQLite database from an NTDS.DIT one. Encrypted bits can be decrypted if the associated system hive is provided altogether. Installation python -m pip install ntdsdotsqlite Usage ntdsdotsqlite NTDS.DI...

CVE-2026-41089-Netlogon

🛡️ AI Security Tool Module CVE-2026-41089: Netlogon Stack Buffer Overflow Официальный модуль проверки безопасности для AI Security Tool Ecosystem 🌐 Демо-версия • 📚 Сайт проекта • 💬 Чат сообщества Навигация по сайту: Главная • Обновления • Загрузки • Модули 🧠 Conceptual Overview Я публикую подробны...

Active-Directory-trust-attacks

This repository does not have a README...

ResetNightmare-impacket

ResetNightmare — CVE-2026-27912 Linux / impacket tooling for CVE-2026-27912 "ResetNightmare". Resets a target Active Directory account's password by requesting a kadmin/changepw TGT for an NTENTERPRISE principal whose name is the target's sAMAccountName, using an account UPNUser on which we can...