RelayKing-Depth

RelayKing v1.10 Dominate the domain. Relay to royalty. RelayKing is a comprehensive relay detection and enumeration tool designed to identify relay attack opportunities in Active Directory environments. Actual reporting options. Comprehensive attack coverage. Find the hidden relay vectors and...

FarsightAD

FarsightAD Table of Contents FarsightAD Table of Contents Description Prerequisite Basic usage AD Hunting cmdlets Demo Fully / partially hidden objects detection Acknowledgements Thanks Author Licence Description FarsightAD is a PowerShell script that aim to help uncovering eventual persistence...

adfsbrute

adfsbrute A script to test credentials against Active Directory Federation Services ADFS, calculating the ADFS url of an organization and allowing password spraying or bruteforce attacks. The main idea is carrying out password spraying attacks with a random and high delay between each test and...

ad-ldap-enum

ad-ldap-enum ad-ldap-enum is a Python script developed to collect users/computers and their group membership from Active Directory. In large Active Directory environments, tools such as NBTEnum were not quick enough. By executing LDAP queries against a domain controller, ad-ldap-enum is able to...

PowerHuntShares

PowerHuntShares v2 PowerHuntShares is PowerShell tool designed to help cybersecurity teams and penetration testers better identify, understand, attack, and remediate SMB shares in the Active Directory environments they protect. Every hacker has a story about abusing SMB shares, but it’s an attack...

GPOZaurr

GPOZaurr Group Policy Eater is a PowerShell module that aims to gather information about Group Policies but also allows fixing issues that you may find in them. GPOZaurr provides 360 degrees of information about Group Policies and their settings. Just a single command Invoke-GPOZaurr provides...

ADBloodHound-AI

ADBloodHound-AI AI-Powered Active Directory Attack Path Analysis Analyse de chemins d'attaque Active Directory avec Intelligence Artificielle English | Francais Architecture +---------------------------+ | BloodHound JSON Export | | users, groups, ACLs | +-------------+-------------+ | v...

BloodHound-Legacy

BloodHound Legacy Edition v4 Has Been Deprecated This repository is for BloodHound Legacy version 4, which was last updated in 2023 and is no longer maintained. It will be archived in the near future. Please Use the New BloodHound Community Edition BloodHound Legacy has been replaced by the free...

Tritium

Tritium A tool to enumerate and spray valid Active Directory accounts through Kerberos Pre-Authentication. Background Although many Kerberos password spraying tools currently exist on the market, I found it difficult to find tools with the following built-in functionality: The ability to prevent...

capsulecorp-pentest

Blog Twitter: Discord: Book: 1. Capsulecorp Pentest The Capsulecorp Pentest is a small virtual network managed by Vagrant and Ansible. It contains five virtual machines, including one Linux attacking system running Xubuntu and 4 Windows 2019 servers configured with various vulnerable services...

Active-Directory-Exploitation-Cheat-Sheet

Active Directory Exploitation Cheat Sheet This cheat sheet contains common enumeration and attack methods for Windows Active Directory. ℹ️ This repository was created by Nikos Katsiopis and Nikos Vourdas. This cheat sheet is inspired by the PayloadAllTheThings repo. Summary Active Directory...

monkey365

Monkey365 is an open-source security assessment framework for Microsoft 365, Azure, and Microsoft Entra ID. It helps security professionals, consultants, administrators, and incident responders identify misconfigurations, review cloud security posture, and evaluate environments against industry...

modifyCertTemplate

Purpose This tool is designed to aid an operator in modifying ADCS certificate templates so that a created vulnerable state can be leveraged for privilege escalation and then reset the template to its previous state afterwards. This is specifically designed for a scenario where WriteProperty righ...

linWinPwn

linWinPwn - Swiss-Army knife for Active Directory Pentesting using Linux Description linWinPwn is a bash script that wraps a number of Active Directory tools for enumeration LDAP, RPC, ADCS, MSSQL, Kerberos, SCCM, vulnerability checks noPac, ZeroLogon, MS17-010, MS14-068, object modifications...

Kestrel

Kestrel BloodHound shows you the path. Kestrel shows you what's already inside. Everyone maps the same thing: the attack path - who can reach Domain Admin. It's the right question, and the tools that answer it are excellent. But a graph of "who can reach whom" is blind to an entire class of...

Snaffler

Snaffler What is it for? Snaffler is a tool for pentesters and red teamers to help find delicious candy needles creds mostly, but it's flexible in a bunch of horrible boring haystacks a massive Windows/AD environment. It might also be useful for other people doing other stuff, but it is explicitl...

GPOddity

GPOddity The GPOddity project, aiming at automating GPO attack vectors through NTLM relaying and more. For more details regarding the attack and a demonstration on how to use the tool, see the associated article available at:...

adwsdomaindump

ADWSDomainDump Active Directory information dumper via ADWS Active Directory Web Services. Install Recommended install: pipx install git+https://github.com/mverschu/adwsdomaindump or pipx install . Usage adwsdomaindump -u 'corp.local\jsmith' -p 'password' -n 10.0.0.1 dc01.corp.local Connecting to...

gssapi-abuse

gssapi-abuse gssapi-abuse was released as part of my DEF CON 31 talk. A full write up on the abuse vector can be found here: A Broken Marriage: Abusing Mixed Vendor Kerberos Stacks The tool has two features. The first is the ability to enumerate non Windows hosts that are joined to Active Directo...

pyGPOAbuse

pyGPOAbuse Filter Additions by D4RKMATT3R DISCLAIMER: This was only tested briefly in a local AD environment I take no responsibility for any unprecedented behavior or malfunctioning, it is provided as-is, for authorized testing only, entirely at your own risk. Now supports filtered targeting of...