performing-active-directory-penetration-test

name	performing-active-directory-penetration-test
description	Conduct a focused Active Directory penetration test to enumerate domain objects, discover attack paths with BloodHound, exploit Kerberos weaknesses, escalate privileges via ADCS/DCSync, and demonstrate domain compromise.
domain	cybersecurity
subdomain	penetration-testing
tags	["active-directory","BloodHound","Kerberoasting","Impacket","DCSync","ADCS","domain-compromise","privilege-escalation"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["ID.RA-01","ID.RA-06","GV.OV-02","DE.AE-07"]

Performing Active Directory Penetration Test

Overview

Active Directory (AD) penetration testing targets the central identity and access management system used by over 95% of Fortune 500 companies. The test identifies misconfigurations, weak credentials, dangerous delegation settings, vulnerable certificate templates, and attack paths that enable an attacker to escalate from a standard domain user to Domain Admin or Enterprise Admin.

When to Use

• When conducting security assessments that involve performing active directory penetration test
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Most Often Missed & How to Confirm

• AS-REP roasting and delegation beyond Kerberoasting — accounts with pre-auth disabled (AS-REP), and unconstrained/constrained/RBCD delegation. Unconstrained delegation + coercion (PrinterBug/PetitPotam) yields a DC TGT directly; RBCD via a created computer object is a common, missed path.
• AD CS (ESC1-ESC8) — frequently the fastest route to DA and the most overlooked. Always certipy find -vulnerable; ESC8 pairs with NTLM relay to the CA web-enrollment endpoint.
• ACL/attack-path analysis in BloodHound — GenericAll/GenericWrite/WriteDACL/WriteOwner/ForceChangePassword on users, groups, GPOs, computers. Mark owned principals and follow shortest-path-to-DA instead of guessing.
• Credential leftovers — GPP cpassword in SYSVOL, readable LAPS attributes, DPAPI secrets, and cached creds/sessions on stale machines.
• Lockout-safe spraying and collection noise — read --pass-pol before any spray, and prefer stealthy SharpHound options; a locked-out domain or tripped alert ends testing.
• How to confirm: prove each step with artifacts — cracked TGS/AS-REP hashes, a BloodHound shortest-path screenshot, a certipy cert/TGT minted for a higher-priv user, a successful S4U/RBCD or relay session, or a DCSync dump of krbtgt. Don't conclude the domain is secure on "no Kerberoastable SPNs" alone until AS-REP, delegation, AD CS, GPP, LAPS, and ACL paths are all checked; validate domain compromise with a controlled DCSync rather than assuming the chain holds.

Prerequisites

• Standard domain user credentials (minimum starting point)
• Network access to domain controllers (LDAP/389, Kerberos/88, SMB/445, DNS/53)
• Tools: BloodHound, Impacket, Certipy, Rubeus, NetExec, Mimikatz
• Kali Linux or Windows attack machine with domain access