section // posts
/posts

Posts

Penetration testing notes, methodology, and technical write-ups. CVE analyses are published under Research.

27 posts3 series
Filter27 posts
Domain:
Tracks:
SERIES 01 // OFFENSIVE WALKTHROUGH4/4 parts · Complete seriesGOAD v2 · 2 Forests · 3 Domains · 5 Windows Hosts

Assessing Active Directory (GOAD Pentest Series)

Step-by-step penetration testing walkthrough of the five-server GOAD lab, moving from zero credentials to full Domain Controller compromise.

  1. A stormbound fortress beneath a direwolf banner, standing in for the GOAD lab and its zero-credentials reconnaissance phase.
    Pentest//17 min read

    GOAD Part 1: From Zero Credentials to the Attack Graph

    Walking through the GOAD Active Directory lab from a single Kali host: zero-knowledge host discovery, SMB signing checks, forest and trust mapping, unauthenticated user enumeration, AS-REP Roasting, SMB/SYSVOL secret hunting, and BloodHound graph analysis.

    #active-directory#methodology#pentest
    Read Write-up
  2. A moonlit wolf throne hall, representing the NORTH domain and the path from a foothold to its Domain Controller.
    Pentest//14 min read

    GOAD Part 2: Owning the NORTH Domain Controller

    Moving from a low-privileged user account to Domain Admin on DC02 in north.sevenkingdoms.local: Kerberoasting a service account, abusing constrained delegation with S4U2Self and S4U2Proxy, and injecting a SYSTEM scheduled task through a writable GPO.

    #active-directory#pentest#privilege-escalation
    Read Write-up
  3. A misty fortress path at dusk, standing in for the eight-hop ACL chain through the sevenkingdoms forest.
    Pentest//18 min read

    GOAD Part 3: Walking the ACL Chain to the Forest Root

    Eight misconfigured ACLs stand between a single recovered password and Domain Admin on the sevenkingdoms.local forest root. Each edge is a different right and forces a different technique. This is every hop, every tool, and the two places it tried to fail.

    #active-directory#pentest#privilege-escalation
    Read Write-up
  4. A stormy harbor map at dusk, representing the cross-forest trust and the ACL chain into essos.local.
    Pentest//18 min read

    GOAD Part 4: Owning essos.local Across the Forest Trust

    The forest trust into essos.local enforces SID filtering, so a forged ExtraSids ticket will not carry Domain Admin across the boundary. What does cross is foreign group nesting, a three-hop ACL chain, LAPS, and an AD CS CA full of ESC templates.

    #active-directory#pentest#privilege-escalation
    Read Write-up
SERIES 02 // CERTIFICATE ATTACKS4/4 parts · Complete seriesAD CS · ESC Primitives · PKINIT · Domain Escalation

Active Directory Certificate Services (AD CS)

Deep dive into AD CS misconfigurations, ESC abuse primitives, certificate enrollment, and domain escalation paths.

  1. A fenced facility with a satellite dish and antenna towers in a misty forest under a full moon, a weathered certificate plaque in the foreground.
    Pentest//13 min read

    AD CS Part 1: Architecture, Template Semantics, and the ESC Taxonomy

    Deconstructing the Active Directory Certificate Services attack surface: template attributes, PKINIT credential exchange, EKU semantics, identity mapping, and the ESC taxonomy mapped by root cause.

    #active-directory#identity-security#authentication
    Read Write-up
  2. A dimly lit secure server room corridor lined with server racks, standing in for the ESC1 path from a single certificate request to Domain Admin.
    Pentest//8 min read

    AD CS Part 2: ESC1 Exploitation: RPC Targeting, PKINIT Authentication, and Forest Compromise

    Weaponizing the ESC1 certificate template on ESSOS-CA: MS-WCCE RPC endpoint resolution, PKINIT Kerberos TGT issuance via weak UPN mapping, and full forest takeover using DRSUAPI DCSync.

    #active-directory#identity-security#authentication
    Read Write-up
  3. A rain-soaked workspace holding a brass key and a wax seal, evoking the template tampering and arbitrary certificate issuance of ESC4 and ESC6.
    Pentest//5 min read

    AD CS Part 3: ESC4 and ESC6 — Creating the Vulnerability Yourself

    Part 2 exploited ESC1, a template that was already vulnerable. This part creates the vulnerability: ESC4 edits a template you have GenericAll over into an ESC1, and ESC6 abuses the CA-wide User Specified SAN flag to stuff a Subject Alternative Name into any Client Authentication template.

    #active-directory#identity-security#authentication
    Read Write-up
  4. A server room where secrets stay sealed, representing the remaining ESC techniques and the four hardening questions that lock the catalog down.
    Pentest//5 min read

    AD CS Part 4: The Rest of the Catalog and How to Lock It Down

    Closing the AD CS series: ESC2's any-purpose EKU, ESC3's enrollment-agent escalation, the identity-mapping weaknesses of ESC9, and the relay-based ESC8/ESC11 — then the four-question hardening checklist that ties the whole taxonomy back together.

    #active-directory#identity-security#authentication
    Read Write-up
SERIES 03 // ARCHITECTURE & PROTOCOLS3/3 parts · Complete seriesMulti-Forest Partitions · Trust TDOs · Delegation · Object ACLs

Active Directory Architecture & Internals

Companion engineering notes examining how multi-forest partitions, trusts, DNS forwarding, Kerberos delegation, and object ACLs work under the hood.

  1. A lit building complex nestled in misty pine forest and hills at dusk, with a radio tower on the ridge behind it.
    Architecture//16 min read

    Multi-Forest Active Directory Architecture: How Forests, Trusts, DNS, and Tiered Services Actually Work

    Looking at the five-server GOAD environment from the systems side before running an exploit: why organizations split forests and child domains, how directory partitions replicate, how DNS forwarders and Trusted Domain Objects route cross-forest authentication, and where normal Windows features turn into attack paths.

    #active-directory#identity-security#authentication
    Read Write-up
  2. Wet railroad tracks converging at a switch at night, red signal lights reflected on the rails.
    Architecture//12 min read

    Inside Kerberos Delegation: Why Multi-Tier Windows Apps Need It (and Why It Breaks)

    Walking through the Kerberos double-hop problem and the three generations of delegation in Windows: how Unconstrained, Constrained (S4U2Self / S4U2Proxy), and Resource-Based Constrained Delegation (RBCD) look in LDAP across the GOAD lab.

    #active-directory#authentication#identity-security
    Read Write-up
  3. The glass corner of a modern office tower at dusk, lit floors visible through the glass against a stormy sky.
    Architecture//13 min read

    Active Directory as a Directed Graph: How Security Descriptors and Object ACLs Actually Work

    Active Directory stores every user, group, computer, and GPO as an LDAP object with a binary nTSecurityDescriptor. Walking the eight-hop escalation chain in GOAD's sevenkingdoms.local domain shows how ACE masks, Extended Rights GUIDs, and ownership changes turn helpdesk permissions into Domain Controller compromise.

    #active-directory#access-control#identity-security
    Read Write-up
STANDALONE REPORTS & PRIMITIVES16 posts

Standalone Write-ups & Primitives

Technical write-ups covering container boundaries, binary exploitation, and domain attack primitives.

  1. Moody cybersecurity tech still life with mobile test device and diagnostic hardware for iOS application security auditing.
    Pentest//8 min read

    iOS Application Security in Practice: Auditing 30 OWASP MASVS Vulnerabilities with Frida and LLDB

    Hands-on iOS penetration testing and secure coding: auditing Keychain misuse, bypassing client-side biometric checks with Frida, defeating SSL pinning, and mapping 30 real-world vulnerabilities to OWASP MASVS v2.

    #ios-security#mobile-security#pentest
    Read Write-up
  2. Rain-soaked tactical communications gear and field antenna representing resilient out-of-band C2 transport pipelines.
    Red Team//8 min read

    Resilient Out-of-Band C2 Pipelines: Framing, AEAD Encryption, and Covert Channels in Go

    Designing fault-tolerant, out-of-band command-and-control pipelines for authorized security testing: forward error correction via XOR parity, P-256 ECDHE session encryption, and 9 covert transport protocols in ghostlink.

    #red-team#exploit-development#attack-paths
    Read Write-up
  3. Cybernetic network hardware board illuminated in red light representing eBPF and XDP kernel-level packet inspection.
    Red Team//8 min read

    Kernel-Level Packet Sniffing with eBPF/XDP: Real-Time Credential Extraction and Exposure Auditing

    How eBPF and XDP bypass userspace packet-capture bottlenecks to intercept authentication handshakes, NetNTLMv2 hashes, and cleartext credentials at line rate: architecture, protocol dissectors, and exposure auditing with driftnet2.

    #linux-security#red-team#detection
    Read Write-up
  4. Cinematic cybersecurity lab workspace with workstation displays auditing macOS security controls and baseline drift.
    macOS Security//9 min read

    macOS Hardening in Practice: Auditing 54 Controls, Detecting Drift, and Remediating Without Dependencies

    A deep dive into macOS endpoint security architecture: auditing SIP, Gatekeeper, TCC, LaunchDaemons, BPF packet filters, and plaintext secret leakage using native Zsh primitives, zero third-party dependencies, and OASIS SARIF v2.1.0.

    #macos-security#apple-security#methodology
    Read Write-up
  5. Architectural blueprint showing indirect prompt injection traversing an LLM reasoning core to trigger unauthorized operating system tool execution via MCP.
    AI Security//14 min read

    Breaking AI Agent Boundaries: From Prompt Injection to Remote Code Execution via Model Context Protocol (MCP)

    How untrusted context in modern AI pipelines forces autonomous agents to execute arbitrary operating system commands through Model Context Protocol (MCP) server tools: indirect injection, ambient authority, and deterministic execution brokers.

    #ai-security#exploit-development#attack-paths
    Read Write-up
  6. A small sealed freight container inside a larger open container, with a control cable from the inner container connected directly to the outer door's locking mechanism.
    Cloud Security//6 min read

    Container Escape: Docker Socket, Privileged Mode, and the Boundary That Moves

    A container is a namespace, a cgroup, and a set of capabilities — not a boundary. When one of those is handed to you, the host is a mount away. The Docker socket and --privileged are demonstrated live, and the cgroup v1 trick that modern systems already killed is called out.

    #container-security#linux-security#cloud-security
    Read Write-up
  7. A row of steel blocks overrunning a boundary and forcing a red mechanical switch onto a second track that leads to a lit lock.
    Exploit Development//6 min read

    Stack Buffer Overflow: From Segfault to RIP Control (Ret2win)

    The non-AD half of the journey: a 64-byte stack buffer, an unbounded read, and the exact steps that turn a segfault into control of the instruction pointer. Compiled live in a Linux container, with the one gotcha — the return address is not where the naive math says it is.

    #exploit-development#linux-security#pentest
    Read Write-up
  8. Two separate access routes—a service module and an archival vault key—converging on the same locked server-room door.
    Pentest//6 min read

    DNSAdmins and Backup Operators: Privileged Group Abuse to SYSTEM on the DC

    The last two GOAD techniques are not exploits but groups: DNSAdmins loads a DLL into the DNS service, Backup Operators reads what the OS would rather hide. One is demonstrated end to end, one is documented honestly with the remote-registry wrinkle, and the relay gap that neither covers is called out.

    #active-directory#pentest#privilege-escalation
    Read Write-up
  9. One master key linked mechanically to six different lock cylinders while several ordinary account keys remain inserted.
    Pentest//7 min read

    Skeleton Key: A Master Password for Every Account in the Domain

    After Domain Admin, the game changes from getting in to staying in. The Skeleton Key patches the Domain Controller's KDC in memory so the single password 'mimikatz' unlocks every account — demonstrated live against KINGSLANDING, alongside the memory SSP and why DSRM does not apply in this lab.

    #active-directory#pentest#red-team
    Read Write-up
  10. An open bank-vault door leading into a dark archive room, with a metal case labeled NTDS.dit and SYSTEM in the foreground.
    Pentest//4 min read

    Offline Domain Dump: Shadow Copies and NTDS.dit

    DCSync is the online way to pull hashes — but it needs replication rights. The offline way asks for nothing from the DC: take a shadow copy of C:, copy the NTDS.dit database and SYSTEM hive out, and dump every credential on your own machine with no Domain Controller cooperation.

    #active-directory#pentest#privilege-escalation
    Read Write-up
  11. A gold access badge and a silver access badge, both embossed with a three-headed-wolf crest and a smart-card chip, on a counter in a server-room corridor.
    Pentest//5 min read

    Forging Kerberos Tickets: Golden and Silver Tickets in GOAD

    DCSync handed us the krbtgt hashes and service-account hashes. This is what they are actually for: forging a Golden Ticket for the whole forest, and a Silver Ticket for one SPN — logging in as Administrator without a password, and why the two differ.

    #active-directory#pentest#authentication
    Read Write-up
  12. A three-headed wolf sigil stamped in red wax on an aged parchment beside a knight's helmet, a wax seal stamp, old books and a lit candle.
    Pentest//8 min read

    Cross-Forest Pivoting via SQL Server Linked Servers: Bypassing Kerberos Trust Boundaries

    Deconstructing SQL Server linked-server lateral movement in GOAD: from a cracked service account (jon.snow) to xp_cmdshell execution as north\sql_svc, pivoting through sa-mapped linked servers into essos\sql_svc without Kerberos trust authentication.

    #active-directory#pentest#attack-paths
    Read Write-up
  13. Rain streaks down a glass office facade, reflecting a lit office interior and a cloudy sky.
    Pentest//5 min read

    Pass-the-Hash and Overpass-the-Hash: Moving with Hashes, Not Passwords

    DCSync left us holding NTLM hashes but no passwords. Pass-the-hash feeds the raw hash straight into NTLM; overpass-the-hash turns that same hash into a Kerberos TGT. Both log in as Administrator without ever cracking anything — and they answer two different problems.

    #active-directory#pentest#authentication
    Read Write-up
  14. A dart stuck dead-center in a dartboard's bullseye, photographed in a dim industrial setting.
    Pentest//4 min read

    Force-Set SPN: Targeted Kerberoasting with GenericWrite

    Kerberoasting normally waits for a service account to already have an SPN. With GenericWrite over a user you can add the SPN yourself and Kerberoast them on demand — turning any weak-password user you can write to into a crackable target.

    #active-directory#pentest#privilege-escalation
    Read Write-up
  15. A row of weathered metal mailboxes with blank nameplates, one door left ajar, in a dim corridor.
    Pentest//4 min read

    Password Spraying: One Password, Every Account

    The lockout-aware credential attack: one common password tried across every account in the domain, respecting the lockout threshold so nothing trips. GOAD's north domain shows the whole dance — from reading the password policy to the one account that reused Winter2022.

    #active-directory#pentest#authentication
    Read Write-up
  16. A storm-lit strategy room with a map of two territories, three connected strongholds, and six tower pieces representing the GOAD lab's forests, domains, and virtual machines.
    Architecture//8 min read

    Building the GOAD Lab: A Two-Forest Active Directory on a Laptop

    The foundation post for the whole series: how a two-forest, three-domain Active Directory lab is provisioned from bare metal on a ThinkPad, what Vagrant and Ansible actually do, the VMware quirks that had to be patched, and how the lab is started, snapshotted, and reached from Kali.

    #active-directory#methodology#pentest
    Read Write-up
Newsletter

Substack

Longer research pieces are also published on Substack.

SubscribeRSS