Content Recommendations

Let HTB guide your next move! Discover the expert-curated HTB recommendations and MITRE-mapped recommendations inside any lab with just one click.

New Content Recommendations

HTB Enterprise

Modules
Machines
Sherlocks
Professional Labs

MY PROGRESS 0%

CONTINUE LEARNING
MODULE

Active Directory Enumeration & Attacks

Tier II · Medium · 7 days

CREATORS

mrb3n
TreyCraf7_1
LTNB0B

LAST UPDATED

28 Mar 2025

This module introduces AD enumeration and attack techniques in modern and legacy enterprise environments. We will cover core principles surrounding AD, Enumeration tools such as Bloodhound and Kerbrute, and attack TTPs such as taking advantage of SMB Null sessions, Password spraying, ACL attacks, attacking domain trusts, and more.

In this module, we will cover:

Foundational AD knowledge
AD enumeration principles
External Reconnaissance
Internal enumeration and footprinting
Lateral movement
Enumerating and Exploiting Trusts
Password spraying
LLNNR/NBT-NS Poisoning
Gaining privileged access
Using native tools to perform actions
Kerberoasting
Performing ACL Attacks
AD hardening principles

CREST CPSA/CRT-related Sections:

Introduction to Active Directory Enumeration & Attacks
Tools Of The Trade
Scenario
External Recon and Enumeration Principles
Initial Enumeration of the Domain
LLMNR/NBT-NS Poisoning - from Linux
LLMNR/NBT-NS Poisoning - from Windows
Password Spraying Overview
Enumerating & Retrieving Password Policies
Password Spraying - Making a Target User List
Internal Password Spraying - from Linux
Internal Password Spraying - from Windows
Enumerating Security Controls
Credentialed Enumeration - from Linux
Credentialed Enumeration - from Windows
Living Off the Land

CREST CCT APP-related Sections:

Introduction to Active Directory Enumeration & Attacks
Tools Of The Trade
Scenario
External Recon and Enumeration Principles
Initial Enumeration of the Domain
LLMNR/NBT-NS Poisoning - from Linux
LLMNR/NBT-NS Poisoning - from Windows
Password Spraying Overview
Enumerating & Retrieving Password Policies
Password Spraying - Making a Target User List
Internal Password Spraying - from Linux
Internal Password Spraying - from Windows
Enumerating Security Controls
Credentialed Enumeration - from Linux
Credentialed Enumeration - from Windows
Living Off the Land

CREST CCT INF-related Sections:

All sections

This module is broken down into sections with accompanying hands-on exercises to practice each of the tools, tactics, and techniques we cover. The module includes several guided and non-guided labs to reinforce the techniques covered throughout.

As you work through the module, you will see example commands and command output for the various topics introduced. It is worth reproducing as many examples as possible to reinforce further the concepts presented in each section. You can do this in the Pwnbox provided in the interactive sections or your virtual machine.

You can start and stop the module at any time and pick up where you left off. There is no time limit or "grading," but you must complete all of the exercises and the skills assessments to receive the maximum number of cubes and have this module marked as complete in any paths you have chosen.

The module is classified as "Medium" but assumes a working knowledge of the Windows and Linux command line and an understanding of information security fundamentals.

A firm grasp of the following modules can be considered prerequisites for successful completion of this module:

Introduction To Active Directory
Linux Fundamentals
Windows Fundamentals
Setting Up
Getting Started
File Transfers
Pivoting, Tunneling, and Port Forwarding
MITRE ATT&CK
NIST NICE
NIST NICE Coverage Map
The NIST NICE framework provides a set of building blocks for describing the Tasks, Knowledge, and Skills (TKS) that are needed to perform cybersecurity work by individuals or teams. Through these building blocks, organizations are enabled to develop their workforces to perform cybersecurity work, and it helps learners to explore cybersecurity work and to engage in appropriate learning activities to develop their knowledge and skills.
Skills
Tasks
Knowledge
1
Setting The Stage
2
Initial Enumeration
3
Sniffing out a Foothold
4
Sighting In, Hunting For A User
5
Spray Responsibly
6
Deeper Down the Rabbit Hole
7
Cooking with Fire
8
An ACE in the Hole
9
Stacking The Deck
10
Why So Trusting?
11
Breaking Down Boundaries
12
Defensive Considerations
13
Skill Assessment - Final Showdown
Your Progress
0%
CONTINUE LEARNING
Related content curated based on attack vector similarity
Modules
Machines
Sherlocks
Professional Labs
Zephyr
RED TEAM OPERATOR
MEDIUM
FullHouse
RED TEAM OPERATOR
MEDIUM
ML
Alchemy
RED TEAM OPERATOR
MEDIUM
XEN
RED TEAM OPERATOR
MEDIUM
ML
Hades
RED TEAM OPERATOR
HARD
ML
MITRE ATT&CK Related
Suggested content based on MITRE ATT&CK similarity
Modules
Machines
Sherlocks
Challenges
Professional Labs
Cloud Labs
Kerberos Attacks
Tier III · Hard · 2 days
M
START
Using CrackMapExec
Tier III · Medium · 2 days
M
START
Attacking Common Services
Tier II · Medium · 8 hours
M
START
Attacking Enterprise Networks
Tier II · Medium · 2 days
M
START
Detecting Windows Attacks with Splunk
Tier II · Medium · 5 days
M
START