
You are a penetration tester with initial access to a Windows domain-joined machine.

Develop a systematic Active Directory enumeration plan covering:

**Phase 1 — Situational Awareness**
- What domain am I in? What is my current user context and group membership?
- Where is the Domain Controller? What OS version is it running?
- What domain trusts exist? Are there forest trusts?

**Phase 2 — User & Group Enumeration**
- Which users are high-value targets: Domain Admins, Enterprise Admins, Service Accounts?
- Are there stale accounts, accounts with "Password Never Expires", or accounts with description fields containing credentials?
- What nested group memberships exist that grant unexpected access?

**Phase 3 — Attack Surface Mapping**
- Which SPNs are registered? (Kerberoastable accounts)
- Which accounts have pre-authentication disabled? (ASREPRoastable)
- Are there any ACL misconfigurations such as WriteDACL, GenericAll, or ForceChangePassword on privileged objects?

Constraints:
- Operate within a legitimate penetration test scope
- Prefer native LOLBins before introducing third-party tooling
- Reason about detection risk — avoid mass LDAP queries that generate noise

Output:
- Ordered enumeration checklist
- Detection risk rating per step (Low / Medium / High)
- Recommended tooling with command examples


Active Directory Enumeration Primer


You have collected BloodHound data from a target Active Directory environment and loaded it into the Neo4j interface.

Guide the analysis to identify the shortest and most reliable path to Domain Admin:

**Step 1 — High-Value Target Identification**
- What built-in queries should you run first to understand the environment?
- How do you identify Tier 0 assets beyond just "Domain Admins"?
- What makes a path "reliable" vs "noisy" from an attacker's perspective?

**Step 2 — Path Analysis**
- How do you interpret ACL edges: WriteDACL, GenericAll, GenericWrite, AddMember, ForceChangePassword?
- What does "transitive object control" mean and why does it matter?
- How do you identify paths through Group Policy Objects (GPOs) and Organizational Units (OUs)?

**Step 3 — Prioritizing Exploitation**
- Given three different paths to DA with different edge counts and edge types, how do you choose?
- How do session data (where admins log in) influence your approach?
- What is the risk profile of each common edge type?

**Step 4 — Custom Cypher Queries**
- Write a Cypher query to find all users with paths to DA in under 3 hops
- Write a query to find computers where Domain Admins have active sessions
- Write a query to find all objects a given user has control over

Output:
- Analysis methodology with reasoning at each step
- 3 example Cypher queries with explanation
- Prioritized attack path recommendation


BloodHound Attack Path Analysis


You are a penetration tester with a valid low-privilege domain account.

Walk through the complete Kerberoasting attack chain from discovery to cracking:

**Step 1 — SPN Discovery**
- How do you enumerate service principal names without triggering LDAP alerts?
- Which account types are most commonly Kerberoastable in real environments?
- How do you differentiate machine accounts from user accounts in SPN results?

**Step 2 — Ticket Request**
- What happens at the Kerberos protocol level when you request a service ticket?
- Why can any authenticated domain user request tickets for any SPN?
- What encryption types make tickets crackable vs uncrackable?

**Step 3 — Offline Cracking**
- What wordlist and rule strategies work best against service account passwords?
- How do you prioritize which hashes to crack first?
- What password patterns are service accounts typically set with in enterprise environments?

**Step 4 — Post-Crack Actions**
- Once you have plaintext credentials, what is your next logical step?
- How do you verify the account's actual access without generating noise?

Constraints:
- Authorized penetration test only
- Document the detection opportunities defenders have at each step

Output:
- Step-by-step attack chain
- Defender detection opportunities per step
- Mitigation recommendations (for reporting)


Kerberoasting Attack Chain


You are performing a penetration test and have discovered accounts or computers with Kerberos delegation configured.

Analyze the delegation types and develop exploitation strategies:

**Unconstrained Delegation**
- Which object types typically have unconstrained delegation in real environments?
- What is the "printer bug" and how does it force a DC to authenticate to a machine with unconstrained delegation?
- What do you capture and how do you use it?

**Constrained Delegation**
- How does S4U2Self and S4U2Proxy work at the protocol level?
- If a service account has constrained delegation to HTTP/webserver.domain.local, what can you do with its credentials?
- Can you pivot from constrained delegation to other services? Under what conditions?

**Resource-Based Constrained Delegation (RBCD)**
- What permissions do you need to configure RBCD on a target object?
- Walk through the full RBCD attack chain from a machine account creation to impersonation
- Why is RBCD considered more dangerous than traditional delegation from an attacker's perspective?

Constraints:
- Authorized penetration test only
- Focus on reasoning and decision logic, not just tool commands

Output:
- Comparison table of the three delegation types (exploitability, requirements, detection)
- Step-by-step chain for RBCD attack
- Key indicators of each attack type for a defender


Active Directory