Tips & Tricks
Short, practical notes from the field: tooling, tradecraft, and shortcuts.
Active Directory
16
Windows and Active Directory tradecraft.
AI & LLM Security
19
Auth & Tokens
12
Cloud & Containers
13
Cloud and identity tips.
Exploitation
2
Turning bugs into working access.
Linux & Privesc
8
Linux tips and privilege escalation.
Recon & OSINT
11
Finding attack surface and mapping targets.
Red Team & Evasion
9
Source Code Review
31
Web & API
22
Web application testing tips.
Windows Post-Exploitation
8
All tips
- Map ACL attack paths with BloodHound before touching anything Collect once, then let the graph show the shortest ACL path from your foothold to Domain Admin.
- DNSAdmins to Domain Controller via server-level DLL Membership in DNSAdmins can load an arbitrary DLL into the DNS service, which runs as SYSTEM on the DC.
- Abuse writable GPOs for code execution on an OU Write access to a GPO linked to an OU means an immediate or scheduled task on every computer in that OU.
- Read LAPS passwords with extended rights Delegated read of the LAPS attribute lets you pull local admin passwords for every managed machine you can see.
- sAMAccountName spoofing (noPac) to impersonate a DC Renaming a machine account to match a DC and requesting a ticket after reset yields a service ticket as domain admin.
- DCSync with replication rights Any principal granted DS-Replication-Get-Changes rights can pull every hash in the domain, including krbtgt.
- Abuse unconstrained delegation with a coerced DC A host with unconstrained delegation caches TGTs of everyone who authenticates; coerce a DC to it and steal the DC TGT.
- ESC8: coerce a DC and relay to AD CS web enrollment HTTP certificate enrollment plus machine coercion turns any domain foothold into a DC certificate and DCSync.
- ESC1 certificate template abuse for domain admin A template that allows enrollee-supplied subject and has a client-auth EKU lets a low-priv user request a cert as any account.
- AS-REP roast accounts without preauth Accounts with Kerberos preauth disabled hand out an offline-crackable blob to any unauthenticated requester.