Abusing Constrained Delegation

Abusing constrained delegation exploits the S4U Kerberos extensions to impersonate users to specific services, and in many configurations, to bypass the intended service restrictions entirely. This lesson explains how constrained delegation works, why it can be abused, what the attacker gains, and how to communicate the risk clearly in interviews, reports, and stakeholder conversations.

View pricing Sign in

What you'll learn

S4U2Self
S4U2Proxy
Service name is not cryptographically bound
Resource-Based Constrained Delegation (RBCD)
Protocol transition
Distinction from unconstrained delegation

What premium includes

All 54 lessons: AD techniques, professional skills, each with interview answers and study kits
Complete study kit for every lesson: quizzes, flashcards, and briefs
Every learning track with full structured progression
All 12 attack paths: full compromise walkthroughs for interviews and reports
New lessons and attack paths added regularly

Abusing Constrained Delegation

What you'll learn

What premium includes

Continue with free content