Relaying NTLM to AD CS Web Enrollment

Learn how NTLM relay attacks can target AD CS HTTP enrollment endpoints to obtain certificates for relayed identities, converting intercepted network authentication into long-lived certificate-based access that survives password resets.

View pricing Sign in

What you'll learn

HTTP enrollment endpoint
Authentication coercion
Transient-to-durable conversion
Machine account certificates
Default template availability

What premium includes

All 54 lessons: AD techniques, professional skills, each with interview answers and study kits
Complete study kit for every lesson: quizzes, flashcards, and briefs
Every learning track with full structured progression
All 12 attack paths: full compromise walkthroughs for interviews and reports
New lessons and attack paths added regularly

Continue with free content

Active Directory Structure
Identifying Privilege Paths with BloodHound
Writing Professional Security Reports