Shadow Credentials

Shadow Credentials exploits write access to an AD object's msDS-KeyCredentialLink attribute to register an attacker-controlled public key, enabling the attacker to authenticate as that object using Kerberos PKINIT without knowing the account's password. This lesson explains why the technique works, what preconditions matter, what the attacker gains, and how to communicate the risk clearly in interviews, reports, and stakeholder conversations.

View pricing Sign in

What you'll learn

msDS-KeyCredentialLink
PKINIT
No password change
Persistence
Computer accounts as targets
Stealthier than password reset

What premium includes

All 54 lessons: AD techniques, professional skills, each with interview answers and study kits
Complete study kit for every lesson: quizzes, flashcards, and briefs
Every learning track with full structured progression
All 12 attack paths: full compromise walkthroughs for interviews and reports
New lessons and attack paths added regularly

Shadow Credentials

What you'll learn

What premium includes

Continue with free content