Learning Tracks

Understand how Active Directory works before you try to break it. Covers domain structure, authentication protocols, access controls, policy enforcement, and trust relationships.

Learn to map a domain systematically before exploiting anything. Covers AD structure, BloodHound graphing, group enumeration, password policy recon, and service account discovery.

Master Kerberos from protocol fundamentals to advanced delegation abuse. Covers ticket mechanics, service account attacks, ticket reuse, and both unconstrained and constrained delegation exploitation.

Understand NTLM authentication and every way attackers harvest and reuse credentials. Covers the protocol, password spraying, memory extraction, hash reuse, relay attacks, and lateral movement.

Learn how AD permission and policy controls work, and how they become attack vectors. Covers ACLs, Group Policy, BloodHound pathing, ACL abuse, GPO takeover, shadow credentials, and DCSync.

Build the day-to-day operator habits that keep engagements professional and efficient. Covers note-taking, daily work logging, evidence organization, VM maintenance, SSH key handling, and access preservation.

Learn to communicate security work clearly: in reports, emails, stakeholder briefings, and interviews. Covers the writing and speaking skills that turn technical expertise into professional impact.

Build sustainable habits for skill development. Covers practice lab design with Ludus and Proxmox, and a disciplined approach to staying current on vulnerabilities without information overload.

Understand Active Directory Certificate Services from architecture to first abuse. Covers what AD CS is, how templates and enrollment control certificate issuance, and how a misconfigured template creates a direct path to domain compromise.

Master the advanced AD CS attack paths: from certificate-based authentication through template permission abuse, NTLM relay to web enrollment, and golden certificate forgery. Covers the techniques that turn certificate infrastructure into domain compromise.

Operate inside a monitored Windows estate without tripping signature-based antivirus. Start with how processes and threads actually work, then live off the land, neutralize in-memory script scanning (AMSI), and run code inside trusted processes.

Turn forced authentication into domain compromise. Understand how NTLM authentication works, coerce it out of privileged hosts, relay it to AD CS, and forge certificates for durable access.

Once you own the domain, keep it. Plant layered persistence: abusable ACL rights, forged tickets, shadow credentials, and golden certificates, that survives password resets and remediation.

Understand how Active Directory represents who a user is and what they are allowed to do. Covers objects and the schema that defines them, security identifiers and principals, how groups scope permissions, and how organizational units apply Group Policy across the environment.

See how a single directory scales into a multi-domain enterprise. Covers domain controllers, LDAP as the query protocol underneath every directory lookup, how domains combine into trees and forests, and the trust relationships that connect them.

Go beyond the basic Kerberos handshake into the mechanics operators actually need to reason about. Covers the full AS and TGS ticket exchange, how delegation lets a service act on a user's behalf, and why the double hop problem breaks delegated authentication across a second connection.

Learn the public key infrastructure that Active Directory Certificate Services builds on, how AD CS issues and manages certificates for the domain, and how those certificates are used to authenticate identities.