Curated paths
Structured lesson sequences by domain. Each track builds your understanding from fundamentals through advanced techniques so you can explain an entire attack surface, not just name the tools.
Understand how Active Directory works before you try to break it. Covers domain structure, authentication protocols, access controls, policy enforcement, and trust relationships.
Learn to map a domain systematically before exploiting anything. Covers AD structure, BloodHound graphing, group enumeration, password policy recon, and service account discovery.
Master Kerberos from protocol fundamentals to advanced delegation abuse. Covers ticket mechanics, service account attacks, ticket reuse, and both unconstrained and constrained delegation exploitation.
Understand NTLM authentication and every way attackers harvest and reuse credentials. Covers the protocol, password spraying, memory extraction, hash reuse, relay attacks, and lateral movement.
Learn how AD permission and policy controls work — and how they become attack vectors. Covers ACLs, Group Policy, BloodHound pathing, ACL abuse, GPO takeover, shadow credentials, and DCSync.
Build the day-to-day operator habits that keep engagements professional and efficient. Covers note-taking, daily work logging, evidence organization, VM maintenance, SSH key handling, and access preservation.
Learn to communicate security work clearly — in reports, emails, stakeholder briefings, and interviews. Covers the writing and speaking skills that turn technical expertise into professional impact.
Build sustainable habits for skill development. Covers practice lab design with Ludus and Proxmox, and a disciplined approach to staying current on vulnerabilities without information overload.
Understand Active Directory Certificate Services from architecture to first abuse. Covers what AD CS is, how templates and enrollment control certificate issuance, and how a misconfigured template creates a direct path to domain compromise.
Master the advanced AD CS attack paths — from certificate-based authentication through template permission abuse, NTLM relay to web enrollment, and golden certificate forgery. Covers the techniques that turn certificate infrastructure into domain compromise.