Catalog
Active Directoryintermediate
Active Directory Offensive Security: Zero to Domain Admin
A complete, module-by-module path from AD fundamentals to full domain compromise. Build your own lab, then attack it.
18 modules79 lessons20h
#active-directory#ad-pentesting#kerberos#red-team#bloodhound#windows#ntlm#adcs
What you'll learn
- Explain DNS, LDAP, NTLM and Kerberos authentication flows without relying on tool output
- Enumerate an AD domain from Linux and Windows, and manually validate BloodHound attack-path edges
- Calculate a safe password-spray plan from a domain’s real lockout and observation-window settings
- Execute and defend against AS-REP Roasting and Kerberoasting, including targeted variants
- Map local admin and remote access, choose an appropriate lateral-movement method, and pivot through segmentation
- Interpret dangerous ACL rights and turn a delegated permission into proven, reversible impact
- Reproduce unconstrained, constrained and resource-based Kerberos delegation end to end
- Build an NTLM relay prerequisites matrix and execute a safe relay chain, including coercion
- Assess AD Certificate Services by understanding templates, enrollment and mapping, not by memorizing ESC numbers
- Recognize how GPO, MSSQL, SCCM, Exchange, WSUS and DNS enter real AD attack paths
Who this course is for
Penetration testers and red-teamers who already have basic Windows/Active Directory administration knowledge and want a structured, in-depth path into AD-specific offensive security: real protocol theory and mechanism, not just a command cheat-sheet. Every lab assumes an isolated environment or a written, authorized engagement; nothing in this course should ever be run against a network you don't own or don't have explicit permission to test.
A complete Active Directory offensive-security curriculum, taking you from foundational AD concepts through to full domain compromise. Every lesson explains the underlying Windows and Kerberos mechanism first (often with a diagram) before covering the tools you'd actually reach for and why, a hands-on lab to practice it yourself, and a defender's-eye view of how the same activity gets caught and stopped. The path runs foundations, building your own lab, enumeration, credential attacks, lateral movement, ACLs and delegation, NTLM relay and coercion, AD Certificate Services, trusts, full domain compromise, red-team tradecraft, and professional reporting, in the order a real internal assessment actually unfolds.
Curriculum
Course content
01Foundations & Core Protocols
8 lessons- AD Architecture, Objects & Administration8m
- Core Protocols: DNS, LDAP, SMB/RPC, NTLM & Kerberos
Reviews
No reviews yet.