Tools of the Trade
Here is a listing of many of the tools which can be used during Active Directory engagements:
| Tool | Description |
|---|---|
| PowerView / SharpView | PowerShell/.NET AD enumeration and situational awareness (user, group, ACL, GPO queries). |
| BloodHound | Graphical tool that maps AD relationships and finds attack paths (uses Neo4j). |
| SharpHound | C# collector that harvests AD data for BloodHound (outputs JSON). |
| BloodHound.py | Python (Impacket) BloodHound ingestor for non-domain hosts. |
| Kerbrute | Fast Kerberos account enumeration, password spraying, and brute force. |
| Impacket toolkit | Python tools for SMB, RPC, LDAP, Kerberos interaction and AD attacks. |
| Responder | LLMNR/NBT-NS/mDNS poisoning and credential capture on local networks. |
| Inveigh.ps1 | PowerShell LLMNR/NBT-NS/mDNS poisoner and credential capture. |
| C# Inveigh (InveighZero) | C# version of Inveigh with semi-interactive console for captured creds. |
| rpcinfo | Query RPC services on a remote host (shows program/version/protocol). |
| rpcclient | Samba utility for RPC-based AD enumeration and operations from Linux. |
| CrackMapExec (CME) | Multipurpose post-exploitation tool for SMB/WMI/WinRM/MSSQL enumeration and execution. |
| Rubeus | C# toolset for Kerberos abuse (requesting/renewing/attacking tickets). |
| GetUserSPNs.py | Impacket script to find SPNs for Kerberoasting. |
| Hashcat | High-performance password cracking tool. |
| enum4linux | Linux tool to enumerate Windows/Samba hosts (shares, users, groups). |
| enum4linux-ng | Reworked enum4linux with updated features and outputs. |
| ldapsearch | Standard LDAP query tool for searching directory objects. |
| windapsearch | Python LDAP enumerator for users, groups, and computers. |
| DomainPasswordSpray.ps1 | PowerShell script to perform domain password-spray attacks. |
| LAPSToolkit | PowerShell toolkit to audit/abuse Microsoft’s LAPS deployments. |
| smbmap | Enumerate SMB shares and permissions across hosts. |
| psexec.py | Impacket psexec-style remote command execution. |
| wmiexec.py | Impacket WMI-based remote command execution. |
| Snaffler | Search file shares for secrets and interesting files. |
| smbserver.py | Simple SMB server for file hosting and payload delivery. |
| setspn.exe | Manage Service Principal Names (SPNs) for service accounts. |
| Mimikatz | Extract credentials, perform pass-the-hash and Kerberos ticket operations from memory. |
| secretsdump.py | Dump SAM/LSA secrets remotely (Impacket). |
| evil-winrm | Interactive remote shell over WinRM for Windows hosts. |
| mssqlclient.py | Impacket tool to interact with MSSQL servers. |
| noPac.py | Exploit combo for CVE-2021-42278 / CVE-2021-42287 SID history/impersonation issues. |
| rpcdump.py | RPC endpoint mapper and enumeration (Impacket). |
| CVE-2021-1675.py | Python PoC for PrintNightmare (CVE-2021-1675) proof-of-concept. |
| ntlmrelayx.py | SMB/HTTP relay tool for NTLM relay attacks (Impacket). |
| PetitPotam.py | PoC to coerce Windows hosts to authenticate via EFSRPC (coercion to auth). |
| gettgtpkinit.py | Tool for manipulating certificates and TGTs (advanced Kerberos attacks). |
| getnthash.py | Use an existing TGT to request PACs or perform further Kerberos tricks. |
| adidnsdump | Enumerate and dump AD DNS records (similar to DNS zone transfer). |
| gpp-decrypt | Extract plaintext credentials from Group Policy Preferences files. |
| GetNPUsers.py | Impacket script for ASREPRoast (get AS-REP hashes for offline cracking). |
| lookupsid.py | SID brute-forcing and resolution tool. |
| ticketer.py | Create/customize TGT/TGS tickets (Golden Ticket and related attacks). |
| raiseChild.py | Impacket helper to automate child-to-parent domain escalation. |
| Active Directory Explorer (AD Explorer) | GUI AD viewer/editor; can load and compare offline AD snapshots. |
| PingCastle | AD security auditing tool that scores risk and highlights issues. |
| Group3r | Audits Group Policy Objects for misconfigurations. |
| ADRecon | Extracts AD data and produces Excel summaries for analysis. |