Active Directory:
Enumeration
AD object, ACL, and attack path enumeration using BloodHound and more
ACL Enumeration
Techniques for enumerating Access Control Lists in Active Directory to identify misconfigured permissions and potential privilege escalation paths.
Object Enumeration
Enumerates AD objects including users, groups, OUs, and GPOs to map domain structure and identify privilege escalation paths.
GPO Enumeration
Techniques for enumerating Group Policy Objects in Active Directory to identify misconfigurations, privileged settings, and potential attack paths.
BloodHound and SharpHound Collection
Covers deploying SharpHound to collect AD relationship data and ingesting results into BloodHound to visualise attack paths and privilege escalation routes.
BloodHound Edge Reference
Maps AD attack paths via BloodHound edges, detailing exploitation techniques, required privileges, and lateral movement vectors for offensive AD enumeration.
AD enumeration maps the domain structure you need before picking an attack path. BloodHound collection, LDAP queries, and native RPC calls reveal users, groups, trusts, ACLs, and service accounts.
Unauthenticated enumeration through null sessions and anonymous LDAP binds is increasingly rare, but still worth checking. With any domain credential, BloodHound and PowerView expose group nesting, delegation settings, GPO links, and ACL chains that manual querying would miss.
Trust enumeration identifies cross-domain and cross-forest relationships that expand your attack surface. ACL mapping shows who can modify what, often the shortest path to escalation.