Reconnaissance

AD Domain and DC Discovery

Techniques for enumerating AD domains and locating Domain Controllers using DNS, LDAP, and native Windows tools during initial reconnaissance.

Jun 9, 2026 • 4 min read

Unauthenticated User Enumeration

Identifies valid AD usernames without credentials using Kerberos pre-auth errors, LDAP null binds, and SMB probing to map attack surface.

Jun 9, 2026 • 3 min read