# Vulnerability Discovery

> Find ADCS flaws, password policies, and NTLM relay targets in AD

- **URL:** https://hackindex.io/platforms/active-directory/vulnerability-discovery
- **Platform:** [Active Directory](https://hackindex.io/platforms/active-directory.md)
- **Published:** 2026-04-30
- **Updated:** 2026-08-11

AD vulnerability discovery confirms specific weaknesses before exploitation. This phase proves that a misconfiguration or design flaw is exploitable, without actually using it for access.

Misconfigured ACLs on critical objects like AdminSDHolder, domain root, and group policy containers indicate paths to privilege escalation. Weak delegation settings, including unconstrained delegation on servers and constrained delegation with protocol transition, are common high-impact findings. ADCS misconfigurations such as vulnerable certificate templates, misconfigured enrollment agents, and overly permissive access to CA endpoints are frequently overlooked.

Dangerous trust configurations, including SID filtering disabled across forest trusts, expand the blast radius of any domain compromise.

## Guides

- [Delegation Misconfiguration Discovery](https://hackindex.io/platforms/active-directory/vulnerability-discovery/ad-delegation-misconfiguration-discovery.md): Identifies Kerberos delegation misconfigurations in Active Directory, including unconstrained, constrained, and resource-based delegation vulnerabilities enabling privilege escalation.
- [Password Policy and Spray Surface](https://hackindex.io/platforms/active-directory/vulnerability-discovery/ad-password-policy-and-spray-surface.md): Enumerate AD password policies to identify weak settings and assess exposure to password spraying attacks across domain accounts.
- [ADCS Misconfiguration Discovery](https://hackindex.io/platforms/active-directory/vulnerability-discovery/adcs-misconfiguration-discovery.md): Techniques for identifying misconfigured Active Directory Certificate Services, including vulnerable certificate templates, enrollment permissions, and ESC attack paths.
- [NTLM Relay Conditions](https://hackindex.io/platforms/active-directory/vulnerability-discovery/ntlm-relay-conditions.md): Covers conditions enabling NTLM relay attacks in AD environments, including signing requirements, EPA configurations, and protocol-level mitigations to assess.