Active Directory:

Vulnerability Discovery

Find ADCS flaws, password policies, and NTLM relay targets in AD

4 guides • Created Apr 5, 2026 • Updated Aug 11, 2026

4 guides

Delegation Misconfiguration Discovery

Identifies Kerberos delegation misconfigurations in Active Directory, including unconstrained, constrained, and resource-based delegation vulnerabilities enabling privilege escalation.

Jun 11, 2026 • 3 min read

Password Policy and Spray Surface

Enumerate AD password policies to identify weak settings and assess exposure to password spraying attacks across domain accounts.

Apr 30, 2026 • 3 min read

ADCS Misconfiguration Discovery

Techniques for identifying misconfigured Active Directory Certificate Services, including vulnerable certificate templates, enrollment permissions, and ESC attack paths.

Apr 30, 2026 • 7 min read

NTLM Relay Conditions

Covers conditions enabling NTLM relay attacks in AD environments, including signing requirements, EPA configurations, and protocol-level mitigations to assess.

Apr 30, 2026 • 3 min read

AD vulnerability discovery confirms specific weaknesses before exploitation. This phase proves that a misconfiguration or design flaw is exploitable, without actually using it for access.

Misconfigured ACLs on critical objects like AdminSDHolder, domain root, and group policy containers indicate paths to privilege escalation. Weak delegation settings, including unconstrained delegation on servers and constrained delegation with protocol transition, are common high-impact findings. ADCS misconfigurations such as vulnerable certificate templates, misconfigured enrollment agents, and overly permissive access to CA endpoints are frequently overlooked.

Dangerous trust configurations, including SID filtering disabled across forest trusts, expand the blast radius of any domain compromise.