ad-discovery

To enumerate Active Directory domains and map the attack surface, this Skill identifies domain controllers, users, groups, and computer accounts while detecting misconfigurations like vulnerable ADCS templates and Kerberoastable accounts.

Finding Kerberoastable accounts in an Active Directory environment is achieved by enumerating user accounts and detecting delegation issues, which highlights potential pathways for lateral movement and privilege escalation.

BloodHound maps attack paths for Active Directory penetration testing by visualizing relationships within the environment, allowing testers to identify potential routes to privileged accounts and domain administrator privileges.

Yes, you can detect vulnerable ADCS templates during AD enumeration. The process identifies misconfigurations in Active Directory Certificate Services to expose potential attack vectors.

Identifying SMB signing issues and unconstrained delegation is performed using tools like NetExec and Certipy to provide a comprehensive view of misconfigurations within the Active Directory environment.

Active Directory enumeration to identify computer accounts and map the attack surface requires access to the target environment to gather information on domain controllers and detect misconfigurations.