Kerberos Delegation Abuse: Unconstrained, Constrained, and RBCD
The three flavours of Kerberos delegation, what each one hands an attacker, and why resource-based delegation is both the safest and the most abusable.
Active Directory
Active Directory Certificate Services: ESC1 Through ESC8 in Practice
Why certificate services are the most reliable escalation path in enterprise AD, and the eight misconfigurations worth checking on every engagement.
NTLM Relay Attacks: Coercion, Poisoning, and Defenses
Why relaying NTLM authentication is still effective in 2022, and what actually stops it.
BloodHound and SharpHound: Mapping Active Directory Attack Paths
How to collect the right AD data once, then query it as a graph instead of guessing your way to Domain Admin.
Kerberoasting: From SPN Enumeration to Offline Cracking
Why requesting service tickets for accounts with SPNs is still one of the most reliable ways to escalate from a domain user to plaintext credentials.