Results for “shadow-credentials”

Traces identity flows, Windows host artifacts, enterprise messaging, and lateral-movement chains in CTF sandbox challenges.

Executes authorized attack simulations against Active Directory environments to identify misconfigurations, weak credentials, dangerous privilege paths, and exploitable trust relationships that could lead to domain compromise.

Traces host-to-host pivot chains in Windows CTF challenges by recovering Kerberos tickets, credential material, and privilege edges across WinRM, SMB, and RDP.

Enumerate SMB, WinRM, LDAP, and MSSQL services, validate credentials, spray passwords, and execute commands on remote hosts using NetExec during authorized penetration tests.

Map Active Directory attack paths and identify privilege escalation chains using BloodHound Community Edition for authorized security assessments.

Exploit misconfigured Active Directory Certificate Services ESC1 vulnerability to request certificates as high-privileged users and escalate domain privileges during authorized red team assessments.

Enumerate and exploit Active Directory Certificate Services ESC1 through ESC16 misconfigurations with Certipy, including SAN abuse, NTLM relay to web enrollment (ESC8), and golden certificate forgery.

Authorized assessment of federated identity systems covering SAML, OIDC, and OAuth2 flows, SSO misconfigurations, and token confusion issues.