Active Directory Silver Ticket Attacks: Forging Kerberos Service Tickets
How attackers forge Kerberos TGS service tickets using a service account hash, and how blue teams detect and prevent it.
Yunolay
Active Directory 
Active Directory Abusing Unconstrained Delegation: From Printer Bug to Domain Compromise
How attackers abuse Kerberos Unconstrained Delegation to capture TGTs and pivot to Domain Admin, plus blue-team defenses.
Active Directory Abusing Kerberos Constrained Delegation: S4U2Self and S4U2Proxy
A practical walkthrough of abusing Kerberos Constrained Delegation via S4U2Self and S4U2Proxy to impersonate privileged users.
Active Directory Resource-Based Constrained Delegation (RBCD) Attack: From a Single Computer Account to Domain Compromise
A practical walkthrough of the Resource-Based Constrained Delegation attack, abusing msDS-AllowedToActOnBehalfOfOtherIdentity for privilege escalation.
Active Directory ADCS Attacks: A Practical Overview of ESC1 Through ESC8
A field guide to Active Directory Certificate Services attacks ESC1-ESC8, with Certipy commands and Blue Team defenses.
Active Directory Introduction to Attack Path Analysis with BloodHound
Learn how to collect AD data with SharpHound and use BloodHound, neo4j, and Cypher to find the shortest path to Domain Admins.
Active Directory LDAP Enumeration Techniques: ldapsearch and windapsearch
A practical guide to enumerating Active Directory over LDAP with ldapsearch, windapsearch, and bloodyAD, plus blue-team defenses.
Active Directory SMB Enumeration and Null Session Exploitation
A practical guide to enumerating SMB and abusing null sessions with enum4linux-ng, smbclient, rpcclient, and RID cycling.
Active Directory Inside Kerberos: A Deep Dive into the Protocol Internals
A practical breakdown of Kerberos internals: AS-REQ, TGS-REQ, the PAC, and why RC4 vs AES etypes matter for attackers and defenders.
Active Directory Abusing Group Policy Objects for Privilege Escalation and Lateral Movement
How attackers weaponize editable Group Policy Objects with SharpGPOAbuse and GPP cpassword, plus blue-team detection and hardening.
Active Directory Abusing Active Directory DACLs: GenericAll, WriteDACL, and the Path to Domain Compromise
How attackers abuse GenericAll and WriteDACL ACEs in Active Directory, and how blue teams detect and prevent it.
Active Directory Shadow Credentials: Abusing msDS-KeyCredentialLink for AD Persistence and Privilege Escalation
Abuse msDS-KeyCredentialLink to forge Key Trust certificates, authenticate via PKINIT, and recover NTLM hashes.
Active Directory Password Spraying Active Directory Without Tripping Lockouts
A practical, lockout-aware guide to password spraying Active Directory with kerbrute, plus detection and defense.
Active Directory PetitPotam and Coercion Attacks: Forcing Authentication and Relaying to AD CS
How PetitPotam coerces machine authentication via MS-EFSRPC and relays it to AD CS for domain compromise — with detection and defense.
Security Abusing Windows Token Privileges: The Potato Attack Family
How service accounts with SeImpersonatePrivilege escalate to SYSTEM via JuicyPotato, PrintSpoofer, and RoguePotato, plus blue-team defenses.
Windows Privesc Privilege Escalation via Unquoted Service Paths on Windows
How unquoted Windows service paths with spaces let low-privileged users plant a binary and escalate to SYSTEM, plus blue-team defenses.
Windows Privesc Weak Service Permissions: Privilege Escalation via SERVICE_CHANGE_CONFIG on Windows
Abuse misconfigured Windows service DACLs to rewrite binPath and escalate to SYSTEM, plus detection and hardening.
Security DLL Hijacking: Privilege Escalation and Persistence on Windows
How DLL search order hijacking and phantom DLLs lead to privilege escalation and persistence, plus Blue Team detection and defense.
Windows Privesc Abusing AlwaysInstallElevated for Windows Privilege Escalation
How a misconfigured AlwaysInstallElevated policy lets a low-privileged user run a malicious MSI as SYSTEM, plus detection and defense.
Windows Privesc UAC Bypass Techniques: A Practical Overview of Auto-Elevation Abuse
A practical tour of Windows UAC bypass techniques abusing auto-elevating binaries, registry hijacks, and UACME, plus blue-team defenses.
Windows Privesc Practical Credential Theft with Mimikatz
A hands-on guide to dumping Windows credentials with Mimikatz and the LSA protections that stop it.
Windows Privesc Dumping LSASS Memory: Techniques and Detection Evasion
A practical guide to dumping LSASS memory with comsvcs.dll, procdump, and nanodump, plus parsing with pypykatz and blue-team defenses.
Windows Privesc Looting Windows Secrets: Attacking DPAPI and Credential Manager
How attackers decrypt DPAPI-protected Credential Manager vaults and browser secrets, plus how blue teams detect and stop it.
Windows Privesc Abusing Scheduled Tasks for Windows Persistence and Privilege Escalation
How attackers abuse writable task XML, schtasks, and Task Scheduler to persist and escalate on Windows, plus blue-team detection.
Windows Privesc Abusing Registry Autoruns for Windows Persistence and Privilege Escalation
How attackers abuse writable Run keys and other autorun locations for persistence and privesc, plus how blue teams detect it.
Windows Privesc AMSI and Windows Defender Bypass: A Practical Primer
A hands-on primer on AMSI patching, reflection, obfuscation, and in-memory bypasses, with blue-team detection guidance.
Windows Privesc PowerShell Obfuscation and Execution Policy Bypass
How attackers bypass PowerShell ExecutionPolicy and CLM with obfuscation, and how defenders detect and stop it.
Windows Privesc Lateral Movement and Persistence with WMI
How attackers abuse WMI for remote code execution and stealthy persistence, plus the detection and defenses blue teams need.
Windows Privesc Named Pipe Impersonation: How Windows getsystem Really Works
A deep dive into ImpersonateNamedPipeClient and how named pipe impersonation powers Meterpreter's getsystem.
Windows Privesc PrintNightmare: Abusing the Windows Print Spooler for Privilege Escalation and RCE
A practical walkthrough of CVE-2021-1675 and CVE-2021-34527 (PrintNightmare): abusing AddPrinterDriverEx for SYSTEM-level code execution, plus blue-team defenses.
Windows Privesc Windows Event Logs and Forensic Artifacts: Tracking and Tampering
How Windows Security event logs record attacker activity, how adversaries clear them, and how defenders detect tampering.
Windows Privesc Practical Windows Enumeration with winPEAS
A hands-on guide to running winPEASx64 for Windows privilege escalation enumeration, with defensive countermeasures.
Windows Privesc Abusing SeBackupPrivilege and SeRestorePrivilege for Windows Privilege Escalation
How attackers abuse SeBackupPrivilege/SeRestorePrivilege to dump SAM, SYSTEM, and ntds.dit, plus blue-team detection and defense.
Security Living off the Land: Abusing LOLBAS Binaries on Windows
How attackers abuse certutil, bitsadmin, mshta, regsvr32 and rundll32 to download, execute and evade — plus blue-team detection.
Linux Privesc Exploiting SUID/SGID Binaries for Linux Privilege Escalation
How attackers abuse SUID/SGID binaries to escalate to root on Linux, plus blue-team detection and hardening.
Linux Privesc Exploiting sudo Misconfigurations with GTFOBins
How attackers turn weak sudo rules, NOPASSWD, env_keep, and LD_PRELOAD into root — and how blue teams shut it down.
Linux Privesc Abusing Linux Capabilities for Privilege Escalation
How attackers abuse cap_setuid and cap_dac_read_search file capabilities to escalate to root, and how blue teams detect it.
Linux Privesc Privilege Escalation via Cron Job Abuse on Linux
Exploit writable cron scripts, weak PATH, and wildcard injection to escalate to root, plus blue-team detection and hardening.
Linux Privesc PATH Hijacking: Privilege Escalation via Writable PATH Directories and Relative Binaries
How attackers abuse relative paths and writable PATH directories to plant malicious binaries and escalate privileges on Linux.
Linux Privesc Abusing NFS no_root_squash for Local Privilege Escalation
How a misconfigured NFS export with no_root_squash lets a low-priv user plant a root SUID binary and escalate.