Active Directory Security Testing Fundamentals
Short answer: Active Directory security testing is the practice of finding the attack paths that let an attacker turn a single foothold into domain dominance. It centers on a handful of well-understood techniques, credential capture, Kerberoasting, Pass-the-Hash, lateral movement, and DCSync, each mapped to a MITRE ATT&CK technique and each discoverable with a small set of standard tools like BloodHound, Impacket, and Responder.
TL;DR: Most AD environments can be fully compromised via misconfiguration and legitimate protocol abuse — not software bugs — so testing must focus on mapping permission relationships and attack chains, not just scanning for CVEs.
Key Takeaways - Active Directory is the identity backbone of most corporate networks, which makes it the primary target of an internal test. - The core attack paths map to documented MITRE ATT&CK techniques: Kerberoasting (T1558.003), Pass-the-Hash (T1550.002), and DCSync (T1003.006). - BloodHound turns a tangle of permissions into a visual graph of the shortest path to Domain Admin. - These techniques exploit misconfiguration and legitimate protocol behavior, not software bugs, so patching alone does not fix them.
Why Active Directory is the target
On most corporate networks, Active Directory (AD) is the single system that decides who can log in to what. Compromise it, and you effectively own the environment. That is why an internal penetration test, which follows the internal network penetration testing methodology, almost always becomes an Active Directory exercise once the tester has a foothold. Before any AD-specific techniques come into play, network reconnaissance establishes which hosts are domain members, where domain controllers sit, and what services are exposed — that map is the foundation every subsequent AD attack builds on.
What makes AD testing distinct is that the most effective attacks abuse features working exactly as designed. Kerberos tickets, NTLM authentication, and replication are all legitimate mechanisms. The weaknesses live in how they are configured and combined, so there is rarely a patch that closes the path.
The core attack paths
| Technique | MITRE ATT&CK ID | What it abuses |
|---|---|---|
| Credential capture (LLMNR/NBT-NS poisoning) | T1557.001 | Hosts broadcasting name-resolution requests |
| Kerberoasting | T1558.003 | Service account tickets that can be cracked offline |
| AS-REP roasting | T1558.004 | Accounts with Kerberos pre-authentication disabled |
| Pass-the-Hash | T1550.002 | NTLM hashes accepted in place of passwords |
| Pass-the-Ticket | T1550.003 | Stolen or forged Kerberos tickets |
| DCSync | T1003.006 | Domain replication rights to pull password hashes |
Credential capture
The first move after landing on a network is usually to listen. Tools like Responder answer the broadcast name-resolution requests (LLMNR and NBT-NS) that misconfigured Windows hosts send, capturing NTLM hashes an attacker can crack or relay. This is MITRE technique T1557.001.
Kerberoasting and AS-REP roasting
Kerberoasting (T1558.003) requests Kerberos service tickets for accounts with a Service Principal Name, then cracks them offline to recover the service account password. AS-REP roasting (T1558.004) targets accounts that have Kerberos pre-authentication disabled. Both let an attacker crack passwords without ever touching a domain controller loudly.
Pass-the-Hash and lateral movement
Windows accepts an NTLM hash in place of a plaintext password for many operations. Pass-the-Hash (T1550.002) reuses a captured hash to authenticate as that user on other machines, and Pass-the-Ticket (T1550.003) does the same with Kerberos tickets. This is how a single compromised credential becomes access across the domain.
DCSync
The end of many paths is DCSync (T1003.006), where an account with domain replication rights asks a domain controller to hand over password hashes, including the krbtgt hash that unlocks forged "golden" tickets. Reaching DCSync rights usually means the test is effectively over.
The core toolkit
You do not need many tools to test Active Directory well. These are the ones that appear in almost every engagement:
- BloodHound (SpecterOps) — collects AD relationships and graphs the shortest path from where you are to Domain Admin. It turns guesswork into a map. In practice, after running
SharpHound.exe --CollectionMethods All, import the resulting JSON files into BloodHound and run the built-in "Shortest Paths to Domain Admins" query — it visually maps the exact AD relationships an attacker would follow. - Impacket (Fortra) — a Python toolkit implementing the protocols (SMB, Kerberos, and more) behind Kerberoasting, Pass-the-Hash, DCSync, and remote execution.
- Responder — poisons LLMNR/NBT-NS to capture hashes during the credential-capture phase.
- Rubeus (GhostPack) — a Windows tool focused on Kerberos abuse, from roasting to ticket manipulation.
- mimikatz (gentilkiwi) — extracts credentials, hashes, and tickets from Windows memory.
Running these requires comfort at the command line and a solid grasp of networking, the foundations covered in Linux networking fundamentals for ethical hackers.
Why misconfiguration, not patching, is the fix
Because these techniques abuse legitimate protocol behavior, you cannot patch your way out of them. Defense comes from configuration: strong, unique service account passwords, tiered administration, removing excessive rights that BloodHound surfaces, and monitoring for the telltale signs of roasting and replication. Testing exists to find those misconfigurations before an attacker does.
Frequently asked questions
What is Active Directory penetration testing?
It is the practice of simulating an attacker inside a Windows domain to find the paths that lead to full control. Testers chain techniques like credential capture, Kerberoasting, Pass-the-Hash, and DCSync, usually mapping each to a MITRE ATT&CK technique for clear reporting.
What is Kerberoasting?
Kerberoasting (MITRE ATT&CK T1558.003) is an attack that requests Kerberos service tickets for accounts with a Service Principal Name, then cracks those tickets offline to recover the service account's password. It is effective because it does not require elevated privileges to perform.
What is BloodHound used for?
BloodHound, maintained by SpecterOps, collects the users, groups, and permissions in an Active Directory environment and graphs them, revealing the shortest attack path from a low-privilege foothold to Domain Admin. It turns complex permission relationships into a visual map.
Can Active Directory attacks be patched?
Mostly no. The core attacks abuse legitimate protocol features such as Kerberos and NTLM, so they are fixed through configuration, strong service account passwords, tiered administration, and removing excessive rights, rather than by applying a software patch.
ThreatBlock's Network Penetration Testing course teaches Active Directory attack paths hands-on, on a live multi-domain lab built for exactly this practice.
About the author: Samaksh is Lead Instructor at ThreatBlock and holds the OSCP, CRTP, CRTO, and CEH certifications, with hands-on experience in penetration testing and red teaming. Read more on the author page · Editorial policy.