Logo
Hard Live Course

AD Pentesting

Attack Active Directory the way real intrusions do.

Watch Free Demo

Starting at $250 · Taught by industry-certified ThreatBlock instructors.

Trusted by teams at
South FloridaSynackLufthansaBooking HoldingsHCL TechWiproMicrosoftSouth FloridaSynackLufthansaBooking HoldingsHCL TechWiproMicrosoft
Highlights: 36h
Highlights: Hard
Batch: Max 18 Learners
Mode: Online Live

What You'll Learn

AD Fundamentals & Enumeration
Core Active Directory architecture: domains, forests, trusts, OUs, and Group Policy. Authentication internals for NTLM and Kerberos. Domain reconnaissance with BloodHound and SharpHound to map attack paths, plus PowerView for users, groups, sessions, and ACL enumeration. Building a mental model of how an attacker reads a domain.
Credential Access & Kerberoasting
Harvesting credentials with Mimikatz and Rubeus. Kerberoasting service accounts with SPNs and cracking extracted TGS tickets offline with Hashcat. AS-REP roasting accounts that lack Kerberos pre-authentication. LLMNR/NBT-NS poisoning with Responder and relaying captured hashes via ntlmrelayx.
Delegation Abuse
Unconstrained delegation and TGT capture from privileged hosts. Constrained delegation abuse with S4U2Self and S4U2Proxy to impersonate users. Resource-based constrained delegation (RBCD) attacks by abusing msDS-AllowedToActOnBehalfOfOtherIdentity. Using Rubeus and Impacket to forge and request tickets for lateral access.
Lateral Movement & Privilege Escalation
Pass-the-Hash and Pass-the-Ticket with Impacket (psexec, wmiexec, smbexec). Overpass-the-Hash and silver/golden ticket crafting. ACL-based escalation: GenericAll, WriteDACL, and GPO abuse paths discovered in BloodHound. Local privilege escalation to feed domain credential theft.
Domain Dominance & Persistence
DCSync attacks to extract the krbtgt hash via the Directory Replication Service. Golden ticket persistence and Skeleton Key implants. AdminSDHolder and ACL backdoors for stealthy long-term access. DPAPI abuse and credential vault extraction across the domain.
Forest Attacks & Reporting
Cross-domain and cross-forest attacks abusing trust relationships and SID history. Exploiting the printer bug and coercion techniques (PetitPotam, PrinterBug) for NTLM relay to AD CS (ESC1-ESC8). Full attack-chain reporting, remediation guidance, and detection considerations for blue teams.
Course Curriculum

What you'll master.

6 modules — tap any topic to expand the details.

Core Active Directory architecture: domains, forests, trusts, OUs, and Group Policy. Authentication internals for NTLM and Kerberos. Domain reconnaissance with BloodHound and SharpHound to map attack paths, plus PowerView for users, groups, sessions, and ACL enumeration. Building a mental model of how an attacker reads a domain.
Enroll Now
$250
Book your demo

One-time payment for full course access. Flexible EMI options available at checkout.

Reviews & Testimonial

Loved by hackers. Trusted by organizations.
Rohan Deshpande
Penetration Tester
★★★★★

The delegation abuse module finally made RBCD and S4U click for me. Within a week I was chaining these attacks on a real engagement.

Sneha Iyer
Red Team Operator
★★★★★

BloodHound to DCSync in a single structured path was exactly how I needed to learn AD. The labs mirror actual enterprise environments.

Karthik Nair
Security Consultant
★★★★★

Kerberoasting and AS-REP roasting were demystified completely. The instructor showed both the attack and the detection angle, which helped my reports.

Ananya Gupta
Offensive Security Engineer
★★★★★

The forest trust and AD CS ESC attacks are rarely taught this well. This course took me from domain user to enterprise admin with confidence.

Vikram Shetty
Senior Pentester
★★★★★

Hands-on from day one. Pass-the-ticket, golden tickets, and DCSync all in realistic labs made the concepts stick far better than any video course.

Rohan Deshpande
Penetration Tester
★★★★★

The delegation abuse module finally made RBCD and S4U click for me. Within a week I was chaining these attacks on a real engagement.

Sneha Iyer
Red Team Operator
★★★★★

BloodHound to DCSync in a single structured path was exactly how I needed to learn AD. The labs mirror actual enterprise environments.

Karthik Nair
Security Consultant
★★★★★

Kerberoasting and AS-REP roasting were demystified completely. The instructor showed both the attack and the detection angle, which helped my reports.

Ananya Gupta
Offensive Security Engineer
★★★★★

The forest trust and AD CS ESC attacks are rarely taught this well. This course took me from domain user to enterprise admin with confidence.

Vikram Shetty
Senior Pentester
★★★★★

Hands-on from day one. Pass-the-ticket, golden tickets, and DCSync all in realistic labs made the concepts stick far better than any video course.

Vikram Shetty
Senior Pentester
★★★★★

Hands-on from day one. Pass-the-ticket, golden tickets, and DCSync all in realistic labs made the concepts stick far better than any video course.

Ananya Gupta
Offensive Security Engineer
★★★★★

The forest trust and AD CS ESC attacks are rarely taught this well. This course took me from domain user to enterprise admin with confidence.

Karthik Nair
Security Consultant
★★★★★

Kerberoasting and AS-REP roasting were demystified completely. The instructor showed both the attack and the detection angle, which helped my reports.

Sneha Iyer
Red Team Operator
★★★★★

BloodHound to DCSync in a single structured path was exactly how I needed to learn AD. The labs mirror actual enterprise environments.

Rohan Deshpande
Penetration Tester
★★★★★

The delegation abuse module finally made RBCD and S4U click for me. Within a week I was chaining these attacks on a real engagement.

Vikram Shetty
Senior Pentester
★★★★★

Hands-on from day one. Pass-the-ticket, golden tickets, and DCSync all in realistic labs made the concepts stick far better than any video course.

Ananya Gupta
Offensive Security Engineer
★★★★★

The forest trust and AD CS ESC attacks are rarely taught this well. This course took me from domain user to enterprise admin with confidence.

Karthik Nair
Security Consultant
★★★★★

Kerberoasting and AS-REP roasting were demystified completely. The instructor showed both the attack and the detection angle, which helped my reports.

Sneha Iyer
Red Team Operator
★★★★★

BloodHound to DCSync in a single structured path was exactly how I needed to learn AD. The labs mirror actual enterprise environments.

Rohan Deshpande
Penetration Tester
★★★★★

The delegation abuse module finally made RBCD and S4U click for me. Within a week I was chaining these attacks on a real engagement.