Attack Simulator

Any domain user can request Kerberos service tickets and crack them offline to recover service account passwords — no admin rights needed.

Mimikatz extracts plaintext passwords, NTLM hashes, and Kerberos tickets directly from LSASS process memory on a compromised host.

Abuse AD replication protocol to request any user's password hash from a domain controller — including the KRBTGT account hash for Golden Ticket attacks.

Use a stolen NTLM password hash to authenticate as a user without ever knowing their plaintext password — the foundational lateral movement technique.

Forge a Kerberos TGT using the KRBTGT hash to impersonate any user — the ultimate AD persistence mechanism providing unrestricted domain access.

Accounts with Kerberos pre-authentication disabled give attackers encrypted material to crack offline — no domain credentials needed.

Try one commonly-used password against every account in the domain — statistically, someone always uses it.

Intercept NTLM authentication on the network and relay it to a different service to gain unauthorized access — the attacker never needs to crack the password.

Exploit a misconfigured certificate template to request a certificate as Domain Admin — no password cracking, no lateral movement, just ask the CA nicely.

Compromise a server trusted for delegation, capture Domain Controller TGTs using the Printer Bug, and escalate to full domain compromise.

Inject a Skeleton Key into the Domain Controller's LSASS process to create a master password that authenticates as any user — while existing passwords continue to work normally.

Temporarily register a rogue Domain Controller in Active Directory, push malicious changes via legitimate replication, and leave virtually no logs on the real DCs.

Inject an Enterprise Admin SID into a compromised user's sidHistory attribute to gain cross-domain access without being a member of any privileged group.

Discover GPOs you can edit, inject a malicious scheduled task using SharpGPOAbuse, and wait for Group Policy to push your payload to every machine in the target OU.

Coerce a Domain Controller to authenticate via PetitPotam, relay the NTLM authentication to AD CS web enrollment to obtain a DC certificate, then use PKINIT for a TGT and DCSync the entire domain.