The basics of Active Directory, authentication with NTLM and Kerberos, enumeration, the mechanism and detection of common weaknesses (password spraying, Kerberoasting, delegation and ACL misconfigurations), the thinking behind lateral movement and persistence, and defense through tiering. In 30 lessons you learn the mechanisms and weaknesses of Windows and AD at the center of the corporate network. Every example and exercise targets only the fictional "Sample Corp." and your own local lab.
The 30 lessons are split into 6 chapters. Working through them in order is recommended, but you can also dip into just the parts you need. * Attack techniques are covered to understand mechanisms, detection and hardening. Only try them against a test domain you set up yourself or the consented labs on the security track.
Active Directory is the mechanism that single-handedly manages authentication and permissions in a company. This chapter covers the basic parts: domains, OUs, accounts and groups, and GPOs.
The core of AD is authentication. Knowing the mechanisms of the old NTLM and the current star Kerberos is the foundation for understanding weaknesses. This chapter covers both flows and how to read authentication logs.
Much of AD is visible if you query its structure. This is also the attacker's reconnaissance. This chapter covers enumeration within authorization and organizing the results as attack surface.
AD has classic weaknesses that recur from configuration and operations. This chapter captures the representative ones in the three points of mechanism, detection and hardening.
The fear of AD is that one breach can spread to the whole domain. This chapter understands conceptually why and how lateral movement and persistence happen, and turns it into detection and defense.
Squashing individual weaknesses alone cannot protect AD. This chapter learns design that protects by system—tiering, privileged access management, and audit—and closes the track.
With these 30 lessons, the main courses of the red track make one lap. How to communicate what you found so the other side can fix it is in the report-writing course; the defender's detection and timelining are deepened in the detection course. The course order is on the security track. Membership unlocks every course.