- Installation
- Selecting & Using a Protocol
- Target Formats
- Using Credentials
- Using Kerberos
- Using Certificates
- Using Modules
- DNS options
- Database General Usage
- BloodHound Integration
- Audit Mode
- Ignore OpSec Warnings
- Logging
- Generate hosts file
- Generate krb5.conf file
- Generate TGT
- Scan for Vulnerabilities
- Enumeration
- Enumerate Hosts
- Enumerate Null Sessions
- Enumerate Guest Logon
- Enumerate Hosts with SMB Signing Not Required
- 🆕 Enumerate Active Windows Sessions
- 🆕 Enumerate Logged-On Users with the Remote Registry Service
- Enumerate Logged-On Users with the Workstation Service
- Enumerate Shares and Access
- 🆕 Enumerate Network Interfaces
- Enumerate Disks
- Enumerate Bitlocker
- Enumerate Domain Users
- Enumerate Users by Bruteforcing RID
- Enumerate Domain Groups
- Enumerate Local Groups
- Enumerate Domain Password Policy
- Enumerate Anti-Virus & EDR
- Enumerate remote processes
- 🆕 Enumerate changed lockscreen executables
- 🆕 Enumerate Primary Site Server and Distribution Point via recon6
- Password Spraying
- Authentication
- Command Execution
- Spidering Shares
- Get and Put Files
- Obtaining Credentials
- Dump SAM
- Dump LSA
- Dump NTDS.dit
- Dump LSASS
- Dump DPAPI
- 🆕 Dump with BackupOperator Priv
- 🆕 Dump SCCM
- 🆕 Dump Token Broker Cache
- Dump WIFI password
- Dump KeePass
- Dump Veeam
- Dump WinSCP
- 🆕 Dump PuTTY
- 🆕 Dump VNC
- 🆕 Dump mRemoteNG
- 🆕 Dump Notepad
- 🆕 Dump Notepad++
- 🆕 Dump Remote Desktop Credential Manager
- 🆕 Dump Event Log Creds(4688)
- Defeating LAPS
- Checking for Spooler & WebDav
- Steal Microsoft Teams Cookies
- Impersonate logged-on Users
- Change User Password
- Dump User Local Security Questions
- Authentication
- Enumerate Domain Users
- Enumerate Domain Groups
- 🆕 Query LDAP
- ASREPRoast
- Find Domain SID
- Kerberoasting
- 🆕 Find Misconfigured Delegation
- Unconstrained Delegation
- Admin Count
- Machine Account Quota
- Get User Descriptions
- Dump gMSA
- Exploit ESC8 (ADCS)
- Extract Subnet
- Check LDAP Signing
- Read DACL Rights
- Extract gMSA Secrets
- Bloodhound Ingestor
- 🆕 List DC IP / Enum Trust
- Enumerate Domain Trusts
- 🆕 Enumerate SCCM
- 🆕 Enumerate Entra ID