This is a curated list of tools for this category.
- ADCSPwn - A Tool To Escalate Privileges In An Active Directory Network By Coercing Authenticate From Machine Accounts And Relaying To The Certificate Service
- ADCollector - A Lightweight Tool To Quickly Extract Valuable Information From The Active Directory Environment For Both Attacking And Defending
- ADExplorerSnapshot.py - An AD Explorer Snapshot Parser. It Is Made As An Ingestor For BloodHound, And Also Supports Full-Object Dumping To NDJSON
- ADLab - Custom PowerShell Module To Setup An Active Directory Lab Environment To Practice Penetration Testing
- Aced - Tool to parse and resolve a single targeted Active Directory principal's DACL
- Adfsbrute - A Script To Test Credentials Against Active Directory Federation Services (ADFS), Allowing Password Spraying Or Bruteforce Attacks
- Adidnsdump - Active Directory Integrated DNS Dumping By Any Authenticated User
- Azure-AccessPermissions - Easy to use PowerShell script to enumerate access permissions in an Azure Active Directory environment
- AzureHound - Azure Data Exporter For BloodHound
- BackupOperatorToDA - From An Account Member Of The Group Backup Operators To Domain Admin Without RDP Or WinRM On The Domain Controller
- BackupOperatorToolkit - The BackupOperatorToolkit Contains Different Techniques Allowing You To Escalate From Backup Operator To Domain Admin
- BadBlood - Fills A Microsoft Active Directory Domain With A Structure And Thousands Of Objects
- BloodyAD - An Active Directory Privilege Escalation Framework
- Certify - Active Directory Certificate Abuse
- Certipy - Python Implementation For Active Directory Certificate Abuse
- Chalumeau - Automated, Extendable And Customizable Credential Dumping Tool
- CheeseTools - Self-developed Tools For Lateral Movement/Code Execution
- Concealed Position - Bring Your Own Print Driver Privilege Escalation Tool
- Cypherhound - Terminal Application That Contains 260+ Neo4j Cyphers For BloodHound Data Sets
- Cypheroth - Automated, Extensible Toolset That Runs Cypher Queries Against Bloodhound's Neo4j Backend And Saves Output To Spreadsheets
- DarthSidious - Building An Active Directory Domain And Hacking It
- DuplicateDump - Dumping LSASS With A Duplicated Handle From Custom LSA Plugin
- EDRSandblast - Tool That Weaponize A Vulnerable Signed Driver To Bypass EDR Detections And LSASS Protections
- Evil SSDP - Spoof SSDP Replies And Create Fake UPnP Devices To Phish For Credentials And NetNTLM Challenge/Response
- FarsightAD - PowerShell Script That Aim To Help Uncovering (Eventual) Persistence Mechanisms Deployed By A Threat Actor Following An Active Directory Domain Compromise
- Get-RBCD-Threaded - Tool To Discover Resource-Based Constrained Delegation Attack Paths In Active Directory Environments
- GodPotato - Local Privilege Escalation Tool From A Windows Service Accounts To NT AUTHORITY\SYSTEM
- GoodHound - Uses Sharphound, Bloodhound And Neo4j To Produce An Actionable List Of Attack Paths For Targeted Remediation
- HandleKatz - PIC Lsass Dumper Using Cloned Handles
- IAM Vulnerable - Use Terraform To Create Your Own Vulnerable By Design AWS IAM Privilege Escalation Playground
- Juicy Potato - A Sugared Version Of RottenPotatoNG, With A Bit Of Juice, I.E. Another Local Privilege Escalation Tool, From A Windows Service Accounts To NT AUTHORITY\SYSTEM
- Kekeo - A Little Toolbox To Play With Microsoft Kerberos In C
- Kerbrute - A Tool To Perform Kerberos Pre-Auth Bruteforcing
- Kerbrute - An Script To Perform Kerberos Bruteforcing By Using Impacket
- KrbRelay - Framework For Kerberos Relaying
- LATMA - Lateral Movement Analyzer Tool
- LDAPDomainDump - Active Directory Information Dumper Via LDAP
- Lil-Pwny - Auditing Active Directory Passwords Using Multiprocessing In Python
- Lnkbomb - Malicious Shortcut Generator For Collecting NTLM Hashes From Insecure File Shares
- Lsarelayx - NTLM Relaying For Windows Made Easy
- Lsassy - Extract Credentials From Lsass Remotely
- MacHound - An extension to audit Bloodhound collecting and ingesting of Active Directory relationships on MacOS hosts
- Masky - Python Library With CLI Allowing To Remotely Dump Domain User Credentials Via An ADCS Without Dumping The LSASS Process Memory
- Max - Maximizing BloodHound
- Monkey365 - Tool For Security Consultants To Easily Conduct Not Only Microsoft 365, But Also Azure Subscriptions And Azure Active Directory Security Configuration Reviews
- MoveKit - Cobalt Strike Kit For Lateral Movement
- Mssqlproxy - A Toolkit Aimed To Perform Lateral Movement In Restricted Environments Through A Compromised Microsoft SQL Server Via Socket Reuse
- NTLMRawUnHide - A Python3 Script Designed To Parse Network Packet Capture Files And Extract NTLMv2 Hashes In A Crackable Format
- NTLMRecon - A Tool To Enumerate Information From NTLM Authentication Enabled Web Endpoints
- NTLMRecon - A Tool To Enumerate Information From NTLM Authentication Enabled Web Endpoints
- NTLMRecon - Enumerate Information From NTLM Authentication Enabled Web Endpoints
- Nanodump - A Crappy LSASS Dumper With No ASCII Art
- Nosferatu - Lsass NTLM Authentication Backdoor
- Ntlm_Theft - A Tool For Generating Multiple Types Of NTLMv2 Hash Theft Files
- One-Lin3r v2.0 - Gives You One-Liners That Aids In Penetration Testing Operations, Privilege Escalation And More
- One-Lin3r v2.1 - Gives You One-Liners That Aids In Penetration Testing Operations, Privilege Escalation And More
- PEASS - Privilege Escalation Awesome Scripts SUITE
- PEASS-ng - Privilege Escalation Awesome Scripts SUITE new generation
- PKINITtools - Tools For Kerberos PKINIT And Relaying To AD CS
- PSPKIAudit - PowerShell toolkit for auditing Active Directory Certificate Services (AD CS)
- PersistBOF - Tool To Help Automate Common Persistence Mechanisms
- PersistenceSniper - Powershell Script That Can Be Used By Blue Teams, Incident Responders And System Administrators To Hunt Persistences Implanted In Windows Machines
- PingCastle - Get Active Directory Security At 80% In 20% Of The Time
- PoisonApple - macOS Persistence Tool
- Postenum - A Clean, Nice And Easy Tool For Basic/Advanced Privilege Escalation Techniques
- PowerHuntShares - Audit Script Designed In Inventory, Analyze, And Report Excessive Privileges Configured On Active Directory Domains
- PrivExchange - Exchange Your Privileges For Domain Admin Privs By Abusing Exchange
- PurpleCloud - An Infrastructure As Code (IaC) Deployment Of A Small Active Directory Pentest Lab In The Cloud
- PurplePanda - Identify Privilege Escalation Paths Within And Across Different Clouds
- PwnedPasswordsChecker - Search (Offline) If Your Password (NTLM Or SHA1 Format) Has Been Leaked (HIBP Passwords List V5)
- Pypykatz - Mimikatz Implementation In Pure Python
- Pytmipe - Python Library And Client For Token Manipulations And Impersonations For Privilege Escalation On Windows
- R77-Rootkit - Fileless Ring 3 Rootkit With Installer And Persistence That Hides Processes, Files, Network Connections, Etc...
- RPC Firewall - Stopping Lateral Movement via the RPC Firewall
- Rbcd-Attack - Kerberos Resource-Based Constrained Delegation Attack From Outside Using Impacket
- RemotePotato0 - Just Another "Won't Fix" Windows Privilege Escalation From User To Domain Admin
- RogueWinRM - Windows Local Privilege Escalation From Service Account To System
- Rootend - A *Nix Enumerator And Auto Privilege Escalation Tool
- Rubeus - C# Toolset For Raw Kerberos Interaction And Abuses
- SCShell - Fileless Lateral Movement Tool That Relies On ChangeServiceConfigA To Run Command
- ScheduleRunner - A C# Tool With More Flexibility To Customize Scheduled Task For Both Persistence And Lateral Movement In Red Team Operation
- SharpDPAPI - A C# Port Of Some Mimikatz DPAPI Functionality
- SharpHound3 - C# Data Collector For The BloodHound Project
- SharpSniper - Find Specific Users In Active Directory Via Their Username And Logon IP Address
- SharpSpray - Active Directory Password Spraying Tool. Auto Fetches User List And Avoids Potential Lockouts
- SharpWSUS - CSharp tool for lateral movement through WSUS
- SilentHound - Quietly Enumerate An Active Directory Domain Via LDAP Parsing Users, Admins, Groups, Etc.
- Solarflare - SolarWinds Orion Account Audit / Password Dumping Utility
- Spray - A Password Spraying Tool For Active Directory Credentials By Jacob Wilkin(Greenwolf)
- Spraykatz - A Tool Able To Retrieve Credentials On Windows Machines And Large Active Directory Environments
- StayKit - Cobalt Strike Kit For Persistence
- TChopper - Conduct Lateral Movement Attack By Leveraging Unfiltered Services Display Name To Smuggle Binaries As Chunks Into The Target Machine
- Talon - A Password Guessing Tool That Targets The Kerberos And LDAP Services Within The Windows Active Directory Environment
- TripleCross - A Linux eBPF Rootkit With A Backdoor, C2, Library Injection, Execution Hijacking, Persistence And Stealth Capabilities.
- Uptux - Linux Privilege Escalation Checks (Systemd, Dbus, Socket Fun, Etc)
- Vulnerable-AD - Create A Vulnerable Active Directory That'S Allowing You To Test Most Of Active Directory Attacks In Local Lab
- WMIHACKER - A Bypass Anti-virus Software Lateral Movement Command Execution Tool
- WSuspicious - A Tool To Abuse Insecure WSUS Connections For Privilege Escalations
- Whisker - A C# Tool For Taking Over Active Directory User And Computer Accounts By Manipulating Their msDS-KeyCredentialLink Attribute
- Youzer - Fake User Generator For Active Directory Environments
- adalanche - Active Directory ACL Visualizer and Explorer
- dazzleUP - A Tool That Detects The Privilege Escalation Vulnerabilities Caused By Misconfigurations And Missing Updates In The Windows OS
- smbAutoRelay - Provides The Automation Of SMB/NTLM Relay Technique For Pentesting And Red Teaming Exercises In Active Directory Environments
- wmiexec-RegOut - Modify Version Of Impacket Wmiexec.Py, Get Output(Data,Response) From Registry, Don'T Need SMB Connection, Also Bypassing Antivirus-Software In Lateral Movement Like WMIHACKER