Guides

What Is a DCSync Attack? DCSync is a credential dumping technique that abuses Active Directory’s replication mechanism. Instead of running code on a Domain Controller, an attacker with the right privileges impersonates a Domain Controller and requests password data directly from another DC using the MS-DRSR (Directory Replication Service Remote Protocol). The result: you get NTLM hashes, Kerberos keys, and plaintext passwords (in some configurations) for any account in the domain — including krbtgt and Domain Admins — without ever touching LSASS on a DC. ...

Active Directory credential attacks come in two flavors that confuse people constantly: Pass-the-Hash (PtH) and Pass-the-Ticket (PtT). Both let you authenticate as another user without knowing their plaintext password. But they work on completely different protocols, hit different defenses, and fail in different ways. This guide covers how each attack actually works under the hood, when to reach for one vs the other, how defenders detect them, and how red teamers stay ahead of detection. ...

Kerberoasting is one of the most reliable privilege escalation techniques in Active Directory environments. It’s quiet, requires no special privileges to execute, and often yields domain admin within hours — because organizations routinely set weak passwords on service accounts and never rotate them. This guide covers everything: how Kerberos works, why the attack is possible, what you need to execute it, and how defenders detect it. What Is Kerberoasting? Kerberoasting targets service accounts in Active Directory that have a Service Principal Name (SPN) set. Any authenticated domain user can request a Kerberos Ticket Granting Service (TGS) ticket for any SPN — and those tickets are encrypted with the service account’s NTLM hash. ...

BloodHound is the closest thing to a cheat code for Active Directory pentesting. Feed it your domain data and it draws a map of every path from regular user to Domain Admin — paths that would take you days to find manually. This guide covers everything: installation, data collection with SharpHound, running Cypher queries, and using the attack paths you find to actually escalate privileges. What BloodHound Does (and Why It Matters) Active Directory environments are complex. Thousands of users, hundreds of groups, nested permissions, ACL misconfigurations, Kerberos delegation settings — no human can reason about all of it manually. ...

Google Cloud is no longer just AWS’s little sibling. It’s the backbone of YouTube, Google Workspace, and thousands of Fortune 500 environments. In 2026, GCP powers a significant chunk of enterprise infrastructure — and most red teams still don’t know how to attack it properly. This guide fixes that. We’ll walk through a complete GCP attack chain: from passive recon through persistence, using real commands against real services. If you’ve done our AWS pentesting guide or Azure pentesting guide , this follows the same structure — but GCP has its own quirks that’ll trip you up if you treat it like AWS. ...

Introduction Amazon S3 (Simple Storage Service) has been at the center of some of the most damaging data breaches in cloud history. From exposed customer databases to leaked government documents, misconfigured S3 buckets remain a goldmine for attackers — and a nightmare for defenders. In 2026, S3 misconfigurations haven’t disappeared. They’ve evolved. New attack surfaces emerge from complex IAM chains, cross-account trust relationships, and the growing use of S3 as a backend for serverless and containerized workloads. For red teamers and pentesters, S3 is still one of the highest-value targets in any AWS engagement. ...

AWS IAM is both the most powerful and most abused system in cloud security. Get the permissions wrong — even slightly — and an attacker can go from a low-privilege read-only role to full AdministratorAccess in under five minutes. This guide covers every IAM privilege escalation technique that works in 2026. Real attack paths, real commands, detection notes where relevant. If you’re doing cloud pentesting, red team engagements, or studying for AWS security certs — this is the complete reference. ...

Azure is the second-largest cloud platform on the planet and the dominant choice in enterprise environments. Microsoft’s deep integration with Active Directory, Office 365, and enterprise tooling means Azure is everywhere corporate red teams operate. If you’re doing internal red team work or enterprise pentesting in 2026, Azure is unavoidable. This guide covers the full attack chain — from initial recon through credential theft, RBAC abuse, lateral movement, and persistence — with real commands and the tools that actually work. ...

AWS is the biggest cloud provider on the planet. It’s also one of the most common attack surfaces in modern red team engagements. If you’re doing pentesting in 2026 and you don’t understand how to attack AWS, you’re leaving scope on the table. This guide covers the full attack chain — from initial recon through privilege escalation — with real commands and the tools that actually matter. You need a lab environment to practice this. Spin up a dedicated AWS account for testing. If you want a VPS to run attack tooling from, Vultr and DigitalOcean are solid choices — cheap, fast, and you can tear them down when done. ...

Windows privilege escalation is one of the most critical skills in offensive security. You land on a box as a low-privileged user, and your job isn’t done until you have SYSTEM. This cheat sheet covers every technique that actually works in 2026 — with real commands, the right tools, and notes on which Windows versions each technique applies to. Bookmark it. You’ll use it. Why Windows PrivEsc Is Different From Linux Linux privilege escalation has patterns: SUID binaries, sudo misconfigs, writable cron jobs, kernel exploits. Clean and predictable. ...