Purple Edge
Get started

Active Directory Attacker

intermediate10 labsSubscription

Go from an unprivileged domain foothold to full domain dominance: fundamentals, enumeration, attack-path analysis, credential attacks, ACL abuse, DCSync, golden tickets and ADCS, ending in a capstone compromise.

This path is available with a Purple Edge subscription. Sign in to read the full overview and start the labs.

Labs in this path

  1. 1
    beginner Subscription

    Active Directory and Kerberos Fundamentals

    The mental model an attacker needs: domains, forests, principals, and how Kerberos authentication actually works.

    35 min3 tasksActive Directory
  2. 2
    beginner Hands-on lab Subscription

    Active Directory Enumeration Basics

    Map a Windows domain from a low-privileged foothold: users, groups, computers, and the service accounts that matter.

    40 min3 tasksActive Directory
  3. 3
    intermediate Hands-on lab Subscription

    Finding Attack Paths with BloodHound

    Turn raw directory data into a graph and let it compute the shortest path from your foothold to Domain Admin.

    45 min3 tasksActive Directory
  4. 4
    intermediate Hands-on lab Subscription

    Kerberoasting Service Accounts

    Request Kerberos service tickets for accounts with an SPN and crack them offline to recover the service account password.

    50 min3 tasksActive Directory
  5. 5
    intermediate Hands-on lab Subscription

    AS-REP Roasting

    Recover crackable material for accounts that do not require Kerberos pre-authentication.

    40 min3 tasksActive Directory
  6. 6
    advanced Hands-on lab Subscription

    Abusing Active Directory ACLs

    Turn a dangerous access-control entry, like GenericAll or WriteDacl, into control of a privileged object.

    55 min3 tasksActive Directory
  7. 7
    advanced Hands-on lab Subscription

    DCSync: Replicating Secrets from the Domain

    Impersonate a domain controller's replication and pull password hashes, including krbtgt, straight from the directory.

    50 min3 tasksActive Directory
  8. 8
    advanced Hands-on lab Subscription

    ADCS ESC1: Certificate Template Privilege Escalation

    Abuse a misconfigured certificate template that lets a low-privileged user request a certificate as anyone.

    55 min3 tasksActive Directory
  9. 9
    advanced Hands-on lab Subscription

    Forging Golden Tickets

    With the krbtgt hash you can forge a Ticket Granting Ticket for any user, granting durable domain-wide access.

    45 min3 tasksActive Directory
  10. 10
    advanced Hands-on lab Subscription

    Capstone: Full Domain Compromise

    Chain everything you learned into one end-to-end path from a low-privileged foothold to durable domain dominance.

    90 min3 tasksActive Directory

Unlock this lab

Launch the lab in your browser. Real Kali, Ubuntu and Windows targets, guided step by step. No setup, no VM downloads.

Create free accountSign in to start

Updated 2026-09-01