Active Directory, pivoting & cracking arsenal

Loads on domain-joined targets, or once you hold a foothold/creds and need to reach Domain Admin. Authorized, in-scope engagements only. Add the DC to /etc/hosts (IP dc01.corp.local corp.local) early — Kerberos needs the FQDN.

Enumeration