Internal penetration testing almost always leads to the same destination. No matter how access is initially obtained—through leaked credentials, infostealer logs, or an exposed legacy server—Active Directory is usually the next target. Most corporate networks are built around a domain, and even environments with significant Linux or macOS presence ultimately rely on domain controllers for management.
Beginners often lose the most time here. Dozens of overlapping AD tools exist, and without a clear understanding of when and why to run each one, reconnaissance generates excessive noise, triggers detectors, and produces data that is difficult to act upon. In practice, domains are frequently compromised without exploiting vulnerabilities at all—simply by methodically collecting small pieces of information.
Reconnaissance begins with domain name and domain controller location
Once inside the network, possibly without domain credentials and on a Linux host with only local privileges, directly attacking the domain controller is rarely effective. The first step is to locate basic landmarks: the domain name, the location of the domain controller, and its IP address. Standard port scanning with nmap revealing open ports 88 (Kerberos) and 389 (LDAP) strongly indicates a domain controller. Native Windows utilities can also extract this information from a domain-joined host without noisy network sweeps.
Old, unpatched hosts such as Windows XP machines remain attractive targets when discovered near the domain, as public exploits can grant quick access.
Significant information can be gathered without credentials
A common misconception is that valid domain credentials are required for reconnaissance. Tools such as enum4linux-ng can retrieve the domain name, user lists, groups, and password policy via null sessions. Although null sessions are less common on modern domain controllers, they still appear regularly and provide enough material to plan subsequent attacks. Password policy details, such as minimum length and history requirements, help attackers tune brute-force attempts to avoid account lockouts.
SMB shares often contain overlooked sensitive data
Few techniques deliver results as consistently as enumerating network shares. smbmap leverages SMB on port 445 to list shares across the domain and identify read or write access. Careful examination frequently uncovers SSH keys, certificates, plaintext passwords, password-manager databases, and service account configuration files. Real-world examples include KeePass files that were brute-forced or quarterly pentest reports left in accessible folders containing still-valid credentials.
BloodHound provides a map rather than an automated attack button
After initial data collection, BloodHound helps determine the next steps. Collectors such as SharpHound gather information about users, groups, computers, and relationships, which BloodHound visualizes as a graph. The resulting map shows concrete paths from a low-privileged account to Domain Admins. In mature environments with active SOC monitoring, quieter collectors are preferred over the default noisy SharpHound to reduce detection risk.
Protocol understanding separates script users from effective attackers
Techniques such as Kerberoasting and AS-REP Roasting rely on tools from the impacket suite, including GetADUsers. However, success depends on understanding the underlying Kerberos and NTLM protocols. An obtained NTLM hash can be reused directly via pass-the-hash rather than cracked, opening additional movement options that are invisible to operators who only copy commands.
Network attacks require caution and stealth
Tools such as mitm6 and ntlmrelayx enable relay attacks in networks without protocol encryption. These techniques must be executed carefully to avoid disrupting availability or alerting defenders. Heavy scanners like Nessus are generally avoided during pentests because they are noisy; experienced operators prefer targeted, low-noise actions.
Beginner checklist for Active Directory reconnaissance
- Locate domain name, domain controller, and IP address via port scanning (88, 389).
- Collect initial data without credentials using enum4linux-ng and null sessions.
- Enumerate SMB shares with smbmap for keys, certificates, and passwords.
- Map attack paths with SharpHound and BloodHound.
- Apply protocol-aware techniques such as Kerberoasting and pass-the-hash.
- Maintain stealth by filtering data collection and minimizing noisy actions.
Additional resources include an interactive AD pentest map from Orange Cyberdefense and the Red September CyberED course on Active Directory attacks covering Kerberos, NTLM, DACL abuse, delegation, and certificate services.
