Active Directory Penetration Testing

A findings list tells you that a service account is Kerberoastable. An attack path tells you that cracking that account’s password gives write access to a group, that the group controls a GPO, that the GPO deploys to a server where a domain admin logs in, and that from there it’s over. We chase the path to its end and show you the shortest place to break it.

We begin with a low-privilege domain user, the access a real intruder gets from one phished password. From there the interesting question is not whether we can get in but how fast we reach the top, and whether anything in your environment would notice. Everything runs under NDA against scope you sign off in advance.

We collect the domain’s structure with BloodHound and the SharpHound collectors, pulling users, groups, sessions, ACLs and delegation settings, then graph the routes from where we stand to Tier 0. This is where the picture forms: which accounts are overprivileged, which ACLs are dangerous, and which “normal” users sit one hop from control.

Kerberoasting extracts crackable tickets for service accounts, and AS-REP roasting targets accounts that don’t require pre-authentication. We crack offline, replay hashes and tickets where password reuse allows, and test the certificate-services attack paths that have become one of the most reliable escalation routes in modern AD.

AD Certificate Services

Misconfigured certificate templates let a normal user request a certificate that authenticates as someone else, up to and including a domain administrator. These ESC-class issues are common, quiet, and devastating, and most defenders don’t know the service is even in scope until we show them the path.

With enough access we demonstrate control: DCSync to pull password hashes straight from a domain controller, GPO abuse to run code across every machine a policy touches, and where trusts exist, escalation across domains and into the forest root. We stop at proof, capture the evidence, and never disrupt production to make a point.

Because the techniques map to MITRE ATT&CK, we can also tell you what your monitoring caught and what it missed. The report walks the whole path with command output and screenshots, then gives your team the specific, prioritized fixes that collapse the most attack paths for the least effort.

Service accounts often have old, human-chosen passwords and rights far beyond what they need. Any domain user can request their tickets, and a weak password cracks in hours on commodity hardware. When that account is also a local admin everywhere, one crack becomes an estate.

Rights like GenericAll, WriteDACL or the ability to reset another user’s password turn ordinary accounts into “shadow admins” nobody tracks. These delegated permissions are almost always accidental, granted years ago and never reviewed. BloodHound surfaces them; we prove which ones actually lead somewhere.

The ESC1 through ESC8 template and endpoint issues have quietly become one of the fastest routes to domain admin in networks that run AD CS. They are widespread, easy to exploit once known, and frequently missed by testing that predates the technique.

Unsigned SMB, NTLM where Kerberos should be enforced, and privileged credentials cached on ordinary workstations all give an attacker an opening. A domain admin who logs into a helpdesk machine leaves a token behind, and that token is a straight line to the top.

A clear read for leadership: how far an attacker gets, what that would cost, and the small number of changes that matter most. It answers “how bad is it and what do we fix first” without a glossary.

Every finding with impact, CVSS, reproduction steps and a specific fix, plus the attack-path graphs showing exactly how access chains together. Your engineers can trace each path and confirm the break point once it’s remediated.

An attestation letter for auditors, clients and insurers, and a no-cost retest after you remediate to confirm the paths are genuinely closed and haven’t simply moved.

ISO 27001 Annex A control 8.8 on technical vulnerability management and access-control controls all speak directly to AD hygiene. SOC 2 auditors expect independent testing of the systems that enforce access, and PCI DSS 4.0 requirement 11.4 covers the penetration testing that AD sits at the centre of. Our reports carry the evidence these reviews want.

For financial entities and essential-service operators, DORA and NIS2 both push threat-led, evidence-based testing of the systems that would cause the most damage if compromised. Active Directory is almost always at the top of that list.

The same finding can be trivial in one domain and critical in another, and only a person who understands the surrounding environment can tell which. A Kerberoastable account with a strong random password is a low-priority note. The same account with a 2016-vintage password and admin rights on the file server is a five-alarm problem. We rank by the reality of your estate, not by a generic severity table, so your team spends its remediation time where it actually moves the needle.

Domain consolidations, trust additions and cloud-identity migrations are exactly the moments new attack paths appear. If you have recently joined two forests, added a trust, or hybrid-joined to Entra ID, the assessment catches the misconfigurations that come with the change while they are still fresh and easy to fix.