YPYogeshwar Peelainexploitnotes.hashnode.dev·Jul 24 · 18 min readTryHackMe : Enterprise WriteupSummary Enterprise is an Active Directory box that starts as a classic external AD footprint (DNS, Kerberos, LDAP, SMB, RDP, WinRM) plus two extra web ports: an IIS site on 80 and a Bitbucket-branded 00
YPYogeshwar Peelainexploitnotes.hashnode.dev·Jun 23 · 13 min readHackTheBox: Breach WriteupSummary Breach is a Windows AD box centered on credential harvesting and Kerberos abuse. Initial access starts from a guest-readable, guest-writable SMB share. Dropping NTLM-coercion files (.scf, .url00
AVAnvesh Vishwarajuinanveshtheaisocanalyst.hashnode.dev·Jun 3 · 10 min readWhy Single-Layer LLM Triage Is Dangerous in a SOC — And the Architecture I'm Building to Prevent ItPublished on Hashnode | Anvesh Raju Vishwaraju | June 2026 I came across an article recently that genuinely surprised me. Not because the topic was new to me — but because someone at the same educatio21A
JJebitokinsharonjebitok.com·Mar 25 · 33 min readDetecting AD Credential Attacks (TryHackMe)Introduction In August 2024, The DFIR Report documented a BlackSuit ransomware intrusion(opens in new tab) where the attackers used Rubeus to Kerberoast service accounts, AS-REP Roasted an account wit00
CACésar Arias Rodríguezinwakata.hashnode.dev·Sep 18, 2025 · 3 min readInfiltratorEnumeración Escaneo de puertos ❯ nmap -p- --open --min-rate 5000 -sS -n -Pn 10.10.11.31 -oG allPorts Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-03-31 18:56 -04 Nmap scan report for 10.10.11.31 Host is up (0.16s latency). Not shown: 65513 filt...00
ADAnand Darshaninblog.redteamers.in·Apr 24, 2025 · 20 min readDissecting KerberosI wrote this article because I personally couldn’t find anyone on the internet explaining Kerberos detailed enough separately or while teaching Kerberoasting, most of them just ran tools. And if they did, they didn’t dive deep enough. What can you ex...00
IIsayar17inx401a.hashnode.dev·Mar 8, 2025 · 21 min read🔥 "Hunting for Domain Admin: Kerberoasting, Credential Spraying, and AD Pivoting in Search" 🔥We began by doing an nmap scan of the machine using the command: result=$(nmap -p- --min-rate=1000 -Pn -T4 10.129.229.114 | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed 's/,$//' | tr -d '%');nmap -p$result -Pn -sC -sV 10.129.229.114 -oA...00
Eelc4br4inxxdbytes.hashnode.dev·Sep 29, 2024 · 9 min readKerberos¿Qué es Kerberos? 🐶 Kerberos es un protocolo de autenticación que sirve para autenticar dos dispositivos que se conectan entre sí. No significa que vaya a autorizarlos, sino autenticarlos. Su función es identificar cada usuario mediante cifrado. Es...00
RRFSinblog.ad-attacks.com·May 13, 2023 · 3 min readUnderstanding Kerberoasting: A Simple GuideKerberoasting is a technique used by ethical hackers and security experts to evaluate network security. It exploits weak service account configurations to extract service tickets or credentials used by certain system services, enabling a form of priv...00
