Summary

This chapter was devoted to tools and techniques that can help you get access to credentials either in clear-text or hashed form. Obtaining such sensitive data is a crucial step to progress further in attacking Active Directory. We have also discussed OpSec consideration and possible mitigation/detection options.

In the next chapter, we will cover lateral movement inside the domain and between forests. We will focus on relay and different types of pass-the-whatever attacks, finishing with Kerberos delegation abuse and lateral movement between forests.