> ## Documentation Index > Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt > Use this file to discover all available pages before exploring further. # Introduction > Enumeration and attack techniques against Active Directory environments. ## Overview Active Directory is the primary target in corporate Windows environments. This section covers the full AD attack chain — enumeration, credential attacks, lateral movement, persistence, certificate abuse, and cross-domain trust exploitation. Quick reference for engagements and CTFs focused on Windows domain environments. *** ## What's Inside AD enumeration with PowerView, ldapsearch, rpcclient, enum4linux, windapsearch, and adidnsdump. Kerberoasting, AS-REP Roast, Pass-the-Hash, Pass-the-Ticket, Golden/Silver Ticket, DCSync, NTLM relay, Responder, delegation abuse, Zerologon, PetitPotam, PrintNightmare, password spraying, and GPP passwords. PsExec, WMIExec, SMBExec, Evil-WinRM, DCOM, and RDP session hijacking. ACL abuse, AdminSDHolder, DSRM backdoor, Skeleton Key, and SID History injection. Certificate Services exploitation — ESC1 through ESC8 with Certify and Certipy. Parent-child escalation, cross-forest attacks, SID filtering bypass, and trust key abuse. Installation, collectors, Cypher queries, attack paths, edges, OPSEC, and custom queries. *** Techniques documented for use in authorized environments only. Labs, CTF platforms, and systems with explicit permission to test.