ad-methodology

# AD Pentest Methodology: Phase Order A domain assessment is not a bag of tricks you run in random order. The order is the craft. Enumeration feeds exploitation; a credential harvested cheaply saves you a spray that locks accounts; a graph collected once tells you which of a hundred possible attacks actually reaches Domain Admin. Run the phases in order and each one narrows the next. Four phases, in sequence: 1. **Setup**: reachability, name resolution, environment posture, first credentials. 2. **Collection**: topology, trusts, directory objects, hosts, shares. Read, do not touch. 3. **Exploitation**: attack-path discovery, then cheap wins, then spraying, then hunting. 4. **Post-processing**: consolidate loot, re-collect as the owned set grows, report. The rest of this skill is what happens inside each phase and why that order holds. --- ## Phase 1: Setup You cannot attack a DC you cannot reach, resolve, or authenticate against. Get these four things straight before anything else. ### 1.1 Reachability and DNS The DC is the DNS server for the domain. If your resolver does not point at it, `corp.local`, `dc01.corp.local` and SRV records will not resolve, and half your tools fail with confusing errors that look like auth problems. ```bash # Point resolution at the DC, confirm the domain answers nslookup -type=SRV _ldap._tcp.dc._msdcs.corp.local <dc_ip> nxc smb <dc_ip> # confirms host up + prints domain/hostname/OS ``` Kerberos also needs FQDNs. A...