Certify is a monolithic C# CLI tool for enumerating and attacking misconfigurations in Active Directory Certificate Services (AD CS). It provides over a dozen verbs covering discovery (enum-cas, enum-templates, enum-pkiobjects), certificate request (request, request-agent, request-download, request-renew), certificate forging (forge), and CA/template management (manage-ca, manage-template, manage-self). The architecture is a single .NET 4.7.2 console application using CommandLineParser for argument handling and COM interop (CERTENROLLLib, ICertAdminD2) for enrollment and CA administration. It queries Active Directory via LDAP (System.DirectoryServices) and uses BouncyCastle for cryptographic operations. The codebase is well-structured, with clear separation of concerns into commands, domain models, libraries, and utilities, and demonstrates deep knowledge of Windows PKI internals, including DCOM communication, remote registry access, and certificate chain manipulation.
DSInternals is a comprehensive .NET library and PowerShell module for Active Directory security auditing, forensic analysis, and offline/in-place manipulation of AD databases. It provides the ability to extract password hashes (NT, LM, Kerberos), decrypt DPAPI backup keys, recover LAPS and gMSA secrets, parse FIDO2/Windows Hello key credentials, and query DNS zones and signing keys. The library supports multiple access modes: offline via ESENT/ISAM (ntds.dit), online via RPC replication (DRSR), LDAP/ADSI, and SAM/LSA native APIs. The PowerShell module exposes over 50 cmdlets organized into logical groups (ADDB, ADRepl, ADSI, LSA, SAM, Hash, Encryption). The codebase is heavily oriented toward reverse-engineering of Microsoft's internal AD structures and protocols, with extensive unit tests using real-world binary vectors. While the primary use case is security auditing (e.g., penetration testing, incident response), the library also provides utilities for password quality testing, domain controller recovery, and offline account modifications. The architecture is modular, with clear separation between common data models, data store access, replication, and PowerShell cmdlets, making it a robust toolkit for Windows domain administrators and security professionals.
This repository is the Python implementation of PowerView, a comprehensive Active Directory (AD) security assessment and exploitation tool. It provides a feature-rich CLI (with an interactive shell), a web-based UI (Flask + vanilla JS), and a Model Context Protocol (MCP) server for AI agent integration. The tool enumerates AD objects (users, groups, computers, GPOs, trusts, certificates, DNS, SMB shares, etc.), identifies security vulnerabilities (kerberoasting, AS-REP roasting, shadow credentials, ACL abuse, certificate template misconfigurations), and supports active exploitation (DACL modification, RBCD, coercion attacks, SMB file operations). It is designed for red team operations and AD security audits. The architecture is a monolith centered on a large `PowerView` class (in `powerview.py`) that orchestrates all commands and dispatches to specialized modules (e.g., `kerberoast.py`, `ca.py`, `exchange.py`, `ldapattack.py`). It supports both standard LDAP and a custom implementation of Microsoft's Active Directory Web Services (ADWS) protocol (SOAP over .NET Message Framing and NegotiateStream), enabling operations without conventional LDAP. The tool leverages Impacket for low-level Windows protocols (SMB, RPC, Kerberos) and includes a plugin system with decorator-based registration and before/after hooks. The web front-end offers interactive graph visualization, object exploration, and real-time command history, while the MCP server exposes AD operations to AI assistants. Key data flows involve LDAP/ADWS queries for object enumeration, SMB/RPC sessions for remote system interaction, and Kerberos tickets for authentication attacks. External dependencies include `ldap3` (forked), `impacket` (forked), `dsinternals`, `flask`, `werkzeug`, and client-side libraries (Cytoscape.js, Alpine.js, Tailwind CSS). The codebase is large and tightly coupled in places, but the custom ADWS implementation, plugin system, and vulnerability detection engine are notable achievements that could be extracted and reused.
MaxKey is an enterprise-grade Identity and Access Management (IAM) / Single Sign-On (SSO) platform written in Java (Spring Boot) with Angular frontends. It supports a comprehensive set of authentication protocols (OAuth 2.0/OpenID Connect, SAML 2.0, CAS, JWT, form-based, token-based) and identity federation standards (SCIM 2.0, LDAP, Active Directory). The codebase is organized as a multi-module Maven project with clear separation between authentication providers, protocol implementations, persistence layer, and web UIs. Architecturally, it follows a service-oriented model with a custom OAuth2 stack (derived from Spring Security OAuth), MyBatis JPA for persistence, and Redis/Caffeine for caching. The frontends are built on NG-ALAIN (Angular 17) and share a common base for user portal and admin console. While the system is functionally rich and actively maintained, it contains some duplicated code across modules and relies on a legacy OAuth2 implementation that has been superseded by Spring Security 5+. The crypto utilities, OTP infrastructure, and adapter patterns are well-structured and demonstrate non-obvious craftsmanship.
msldap is a Python library and CLI tool for interacting with Microsoft Active Directory via LDAP. It provides both a low-level async connection (MSLDAPClientConnection) and a high-level client (MSLDAPClient) with convenience methods for enumerating users, computers, groups, GPOs, trusts, and more. The library supports multiple authentication methods (NTLM, Kerberos, simple, SSPI), LDAPS, SOCKS proxy, and includes an interactive console client (msldap) and a BloodHound collector (msldap-bloodhound). It also features ADCS vulnerability scanning, shadow credentials, LAPS extraction, DNS record manipulation, and an LDAP relay server. The codebase is well-organized with a modular architecture, extensive test suite (offline and live interop tests), and several reusable components such as a custom ASN.1 packetizer, LDAP filter parser, and binary structure parser. However, it has some known bugs (7 registered in known_failures.yml), vendored dependencies (asciitree, aiocmd) that may drift from upstream, and a few code quality issues (typos, dead code). Overall, it is a solid, feature-rich tool for AD security assessments.
Outpacket is a comprehensive cheatsheet/reference guide that maps traditional impacket penetration testing workflows to modern alternative tools like gopacket, Titanis, NetExec, and others. It serves as a static documentation resource for security professionals working with Windows environments, particularly Active Directory attacks. The repository contains only a single README.md file organized into sections covering authentication, remote execution, Kerberos operations, SMB/file operations, credential dumping, enumeration, AD/LDAP operations, auth coercion, certificate attacks, and exotic credential harvesting techniques. Each section provides command examples for multiple tools alongside explanatory notes about tool-specific behaviors and limitations.
This repository is a comprehensive OSCP pentesting cheatsheet composed of markdown notes and diagrams. It serves as a reference guide for penetration testing methodologies, covering enumeration, privilege escalation, web application testing, Active Directory attacks, and more. While not containing executable code or data processing pipelines, it curates actionable information from various security resources into an organized format. The content is structured as checklists and step-by-step guides for common pentesting tasks, making it immediately applicable for individuals preparing for the OSCP certification or conducting real-world assessments. The repository does not ingest or transform external datasets; instead, it represents synthesized knowledge intended for direct consumption. Despite lacking traditional data engineering components, the repository demonstrates value as a knowledge artifact. Its maintenance is active with recent updates, and the static nature ensures zero technical drift. Reproducibility is trivial as the entire content is self-contained within the repository.