Active › Module 1 › Lesson 3
No Stranger Domain
Cyberlium explicitly refuses stranger-domain AD attacks — name techniques on $LAB_AD; refuse production and unauthorized forests.
Visual · t25_no_stranger_domain
Refusal literacy. $LAB_AD only. Original Cyberlium.
Opening
When a tutorial Kerberoasts a domain you do not own, the answer is refused.
Stranger-domain attacks turn AD literacy into harm: enum and auth abuse against corporate tenants, campus forests, or internet-exposed DCs without scope. Cyberlium teaches class names — Kerberoast, AS-REP roast, Pass-the-Hash, Pass-the-Ticket — so you can detect and mitigate, not ship working chains against unauthorized targets. If asked to run Rubeus/Impacket fire recipes beyond $LAB_AD, answer: refused — document mitigations, map detections, practice naming only inside scoped lab. Next: RoE Lab.
1. What counts as stranger targeting (named)
Any AD forest, DC, or tenant you do not own and lack written authorization to test — including employer production, classmates' labs without permission, and 'try this domain' paste bins.
Defender-acceptable work: 'Kerberoast is TGS request for user SPN + offline crack risk; mitigate with strong service passwords and gMSA.' Attacker-cookbook work: 'run this Rubeus line against contoso.local' on a stranger — refused.
Command guide
Try these commands — What counts as stranger targeting (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CISA AD best practices — https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices (authorized scope) adsecurity.org — https://adsecurity.org/ (technique names for defenders) MITRE ATT&CK — https://attack.mitre.org/ (map literacy, not attack cookbooks)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export LAB_AD=${LAB_AD:-$HOME/cyberlium-lab/t25-ad}
cat > "$LAB_AD/notes/no-stranger-domain.txt" <<'EOF'
SCOPE: YOUR lab AD / GOAD / HTB assigned machine only
NEVER: employer, school, ISP, or any domain without written RoE
BANNED: Impacket attack recipes, Rubeus roast fire, Mimikatz dump/PtH, BloodHound on strangers
PURPOSE: literacy + defender mitigations — not stranger-domain abuse
EOFCommand — copy this
grep -E 'SCOPE|NEVER|BANNED' "$LAB_AD/notes/no-stranger-domain.txt"
python3 -c "print('Ethics: stranger domains = expulsion + legal risk — lab only')"Primary tools to practice this lesson: grep, python3. Reference sites: CISA AD best practices (https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices); adsecurity.org (https://adsecurity.org/); MITRE ATT&CK (https://attack.mitre.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Refusal script for mentors and chat
Template: 'I can name the AD technique class and list mitigations on MY $LAB_AD — I will not run attack cookbooks, credential dumps, or enum against stranger/production domains.'
Classmates build their own literacy notes — not copy-paste Impacket one-liners aimed at live tenants.
3. Sharing hygiene
Share mitigation tables, event ID mappings, and anonymized lab graphs — not working crack commands, hash dumps, or golden-ticket bytes from real environments.
Ship: NEVER STRANGER DOMAIN block — five refused actions (unauthorized Kerberoast, production LDAP enum, leaked cred use, DCSync on live DC, campus AD scan). Next: RoE Lab.
4. What you ship: explicit stranger-domain refusal for $LAB_AD
NEVER list: stranger Kerberoast, production enum, credential dumps, unauthorized PtH, campus AD scans. chmod 600.
5. What you record before the next lesson
Date. Refusal block. $LAB_AD named. File t25-m01-l03-no-stranger-domain.txt chmod 600.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Kerberoast a corporate domain from a tutorial. Ask Mentor to debug PtH against a neighbor's DC.
Right
Write NEVER STRANGER DOMAIN block for $LAB_AD work. Next: RoE Lab.
Mission: freeze YOUR refusal block
1) List five refused stranger-domain actions. 2) Write one-sentence refusal script. 3) Note share-safe items (mitigation table, event IDs). 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Naming Kerberoast with mitigations beats any unauthorized roast command.
Knowledge Check
APPLY: Cyberlium explicitly refuses:
Multiple choice
Knowledge Check
APPLY: True or False: Running Impacket secretsdump against unauthorized DCs is acceptable course output.
True or False
Knowledge Check
APPLY: When a tutorial Kerberoasts a live corporate forest, you:
Multiple choice