Penetration › Module 7 › Lesson 1
AD Named
Active Directory vocabulary for YOUR $LAB_AD — domains, forests, and trust literacy, not stranger-domain attacks.
Visual · t19_ad_named
AD = Microsoft directory for users, groups, computers, policies. $LAB_AD only. Original Cyberlium.
Opening
Learn what a domain controller is on a lab forest you built — not on your employer's production without a ticket.
Active Directory (AD) stores identity and policy for Windows enterprises: domains, domain controllers (DCs), organizational units (OUs), users, groups, computers, Group Policy, and trusts between domains/forests. Pentest literacy requires naming these objects on YOUR intentional $LAB_AD lab — e.g., lab.local with disposable VMs you snapshot. You will NOT enumerate real university AD, neighbor offices, or internet-exposed LDAP without signed scope. Defender view: AD is crown jewels — protect DCs, tier admin model, and monitor identity events.
1. Core objects
Domain, DC, user, group, computer account, OU, GPO — map to YOUR $LAB_AD lab diagram.
Forest vs domain: forest holds domains; trusts link them — literacy for lab topology only.
Command guide
Try these commands — Core objects
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
AD literacy — YOUR intentional AD lab only MITRE Kerberos — https://attack.mitre.org/techniques/T1558/ (defender literacy)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install dnsutils sudo apt install curl
macOS:
Command — copy this
brew install bind
Windows: Built-in: nslookup (or install BIND for dig) Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
curl -sS https://attack.mitre.org/techniques/T1558/ | head -8
python3 -c "print('Kerberoast = named for defender literacy — no stranger domain')"Primary tools to practice this lesson: dig, curl. Reference sites: AD literacy; MITRE Kerberos (https://attack.mitre.org/techniques/T1558/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why AD matters in pentest
Engagement goals often include assessing identity blast radius — under written RoE on $LAB_AD.
Misconfigurations (weak service accounts, excessive privileges) are findings — not excuses to touch stranger domains.
3. Scope boundary
All AD practice on $LAB_AD VMs you deploy — isolated lab network per course brief.
No LDAP binds, password sprays, or BloodHound imports against organizations you do not own.
4. What you ship: AD vocabulary sheet
Domain/DC/user/group/OU/GPO definitions + $LAB_AD topology sketch + NEVER stranger AD sentence.
5. What you record before the next lesson
AD vocabulary path.
6. Wrong vs right: stranger nets vs YOUR lab VMs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run ldapsearch against university AD 'to learn objects.'
Right
Name AD core objects on $LAB_AD. Next: Enum Concepts.
Mission: AD vocabulary
1) Define domain and DC. 2) Name user, group, computer, OU, GPO. 3) Sketch YOUR $LAB_AD lab topology. 4) Write NEVER stranger production AD.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum $LAB_AD VMs for literacy lab?”
Knowledge Check
APPLY: Active Directory primarily stores:
Multiple choice
Knowledge Check
APPLY: True or False: Enumerating real employer AD without ticket is lab.
True or False
Knowledge Check
APPLY: Domain controller role includes:
Multiple choice