Day 24 : Active Directory Attacks 2026 — Enumeration, Password Spraying & Initial Foothold

This article is Day 24 of a 100-day ethical hacking course focused on Active Directory attacks in an isolated lab environment. It introduces the professional AD penetration testing methodology of enumerating the domain completely before attempting exploitation, covering unauthenticated enumeration techniques, password policy discovery, password spraying, and BloodHound mapping. The article matters because it establishes foundational attack methodology that prevents account lockouts, operational disruption, and detection while creating a complete attack path map to Domain Admin.

• Enumeration precedes exploitationThe article emphasizes that professional AD penetration testing follows a strict five-step chain beginning with unauthenticated enumeration (using Kerbrute, DNS queries, anonymous LDAP, and password policy queries), progressing through credential acquisition, authenticated enumeration with BloodHound and CrackMapExec, privilege escalation via Kerberoasting and ACL abuse, and finally domain compromise via DCSync and Golden Tickets. Today's work covers steps 1–3, with subsequent days covering steps 4–5.
• Password policy discovery prevents lockoutsBefore any password spraying occurs, the attacker must query the domain's lockout policy to determine the lockout threshold and observation window. The article illustrates through Exercise 1 that spraying 200 users with 3 incorrect passwords against an unknown policy risks locking out all 200 accounts simultaneously, causing immediate operational disruption and alerting defensive teams. Policy-first spraying is characterized as a professional discipline, not optional caution.
• Kerbrute leverages Kerberos KDC responsesKerbrute is a Go-based tool that performs username enumeration without credentials by exploiting how the Kerberos KDC differentially responds to AS-REQ messages: valid usernames trigger a TGT response or pre-authentication request, while invalid usernames trigger PRINCIPAL_UNKNOWN error codes. This technique crucially does not generate failed login events in Windows Security Event logs, making it undetectable through standard logging.
• BloodHound maps attack paths to DAThe article identifies BloodHound (along with bloodhound-python) as a tool that maps the full attack path to Domain Admin by analyzing the authenticated domain environment. After obtaining initial credentials through enumeration and spraying, BloodHound enables identification of the shortest privilege escalation path and prioritization of next exploitation steps.
• CrackMapExec provides multi-purpose enumerationCrackMapExec is presented as a Swiss Army Knife for Active Directory enumeration, operating during both credential acquisition and authenticated enumeration phases to execute controlled password sprays and gather domain intelligence during authenticated phases.
• Lab isolation is mandatory for practiceThe article explicitly restricts all techniques to isolated lab environments (the lab.local domain controller) built on Day 23. Unauthorized testing against production AD environments violates the Computer Misuse Act, CFAA, and equivalent laws globally, and the article emphasizes that exercises target only the personal lab, never production systems.
• Enumeration feeds escalation chainThe five-step AD attack methodology creates a direct dependency chain where Day 24's enumeration work (usernames, SPN data, password policies) directly enables Days 25–27's exploitation work, particularly Kerberoasting and AS-REP Roasting attacks that depend on usernames and service principal names discovered during the enumeration phase.

Bottom line: Professional Active Directory penetration testing requires complete unauthenticated enumeration—particularly password policy discovery—before any credential testing or exploitation, using tools like Kerbrute and CrackMapExec to map the entire domain safely and avoid account lockouts or detection. The enumeration phase creates the complete attack path map that enables subsequent privilege escalation and domain compromise in controlled, detectable ways.