Reconnaissance

Reconnaissance | The Hacker Recipes

nmap --script broadcast-dhcp-discover
nmap --script dns-srv-enum --script-args dns-srv-enum.domain=$FQDN_DOMAIN

• responder

responder --interface "eth0" --analyze
responder -I "eth0" -A

• enum4linux
• bloodHound

bloodhound.py --zip -c All -d $DOMAIN -u $USERNAME -p $PASSWORD -dc $DOMAIN_CONTROLLER

Mouvement

Movement | The Hacker Recipes

• kerberoasting / zerologon / Relay NTLM …