rbcd

Free Active Directory pentesting tool for Linux, macOS and Windows. Automates AD and LDAP enumeration, Kerberoasting, ASREPRoast, password spraying, ADCS/ESC1, DCSync, RBCD, gMSA, shadow credentials, NTLM relay and credential dumping across 104 techniques, mapping BloodHound-compatible attack paths to Domain Admin. NIS2 / ISO 27001 reports.

Active Directory attack simulation demonstrating LDAP/SMB enumeration, credential harvesting, lateral movement, Kerberos abuse, Resource-Based Constrained Delegation (RBCD), and Domain Administrator privilege escalation in a TryHackMe lab.

Linux-native Kerberos delegation abuse framework for Active Directory. Enumerates and exploits RBCD, constrained, and unconstrained delegation paths with OPSEC noise profiling and Elastic SIEM telemetry validation.

Search msDS-AllowedToActOnBehalfOfOtherIdentity

Full Active Directory compromise of Support.htb through SMB enumeration, binary reverse engineering, LDAP credential harvesting, and Resource-Based Constrained Delegation abuse

Audit Active Directory for unconstrained, constrained, and resource-based Kerberos delegation using only built-in .NET, with no AD module or admin rights required.

focused tool to search and audit msDS-AllowedToActOnBehalfOfOtherIdentity attributes in Active Directory — detecting RBCD misconfigurations, Kerberos delegation risks, and privilege escalation paths.

Active Directory Kerberos Delegation Audit Tool - 100% Defensive Security

post-exploitation tool for computer object takeover via Resource-Based Constrained Delegation modify msDS-AllowedToActOnBehalfOfOtherIdentity attributes to abuse Kerberos delegation and escalate privileges in Active Directory.

Full walkthrough of HackTheBox Pirate (Hard, Windows). A pure Active Directory chain from a pre-Windows-2000 machine account to Domain Admin, no CVEs, finishing with a constrained-delegation SPN injection.

post-exploitation tool for computer object takeover via Resource-Based Constrained Delegation modify msDS-AllowedToActOnBehalfOfOtherIdentity attributes to abuse Kerberos delegation and escalate privileges in Active Directory.

Computer object takeover through Resource-Based Constrained Delegation msDS-AllowedToActOnBehalfOfOtherIdentity

focused tool to search and audit msDS-AllowedToActOnBehalfOfOtherIdentity attributes in Active Directory — detecting RBCD misconfigurations, Kerberos delegation risks, and privilege escalation paths.

post-exploitation tool for computer object takeover via Resource-Based Constrained Delegation modify msDS-AllowedToActOnBehalfOfOtherIdentity attributes to abuse Kerberos delegation and escalate privileges in Active Directory.

focused tool to search and audit msDS-AllowedToActOnBehalfOfOtherIdentity attributes in Active Directory — detecting RBCD misconfigurations, Kerberos delegation risks, and privilege escalation paths.