🛡️ Awesome Active Directory Pentest Tools

🔍 Enumeration & Recon

1. BloodHound
   Visualizes privilege escalation paths and relationships in AD.

2. SharpHound
   Data collector for BloodHound in PowerShell and C#.

3. Enum4Linux
   Enumerates SMB info (users, groups, shares) from Linux.

4. WADComs
   Collection of useful AD commands for Windows environments.

5. Grouper2
   Enumerates misconfigured GPOs for privilege escalation.

6. Seatbelt (GhostPack)
   Situational awareness tool for post-exploitation.

---

🔐 Credential Dumping & Kerberos Abuse

7. Mimikatz
   Extracts passwords, hashes, tickets and more.

8. Rubeus
   Kerberos abuse toolkit (tickets, AS-REP roasting, etc).

9. Kekeo
   Advanced Kerberos manipulation by the author of Mimikatz.

10. SharpLAPS
    Dumps LAPS passwords via LDAP.

11. LAPSDumper
    Extracts LAPS secrets from AD.

12. Pandora
    Extracts credentials from Windows Credential Manager.

---

⚔️ NTLM Relay, Coercion & Network Attacks

13. Responder
    Poisoner for LLMNR, NBT-NS and WPAD.

14. NTLMThief
    Captures NTLMv2 hashes via remote file access.

15. Impacket
    Python library with tools like ntlmrelayx, secretsdump, wmiexec.

16. ntlmrelayx
    Relay NTLM authentication for code execution or token abuse.

17. PetitPotam
    Forces NTLM auth via MS-EFSRPC endpoint.

18. Coercer
    Forces authentication via DCE/RPC to relayable services.

19. Coerce-NTLM (PrintNightmare)
    Trigger NTLM authentication via MS-RPRN and others.

---

🎓 Active Directory Certificate Services (ADCS) Attacks

20. Certipy
    Exploits vulnerable certificate templates (ESC1–ESC8).

21. ForgeCert
    Creates forged certificates for impersonation/persistence.

22. ADCSKiller
    Automates enumeration and exploitation of ADCS environments.

---

📦 Post-Exploitation & Persistence

23. PowerSploit
    PowerShell scripts for persistence, recon and more.

24. PowerSharpPack
    Offensive C# tools inspired by PowerSploit.

25. CrackMapExec
    Swiss army knife for AD recon, spray, and execution.

26. NetExec
    Modern fork of CME with improved modules and usability.

27. BloodyAD
    Abuse ACLs for privilege escalation in AD.

28. GhostPack
    Collection of tools: SharpUp, SharpDump, Seatbelt, etc.

29. Whisker
    Kerberos delegation abuse via S4U2Self and S4U2Proxy.

30. PyWhisker
    Python version of Whisker delegation attacks.

31. DCOMrade
    Discover vulnerable DCOM objects for remote execution.

---

🧪 C2 Frameworks & Support Tools

32. PowerShell Empire
    Post-exploitation C2 framework focused on PowerShell.

33. PoshC2
    Command-and-control framework with HTTP/HTTPS agents.

---

🔧 Miscellaneous & Analysis Tools

34. ADExplorerSnapshot.py
    Compares AD Explorer snapshot files to detect changes.

35. SharpView
    AD enumeration and manipulation via C#.

---

📌 Contributing

Want to add your tool or suggest a category? Feel free to open an issue or PR!

---

🧠 Disclaimer

This repository is for educational and authorized security testing only. Always get proper permission before using any of these tools.