Active Directory Pentesting with Kali Linux Practical Lab

Name: Active Directory Pentesting with Kali Linux Practical Lab
Rating: 4.9 (7 reviews)

AD Pentesting with Kali Linux, Red Team, Blue Team, Certification Ready, and Practice Real-World AD attacks and Hacking

Created byYagya Bashyal

Last updated 5/2026

English

English [Auto],

What you'll learn

You’ll learn how to set up a complete Active Directory lab environment and simulate real-world attacks in a safe, controlled setting.
You’ll explore how attackers gather information about a domain, find weak entry points, and gain initial access to a network
You’ll dive into advanced attack techniques against Domain Controller
Fully practical environment where you can simulate attacks and understand exactly how they work.
Conduct post-exploitation techniques to persist, move laterally, and exfiltrate sensitive data from the domain
Perform real-world attacks like Pass-the-Hash, Pass-the-Ticket, and Kerberoasting in a safe lab environment
Capture and analyze network credentials using tools like Responder and perform relay-based attacks
Document and report your findings with professional pentest reporting structure, screenshots, and remediation guidance

Course content

1 section • 47 lectures • 7h 27m total length

Introduction to the course0:49
This hands-on course you deep into the world of Active Directory pentesting from foundational concepts to advanced red team techniques. Whether you're a beginner curious about how hackers break into Windows networks or a security professional looking to sharpen your offensive skills, this lab-driven experience is for you. You'll build a safe, isolated lab with Kali Linux and Windows machines, and then perform real-world attacks like enumeration, password dumping, Kerberoasting, privilege escalation, Pass-the-Hash, and Golden Ticket forging so on. Step-by-step guidance No theory just practical, repeatable attacks used by real adversaries.
Who am i and what will you learn1:21
Meet the instructor and discover a hands-on path to mastering active directory exploitation through guided labs and step by step tracking simulation for beginners or aspiring ethical hackers.
What you will learn in this course0:47
What is Active Directory1:30
Active Directory (AD) is Microsoft’s directory service used to manage users, computers, and resources in a Windows network. It allows administrators to control access, enforce security policies, and centralize identity management all from a single domain controller.
In short: Active Directory is the backbone of enterprise Windows networks, handling logins, permissions, and security
System Requirement2:01
Set up the lab with practical system requirements: 32 gb RAM, 250 gb storage; Windows Server 2022 domain controller, Windows 10/11 clients, Kali attacker, on VMware, VirtualBox, or Fusion.
Lab Configurations7:11
Configure Kali Linux lab for active directory pentesting by importing OVA, selecting virtualization platform, and NAT networking. Assign IPs to DC 192.168.35.99, PC2 192.168.35.103, PC3 192.168.35.104, with DNS 192.168.35.99 and DHCP.
Snapshot - Backup and Restore1:28
Always create a system snapshot before making changes, then use the snapshot manager to restore to a saved state and reboot if needed.
DNS and Active Directory Configuration8:14
Join the PC to Domain2:23
Import Virtual OVA6:42
Import and configure Kali and Windows 10 virtual machines from OVA/OVF in VMware, set NAT, adjust resources, log in with provided credentials, and apply a manual IP.
Vulnerable User Creation in Domain2:45
Create multiple test user accounts in Active Directory via PowerShell, configure domain name and user limits, and review default passwords in a vulnerable PowerShell lab setup.
Note Taking2:20
In penetration testing, note-taking is a critical part of any penetration test, not just for staying organized, but for ensuring accuracy, accountability, and professionalism. During a pentest, you’ll perform lots of tasks across multiple systems, from reconnaissance and scanning to exploitation and post-exploitation. Without proper notes, it becomes difficult to track what you did, when you did it, and what the results were. Detailed documentation helps you recreate attack chains, log credentials, record vulnerabilities, and capture outputs that will later form the basis of your final report. Good note-taking also ensures your work is productive, legally defendable, and clear to clients or stakeholders.
Popular examples include OneNote, Notion, Evernote, KeepNote, CherryTree, Google Keep.
NMAP15:31
Enumerate networks with nmap in Kali Linux, performing a /24 scan to discover hosts, open ports (ldap 389, smb 445), and run scripts to assess vulnerabilities, documenting results.
Responder rpcclient and Hashcat14:37
Learn to use Responder as a man-in-the-middle to capture NTLM hashes through spoofed name resolution, then crack them with Hashcat and leverage RPC client and impact for Active Directory attacks.
CrackMapExec SMB and WinRM25:28
Reverseshell using CrackMapExec5:43
Shows a reverse engineering attack on PC3 using CrackMapExec over WinRM, deploying a PowerShell one-liner to download and run a script via an HTTP server, and establishing a reverse shell.
SAM LSA NTDS and PassTheHash (PTH) using CrackMapExec13:21
Bloodhound22:51
JAWS sherlock and GodPatato Part 113:07
Enumerate privilege escalation on Windows using the JCR tool, Sherlock, and Got Potato, running from PowerShell or cmd, and export findings on users, services, firewall status, and task scheduler.
JAWS Part 23:32
Learn to use gesture and a PowerShell script to enumerate Windows environments for potential privilege escalation, run the PS1 on a PC, output results to a json file on PC3.
Eternalblue exploit Part 13:20
Practice identifying the eternalblue vulnerability with msf console in Kali Linux, scan a remote host, and test the ms17-010 exploit on a Windows 10 Pro machine.
Eternalblue exploit Part 23:31
Token and User Enumeration Metasploit8:30
Explore token and user enumeration with Metasploit in a Kali Linux lab, uncovering users, credentials, and ARP information, bootstrapping exploitation via session management and privilege escalation.
Add and remove user and Hash Collection Metasploit Part 13:28
Demonstrates adding and deleting a local user, adjusting domain options, and using a credential collector to gather credentials and a token from the test service local.
Hash Collection via Metasploit Part 23:42
DCSync and impersonation attack8:34
DCSync is essentially a way for an attacker to pretend to be a Domain Controller and ask the real one for password data using the same replication protocol that legitimate controllers rely on. Because the request looks normal on the surface, the target DC often hands over sensitive information like password hashes, even for high‑value accounts such as KRBTGT. Tools like Mimikatz make this attack straight forward to pull off, and the danger is huge: the attacker never needs to run code on the Domain Controller itself, yet they can still grab the keys to the kingdom and escalate privileges across the entire domain with alarming speed it's one of the beauty of the DCSync.
Goldenticket using Mimikatz8:05
Windapsearch and LDAP Domain dump12:36
Learn to run windapsearch in Python to enumerate users, groups, and computers from the Windows domain controller via LDAP queries and use LDAP domain dump to extract domain information.
Enum4linux6:14
Utilize enum4linux in Kali Linux to enumerate domain details, including domain groups, user accounts, password information, and OS data, with outputs saved to text files for active directory pentesting.
LDAP-utils5:15
Learn to use ldapsearch and ldap utilities to query Active Directory data, perform domain-wide searches, set connection parameters, and explore object class filtering in a practical Kali lab.
Krbtgt user Tickets2:23
PowerView and PowerUp via Evil-WinRM11:05
Explore Windows remote management by installing Wynnum (WinRM) and using PowerView and PowerUp in Kali Linux to enumerate, bypass antivirus, and perform pentesting tasks.
DPAT: Domain Password Audit Tool19:59
Use the dpat domain password audit tool in Kali Linux to analyze domain password hashes, generate HTML reports, and crack NTLM hashes with John the Ripper or Hashcat.
PassTheHash using Mimikatz8:38
Demonstrates pass-the-hash techniques on Windows using Mimikatz in a Kali Linux lab, including setting up a local HTTP server, extracting SAM/LSA credentials, and escalating privileges to access domain controllers.
PassTheHash using Meterpreter8:37
Explore pass-the-hash techniques using meterpreter in Kali Linux, elevating tokens and extracting administrator credentials with crack map exec. Demonstrate using msf console, EternalBlue, and QE commands to obtain hashes.
Golden Ticket DCSync Krbtgt PTH via Kiwi28:27
Golden Ticket DCSync Krbtgt PTH via Windows6:57
Lsassy tool9:39
Empire - Starkiller GUI36:48
Explore the Empire Starkiller GUI in Kali Linux to deploy PowerShell Empire with Miss Venom, create HTTP listeners and stagers, and manage post-exploitation sessions on Windows hosts.
Zero Login using Mimikatz via Kali12:11
Zero Login using Mimikatz via Windows14:38
Demonstrates zero login with Mimikatz on Windows and domain controllers, using PowerShell and Mimikatz to dump hashes, authenticate, and explore Kerberos and domain admin access in a Kali lab.
GPO Policy Configuration9:01
configure gpo on windows server 2022 to disable defender and firewall, update policies with gpupdate /force, and verify with gpresult in the domain.
RDP SSH via Kali & Hydra12:38
Demonstrate RDP and SSH assessment with Kali tools, including Hydra, Nmap, and MSF console. Explore enabling NLA, confirming OpenSSH services, and credential brute-forcing across RDP and SSH.
Generating the Report10:02
Develop concise, well-structured Active Directory pentest reports using templates, documenting scope, methodology, evidence and screenshots, findings, and actionable recommendations while blurring sensitive data.
Wireshark: Capturing Telnet/FTP/HTTP Username and Password14:00
Bonus: Shadow File Hacking11:15
Crack shadow and password files from a Kali lab by escalating privileges and cracking hashes with John using a wordlist such as rockyou.
Bonus: Linux System Admin Tools16:20

Requirements

Basic Networking, Active Directory, and Linux, with a strong eagerness to learn and grow.

Description

Active Directory (AD) is the foundation of enterprise network infrastructure, and a critical target for threat actors. Once compromised, it can grant attackers full access to systems, users, and sensitive data. Many IT professionals and security teams lack the hands-on experience needed to identify and exploit real-world AD vulnerabilities.

You'll build a safe, isolated lab with Kali Linux and Windows machines, and then perform real-world attacks like enumeration, password dumping, Kerberoasting, privilege escalation, Pass-the-Hash, and Golden Ticket forging so on. Step-by-step guidance NO theory just practical, repeatable attacks used by real adversaries.

This course bridges that gap by offering a fully interactive, lab-based environment where learners can safely simulate attacks and gain practical insight into how adversaries operate. Whether you're preparing for red team operations, blue team defense, or cybersecurity certifications, mastering AD exploitation is a vital skill, and this course equips you with the tools to do just that.

You’ll learn to build a complete Active Directory lab using Kali Linux and simulate real-world attack scenarios in a controlled setting. Topics include domain reconnaissance, identifying weak entry points, initial access technique's credential harvesting, lateral movement, and privilege escalation. You'll also explore advanced attacks on Kerberos authentication, persistence strategies, and AD structure analysis to uncover hidden paths to high value targets.

By the end of the course, you’ll be able to execute full-scope red team simulations, from initial compromise to complete domain takeover, with confidence and precision.

Who this course is for:

For anyone curious about Cybersecurity