Skip to content

Syslifters Handbook

Main Navigation Home Pentesting Manual Organization Blog

English

Deutsch

English

Deutsch

Appearance

Sidebar Navigation

Our Pentesting Manual

About the handbook

Contact us

Pentesting

Pentest planning process

Pentest operation rules

Firefox Multi-Account Containers

Customer communication

Working together

Reporting

Report writing

Findings

Titles

Summaries

Descriptions

Recommendations

Executive summaries

Screenshots

Sending reports

Web Applications

Burp Proxy tips and tricks

Recon & tooling

Katana recon pipeline

Downloading m3u8 playlists

ASP.NET endpoint checklist

Search Shodan for SSH keys

Cheat sheets

Authentication & account flows

Normalization and Unicode attacks

Parameter pollution

Mass assignment in password resets

CRLF injection to add email CC

UUID v1 sandwich attack

OIDC

JWT attacks

WebSocket hijacking

File uploads

XMP metadata injection in PNG uploads

XSS via SVG file upload

SQLi and XSS payloads in filenames

Open redirect via HTML file upload

XXE payloads

Universal WAF bypass (request padding)

NTLM channel binding for web apps

ASP.NET ViewState

Common security issues in financial web apps

Wordlists

API endpoints wordlists

User agent wordlists

Framework-specific wordlists

Small brute force password lists

Learn and practice

Active Directory & Infrastructure

Enumeration

Host enumeration

AD enumeration

Fileshare enumeration

Network enumeration

Network access control

Host and service discovery

Defense evasion

Antivirus & EDR

AMSI

WDAC & AppLocker

Credential Guard

Lateral movement

SMB relaying

LDAP relaying

HTTP / RPC relaying

ADCS

DNS manipulation

IPv6 MitM

Kerberos delegation

Delegations overview

Unconstrained delegation

RBCD

Shadow credentials

WSUS

Privilege escalation

BitLocker

Crassus

NTLM / Kerberos relaying

PrivescCheck

WSUS

Credential access

Hash cracking

Hijack RDP session

Password spraying

Credential dumping

Password managers

PXE boot

Tool cheat sheet

Entra ID & Azure

Checklist

Enumeration

Identity & policy enumeration

Attack-path data collection

Azure resource configuration audit

Microsoft 365 pillaging

Sensitive data discovery

Defense evasion

Conditional Access

Lateral movement

Azure Arc

Other

Mobile

Android emulation

Remote debugging

Flutter app setup

Power Platform

Basic knowledge

Overview of Microsoft Power Platform

Power Platform dataverse

Power Platform environments

Solutions in Power Platform

Canvas apps vs model-driven apps

Default permissions and access

License to role mapping risks

Security roles and permissions

Misconfigurations

Read access to compiled assemblies

Missing DLP policy

Limit environment creation

Limited audit trail (auditing)

Plain-text environment variables

Traffic inspection

HTTPS traffic decryption with Wireshark

Java RMI

Physical security

Ansible Automation Platform (AAP)

Tools & Providers

Pentesting toolset

Internal toolset

Social security numbers

On this page

Are you an LLM? You can read better optimized documentation at /pentesting-manual/active-directory/lateral-movement/kerberos-delegation/delegations-overview.md for this page in Markdown format

Delegations overview

Edit the source (internal link).

Pager

Previous pageIPv6 MitM

Next pageUnconstrained delegation

Our Website · Privacy · Imprint

Delegations overview ​

Delegations overview