Active Directory Tools

The desktop app bundles a suite of Active Directory (AD) tools under Tools → Active Directory. Each opens a dedicated window that wraps a well-known AD tool with a form-based interface, captures output into the session, and links results back to hosts and findings. Credentials and targets you enter are reused across the AD tools during a session.

Open these from the Tools → Active Directory submenu.

LDAP Query

LDAP Query performs LDAP-based Active Directory enumeration against a domain controller.

  • Connect to a DC by IP or hostname, with a domain (or run anonymous with the domain blank)
  • Enumerate users, groups, computers, and other directory objects
  • Authenticate with credentials or run unauthenticated where the target allows it

Use it early for low-noise directory reconnaissance.

Kerbrute

Kerbrute enumerates and validates Active Directory accounts through Kerberos pre-authentication.

  • Provide the domain and a domain controller (hostname or IP)
  • Enumerate valid usernames from a list
  • Password-spray or validate credentials via Kerberos

Because it uses Kerberos pre-auth, username enumeration does not generate typical failed-logon events.

Impacket Tools

Impacket Tools exposes the Impacket script collection through a single window.

  • Pick a script from the list to see its description
  • Fill in the parameters the selected script needs (target, credentials, options)
  • Run scripts such as secretsdump, psexec/wmiexec/smbexec, GetNPUsers/GetUserSPNs, and more

This is the go-to window for credential dumping, remote execution, and Kerberos attacks (AS-REP roasting, Kerberoasting).

NetExec

NetExec (the successor to CrackMapExec) drives protocol-based enumeration and post-exploitation across a host, range, or CIDR.

  • Target an IP, range, or CIDR
  • Supply a single user or a users.txt, plus a password/hash
  • Enumerate SMB/WinRM/LDAP/MSSQL, spray credentials, and run modules

Great for validating credentials at scale and sweeping a network for access.

A separate CrackMapExec interface is also available in the Workshop; see Data Management → CrackMapExec Interface.

BloodHound CE

BloodHound CE integrates the Community Edition of BloodHound for attack-path analysis.

  • Connect to a running BloodHound CE server (URL and credentials)
  • Set up the server locally (Docker or binary) directly from the window when it is unreachable
  • Upload collected data and open the graph to hunt for privilege-escalation and lateral-movement paths

See the Server/collector notes inside the window for local setup options.

Certipy (AD CS)

Certipy assesses Active Directory Certificate Services (AD CS).

  • Target a CA/host and domain with credentials
  • Enumerate certificate templates and find misconfigurations (ESC1–ESC# style issues)
  • Request and abuse certificates for authentication and escalation

Use it whenever AD CS is in scope to surface certificate-based escalation paths.

Coercer

Coercer triggers authentication coercion — forcing a target to authenticate back to you.

  • Provide the target host and your attacker IP (the listener)
  • Coerce authentication over multiple RPC methods (e.g., PetitPotam-style)
  • Pair with a listener such as Responder or an NTLM relay

Coercion feeds relay and capture attacks; run it alongside a capture tool.

Responder

Responder is a network poisoner that captures authentication over LLMNR/NBT-NS/mDNS.

  • Bind to an interface (e.g., eth0)
  • Optionally set your IP
  • Capture NetNTLM hashes for offline cracking or relaying

Combine with Coercer for forced authentication, or run passively to catch broadcast name-resolution requests.

AD Enumeration Data

AD Enumeration Data is the viewer for enumeration results collected during the engagement. Review imported Active Directory data in one place and use it to plan the next step. This mirrors the server-side Active Directory Explorer.