VAPT

VAPT of Active Directory

Active Directory is rarely compromised through a vulnerability. It is compromised through configuration that was reasonable when it was set and has been accumulating for fifteen years — a service account with unnecessary rights, a delegation nobody remembers granting, an ACL inherited from a migration. The assessment therefore maps paths rather than hunting CVEs, and reports the shortest path an attacker would actually take.

Methodology

01
Domain enumeration
From a standard user account: users, groups, computers, GPOs, trusts, delegation settings, password policy and ACLs across the directory.
02
Attack path analysis
The collected graph is analysed for every path from an owned principal to a privileged one — not the first path found, but the full set, so remediation closes the class.
03
Credential attacks
Kerberoasting, AS-REP roasting, password spraying within lockout thresholds, and credential reuse across tiers.
04
Delegation and ACL abuse
Unconstrained, constrained and resource-based delegation; GenericAll, WriteDACL, WriteOwner and AddMember rights that permit escalation without any exploit.
05
Certificate services assessment
AD CS template and enrolment permissions reviewed against the known escalation classes, which remain among the most reliable paths to domain admin.
06
Hybrid and Entra ID review
Where the domain is synchronised: Entra Connect account rights, seamless SSO configuration, cloud roles, and whether cloud compromise reaches on-premises or the reverse.
07
Persistence assessment
Whether an attacker who reached domain admin could persist undetected — golden and silver tickets, DCSync rights, and backdoored ACLs.
08
Reporting and retest
Technical report, executive summary and an attack path diagram, then a retest evidencing closure.

Approach to testing

Testing starts from a standard domain user with no special rights. Starting from an administrative account measures the wrong thing.
Every path is reported, not the first. Closing one path in a graph with forty of them produces a retest that fails, and a client who believes they are fixed.
Password spraying respects the domain lockout policy and is run with the client's service desk informed, because locking out a production environment is an outage caused by the assessment.
Tiering is assessed against the client's own model where one exists. Where none exists, that absence is the primary finding.
Changes made during testing — accounts created, ACLs modified — are logged and reverted, with the log handed over so the client can verify.

Types of assessment

Standard user assumed breach (default)

Starts from one ordinary account, which is what a phishing email produces. The most realistic starting point and the most informative result.

Unauthenticated

From a network position with no credentials. Answers whether a foothold can be obtained from the network alone, before any user is compromised.

Configuration review

Read-only assessment with a privileged account, no exploitation. Faster and safer, and appropriate where the environment cannot tolerate active testing.

Hybrid identity assessment

Focused on the boundary between on-premises AD and Entra ID, which is where most modern escalation paths now run.

Frameworks and standards

MITRE ATT&CK: Every technique used is mapped, so the detection team can compare coverage directly.
Microsoft Enterprise Access Model: The tiering reference the environment is assessed against.
CIS Microsoft Windows Server Benchmarks: Configuration baseline for domain controllers and member servers.
NIST SP 800-115 / PTES: Testing lifecycle and exploitation standard.
CWE / CVSS v3.1: Classification and severity, with the caveat that CVSS scores configuration weaknesses poorly and path length is reported alongside it.

Tools used

Tooling is where testing starts, not where it ends. Every automated result is reproduced by hand before it reaches a report.

BloodHound / SharpHound

Collecting and analysing the directory graph, and enumerating every attack path rather than the first.

PingCastle

Rapid maturity scoring and drift detection between assessments.

Impacket

Kerberos, SMB and RPC interaction: secretsdump, GetUserSPNs, ntlmrelayx.

Certipy

AD CS template and enrolment permission assessment.

Rubeus

Kerberos ticket manipulation, roasting and delegation abuse.

CrackMapExec / NetExec

Credential validation and spraying across the domain within lockout limits.

ADRecon

Structured directory inventory for the report appendix.

Checklist approach

The checklist is the floor, not the ceiling. It guarantees coverage so nothing standard is missed; the findings that matter usually come from what a tester does after it is complete.

Privileged access

Domain Admins, Enterprise Admins and Schema Admins membership
Accounts with DCSync rights outside the expected set
Nested group membership granting unintended privilege
Privileged accounts used for daily work or email
Protected Users group and Authentication Policy usage

Credentials

Kerberoastable service accounts and password strength
AS-REP roastable accounts with pre-authentication disabled
Passwords stored in GPO, scripts or description fields
Password policy, lockout threshold and reuse across tiers
LAPS deployment coverage on member hosts

Delegation and ACLs

Unconstrained delegation on any non-domain-controller host
Constrained and resource-based delegation configuration
GenericAll, WriteDACL, WriteOwner and AddMember on privileged objects
ACL inheritance from historical migrations
Ownership anomalies on OUs and groups

Certificate services

Template enrolment permissions and subject alternative name control
Enrolment agent rights
CA configuration flags permitting escalation
Certificate-based authentication mapping

Hybrid identity

Entra Connect service account rights on premises
Password hash sync and pass-through authentication configuration
Cloud role assignments mirroring on-premises privilege
Conditional access gaps for privileged accounts
Seamless SSO computer account handling

Domain hygiene

Stale accounts and computers still enabled
Domain and forest functional level
Trust relationships and their direction and filtering
SMB signing and LDAP channel binding enforcement
Domain controller patch level

How findings are scored

Every finding is scored on CVSS 3.1 and placed in one of five levels. The executive summary adds a sixth band — Compliant — so components that passed appear on the same chart as those that did not.

Critical: Immediate measures must be taken. These vulnerabilities can allow an attacker to take complete control of the application or server — stealing user data, tricking users into supplying sensitive information, or defacing the site.
High: Maximum risk associated with a specific vulnerability instance. May enable an attacker to compromise the application and its data, partially or completely, or to modify application behaviour beyond its intended purpose. To be handled with utmost priority.
Medium: Considerable risk. May enable an attacker to exploit the application to a particular level, gaining low-level information that can be used to craft more specific attacks.
Low: Lowest risk. May allow an attacker to gain some information about the application that was not intended to be known, without an exploitation technique currently available at that instance.
Informational: A functionality or component is missing best-practice implementation. Not a risk today, but may become one as the application changes or as exploitation techniques, policy or legal requirements evolve.

Scan types selected

Safe Checks
Standard / OWASP Top 10
Destructive
SANS Top 25
Business Logic Vulnerability Testing

Standard toolset by stage

OSINT: Datasploit, Google Dorks, Shodan
Enumeration & Scanning: Nmap, Wfuzz, Unicornscan
Domain Enumeration: Nikto, DnsRecon, Knock
Crawling & Fuzzing: Burp Suite, Acunetix, Netsparker
Vulnerability Analysis: OpenSSL, sqlmap, CVE-Details
Exploitation: Metasploit, Netcat, Exploit-DB

Free toolkit

Penetration Testing Checklists

Sixteen assessment checklists covering the targets we test: web applications, Android, iOS, APIs, networks, Active Directory, thick clients, WiFi, SCADA and ATMs — plus red team test cases, firewall audit, malware analysis and vendor security assessment.

16 checklists · ZIP · 775 KB

Download the toolkit

Deliverables

Technical assessment report (PDF)
Executive summary (PDF, one page)
Attack path diagram and BloodHound graph export
Finding register (spreadsheet) with affected objects
Prioritised remediation sequence with dependencies
Change log of everything modified and reverted during testing
Retest report evidencing closure

Frequency

One-time: A first assessment, or validation after a migration, merger or major restructuring.
Biannually: The default for most organisations. AD configuration drifts continuously and six months is enough for a new path to appear.
Quarterly: Large or frequently changing directories, or where a previous assessment found systemic issues under active remediation.
After any tiering change: Triggered rather than scheduled — any change to privileged group membership, delegation or the tiering model.

Resource deployment

Active Directory assessment requires a domain-joined position, which is normally a CSS-supplied device shipped to the client or a virtual machine within the client environment. On-site deployment is preferred where the client wants the infrastructure team present during collection, or where the directory holds data that cannot leave the premises. A typical engagement places one senior tester on site for two to three days of collection and exploitation, with graph analysis and reporting completed remotely.

How CSS tests

A unified swarm of agents, for blind spot detection

AI agents drive several testing tracks against the same target at once, then cross-check each other. A single tester works one hypothesis at a time; parallel agents cover the space a sequential pass leaves behind.

Attack path enumeration in a directory of 20,000 objects is a graph traversal problem. A tester finds a path; agents find every path, which is the difference between remediation that works and remediation that moves the attacker one hop sideways.
ACL abuse hides in inherited permissions nobody set deliberately. Exhaustive ACL comparison against a clean baseline is machine work.
Password spraying across thousands of accounts while respecting per-account lockout state requires scheduling that a human gets wrong under time pressure.
Certificate template misconfiguration has several known classes with subtle preconditions; checking every template against every class is enumeration, not insight.

Every agent finding is validated by a human tester, and all exploitation stays under human control — in a production directory the blast radius of an automated action is the business. The swarm decides what to look at; it does not act.

Why this differs

What CSS does that most vendors do not

Every one of these is checkable. Ask any vendor for the same and compare the answers.

Every path, not the first

Most assessments stop at domain admin because the objective is met. CSS enumerates the full path set, because closing one path in a graph of forty changes nothing.

Exploited, not scanned

Paths are demonstrated rather than asserted from a tool's output, with the caveat that exploitation in production is agreed and bounded in advance.

Both reports, always

Technical report and executive summary together, plus a path diagram the infrastructure team can work from directly.

Fixation, not a backlog

AD remediation is delicate and easy to get wrong. CSS works the changes with the infrastructure team and retests to evidence closure.

Reporting

Two documents, two audiences

Both are produced for every engagement. They are not the same document at two lengths — they answer different questions and are written separately. The structure below is the one CSS actually issues.

Technical assessment report

For the engineers who will fix it

Disclaimer, and Limitations on Disclosure and Use
Risk Level & Description — the five levels above, scored on CVSS 3.1
Scan Type — which of the five assessment types were selected
Assessment Scope — the control areas covered
Assessment Date — the exact testing window
Objective of the Assessment — objectives listed against completion status
Tools Utilization — manual and automated tooling by stage
Summary of the Assessment
Overall Recommendations, split into Must Have and Should Have
Vulnerability Overall Classifications as per Organization
Security Issues Highlighted
The Key Findings — each with evidence and detailed recommendation
Summary of Findings & Conclusion

For this assessment specifically

Scope, starting account, collection method and the exact test window
Every attack path from the starting principal to a privileged one, with length and preconditions
Findings with CVSS v3.1 where meaningful, and path-based severity where it is not
Evidence: tool output, graph exports, command transcripts
MITRE ATT&CK technique mapping
Full log of changes made and reverted during testing
Retest results appended against each original finding

Executive summary

For the people who will fund the fix

Objectives, each against a completion status
Overall Finding of the Assessment — total threats identified, broken down by component and severity
Summary of the Assessment
Artefacts of the Assessment — the key findings as a numbered register with severity
Observation of the Assessment — the major attacks the organisation should be prepared for, given what was found
Overall Recommendation, including a Business Enabling Recommendation sequence
Must Have and Should Have actions

For this assessment specifically

How long it took to reach domain admin from one ordinary user account
The three configuration decisions that most shorten an attacker's path
Severity distribution and movement since the previous assessment
Regulatory exposure where identity controls are in scope
Remediation sequence, because AD changes have dependencies and order matters
One page

Case studies

What this finds in practice

Representative engagement patterns. Sector and scale only — no client is named, and no detail is included that could identify one.

A retail group of roughly 4,000 staff, single forest, twenty years old.

Finding: A print server retained unconstrained delegation from a 2011 deployment. Coercing a domain controller to authenticate to it yielded a domain controller TGT and full compromise in under forty minutes from a standard user account.
Recommendation: Remove unconstrained delegation entirely, add domain controllers to Protected Users, and audit delegation settings as a standing control rather than a one-off.
Outcome: Delegation removed across three legacy hosts. The retest found no path shorter than nine hops, up from three.

A financial services firm running hybrid identity with Entra ID.

Finding: An AD CS template permitted low-privileged users to supply their own subject alternative name and enrol for client authentication. Any user could request a certificate as a domain administrator and authenticate with it.
Recommendation: Remove the enrollee-supplies-subject flag, restrict enrolment permissions, and require manager approval on templates permitting authentication.
Outcome: Template corrected within a day of the finding being raised. A review of the remaining 22 templates found two more with related issues.

A logistics company after a merger, two forests with a bidirectional trust.

Finding: The trust had been created without SID filtering. A compromised administrator in the smaller, less mature forest could inject a SID granting Enterprise Admin in the larger one, making the weaker environment the effective security boundary for both.
Recommendation: Enable SID filtering on the trust, or restructure to a one-way trust. Treat the less mature forest as untrusted until its own posture is assessed.
Outcome: SID filtering enabled after a compatibility test. The merger programme was re-sequenced to assess the acquired forest before further integration.

Scope this assessment

Most scopes are settled in one call. Tell us what the application does and who uses it, and we will tell you what testing it properly involves.

Start a conversation All VAPT capabilities