⊞   KNOWLEDGE AREA

Windows & Active Directory

Identity, authentication, and Windows security internals.

10 topics

Windowsintermediate

Active Directory enumeration as an authorization graph

Active Directory relationships connect users, groups, computers, service accounts, and delegated object rights.

active-directory-enumerationwindows
Windowsadvanced

DPAPI and protected-data ownership

DPAPI protects data using user or machine context and associated key material.

dpapi-and-credential-contextwindows
Windowsintermediate

Kerberos tickets, service names, and key ownership

Kerberos separates initial authentication from service authentication.

kerberos-modelwindows
Windowsadvanced

NTLM authentication and relay prerequisites

NTLM uses a challenge-response exchange rather than sending a plaintext password.

ntlm-and-relaywindows
Windowsadvanced

Pool corruption through a primitive ladder

Turn a narrow adjacent overwrite into measured disclosure and access primitives with build-specific object constraints.

kernelpool-overflowwnf
Windowsintermediate

PowerShell and built-in executable behavior

Built-in Windows tools can access networks, transform data, launch processes, and load components.

powershell-and-lolbinswindows
Windowsadvanced

Privileged IPC cleanup as a filesystem primitive

Separate process-image identity, message authorization, path control, and installer rollback requirements.

named-pipeslpepath-traversal
Windowsintermediate

Registry and startup configuration evidence

The registry stores configuration, including startup and service-related settings.

registry-and-autorunswindows
Windowsfoundation

Windows access tokens, groups, and privileges

Windows access tokens describe a security principal, group membership, privileges, integrity level, and restrictions.

tokens-and-privilegeswindows
Windowsintermediate

Windows services and execution-path permissions

A Windows service has an account, command line, start policy, and configurable security descriptor.

services-and-pathswindows