Active Directory Password Audit
Extracting and auditing password hashes from Active Directory to identify weak, reused, and policy-violating passwords before attackers do. Covers hash extraction, offline cracking with optimized rulesets, password spray detection, and policy gap analysis with remediation recommendations.
Hash Extraction from Active Directory
Extract NTLM password hashes from the Active Directory database. The cleanest method is DCSync using a domain admin account, which replicates hashes from a domain controller without touching disk. Alternatively, extract NTDS.dit via Volume Shadow Copy and parse offline. This gives you every user's password hash in the domain without disrupting services or triggering most security tools.
Tools for this step
Impacket
Mimikatz
CrackMapExec
NetExecTip: Impacket's secretsdump.py with DCSync is the cleanest extraction method - run 'secretsdump.py domain/admin@dc-ip -just-dc-ntlm' to get NTLM hashes only. CrackMapExec and NetExec can also DCSync across multiple DCs. If you need the full NTDS.dit for additional analysis, use 'ntdsutil' or Volume Shadow Copy on the DC. Always hash-verify your extract against a known test account to confirm accuracy.
Password Policy Assessment
Before cracking, document the current password policies - both the default domain policy and any fine-grained password policies (FGPPs) applied to specific groups. Record minimum length, complexity requirements, history count, lockout thresholds, and maximum age. This context is essential for interpreting cracking results: if policy requires 8 characters with complexity, and you crack 40% in under an hour, the policy is clearly insufficient.
Tools for this step
PingCastleTip: CrackMapExec's --pass-pol flag dumps the domain password policy. PingCastle provides a comprehensive AD security assessment including password policy scoring against best practices. Check for fine-grained password policies that might apply weaker rules to specific groups - 'Get-ADFineGrainedPasswordPolicy -Filter *' in PowerShell reveals these. Document which accounts are excluded from lockout policies.
Wordlist Preparation and Rule Optimization
Build targeted wordlists before running generic attacks. Include the company name, location, products, sports teams, seasons, years, and common patterns specific to the organization. Combine with standard breach wordlists (rockyou, Have I Been Pwned NTLM list). Craft Hashcat rules that model how users transform base words into 'complex' passwords - capitalizing first letter, appending numbers and symbols, leetspeak substitutions.
Tools for this step
hate_crack
HashcatTip: HATE_CRACK automates the optimized attack workflow from basic wordlists through progressively complex rule combinations. Start with the NTLM hashes from Have I Been Pwned - these crack instantly via lookup and typically get 10-20% of a domain on their own. Build an organization-specific wordlist from the company website, LinkedIn, and internal documentation. The pattern 'Season+Year+!' (Summer2024!) is still the most common password format in corporate environments.
Offline Hash Cracking Campaign
Run a structured cracking campaign, starting with the fastest attacks and progressing to slower, more thorough ones. Begin with straight wordlist attacks against known-breached passwords, then company-specific wordlists with rules, then combination attacks, and finally brute-force for short passwords. Track your crack rate at each stage - this data drives your policy recommendations.
Tools for this step
John the RipperTip: Hashcat mode 1000 is NTLM. Run attacks in this order for maximum efficiency: (1) known-hash lookup against HIBP NTLM database, (2) company wordlist + best64.rule, (3) rockyou + dive.rule, (4) combination attacks with company words, (5) brute-force up to 7 characters. Track timing - if you crack 60% in under an hour, that's your headline finding. Save cracked passwords for pattern analysis in the next step.
Password Pattern Analysis and Reuse Detection
Analyze cracked passwords for patterns, reuse, and policy gaming. Identify the most common base words, the most common transformations, passwords shared between multiple accounts, and accounts using variations of the same password across the domain. Check whether admin accounts have stronger passwords than standard users, and whether service accounts use guessable passwords.
Tools for this step
Tip: Group cracked passwords by pattern: 'SeasonYear!' variants, 'CompanyName+digits', keyboard walks, etc. Check for identical NTLM hashes across accounts - same hash means same password, revealing reuse without needing to crack. Pay special attention to admin accounts, service accounts, and accounts with sensitive access. Calculate crack rates by OU or department to identify groups needing targeted training.
Password Spray Resilience Testing
Test the domain's resilience to online password spraying attacks. Using the most common passwords you discovered during cracking, simulate a slow password spray that stays under lockout thresholds. This validates whether the passwords that exist in your domain would survive a real attacker's spray attempt. Also verify that spray detection and lockout policies actually trigger correctly.
Tools for this step
DomainPasswordSpray
KerbruteTip: DomainPasswordSpray is purpose-built for this - it enumerates valid accounts and sprays while respecting lockout policies. Kerbrute sprays via Kerberos pre-auth which is faster and doesn't generate traditional logon failure events. Spray only the top 3-5 most common passwords found during cracking. Coordinate with the SOC team to verify their spray detection fires correctly - if it doesn't, that's a finding too.
Report and Policy Recommendations
Compile findings into an executive report with clear metrics: percentage cracked within 1 hour, 4 hours, 24 hours. Show the most common patterns, reuse statistics, and accounts with the weakest passwords (redact the actual passwords). Provide specific policy recommendations: minimum length increase, banned word lists, mandatory MFA for specific account types, and detection improvements for spray attacks.
Tools for this step
Tip: Lead with the headline number - 'X% of domain passwords cracked in under 1 hour' gets executive attention. Include PingCastle's overall domain security score for broader context. Recommend a minimum 14-character length with a banned password list over complexity requirements - research shows length beats complexity. Recommend Azure AD Password Protection or similar tools that block common patterns. Include a timeline for remediation that accounts for password expiry cycles.
Other Workflows
OSINT Investigation Workflow
A structured approach to open-source intelligence gathering, from target identification through to reporting. Covers passive reconnaissance, social media analysis, email and phone lookups, and data correlation.
Web Application Penetration Test
A systematic approach to testing web applications for security vulnerabilities. Covers reconnaissance, mapping, vulnerability discovery, exploitation, and reporting.
Active Directory Attack Path
From initial foothold to domain admin. A step-by-step approach to enumerating and attacking Active Directory environments during authorized penetration tests.