An authorized and sanitized AD CS ESC8 NTLM relay lab with evidence, impact analysis, detection, and mitigations. - madjjjxh/adcs-esc8-ntlm-relay-lab

Windows SMB NTLM authentication coercion tool, triggers target to connect to your listener via MS-RPRN/MS-EFSR/MS-FSRVP/MS-DFSNM RPC protocols for NTLM relay. - RedteamNotes/Printerbug-Pro

Free Active Directory pentesting tool for Linux. Automates AD and LDAP enumeration, Kerberoasting, ASREPRoast, password spraying, ADCS/ESC1, DCSync, RBCD, gMSA, shadow credentials, NTLM relay and c...

Connection-bound NTLM relay broker for controlled HTTP/HTTPS browser sessions over SOCKS. - abdelaaziz0/NTLMancer

Ghostlink HTB — Full Chain AD + Gogs Exploitation | MQTT → NTLM Relay → Path Traversal → CVE-2025-8110 → ADCS ESC11 → DCSync | AMN SECURITY - amnsecurity/internal-domain-development-compromise-asse...

Demonstrates SMB Relay attacks in an Active Directory Home Lab by leveraging Responder and Impacket's ntlmrelayx to relay NTLM authentication, obtain administrative access, execute remote c...

Ghostlink HTB — Full Chain AD + Gogs Exploitation | MQTT → NTLM Relay → Path Traversal → CVE-2025-8110 → ADCS ESC11 → DCSync | AMN SECURITY - amnsecurity/ghostlink-writeup

Máquina Pirate de @HackTheBox — Dificultad Hard. Cadena completa de ataque Active Directory: Pre-Windows 2000 accounts con passwords predecibles, gMSA extraction, Ligolo-ng pivoting, PetitPotam coe...

Защита AD от NTLM Relay через coerced auth. Блокирует RPC-векторы принуждения аутентификации (MS-RPRN, MS-EFSR, MS-DFSNM, MS-FSRVP) с инструкцией по доменному деплою через GPO - vitwervit/coerce_fi...

💀 JOCK-JACKER - Advanced Offensive Security Framework. Network discovery, LLMNR poisoning, Kerberoasting, NTLM relay, Golden Ticket forgery, EDR bypass, persistence matrix, multi-protocol C2, and a...

An OPSEC-aware NTLM relay operations framework. Contribute to RedteamNotes/RelayX development by creating an account on GitHub.

NTLM/Kerberos relay attack prerequisite checker for Active Directory environments - DenialAndError1337/RelayHound

NOEMVEX APEX PREDATOR v6.0: Advanced Active Directory Offensive Suite. Automates complex domain compromise paths via Kerberos Delegation Abuse (RBCD, Unconstrained), krbtgt Hygiene Audits (Golden T...

Contribute to kaleth4/NTLM-Relaying development by creating an account on GitHub.

SMB Red Team Lab— NTLM Relay via LLMNR Poisoning, CVE-2007-2447, NTLMv2 Hash Cracking & NT AUTHORITY\SYSTEM on Windows 10 - Youneskc/SMB-Penetration-Testing-NTLM-Relay-Version-2-

Practical cheatsheets for pivoting, tunneling, and lateral movement in Windows environments, covering SSH, Chisel, Ligolo, NTLM relay, and common execution methods. - PentestPlaybook/pentest-cheats...

Attack Chain full compromise. LLMNR poisoning, Kerberoasting, IPv6 NTLM relay, pass-the-hash, and Golden Ticket persistence. No CVEs, no software vulnerabilities. - otto-youds/active-directory-pent...

Analyze NTLM attack surface and identify relay, poisoning, and coercion vectors in AD. - 0xnear-13/ntlm_audit.py

NTLM HTTP relay tool with SOCKS proxy for browser session hijacking - senderend/ghostsurf

Internal Active Directory Penetration Testing | NTLM Relay | RBCD | Domain Compromise - sagarV-cybersecu/Active-Directory-Penetration-Test