Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

RTT· red team

RTT · red team

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Search techniques, tools, commands…⌘K

No scenario

No scenario · all techniques in scope

IdleStatus

0Scenarios

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Back to Tools

krbrelayx

NTLM/Kerberos Relaying

Lateral Movement

AD Misconfigurations

Credentials & User Impersonation

Python toolkit for Kerberos relay and unconstrained delegation abuse in Active Directory. It accepts Kerberos authentication through SMB, HTTP, and DNS listener components, then stores or uses delegated tickets or relays authentication to supported target services. AD CS web enrollment is a documented HTTP relay target. Success depends on a separate authentication trigger, correct service/SPN mapping, target protocol protections, and enrollment permissions. The upstream README marks SMB as a target incomplete.

Source

https://github.com/dirkjanm/krbrelayx

Language

Python

References

github.com github.com github.com github.com dirkjanm.io

+7 more

Extended Details

RESTRICTED_ACCESS_BLUR_MARKER