Active Directory Toolkit

Interactive AD pentest tools. SID decoder, LDAP filter builder, and Kerberos flow visualizer.

#AD SID Decoder

AD SID / RID Decoder

Well-Known RID Reference

RID Account Notes

#Interactive Tools

#LDAP Filter Builder

Visual LDAP filter constructor with presets (Kerberoastable, AS-REP Roastable, delegation, AdminCount...) and automatic command generation for ldapsearch / PowerView / python-ldap. Includes UAC flag decoder.

LDAP Filter Builder - Active Directory

Visual Filter Builder

UAC Flag Decoder

Enter decimal value

#Kerberos Authentication Flow

Kerberos flow visualization (AS-REQ -> AS-REP -> TGS-REQ -> TGS-REP -> AP-REQ) with attack injection points (Kerberoasting, AS-REP Roasting, Golden/Silver Ticket, Pass-the-Ticket, Delegation) and exact commands.

Kerberos Authentication Flow

1
AS-REQ Client → KDC

Client sends username + timestamp encrypted with user's key (pre-authentication). Fields: cname, realm, till, nonce, etype (preferred encryption).

2
AS-REP KDC → Client

KDC returns: TGT (encrypted with krbtgt hash) + session key (encrypted with user's key). TGT contains the PAC with user SID, group memberships, and privileges.

3
TGS-REQ Client → KDC

Client presents TGT + requested service SPN + authenticator (encrypted with session key). KDC validates the TGT but does not check if the user can access the service.

4
TGS-REP KDC → Client

KDC returns the Service Ticket (TGS) encrypted with the service account's key + a service session key encrypted with the TGT session key.

5
AP-REQ Client → Service

Client presents the Service Ticket + authenticator directly to the target service. Service decrypts with its own key and validates the PAC. No KDC involved at this stage.

6
AP-REP Service → Client

Mutual authentication (optional). Service proves its identity by responding with a message encrypted with the service session key. Only sent if the client requested mutual auth in the AP-REQ flags.

✓
Access Granted Normal flow complete

Service grants access based on the PAC (Privilege Attribute Certificate) embedded in the Service Ticket. Authorization is entirely local, no further KDC contact required.

Ticket Reference

Ticket Encrypted with Lifetime Forged via
TGT krbtgt key 10h / renew 7d Golden / Diamond
TGS (Service Ticket) Service account key 10h (not renewable) Silver Ticket

Encryption types: RC4 (etype 23, NTLM hash) • AES128 (etype 17) • AES256 (etype 18, default since Server 2008). RC4 is weaker and faster to crack. AES keys derived from password + salt (realm + principal).

#Also See

#Official Resources

#Cyber Aurelien Guidi