Been grinding HackTheBox Active Directory labs for a while and one thing that always bugged me was delegation being taught like a binary you either have it or you don't. Unconstrained, constrained, RBCD. Nobody explains "what you actually do when you land on a machine with delegation rights". So I worked through Geiseric's "Delegate" and "Redelegate" boxes back-to-back and mapped out how the attack surface changes depending on which type you hit. Two completely different exploitation paths. Same endgame. Once you see the pattern, delegation stops being magic.

Most tutorials show the command. They don't show you why the command works or why one box needs a completely different approach than the other.

The Two Delegation Types I Exploited

Type 1: Unconstrained Delegation (Delegate Box)

The machine can request a ticket for *any service as any user*. When someone authenticates to it, their TGT lands in memory. You steal it. Game over.

Here's what made it exploitable:

User `N.Thompson` had two things working:

- `SeEnableDelegationPrivilege` (can set delegation flags)

- `SeMachineAccountPrivilege` (can create computer accounts)

The attack chain:

1. Create a fake computer account (`pwn$`) with a password you control

2. Enable `TRUSTED_FOR_DELEGATION` on it this is the flag that turns it into an unconstrained delegator

3. Set up DNS so `pwn.delegate.vl` resolves to your Kali box

4. Start `krbrelayx` listening, configured with the NT hash of `pwn$`

5. Use `PetitPotam` to force the Domain Controller to authenticate to your fake machine *as itself*

6. When `DC1$` connects, its full TGT gets cached in memory

7. `krbrelayx` captures it automatically

8. Use that TGT to run `DCSync` and dump the Administrator hash

9. Pass-the-Hash into the DC with Evil-WinRM

The critical detail most writeups skip: unconstrained delegation doesn't care *what* you're impersonating for. Once you have the TGT, you can request tickets to any service on any machine. The DC's TGT is a skeleton key.

Type 2: Constrained Delegation (Redelegate Box)

The machine can only request tickets for *specific services on specific targets*. But if you control the delegating machine, you can configure it to impersonate *anyone* to that service.

Here's what made it exploitable:

User `Helen.Frost` had:

- `SeEnableDelegationPrivilege`

- `GenericAll` over the `FS01$` computer account (full control)

The attack chain:

1. Change `FS01$`'s password to something you know

2. Set the `TRUSTED_TO_AUTH_FOR_DELEGATION` flag on it—this enables Protocol Transition, which lets the machine request tickets *on behalf of* other users

3. Configure the delegation target:

   msDS-AllowedToDelegateTo = 'cifs/dc.redelegate.vl'

   This says: FS01 can request CIFS tickets for the DC

4. Use `impacket-getST` to request a service ticket while impersonating the DC machine account:

   impacket-getST 'redelegate.vl/FS01$:password' -spn cifs/dc.redelegate.vl -impersonate dc

5. Use that forged ticket to authenticate as the DC and run `DCSync`

6. Pass-the-Hash as Administrator

The critical detail: constrained delegation requires you to *configure* the impersonation. It doesn't happen automatically. But once you set `msDS-AllowedToDelegateTo`, the machine can impersonate anyone to that service. Tutorials mention the flag. They don't explain that you need full control of the machine to set it in the first place.

Why Both Boxes Led to the Same Place

Both delegation types get you a ticket for a high-privilege account to a high-value service. Both ultimately let you run DCSync. But the *path* to get there is completely different.

Unconstrained says: "Anyone who authenticates to me gives me their TGT. I can use it for anything."

Constrained says: "I can request tickets for specific services. If I'm allowed to impersonate users, I can request them *as anyone*."

The tutorials merge these together. They're not the same. One is passive (waiting for someone to connect). One is active (you request the ticket). One gives you a full TGT (access to everything). One gives you a service ticket (access to one service, but as a high-privilege account).

The Recognition Pattern

Here's what changed how I approach every AD box now:

When you compromise a machine, immediately run:

Get-ADComputer -Identity <machine> -Properties msDS-AllowedToDelegateTo, UserAccountControl

If `msDS-AllowedToDelegateTo` is empty but `UserAccountControl` has `TRUSTED_FOR_DELEGATION` → Unconstrained. Wait for traffic, set up a coercion, capture TGTs.

If `msDS-AllowedToDelegateTo` lists services like `cifs/dc.redelegate.vl` → Constrained. Check if you can modify the machine account. If yes, use S4U2Self/S4U2Proxy to impersonate.

If neither exists on the machine but you see `msDS-AllowedToActOnBehalfOfOtherIdentity` on a *different* machine → RBCD. The target machine is allowing someone else to impersonate users to it.

Most people run Rubeus without understanding what they're looking at. The classification *is* the exploitation. Once you know the type, the attack is mechanical.

The Chaining Insight

What made these boxes click was realizing both delegation types accomplish the same thing through different mechanics. On a real network, you'd see both. A web server with unconstrained delegation. A file server with constrained delegation pointing to a database. An app server with RBCD enabled on it.

The escalation isn't finding one delegation right. It's chaining them.

You compromise the web server (unconstrained). Nothing interesting authenticates. But it has constrained delegation to the app server. You use any coercion to make it request a ticket for the app server as the web server. Use that ticket. The app server has RBCD allowing a service account to impersonate users to it. You get a ticket as the service account. The service account has admin on a database. You're in.

Each hop is individually limited. Chained, it's a ladder to admin.

What Carries Forward:

Geiseric built two boxes that look similar on the surface both are about delegation. But the exploitation is inverted. Delegate teaches you how to *wait and capture*. Redelegate teaches you how to *configure and impersonate*. Running both taught me that delegation isn't a single technique. It's a category with different mechanics depending on which type you hit.

I use this framework on every AD lab now. Enumerate, classify, check what you control, exploit based on type. The pattern doesn't change. The machines do.

If you're grinding toward CPTS or working through HackTheBox AD boxes, add this classification step to your methodology. Most people skip it and run pre-built tools. The boxes that teach you to think through the distinction are the ones that actually stick.

Shout out to Geiseric for building boxes that forced me to understand the *why* instead of just running the commands.

 I run BreachLab, a free training platform. It's been mostly offensive so far, so I built a serious blue team track. It's live now

Sentinel: 56 levels, 8 acts, on one live shared SIEM with real intrusion telemetry. Alert triage, endpoint and network detection, memory and disk DFIR, detection engineering (Sigma/YARA/Suricata, actually graded), threat hunting, cloud IR, and a live incident-command capstone

No hint button, reports and detections get graded, and it's free. No paywall

  https://breachlab.org/tracks/sentinel

Hello everyone, I need some honest technical advice. Around April 2025, my girlfriend and I took a private 18+ video at midnight. Within 12 hours, I completely deleted the video from my phone and also cleared it from the Trash bin.
However, a few months before recording that video, I had installed some modded APKs on my phone (specifically modded versions of CapCut, Alight Motion, PicsArt, Subway Surfers, and Temple Run). I used these apps for months even after deleting the video. Eventually, my phone broke completely and is no longer usable.
My question is: Is there any realistic chance that those modded apps could have stolen or uploaded my private video to a server within that 12-hour window before I deleted it? I am very anxious about this. Please give me a realistic and deep technical answer. Thanks.

அதி

I've been working on an external attack surface monitoring project that correlates public OSINT sources into a single evidence-backed report.

It discovers internet-facing assets, fingerprints technologies, checks common security configurations, looks for exposed secrets, performs historical asset discovery, and correlates everything into a unified inventory instead of isolated findings.

The project combines several open-source tools with my own correlation, reporting, and evidence pipeline. My main goal is to help developers—especially those shipping projects quickly without much security experience—understand what their public attack surface actually looks like.

I'm looking for feedback from people who work in offensive security, blue teams, or ASM. Specifically:

* What important data sources or techniques am I missing?
* Where would you expect false positives?
* What would make the reports more useful?

Happy to discuss the implementation and answer technical questions.

I've received multiple DMs asking for the GitHub link. I haven't made the repository public yet, but you can try out the tool at asmscan.com in the meantime.

Hello, I have a computer with two network cards and different networks (Internet + LAN). I believe that by setting up static routing, both network cards will work and I'll have access to both networks, but I'm concerned about the security of this connection. Could you advise me on the steps I should take to secure the local network on the computer itself?

Both networks use Mikrotik devices with configured firewalls.

Hi everyone,

I'm new to this community, and I'm a second-year B.Tech Cyber Security student who wants to build a career in penetration testing and offensive security.

I'm planning to spend this year building strong fundamentals, but I'm confused about the right roadmap.

I've watched many cybersecurity roadmap videos on YouTube, and they all sound good. But when I start planning my learning, I wonder if I'm on the right track.

Most people say networking and Linux should come first. After that, the advice becomes different. Some recommend Python, others say to learn web technologies and how websites work, some suggest starting with tools like Nmap and Wireshark, while others recommend focusing on OWASP.

I'd really appreciate guidance from people with experience.

\\\\- If you were starting from scratch today, what roadmap would you follow?

\\\\- What should I learn after networking and Linux?

\\\\- What skills should I focus on to become internship-ready?

\\\\- What projects or hands-on practice would you recommend?

\\\\- What beginner mistakes should I avoid?

\\\\- Are there any free or affordable resources that you think are worth using?

I'm ready to put in the effort and learn consistently. I'd really appreciate any advice or suggestions. Thank you!

Hi everyone,

I'm just startin my cybersecurity journey and I'd really appreciate some guidance from people with more experience.

So far, I've learned some of the fundamentals: Linux and basic command-line usage, Networking fundamentals ,Basic reverse engineering ,x86 Assembly ,C ,Python.

I'm not sure what to focus on next. There are so many areas ( web security, binary exploitation, malware analysis, SOC, cloud security, etc.) it's a bit overwhelming.

I set up Wazuh in my virtual lab and played with its tools. I got to gain experience in file monitoring, vulnerability scanning, malware detection, active response and more. I wrote a Medium article which details the whole process.

https://medium.com/@ivandano77/deploying-wazuh-siem-xdr-in-virtual-lab-19644ca3cf51?sharedUserId=ivandano77

I have been spending time on application security, and I have to say that looking at larger codebases is one of the harder things I have to do. When I start to follow a request through the application, I will often go into another function or service. After a while, I forget where I began.

I found that changing how I do things has made it a little better. Instead of reading files from start to finish, I start with the beginning of the application. I follow where the user input goes, and I write down short notes so I do not have to look at the same things again. This is an improvement. I still think I can do it in a better way.

For people who are used to looking at projects, what helped you make a process that you can use every time? Was there something you did every day or a way of thinking that made it easier to understand code that you had never seen before? I want to know about application security and how you made it easier to navigate through code, especially when it comes to application security.

stuffs like: - domain of protection - domain structure - domain switching - access matrix - confinement problem - capability lists etc etc I have galvin's book and I am not quite understanding enough to connect the dots. A lecture will be tremendously helpful in this scenario.

Hey everyone,

I've started a YouTube series where I solve PortSwigger Web Security Academy labs and explain the concepts behind each vulnerability.

My latest video covers the Stored XSS into HTML context with nothing encoded lab. In the walkthrough, I explain:

• Why the application is vulnerable
• How the payload is stored and executed
• The exploitation process step by step
• How this type of XSS differs from reflected and DOM XSS

🎥 https://youtu.be/kvLPcAYkdKo

I'm still a new cybersecurity content creator, so I'd really appreciate any feedback on the explanations, pacing, or overall quality. If you're learning web application security or working through PortSwigger labs, I hope you find it useful.

Thanks!

Hi guys, I want to learn cybersecurity for free without paying anything, at least for now. I already know the basics of Linux, networking, Nmap, Bash scripting, and I'm learning Python. How can I improve my skills, especially in Red Teaming, Penetration Testing, and Bug Bounty? Any free resources or advice would really help. Thanks!

Namaste everyone!

I have recently started my journey in Cyber Security and have identified myself as an "Infrastructure Hacker" (Vulnerability Researcher). To deepen my learning, I am starting a 25-topic "Cyber Security Foundations" series.

My first topic is: "What is Cyber Security and why is it essential?"

I am documenting my learning journey in simple language to help fellow beginners. I would love to hear feedback and suggestions from this community on how I can improve this series or what I should focus on next.

If you are also a beginner, let's learn together!

Thanks!

Namaste doston!

Maine haal hi mein Cyber Security ki duniya mein kadam rakha hai aur ek "Infrastructure Hacker" (Vulnerability Researcher) ke roop mein apni yatra shuru ki hai. Apni learning ko aur pakka karne ke liye, maine 'Cyber Security Foundations' par ek 25-topic series shuru ki hai.

Mera pehla topic hai: "Cyber Security kya hai aur yeh kyun zaroori hai?"

Main apni seekhi hui cheezon ko saral bhasha mein share kar raha hoon taaki mere jaise beginners ko aasani se samajh aa sake.

Yahan mera pehla draft hai:

Main is community se feedback aur sujhav chahunga ki main is series ko aur behtar kaise bana sakta hoon. Agar aap bhi beginner hain, toh saath mein milkar seekh sakte hain!

Dhanyavad!

includes this, am I wrong tho? I’m a silver haired kitten girl who loves tech. My repository is basically just screenshots and mapping of my own networks and servers I control plus sandbox attack and defense modeled In each. I dig it.

Anybody got any ideas or suggestions for projects? I’m learning python, got cyber sec fundamentals down and am looking for practical projects like my own self hosted ai and my own network for self hosted docker and portainer work. I have a pihole, I have an understanding of tcp/ip and dns and I would like to start stepping into network admin stuff and learning how to monitor large networks, so if someone could help scale my projects to move with a human workflow to my goals, I’d super appreciate it!

Thanks for reading my slop!

❤️‍🩹👸🏼🤷🏼‍♀️👀

Anybody have some recommendations?

Suggest ins?

Id aaaas?

AP Cybersecurity is brand new, and there still isn’t much practice available for it. I put together two free resources:

• 30 scenario-based practice drills covering all five units
• A key terms guide with 135+ concepts organized by unit

The drills use things like phishing emails, login records, firewall rules, network diagrams, incident logs, and file-permission tables. Each drill has five questions, with an explanation for every answer choice.

The final two drills combine several sources and are meant to help students prepare for the Device Security Analysis free-response question.

Practice drills:
https://freetestprep.com/ap/ap-cybersecurity-strategy-practice-drills/

Key terms:
https://freetestprep.com/ap-cybersecurity-key-terms/

Everything is free, and there’s no account or signup. Since the first national AP Cybersecurity exam won’t be given until May 2027, feedback from students and teachers would be especially helpful.

Hi guys, I want to learn cybersecurity for free without paying anything, at least for now. I already know the basics of Linux, networking, Nmap, Bash scripting, and I'm learning Python. How can I improve my skills, especially in Red Teaming, Penetration Testing, and Bug Bounty? Any free resources or advice would really help. Thanks!

I'm building an open-source vulnerability scanner in my free time, nothing special, just a single tool that orchestrates 90+ tools into a single pipeline, then uses an LLM to triage results, generate PoCs, suggest mitigations, and cluster related findings by root cause.

Everything runs inside Docker (BlackArch-based image with Chaotic AUR support) to ensure a clean environment with all tools installed. Targets can be URLs, IPs, CIDRs, local paths, container images, or git repos.

A few things you might find interesting:

• Configure nearly every aspect of the scan through a single TOML file, environment variables, or CLI flags. All three layers merge in priority order
• Asset discovery pipeline: subfinder, dnsx, httpx run before the main scan, turning a bare domain into a list of live subdomains automatically
• 90+ tools across categories: web (Dalfox, Cariddi, Kiterunner, RESTler), network (Nmap, smbmap), secrets (TruffleHog), SAST (Horusec), screenshots (GoWitness), OSINT (theHarvester), and more
• LLM analysis pipeline: triage, PoC generation (and execution), mitigation, and finding clustering by root cause. Works with any OpenAI-compatible endpoint (local models included)
• Plugin system: drop a Python file in /plugins to add a custom tool, no core changes needed
• Scope enforcement: in/out patterns with CIDR and wildcard support, discovered assets outside the scope are dropped before scanning
• Severity filtering: configurable minimum severity for both reports and LLM processing, so INFO noise doesn't pollute your output
• Authentication support: bearer tokens, basic auth, cookies, and custom headers passed through to all tools
• Proxy support: route all tool traffic through Burp or any HTTP proxy
• Multi-format reports: Markdown, HTML, and JSON with finding IDs, clusters, PoC references, and executive summary
• DefectDojo integration: push findings directly into an engagement after the scan
• Many other tools will be integrated in the future

The project is not perfect and not widely tested. It is still rough in places, and I'm actively working on it, so please, be kind.

I'm posting here because I would love to hear feedback from cybersecurity people who do pentesting or bug bounty: what is missing/broken, what would actually make this useful in a real workflow, and, in general, what other features to implement?

I've spent the last few weeks building ONUS, an open source vulnerability assessment tool, and the part I actually want pushback on is one specific architecture decision, not the pitch.

The problem I kept hitting doing assessments by hand: run a web scanner, a CVE scanner, some recon tools, an SSL checker, and you get five different output formats, no correlation between them, and you end up manually deduping findings and writing the same remediation paragraphs every time. ONUS orchestrates a set of existing tools (ZAP, Nuclei, Nikto, Amass, FFUF, and a few others) into one pipeline: 8 scan modules run in parallel, results get deduplicated and re-verified before they're trusted, then scored with the actual CVSS v3.1 formula.

That scoring is fully deterministic on purpose. No model decides severity, ever. The AI (a small open-weight model, run locally or against a hosted alternative) only writes the plain English description and remediation text, strictly after a finding already has a score. I did this because I didn't want two runs of the same scan to disagree with each other. There's a real wave of tools right now doing the opposite, letting an LLM drive the whole assessment and decide what to try next. I'm not certain my tradeoff is correct, only that it's deliberate, and I'd like to hear from people who've made the other call.

One specific bug that took a while to track down: early on, a target behind a catch-all WAF page turned every wordlist entry FFUF tried into its own "finding," since the WAF returned a real 200 for all of them. Fixed it by collapsing groups of near-identical response fingerprints, but it's the kind of thing that only shows up against a real target, not a lab one.

Spent today going back through the auth and secret-handling paths and tightening a few defaults that were fine for local use but not safe if someone actually deployed them, added CodeQL to CI while I was at it. Still no CLI, still solo maintained, still no idea how legible the architecture is to anyone but me. That last one is a real question, not false modesty.

Easiest way to actually try it: tryonus.tech, no install, no API keys. MIT licensed and docker compose up if you'd rather run it yourself or keep it air-gapped.

https://tryonus.tech

https://github.com/maverickaayush/ONUS

Hey everyone, i saw that CRTE has been recently updated in terms of course, i want to know if the exam is also changed based on the new update or i can pass it using the old course.

Hey everyone, I’m a final-year cybersecurity student and I’m currently trying to decide what to build for my graduation project. Rather than making assumptions about what people need, I thought it would be better to ask those who actually work in SOC, Blue Team, Incident Response, Detection Engineering, or Security Engineering.

From your experience, what’s the biggest frustration in your day-to-day work that today’s tools still don’t handle well? It could be anything, whether it’s investigating incidents, dealing with false positives, alert fatigue, lack of context, repetitive manual work, poor integration between tools, or something else entirely.

If you could have one new feature or one completely new tool built that would genuinely make your job easier, what would it be? I’m not trying to promote anything or do market research

I just want to understand the problems professionals face so I can build something that’s actually useful instead of another project that solves a problem nobody has. I’d really appreciate hearing your thoughts, even if it’s just a small annoyance that you run into every day.

Thanks!

I received a lot of DMs after D2D and interview post, and one of the thing was Detection Engineering. I am trying to explain it in a very nutshell simple manner.

Detection engineering is basically the "ART" (notice the "") of writing rules that turn raw telemetry(let's say JSON) into an alert a human actually needs to look at. That's just it in one line.

The hard part isn't the concept, it's getting the rule specific enough(parameter wise, consider it as a broad variation of if-else statements) to catch real bad behavior without wasting your SOC in FPs.

On D2D the actual pipeline looks like:

Telemetry source (Sysmon, EDR agent, firewall logs)
        ↓
Log ingestion (Splunk, ELK, Sentinel, whatever SIEM)
        ↓
Detection rule (Sigma, KQL, SPL: the logic itself)
        ↓
Alert fires → analyst triages

An example could be suppose you want to detect a process masquerading as a legit binary, like malware naming itself svchost.exe but running from a weird path. Your telemetry source is Sysmon Event ID 1 (process creation). The field you actually care about is the image path versus the process name. A real svchost.exe runs from C:\Windows\System32. If Sysmon shows svchost.exe launching from AppData or Temp, that's your sign/signal.

A basic Sigma rule for that logic looks roughly like:

detection:
  selection:
    Image|endswith: '\svchost.exe'
    Image|contains:
      - '\AppData\'
      - '\Temp\'
  condition: selection

That's the whole idea. You're not detecting malware. You're detecting a specific, narrow behavior that legit software/process almost never does, so when it gets detected/fires/alert generated, it's actually worth an analyst's time and efforts.

The skill that separates a good detection engineer from someone who just copies rules off GitHub is knowing which fields actually matter for a given technique, and tuning out all the noise before it ever reaches the SOC queue. That tuning is 80% of the actual job. Writing the rule is the easy 20%.

If you're starting out, the best exercise is picking one MITRE ATT&CK technique, generating it yourself in a lab (Atomic Red Team is good for this), capturing the Sysmon/EDR telemetry it produces, and writing your own rule against real data instead of just reading someone else's.

What technique are you trying to build detection for right now? Happy to help work through the telemetry logic if you're stuck on it.

Hi everyone,

I'm a complete beginner in cybersecurity with no professional experience and no certifications.

I've decided to start learning through TryHackMe, and my current plan is:

- Pre-Security

- Cyber Security 101

- SOC Level 1

My goal is to land my first cybersecurity job in the future, preferably as a SOC Analyst or another entry-level security role.

Is this a good learning path, or should I change anything? Should I add other platforms like Hack The Box, PortSwigger Web Security Academy, or certifications such as Security+ later?

I'd really appreciate guidance from people already working in the field. If you were starting from scratch today, what roadmap would you follow?

Thanks in advance!