AD Attacks and Internal Pentesting

Under-the-hood highlights of Prancer Network Research Module

| Super-power | How the code pulls it off | Value to your blue & red teams |

| Zero-touch intelligence sweep | A 90-second passive sniff (scapy.sniff) learns ARP, DHCP, NetBIOS, DNS, Kerberos and NTLM traffic, feeding a Discovery class that infers CIDR ranges, AD domains, DC IPs, user names and even _Kerberoast_ / _AS-REP_ roastable hashes. | You get an instant network map and credential intel without sending a single probe—perfect for stealthy purple-team or compliance-friendly baselining. |

| Smart alert engine baked-in | Each juicy finding triggers pr_alert(), writing OWASP-style JSON alerts plus human-readable evidence. Everything streams to /tmp/pr_alert.jsonl and to the stdout contract Prancer dashboards expect. | Stakeholders see exactly _what_ was found, _where_, and _why it matters_—ready for SIEM ingestion or straight into Jira. |

| Adaptive active recon | When passive recon guesses a CIDR, the module auto-fires an nmap -sV -A scan (threads & rate throttled) and parses the XML to raise port/service alerts. | Pin-points exposed services with CVE-relevant versions—no manual scope juggling. |

| Automatic AD user harvest | Detects a DC, then pivots to Impacket’s GetADUsers.py (passwordless or hash-based) to enumerate every AD account. | Demonstrates real credential exposure and speeds lateral-movement replicas for red-team drills. |

| Targeted packet captures with evidence artefacts | A jittered, filter-focused capture writes a timestamped .pcap plus matching alert, ensuring trace files for DFIR. | Let’s you replay or hand evidence to auditors— _the packet didn’t lie_. |

| Graceful everywhere-run | Runs as non-root? It warns & continues. Receives SIGINT/SIGTERM? It emits a final JSON result block before exit. | Safe to embed in CI/CD pipelines, ephemeral containers, or tightly-controlled prod mirrors. |

| Command provenance | Every external tool call is logged into the top-level commands[] array with stderr capture. | Auditors (or your own devs) can reproduce every step without guessing flags. |

_“Mapping your kingdom before the siege”_

Before we swing a single exploit, we deploy the Prancer Network Research Module to answer four critical questions:

1. What does the network really look like?

In under two minutes of silent listening we learn subnets, Windows domains, and key servers—often without tripping a single IDS alert.

2. Where are the live hosts and what do they expose?

A surgical Nmap sweep, rate-limited to keep your SOC dashboards calm, fingerprints every open service and version. You’ll see precisely which boxes are quietly running outdated SMB or forgotten Tomcat instances.

3. Who are the users and how can we impersonate them?

By harvesting NTLM handshakes, Kerberos realms and domain-controller traffic, we automatically enumerate Active Directory accounts—no password required—replicating the intel an attacker would weaponise for lateral movement.

4. Can we prove it with packets?

Every interesting exchange is written to a signed-off .pcap and referenced in the alert feed. That means your forensic or compliance teams can replay the evidence instead of relying on screenshots.

Why this matters

Faster hardening cycles – Ops receives a prioritized list of live hosts, open services and weak auth flows within minutes, not days.

Lower risk testing – Passive-first methodology means minimal disruption even in production mirrors.

Audit-ready deliverables – All findings come with OWASP/CWE tags, JSON artifacts, and raw packet captures—no extra tooling needed to satisfy auditors.

Seamless hand-off to Prancer Exploit Module – The intel (CIDRs, DC IPs, credentials) flows straight into the Attack Module you saw last week, enabling a full kill-chain exercise at the click of a button.

TL;DR: The Network Research Module is your _cartographer_. It quietly draws a high-resolution map of your environment, uncovers hidden credentials, and tags every doorway worth kicking in—so the next phase of Prancer testing is laser-focused and impossible to ignore.