AD foundations, rights, ACLs, Kerberos, NTLM, and Tier 0
Secure PDFUpdated Practitioner Edition
Active Directory Attack Paths
2026 Fifth Edition Revision 5.1 / Practitioner Edition
A practitioner field manual for authorized Active Directory assessment, attack-path validation, hybrid identity, detection, defense, and reporting.
400 pagesPractitioner editionSecure PDF delivery
Launch price $150 · one-time purchase · Stripe-secured private PDF delivery
Inside the Manual
Learn the path. Verify the evidence. Break the chain.
Built for defensive professionals, authorized assessors, instructors, administrators, and serious lab learners.
Scope, rules of engagement, reconnaissance, DNS, and enumeration
BloodHound, SharpHound, and PowerView verification workflows
Kerberoasting, AS-REP roasting, credential stores, hashes, and tickets
GenericAll, GenericWrite, WriteDACL, WriteOwner, GPO, OU, and sessions
Windows LAPS, gMSA, delegation, AD CS, DCSync, and trusts
Hybrid Microsoft Entra identity and control-plane analysis
Detection engineering, evidence, reporting, remediation, and retesting
GOAD labs, case studies, capstone, event encyclopedia, and field cards
Evidence-Driven
More than a command list.
The manual teaches attack-path reasoning, manual edge verification, least-invasive validation, defensible evidence, reporting language, and retest decisions.
Practitioner Ready
Designed for repeatable fieldwork.
Use sequential study, operator lookup, GOAD exercises, screenshot walkthroughs, detection references, field cards, case studies, and hybrid identity chain analysis.
Expanded for the Fifth Edition
Clearer practitioner workflows.
The Fifth Edition Revision 5.1 adds a clearer route into the book: plain-language section titles, a section-code legend, and a contents map, alongside the full Hacker Blueprint chain library (Chains 01-09), hybrid-identity attack paths, structured validation, defensive interpretation, and reporting guidance.
Stronger Reference Library
More material at hand.
Use the manual for study, authorized lab work, repeatable assessment, detection planning, evidence collection, remediation, and retesting.
Preview the Style
Read a free sample of the Fifth Edition.
This 28-page sample previews the manual's teaching style and foundational coverage. The paid product delivered after checkout is the full 400-page Fifth Edition Revision 5.1 / Practitioner Edition.
Operator Companion
Pair the book with Flightpath.
Flightpath is the ready-to-run CherryTree operator notebook: every command behind the decision cards, the field tells, and a clone-per-host engagement workspace. $19 for book owners, or $160 for the book + notebook bundle.
Included With Paid Scans
Get the expanded Client Edition with a paid scan.
The 43-page Public Exposure and Your Digital Footprint Client Edition is $14.99 standalone or included at no added cost with any paid one-time scan.
Responsible use: Commands and procedures are intended for intentionally vulnerable labs or systems covered by explicit written authorization. Purchase grants one customer a non-transferable license. Redistribution, resale, public posting, and removal of copyright notices are prohibited.