Breach Club

Think and operate like a real red teamer. Cheatsheets, playbooks and a community of operators.

AD · Web · Cloud · mobile

[Breach Club @breachclub]

The exploit is the last 5%. The attack path is the other 95%, and almost nobody teaches it.

That is why Breach Club born: real attack paths, the tools I actually use, and free cheatsheets on Active Directory, Azure and web. Plus a community of operators.

https://t.co/6FqTzezwBS

[Breach Club @breachclub]

Cheatsheet + write-up:

https://t.co/JV8NrWkyFE

More tradecraft at @breachclub.

[Breach Club @breachclub]

Everyone runs BloodHound. Almost nobody thinks about how loud the collection is.

Thousands of LDAP queries screaming across the network is a great way to get caught before you've done anything.

How to map AD quietly, over ADWS 🧵

[Breach Club @breachclub]

The stealthy BloodHound workflow (ADWS collection, tooling, and how to analyze the graph) is a free cheatsheet.

Link below 👇

[Breach Club @breachclub]

Cheatsheet + write-up:

https://t.co/7fl86lVvbu

More attack paths at @breachclub.

[Breach Club @breachclub]

One coerced authentication and a domain controller can end up owning itself.

No CVE-of-the-week, no malware. Just NTLM behaving exactly as designed, pointed back at the machine that started it.

How NTLM reflection turns a DC into your escalation path 🧵

[Breach Club @breachclub]

Full chain (coercion methods, relay targets, the exact tooling and the fixes) is written up as a free cheatsheet.

Link below 👇

[Breach Club @breachclub]

Write-up + free cheatsheet:
https://t.co/XlivsSUh7h

Tool:
https://t.co/f8TZHpl05e

More at @breachclub

[Breach Club @breachclub]

A low-privileged user asks Active Directory Certificate Services for a certificate. Minutes later they own the domain.

That is CVE-2026-54121, "Certighost." I rebuilt the whole chain and wrote a tool for it.

How it works 🧵

[Breach Club @breachclub]

I packaged the full chain into a tool. The part that kills most attempts is the certificate SAN, so it fixes that automatically, reuses one computer account to avoid draining the machine account quota, and drives the request attributes for you.