Daniel Andrade
Independent Active Directory & Internal Infrastructure Penetration Tester
I identify and validate multi-step attack paths leading to Active Directory domain compromise, auditing misconfigured DACL permissions, AD CS certificate templates, Kerberos delegations, and authentication coercion.
Available for direct enterprise assessments (100 to 500+ endpoints) and white-label subcontracting for offensive security consultancies.
Assessment Capabilities
01.Active Directory & AD CS Auditing
Offensive auditing of Enterprise PKI (ESC1 to ESC17, orphaned certificate templates, enrollment relays), Kerberos delegations (Unconstrained, KCD, RBCD, Shadow Credentials), dangerous DACL permissions, GPO abuse, and cross-forest trusts.
02.Internal Network & Assumed Breach
Validation of lateral movement across 100 to 500+ endpoint environments: authentication coercion, NTLM relaying, SMB and LDAP signing enforcement, credential hygiene (LAPS, gMSA), and network segmentation verification.
03.Subcontracting for Consultancies
Reliable, senior capacity for offensive security consultancies and MSSPs. White-label execution aligned with your rules of engagement, testing infrastructure, and client reporting standards.
04.Actionable Remediation & Debriefs
No automated scanner dumps. Every engagement delivers validated attack-path narratives, executive risk summaries, and live technical debriefs to help infrastructure teams fix root causes without disruption.
Example Finding: Multifunction Printer to Domain Admin
Attack Vector & Root Cause
An unauthenticated office printer exposed stored domain credentials via LDAP pass-back. The compromised account held inherited WriteDacl permissions over Tier-0 PKI groups, allowing certificate template modification (ESC4) and full domain dominance.
Production-Safe Remediation
Step-by-step remediation instructions with verified PowerShell and dsacls commands to remove unauthorized ACL inheritance and restrict service account logon rights without interrupting enterprise printing or PKI services.
Featured Research & Tooling
nxc-adcs-orphans: NetExec Hygiene Detector
Open-Source ToolEnterprise CAs can continue publishing certificate-template references in Active Directory even after the underlying pKICertificateTemplate object is deleted. This tool identifies orphaned templates that attackers can recreate to escalate privileges.
nxc ldap <DC_IP> -u <USER> -p '<PASS>' -M adcs_orphansFrom Office Printer to Domain Admin
Case StudyWhy hardened Windows workstations and disabled LLMNR are not enough: how multifunction printers, network appliances, and over-privileged default group DACLs turn an unauthenticated network drop into full Tier-0 domain dominance.
(svc_printer) -> (Domain Users) -[WriteDacl]-> (PKI-Admins) -> (Tier-0)Verified Credentials
HTB CAPE
2026Certified Active Directory Pentesting Expert
HackTheBox
Advanced enterprise Active Directory exploitation, AD CS abuse, Kerberos delegations, trust boundaries, and defense evasion.
Verify credential (opens in a new tab) →OSCP
2024Offensive Security Certified Professional
OffSec
Hands-on network penetration testing, internal pivoting, privilege escalation, and Active Directory domain compromise.
Verify credential (opens in a new tab) →HTB Pro Labs
2024 - 2025Enterprise Pro Labs (Alchemy & Dante)
HackTheBox
Large-scale enterprise network pivoting, multi-forest Active Directory exploitation, and complex lateral movement paths.
Verify credential (opens in a new tab) →Track Record & Background
Independent Penetration Testing Practice
January 2026 to PresentConducting internal network and Active Directory penetration tests for environments typically spanning 100 to 500+ endpoints and 200 to 500 users. Delivering both direct enterprise assessments and white-label subcontracting for specialized offensive security consultancies. Worldwide remote engagements.
Systems & Security Engineering Background
2021 to 2026Prior to full-time penetration testing, worked in systems security engineering: hardening embedded Linux operating systems according to ANSSI and NIST guidelines at Osmium Solutions, and conducting cryptographic threat analysis on distributed IoT networks at Instituto de Telecomunicações.
Ready to audit your Active Directory attack paths?
Whether you need a standalone internal network pentest or a specialized AD contractor for an upcoming client engagement, let’s scope your requirements.