Abdul Mhanni

I authored Kerberos-Explained, a comprehensive GitBook resource designed to serve as an accessible, one-stop reference for the Kerberos authentication protocol and its implementation within Active Directory. Inspired by Eric Glass's well-known NTLM resource, I wanted to fill a similar gap for Kerberos, making the protocol approachable for security professionals without sacrificing the technical details that may otherwise be found in RFC 4120, MS-KILE, and MS-PAC. The guide walks through the protocol's mechanics, message structures, and AD-specific implementation details in a structured, digestible format. My goal was to create something a practitioner could read end-to-end and walk away with a genuine understanding of how Kerberos works under the hood, not just how to exploit it. Since publishing, the resource has been independently referenced and shared by other security professionals across separate blog posts.

I authored the first proper open-source implementation of MS-NEGOEX in Impacket. Its significance is that on one hand NEGOEX is the extended-negotiation evolution of SPNEGO, and it is the mechanism that now powers both PKU2U and CloudAP which are behind modern Azure/Entra authentication. The second is that Making NEGOEX available in Impacket in a testable, abstracted form removes a real barrier to entry and opens a new frontier for research into Azure-native authentication, letting security professionals interrogate and build on flows that were previously either unimplemented, not fully documented or otherwise difficult to build ontop of

I authored and released the largest publicly available Indicator of Compromise reference for Impacket, the most widely abused offensive toolset targeting Windows and Active Directory environments. The project goes beyond simple detection signatures by providing a deep technical breakdown of what "normal" looks like at the protocol level across SMB, LDAP, Kerberos, SPNEGO, and DCERPC, giving defenders the context they need to distinguish legitimate Windows behavior from offsec tooling. The community response was big as 313 GitHub stars within two months, over 400 combined likes across X and LinkedIn, and mentions in industry roundups including the UK National Cyber Security Centre CTO's blog. This reception reflected a gap in that cyber professionals had limited resources for understanding how Impacket's or any tooling behaves on the wire compared to native Windows traffic. This reference corrected that by acting as the largest deep dive into Windows "normal" protocols

This blog was original security research published as a technical blog post detailing a novel local privilege escalation vector. I discovered that Windows virtual accounts (e.g., MSSQL service accounts) can enroll in domain resources on behalf of the computer they run on—allowing them to obtain a machine certificate and then leverage S4U2Self to impersonate a local administrator, resulting in full host takeover. The technique relies solely on the certreq LOLBIN, making it stealthier and harder to detect than the noisier 'potato'-class attacks it can replace. I developed this method during a live engagement after gaining code execution as an MSSQL account on a host protected by CrowdStrike. The post walks defenders through the attack chain, detection opportunities, and mitigations. Shared across X (Twitter) and LinkedIn, it earned 500+ combined likes and sparked active discussion within the offensive and defensive security communities.

Beyond the entries highlighted here, my blog is a continuously growing body of work—and it keeps expanding even as this application is under review, covering novel Active Directory security research, hardening guidance, protocols implemented in Windows and practical cheatsheets for defenders and operators alike to navigate topics such as AWS pentesting etc. I believe in building my tooling in the open and learning in the open, and I do that most by publishing research on topics I repeatedly see clients and the wider community misunderstand: for example, the distinction between Channel Binding and Service Binding as it relates to EPA and NTLM relay attacks against MSSQL and HTTP endpoints. The entry limit means I cannot surface everything I have written, but my work consistently delivers new, unexplored research or meaningful expansion of existing topics, content that has been well received in the community, uplifts defenders, and informs fellow offensive security practitioners.