Back Blackhillsinfosec

Abusing Delegation with Impacket (Part 2): Constrained Delegation

Blackhillsinfosec •BHIS • November 12, 2025

This is the second in a three-part series of blog posts discussing how to abuse Kerberos delegation! If you haven't already, feel free to read the first blog post, as it discusses the Kerberos authentication process and how delegation plays an important role in solving the double-hop problem.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Exploiting Kerberos Delegation with Impacket in Active Directory A series of blog posts discusses the exploitation of Kerberos delegation in Active Directory using Impacket. The first part covers unconstrained delegation, while the second part focuses on constrained delegation. These techniques allow attackers to bypass security measures and gain unauthorized access to resources within a network. 2 sources 7

Abusing Delegation with Impacket (Part 2): Constrained Delegation

The full story

Extracted Entities

Attack Types (1)

Tools (1)