// DACL PASTE & ANALYZE

Paste DACL / ACE Output — Get Attack Paths

Drop in a file or paste ACE output below — all analysis is client-side (built-in .xlsx reader, no third-party libs, nothing leaves your browser). Format is auto-detected. Grab your data from either stack:

PowerView WINDOWS

Get-DomainObjectAcl -Identity <target> -ResolveGUIDs
Get-DomainObjectAcl -Identity <target> | Export-Csv out.csv -NoTypeInformation
Get-DomainObjectAcl -Identity <target> | ConvertTo-Json

Also reads Excel/CSV exports with friendly names (Netwrix, ADManager, ADUC).

netexec / impacket KALI / LINUX

nxc ldap <dc-ip> -u <user> -p <pass> -M daclread -o TARGET='<name>' ACTION=read
dacledit.py -action read -principal <name> -target '<target>' <domain>/<user>:<pass>

Mask names (ControlAccess, FullControl, DS_SELF) are mapped automatically.

// INPUT — ACE DATA

Hide inherited ACEs Table: findings only

⚖ TIER 0 BASELINE — expected grants collapsed

My baseline — service accounts and delegated groups that are expected in this environment

⬩

Paste ACE data above to begin

Finds GenericAll / WriteDacl / WriteOwner, RBCD, Shadow Credentials, DCSync, LAPS disclosure, Self-Membership, GPO hijack, and more