---
id: 3157
title: "ESC8s and Where to Find Them"
source_domain: abdulmhsblog.com
source_url: "http://abdulmhsblog.com/posts/esc8andfindingwebenrollmentendpoints/"
published_at: "2026-03-27 00:00"
tags: ["pentesting", "vulnerability-research", "active-directory", "adcs", "esc8", "certipy", "relay-attack", "web-enrollment"]
phying_url: "https://phying.com/item/3157"
lang: en
---

# ESC8s and Where to Find Them

## Summary

How to locate AD CS Web Enrollment endpoints for ESC8 relay attacks by enumerating constrained delegation with nxc and BloodHound, then confirming certsrv endpoints with curl before relaying.

## Intelligence Metadata

- **Sources:** abdulmhsblog.com
- **Published:** 2026-03-27 00:00
- **Original:** http://abdulmhsblog.com/posts/esc8andfindingwebenrollmentendpoints/
- **Phying News:** https://phying.com/item/3157