Resources:
Active directory pentesting: cheatsheet and beginner guide (hackthebox.com)
https://viperone.gitbook.io/pentest-everything/everything/everything-osint/password-osint
- Sending XML to API instead of json because sometimes it will also execute XML