How can you list active net sessions on a Windows host?
Several methods exist to view net sessions: the `net session` command in cmd, the Sysinternals tool LogonSessions (which shows sessions with Logon type 'Network'), a custom C++ program using LsaEnumerateLogonSessions and LsaGetLogonSessionData, or mimikatz with `token::list` after enabling debug privileges. These tools reveal the session's user, SID, and authentication identifier, which can then be used for token impersonation.
net session listLsaEnumerateLogonSessionsLogonSessionsmimikatz token::list