active-directory-attacks
This skill covers offensive techniques for compromising Active Directory environments, including reconnaissance with BloodHound, credential extraction via Kerberoasting and AS-REP roasting, ticket forgery, and lateral movement. Learn pass-the-hash, DCSync, NTLM relay, and exploitation of AD Certificate Services vulnerabilities alongside critical CVE tactics.
active-directory-attacks teaches red team techniques for compromising Windows domains through Kerberos, credential, and lateral movement attacks.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-07-26
active-directory-attacks teaches red team techniques for compromising Windows domains through Kerberos, credential, and lateral movement attacks. This skill covers offensive techniques for compromising Active Directory environments, including reconnaissance with BloodHound, credential extraction via Kerberoasting and AS-REP roasting, ticket forgery, and lateral movement. Learn pass-the-hash, DCSync, NTLM relay, and exploitation of AD Certificate Services vulnerabilities alongside critical CVE tactics.
Use it when
- active-directory-attacks covers multiple Kerberos-based attacks: Kerberoasting extracts service account credentials.
- active-directory-attacks details DCSync attacks that impersonate domain controllers to extract password hashes directly from AD.
Verify before relying
Read SKILL.md below before installing (2 files). Open directory: indexed for reading, not audited.
Install
zebbern/claude-code-guide/active-directory-attacks · repository language: Python
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How to attack active directory in red team operations?
active-directory-attacks covers offensive techniques for compromising AD environments through reconnaissance, credential extraction, and exploitation. The skill teaches BloodHound enumeration, Kerberoasting, AS-REP roasting, pass-the-hash attacks, DCSync exploitation, NTLM relay, and lateral movement tactics. You'll learn to leverage Kerberos vulnerabilities, forge tickets, and exploit AD Certificate Services weaknesses to achieve domain compromise during authorized penetration tests.
What Kerberos attack methods does active-directory-attacks include?
active-directory-attacks covers multiple Kerberos-based attacks: Kerberoasting extracts service account credentials; AS-REP roasting targets users without pre-authentication; Golden Tickets forge domain admin credentials; Silver Tickets create forged service tickets; and Rubeus automates these attacks. The skill teaches ticket generation, manipulation, and replay techniques for lateral movement and privilege escalation within Windows domains.
How does active-directory-attacks explain DCSync and NTLM relay?
active-directory-attacks details DCSync attacks that impersonate domain controllers to extract password hashes directly from AD, and NTLM relay techniques that intercept and forward authentication requests to compromise systems. Both methods enable credential harvesting and lateral movement. The skill covers exploitation prerequisites, detection evasion, and practical implementation using tools like Mimikatz and Responder for domain controller compromise.
What credential harvesting techniques are covered?
active-directory-attacks teaches credential extraction via Kerberoasting, AS-REP roasting, pass-the-hash attacks, and Mimikatz-based harvesting. It includes LLMNR poisoning with Responder, DCSync exploitation, and NTLM relay interception. The skill demonstrates how to capture, extract, and reuse credentials for lateral movement and privilege escalation across Windows domain environments during authorized red team operations.
Can active-directory-attacks help with domain administrator access?
active-directory-attacks teaches enumeration and exploitation pathways to domain administrator access through credential extraction, ticket forgery, and lateral movement. Techniques include Kerberoasting service accounts, exploiting AD Certificate Services, DCSync attacks, and pass-the-hash methods. The skill emphasizes reconnaissance with BloodHound to identify privilege escalation paths and vulnerable accounts for authorized penetration testing scenarios.
What tools and CVEs does active-directory-attacks reference?
active-directory-attacks covers tools including BloodHound for enumeration, Mimikatz for credential extraction, Rubeus for Kerberos attacks, CrackMapExec for domain exploitation, and Responder for LLMNR poisoning. It addresses critical vulnerabilities like Zerologon (CVE-2020-1472) and AD Certificate Services exploits. The skill provides practical guidance on leveraging these tools and CVEs for authorized red team operations against Windows domains.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
Active Directory Attacks
Purpose
Provide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and domain dominance for red team operations and penetration testing.
Inputs/Prerequisites
- Kali Linux or Windows attack platform
- Domain user credentials (for most attacks)
- Network access to Domain Controller
- Tools: Impacket, Mimikatz, BloodHound, Rubeus, CrackMapExec
Outputs/Deliverables
- Domain enumeration data
- Extracted credentials and hashes
- Kerberos tickets for impersonation
- Domain Administrator access
- Persistent access mechanisms
Essential Tools
| Tool | Purpose |
|---|---|
| BloodHound | AD attack path visualization |
| Impacket |
(truncated - see the full file via the links below)
File tree — 2 files
skills/active-directory-attacks/SKILL.md
skills/active-directory-attacks/references/advanced-attacks.md
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Learn Active Directory attack techniques for red team operations”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
Auth Coercion Relay guides penetration testers through forcing authentication from remote systems via coercion techniques like PetitPotam and PrinterBug, then relaying those credentials through NTLM or Kerberos to escalate privileges or move laterally. It covers relay targets (SMB, LDAP, AD CS), feasibility checks, and both credential capture and exploitation paths.
This skill covers systematic approaches to elevate from low-privilege shells to root or administrator access on compromised systems. It addresses both local escalation paths—such as exploiting misconfigured sudo, capabilities, and scheduled tasks on Linux—and Windows-specific vectors including token impersonation and service abuse. For domain environments, it includes Active Directory attacks like Kerberoasting, golden tickets, and credential harvesting via LLMNR poisoning.
Orchestrate post-compromise domain exploitation through Kerberos attacks, coercion-relay chains, certificate template abuse, and BloodHound-guided lateral movement. Covers roasting, delegation abuse, NTLM reflection, ADCS ESC variants, ticket forgery, DCSync, and dMSA BadSuccessor attacks with integrated OPSEC and detection guidance.
Master NTLM relay attacks to capture and forward authentication across multiple protocols for privilege escalation. Learn relay targets, signing requirements, Responder poisoning, ntlmrelayx execution, mitm6 DNS takeover, and cross-protocol techniques including WebDAV coercion to bypass defenses.
This skill guides you through Metasploit Framework operations for authorized security assessments, covering exploitation, payload generation, and post-exploitation activities. Navigate msfconsole, select from exploit and auxiliary modules, configure targets and payloads, and manage Meterpreter sessions for credential harvesting and system reconnaissance.
This skill guides you through methodical privilege escalation assessments on Linux systems, covering enumeration of kernel exploits, sudo misconfigurations, SUID binaries, capabilities, cron jobs, PATH hijacking, and NFS weaknesses. It provides workflows for identifying attack vectors and executing exploitation techniques to achieve root-level access from a low-privilege shell.
More skills network-attack (MIT) · Windows Discovery (GPL-3.0)