Agent skill · security · davila7
Active Directory Attacks
This skill should be used when the user asks to "attack Active Directory", "exploit AD", "Kerberoasting", "DCSync", "pass-the-hash", "BloodHound enumeration", "Golden Ticket", "Silver Ticket", "AS-REP roasting", "NTLM relay", or needs guidance on Windows domain penetration testing.
Why this skill is useful
Provides executable scripts and detailed methodologies for exploiting Active Directory environments that are not commonly known or documented.
What it needs
Requires bloodhound, crackmapexec, impacket, kali-linux, mimikatz, powerview, responder, rubeus installed locally. About 5k tokens when loaded. Last updated 2026-08-06. 30,138 stars on the source repository.
What this skill does
Active Directory Attacks Purpose Provide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and domain dominance for red team operations and penetration testing. Inputs/Prerequisites Kali Linux or Windows attack platform Domain user credentials (for most attacks) Network access to Domain Controller Tools: Impacket, Mimikatz, BloodHound, Rubeus, CrackMapExec Outputs/Deliverables Domain enumeration data Extracted credentials and hashes Kerberos tickets for impersonation Domain Administrator access Persistent access mechanisms --- Essential Tools Tool Purpose ------ --------- BloodHound AD attack path visualization Impacket Python AD attack tools Mimikatz Credential extraction Rubeus Kerberos attacks CrackMapExec Network exploitation PowerView AD enumeration Responder LLMNR/NBT-NS poisoning --- Core Workflow Step 1: Kerberos Clock Sync Kerberos requires clock synchronization (±5 minutes): Step 2: AD Reconnaissance with BloodHound Step 3: PowerView Enumeration --- Credential Attacks Password Spraying Kerberoasting Extract service account TGS tickets and crack offline: AS-REP Roasting Target accounts with "Do not require Kerberos preauthentication": DCSync Attack Extract credentials directly from DC (requires Replicating Directory Changes rights): --- Kerberos Ticket Attacks Pass-the-Ticket (Golden Ticket) Forge TGT with krbtgt hash for any user: Silver Ticket Forge TGS for specific service: Pass-the-Hash OverPass-the-Hash Convert NTLM hash to Kerberos ticket: --- NTLM Relay Attacks Responder + ntlmrelayx SMB Signing Check --- Certificate Services Attacks (AD CS) ESC1 - Misconfigured Templates ESC8 - Web Enrollment Relay --- Critical CVEs ZeroLogon (CVE-2020-1472) PrintNightmare (CVE-2021-1675) samAccountName Spoofing (CVE-2021-42278/42287) --- Quick Reference Attack Tool Command -------- ------ --------- Kerberoast Impacket GetUserSPNs.py …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills davila7/active-directory-attacks