Active Directory Attacks Agent Skill

This skill should be used when the user asks to "attack Active Directory", "exploit AD", "Kerberoasting", "DCSync", "pass-the-hash", "BloodHound enumeration", "Golden Ticket", "Silver Ticket", "AS-REP roasting", "NTLM relay", or needs guidance on Windows domain penetration testing.

5k tokens

context cost

the whole folder, loaded on every use

files

instructions only

copies elsewhere

how many repositories repackaged it

505

stars on the repo

on the repository, not the skill itself

Install

one command, takes just this skill from the repository

npx skills add https://github.com/Dokhacgiakhoa/Agent-Skills-4-Vibe-Coding-CLI --skill Active Directory Attacks

What comes with it

17 611 bytes besides the instruction

references/advanced-attacks.md

sub-skills/as-rep-roasting.md

sub-skills/dcsync-attack.md

sub-skills/esc1-misconfigured-templates.md

sub-skills/esc8-web-enrollment-relay.md

sub-skills/example-1-domain-compromise-via-kerberoasting.md

sub-skills/example-2-ntlm-relay-to-ldap.md

sub-skills/kerberoasting.md

sub-skills/overpass-the-hash.md

sub-skills/pass-the-hash.md

sub-skills/pass-the-ticket-golden-ticket.md

sub-skills/password-spraying.md

sub-skills/printnightmare-cve-2021-1675.md

sub-skills/responder-ntlmrelayx.md

sub-skills/samaccountname-spoofing-cve-2021-4227842287.md

sub-skills/silver-ticket.md

sub-skills/smb-signing-check.md

sub-skills/step-1-kerberos-clock-sync.md

sub-skills/step-2-ad-reconnaissance-with-bloodhound.md

sub-skills/step-3-powerview-enumeration.md

sub-skills/zerologon-cve-2020-1472.md

The instruction itself

27 sections, as written by the author

Active Directory Attacks

Purpose

Provide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and domain dominance for red team operations and penetration testing.

Inputs/Prerequisites

Kali Linux or Windows attack platform
Domain user credentials (for most attacks)
Network access to Domain Controller
Tools: Impacket, Mimikatz, BloodHound, Rubeus, CrackMapExec

Outputs/Deliverables

Domain enumeration data
Extracted credentials and hashes
Kerberos tickets for impersonation
Domain Administrator access
Persistent access mechanisms

Essential Tools

| Tool | Purpose |

|------|---------|

| BloodHound | AD attack path visualization |

| Impacket | Python AD attack tools |

| Mimikatz | Credential extraction |

| Rubeus | Kerberos attacks |

| CrackMapExec | Network exploitation |

| PowerView | AD enumeration |

| Responder | LLMNR/NBT-NS poisoning |

Core Workflow

🧠 Knowledge Modules (Fractal Skills)

1. Step 1: Kerberos Clock Sync

2. Step 2: AD Reconnaissance with BloodHound

3. Step 3: PowerView Enumeration

4. Password Spraying

5. Kerberoasting

6. AS-REP Roasting

7. DCSync Attack

8. Pass-the-Ticket (Golden Ticket)

9. Silver Ticket

10. Pass-the-Hash

11. OverPass-the-Hash

12. Responder + ntlmrelayx

13. SMB Signing Check

14. ESC1 - Misconfigured Templates

15. ESC8 - Web Enrollment Relay

16. ZeroLogon (CVE-2020-1472)

17. PrintNightmare (CVE-2021-1675)

18. samAccountName Spoofing (CVE-2021-42278/42287)

19. Example 1: Domain Compromise via Kerberoasting

20. Example 2: NTLM Relay to LDAP

Other skills for the same job

different authors, same section of the catalogue

Network 101

by ComeOnOliver

×2

This skill should be used when the user asks to "set up a web server", "configure HTTP or HTTPS", "perform SNMP enumeration", "configure SMB shares", "test network services", or needs guidance on configuring and testing network services for penetration testing labs.

This skill should be used when the user asks to "run pentest commands", "scan with nmap", "use metasploit exploits", "crack passwords with hydra or john", "scan web vulnerabilities with nikto", "enumerate networks", or needs essential penetration testing command references.

Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection.

Smtp Penetration Testing

by ComeOnOliver

×2

This skill should be used when the user asks to "perform SMTP penetration testing", "enumerate email users", "test for open mail relays", "grab SMTP banners", "brute force email credentials", or "assess mail server security". It provides comprehensive techniques for testing SMTP server security.

7k tokens

SQL Injection Testing

by ComeOnOliver

×2

This skill should be used when the user asks to "test for SQL injection vulnerabilities", "perform SQLi attacks", "bypass authentication using SQL injection", "extract database information through injection", "detect SQL injection flaws", or "exploit database query vulnerabilities". It provides comprehensive techniques for identifying, exploiting, and understanding SQL injection attack vectors across different database systems.

6k tokens

SSH Penetration Testing

by ComeOnOliver

×2

This skill should be used when the user asks to "pentest SSH services", "enumerate SSH configurations", "brute force SSH credentials", "exploit SSH vulnerabilities", "perform SSH tunneling", or "audit SSH security". It provides comprehensive SSH penetration testing methodologies and techniques.

8k tokens

Wordpress Penetration Testing

by ComeOnOliver

×2

This skill should be used when the user asks to "pentest WordPress sites", "scan WordPress for vulnerabilities", "enumerate WordPress users, themes, or plugins", "exploit WordPress vulnerabilities", or "use WPScan". It provides comprehensive WordPress security assessment methodologies.

7k tokens

How to use it

Copy the folder

Take dokhacgiakhoa/active directory attacks from the repository into ~/.claude/skills for personal use, or into .claude/skills inside a project.

Check the name does not clash

The agent identifies a skill by the name field in its header. Two skills with the same name cannot sit side by side — one of them will be ignored.