skills.rest
rahmatullahboss
rahmatullahbossCOMMUNITY
Explore all skills by this author →
GitHub

Active Directory Attacks

Test Windows Active Directory security with reconnaissance, credential extraction, and Kerberos attacks.

Updated Jan 4, 2026
Search Tags:#pass-the-hash#mimikatz#bloodhound#active directory#golden ticket#ad security#kerberoast
One-click install
npx skills add https://github.com/rahmatullahboss/multi-store-saas --skill active-directory-attacks-rahmatullahboss
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Active Directory Attacks
Source: https://github.com/rahmatullahboss/multi-store-saas/tree/main/.agent/skills/Active%20Directory%20Attacks
Command: npx skills add https://github.com/rahmatullahboss/multi-store-saas --skill active-directory-attacks-rahmatullahboss

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires BloodHound, Impacket, Mimikatz, Rubeus, CrackMapExec, PowerView, Responder, and includes references (resource) components.

What problem does it solve?

This Skill provides detailed methodologies for attacking and assessing Microsoft Active Directory environments, enabling security professionals to identify vulnerabilities and security gaps.

Core Features & Use Cases

  • Reconnaissance and enumeration: Gather domain structure, user accounts, and permissions data.
  • Credential harvesting: Extract hashes and passwords using various tools and techniques.
  • Kerberos and token attacks: Exploit ticket vulnerabilities such as Kerberoasting, Golden Ticket, and Silver Ticket attacks.
  • Lateral movement and persistence: Establish and maintain access within AD networks.
  • Use Case: A red team engineer conducting simulated attacks to test the resilience of an AD environment and identify exploitable flaws.

Quick Start

Provide instructions on using bloodHound for mapping attack paths or using Mimikatz for credential extraction.

Frequently Asked Questions about Active Directory Attacks

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform Active Directory penetration testing using BloodHound and Mimikatz?▼

Active Directory penetration testing involves mapping attack paths with BloodHound and extracting credentials using Mimikatz. You gather domain structure data, harvest hashes, and identify exploitable flaws during simulated red team attacks.

What is the best way to extract Windows domain hashes and passwords for security assessments?▼

Extracting Windows domain hashes requires tools like Mimikatz, Impacket, and CrackMapExec. These tools enable security professionals to perform credential harvesting, dump hashes, and identify vulnerabilities within the AD environment.

Can I use Impacket and Rubeus for Kerberoasting and Golden Ticket attacks?▼

Yes, you can use Impacket and Rubeus for Kerberoasting and Golden Ticket attacks. These tools facilitate Kerberos ticket exploitation, allowing testers to forge tickets and escalate domain privileges during security assessments.

How does pass-the-hash work for lateral movement in Windows domain environments?▼

Pass-the-hash enables lateral movement by using stolen NTLM hashes to authenticate without needing plaintext passwords. Tools like CrackMapExec and Mimikatz automate this process to maintain access and traverse internal AD networks.

Do I need PowerView and Responder for Active Directory reconnaissance and enumeration?▼

Yes, PowerView and Responder are essential for Active Directory reconnaissance and enumeration. They help gather domain structure, user accounts, and permissions data needed to map network topology and identify attack vectors.

What techniques help maintain persistence after domain privilege escalation in AD networks?▼

Maintaining persistence after domain privilege escalation involves forging Golden Tickets and leveraging compromised credentials. Techniques include using Mimikatz for ticket manipulation and CrackMapExec for sustained network access.

Related Skills

Explore More Software Engineering Skills→
jokken79jokken79
1

Network 101

Configure and test HTTP, HTTPS, SNMP, and SMB services in penetration testing labs.

Community
Advanced
infantesromeroadrianinfantesromeroadrian

pentest-ad-attacker

Execute Active Directory attacks and credential access techniques with Impacket, CrackMapExec, and Certipy.

Community
Advanced
hardw00thardw00t
90

network-pentest

Simulate attacker techniques across internal networks and Active Directory environments.

Community
Advanced
zebbernzebbern
4.5k

Red Team Tools and Methodology

Automate red-team reconnaissance and vulnerability discovery workflows.

Community
Advanced