skills.rest
noname300989
noname300989COMMUNITY
Explore all skills by this author →
GitHub

ad-offensive

Orchestrate Active Directory offensive security operations with BloodHound, Impacket, and CrackMapExec.

Updated Aug 23, 2026
Search Tags:#penetration testing#red team#kerberoasting#dcsync#bloodhound#windows security#active directory
One-click install
npx skills add https://github.com/noname300989/Security-Claw --skill ad-offensive
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ad-offensive
Source: https://github.com/noname300989/Security-Claw/tree/main/skills/ad-offensive
Command: npx skills add https://github.com/noname300989/Security-Claw --skill ad-offensive

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires python3, nmap, bloodhound, crackmapexec, kerbrute, impacket, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates complex and time-consuming Active Directory penetration testing tasks, enabling efficient discovery of vulnerabilities and attack paths within Windows environments.

Core Features & Use Cases

  • Comprehensive Enumeration: Discover users, groups, computers, and GPOs using LDAP.
  • Credential Attack Execution: Perform Kerberoasting, AS-REP Roasting, and DCSync attacks.
  • Lateral Movement & Privilege Escalation: Utilize Pass-the-Hash/Ticket, GPO abuse, and ACL exploitation.
  • Attack Path Visualization: Leverage BloodHound for identifying critical attack paths.
  • Use Case: Assess the security posture of a corporate Active Directory domain by identifying all potential avenues for privilege escalation and lateral movement, from initial reconnaissance to achieving Domain Admin.

Quick Start

Execute an Active Directory offensive testing scan against the domain controller at 192.168.1.10 for the corp.local domain.

Frequently Asked Questions about ad-offensive

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate Kerberoasting and DCSync attacks in Active Directory?▼

Map Active Directory attack paths using BloodHound to visualize lateral movement and privilege escalation routes via GPO and ACL abuse. It integrates reconnaissance data to identify critical vulnerabilities from initial access to Domain Admin.

What is the best way to enumerate Active Directory users and GPOs?▼

Enumerate Active Directory users, groups, computers, and GPOs using LDAP queries orchestrated through integrated Python scripts. It automates comprehensive reconnaissance to assess the security posture of corporate Windows environments efficiently.

Do I need Impacket and BloodHound installed to perform lateral movement?▼

Perform lateral movement in Windows environments via Pass-the-Hash and Pass-the-Ticket techniques using Impacket and CrackMapExec. It facilitates credential theft and lateral traversal across Active Directory networks for red team operations.

Can I use this for AS-REP Roasting and credential theft on Windows?▼

Yes, this supports AS-REP Roasting and credential theft on Windows domains by orchestrating attacks against Active Directory. It automates the extraction of vulnerable user hashes to identify accounts requiring no preauthentication.

Related Skills

Explore More Software Engineering Skills→
darblexdarblex

Nmap Recon

Scan targets with Nmap to find open ports and detect services.

Community
Intermediate
AeonDaveAeonDave
15

bloodhound

Map Active Directory attack paths and identify privilege escalation opportunities.

Community
Advanced
rahmatullahbossrahmatullahboss

Active Directory Attacks

Test Windows Active Directory security with reconnaissance, credential extraction, and Kerberos attacks.

Community
Advanced
langbyyilangbyyi
96

ldap-injection-testing

Detect, exploit, and remediate LDAP injection vulnerabilities in directory-integrated applications.

Community
Intermediate