skills.rest
xijunww
xijunwwCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

ad-pentest

Automate Active Directory penetration testing from reconnaissance to domain compromise.

1|Updated Jun 26, 2026
Search Tags:#penetration testing#lateral movement#Active Directory#AD pentest#AD exploitation
One-click install
npx skills add https://github.com/xijunww/Pentest --skill ad-pentest-xijunww
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ad-pentest
Source: https://github.com/xijunww/Pentest/tree/main/packages/core/src/config/skills/builtin/ad-pentest
Command: npx skills add https://github.com/xijunww/Pentest --skill ad-pentest-xijunww

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires goad, bloodhound, certipy, nxc, psexec, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill provides comprehensive attack chain guidance for Active Directory penetration testing, automating the full process from reconnaissance to domain controller compromise.

Core Features & Use Cases

  • Reconnaissance and Enumeration: Automate network discovery, domain structure identification, and user enumeration.
  • Initial Credential Acquisition: Automate AS-REP Roasting, password spraying, Kerberoasting, NTLM Relay, and ADCS attacks.
  • Intrusion and Privilege Escalation: Automate lateral movement, credential extraction, and privilege escalation techniques.
  • Domain Control Takeover: Automate Golden Ticket creation, DCSync, and domain trust exploitation.
  • Use Case: Use this Skill to quickly identify and exploit vulnerabilities in an Active Directory environment, saving time and resources compared to manual testing.

Quick Start

Trigger the 'ad-pentest' skill with the keyword 'Active Directory penetration testing'.

Frequently Asked Questions about ad-pentest

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate Active Directory penetration testing from reconnaissance to domain takeover?▼

Automate Active Directory penetration testing by using tools like GOAD and BloodHound for network discovery and enumeration, then executing credential harvesting, lateral movement, and privilege escalation to compromise the domain controller.

What techniques are used for initial credential acquisition in AD pentest?▼

Initial credential acquisition in AD pentest involves automating AS-REP Roasting, password spraying, Kerberoasting, NTLM Relay, and ADCS attacks to harvest user credentials during the security audit.

Does AD exploitation require specific Python libraries and environments?▼

AD exploitation requires Python and specific libraries to perform reconnaissance, credential harvesting, and privilege escalation. The environment must support tools like certipy, nxc, and psexec for full attack chain automation.

Can I use BloodHound and nxc for lateral movement in Active Directory?▼

Yes, you can use BloodHound and nxc for lateral movement in Active Directory. The skill automates intrusion and lateral movement techniques alongside credential extraction and privilege escalation to progress through the network.

What is the best way to automate Golden Ticket creation and DCSync attacks?▼

The best way to automate Golden Ticket creation and DCSync attacks is by triggering the skill for domain control takeover, which also automates domain trust exploitation to maintain persistent access during red teaming.

Related Skills

Explore More Software Engineering Skills→
raphaelchristiraphaelchristi
43

harness:setup

Configure Harness Evolver, LangSmith, and baseline evaluations for Python projects.

Community
Advanced
YukiIto1999YukiIto1999

performing-aws-privilege-escalation-assessment

Identify IAM misconfigurations enabling privilege escalation in AWS environments.

Community
Advanced
infantesromeroadrianinfantesromeroadrian

pentest-ad-attacker

Execute Active Directory attacks and credential access techniques with Impacket, CrackMapExec, and Certipy.

Community
Advanced
ArianHobson333ArianHobson333
7

ad-exploitation

Perform Active Directory exploitation with BloodHound analysis, Kerberoasting, and AD CS abuse.

Community
Advanced