lateral-movement

Active Directory lateral movement paths can be mapped by enumerating AD objects and SMB shares, then testing credential reuse via pass-the-hash and Kerberoasting to reveal privileged access routes. This skill automates that discovery and exploitation process across Windows networks.

Network pivoting in a Windows environment uses NTLM relay, SMB relay, and RBCD delegation attacks to expand access from an initial foothold. These techniques demonstrate how compromised credentials can traverse internal corporate networks for privilege escalation.

Kerberoasting and pass-the-hash attacks are supported using specialized Kali tools orchestrated through MCP. The skill coordinates discovery and execution to test credential reuse against Active Directory service endpoints and Windows targets.

Testing Active Directory lateral movement requires an existing initial foothold or available credentials within the internal corporate network. The skill uses this access to orchestrate discovery, execute relay attacks, and generate remediation reports.

Lateral movement findings are documented using automated reporting that generates findings, diagrams, and dashboards. This maps each movement step taken during the assessment to provide clear visibility for remediation planning.

Assessing credential theft impact involves comprehensive enumeration of AD objects and service endpoints, combined with credential reuse testing. This reveals real-world privileged access paths and pivoting possibilities across the compromised environment.