Verified:Website 𝕏@infantes_adrian GitHub

pentest-ad-attacker

Execute Active Directory attacks and credential access techniques with Impacket, CrackMapExec, and Certipy.

Updated Jun 21, 2026

Search Tags:#penetration testing #lateral movement #credential access #certificate abuse #Active Directory #ACL abuse #AD attacks #delegation attacks

Ready to run

npx skills add https://github.com/infantesromeroadrian/arca-agent --skill pentest-ad-attacker

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: pentest-ad-attacker
Source: https://github.com/infantesromeroadrian/arca-agent/tree/main/template/skills/pentest-ad-attacker
Command: npx skills add https://github.com/infantesromeroadrian/arca-agent --skill pentest-ad-attacker

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires Impacket, CrackMapExec, Certipy, BloodHound, enum4linux-ng, ldapsearch, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill provides a comprehensive set of tools and guidelines for Active Directory penetration testing, streamlining the process and ensuring security best practices are followed.

Core Features & Use Cases

Active Directory Attacks: Execute a range of attacks like Kerberoasting, AS-REP Roasting, Golden Ticket, and Silver Ticket.
Credential Attacks: Implement DCSync, Pass-the-Hash, and Pass-the-Ticket attacks for credential access.
Lateral Movement: Facilitate lateral movement within the AD environment using PSExec, WMIExec, and SMBExec.
Delegation Attacks: Detect and exploit unconstrained and constrained delegation, and resource-based constrained delegation.
ACL Abuse: Identify and exploit common ACLs for unauthorized access.
Certificate Abuse: Exploit vulnerable AD CS templates with Certipy.
BloodHound Analysis: Analyze BloodHound data to identify shortest paths to Domain Admin, Kerberoastable accounts, AS-REP Roastable accounts, and more.
Enumeration Results Analysis: Provide a summary of AD assessment results, including domain information, user statistics, computer statistics, and attack paths identified.
Analysis Framework: Offers a framework for analyzing enumeration results and BloodHound data.
Behavioral Rules: Establishes guidelines for safe and effective use of the Skill, including lockout awareness, OPSEC, and evidence handling.
Dual-Perspective Requirement: Provides both offensive and defensive views for every technique, including execution steps, detection opportunities, and remediation.
MITRE ATT&CK Mapping: Maps the Skill's capabilities to MITRE ATT&CK framework identifiers.
Findings Database Integration: Integrates with a findings database for persisting AD findings and avoiding re-cracking known accounts.

Quick Start

Analyze the Active Directory environment using the 'pentest-ad-attacker' skill and generate a report on potential vulnerabilities.

Frequently Asked Questions about pentest-ad-attacker

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform Active Directory penetration testing for lateral movement and credential access?▼

Active Directory penetration testing executes attacks like Kerberoasting, AS-REP Roasting, Pass-the-Hash, and lateral movement via PSExec and WMIExec. It uses tools like Impacket and CrackMapExec to exploit vulnerabilities and access credentials within the AD environment.

What is the best way to analyze BloodHound data for AD attack paths and vulnerable ACLs?▼

Analyzing BloodHound data identifies shortest paths to Domain Admin and accounts vulnerable to Kerberoasting or AS-REP Roasting. It maps Active Directory ACL abuse opportunities and highlights unauthorized access paths using collected enumeration results.

How do I exploit vulnerable AD CS templates using Certipy during a red team engagement?▼

Exploiting vulnerable AD CS templates uses Certipy to perform certificate abuse attacks. It targets misconfigured certificate services to request fraudulent certificates, enabling unauthorized authentication and lateral movement within the Active Directory domain.

Does this Active Directory penetration testing approach support unconstrained and constrained delegation attacks?▼

Yes, Active Directory penetration testing detects and exploits unconstrained delegation, constrained delegation, and resource-based constrained delegation. It maps these delegation attacks to MITRE ATT&CK identifiers and provides both execution steps and remediation strategies.

What tools do I need to execute DCSync and Pass-the-Ticket attacks in an AD environment?▼

Executing DCSync and Pass-the-Ticket attacks requires tools like Impacket and CrackMapExec. These dependencies facilitate credential access techniques by extracting password hashes and ticket-granting tickets from the Active Directory domain controller.

How do I ensure operational security and avoid account lockouts during AD attacks?▼

Active Directory penetration testing establishes behavioral rules for operational security and lockout awareness. It integrates with a findings database to avoid re-cracking known accounts and mandates safe evidence handling during red team engagements.