skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

pentesting-rdp

Tests RDP services for weak credentials, NLA misconfigurations, and session hijacking paths.

954|172|Updated Mar 13, 2026
Search Tags:#penetration testing#windows#pass-the-hash#Nmap#rdp#session hijacking#bluekeep
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill pentesting-rdp
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: pentesting-rdp
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/network-services-pentesting/pentesting-rdp
Command: npx skills add https://github.com/xalgord/xalgorix --skill pentesting-rdp

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

During authorized penetration tests, RDP (TCP 3389) is a common attack surface, but testers often miss critical checks like NLA status, pre-auth screenshots, BlueKeep exposure, and session hijacking opportunities. This Skill provides a structured workflow to enumerate, authenticate against, and post-exploit RDP services without overlooking high-impact findings.

Core Features & Use Cases

  • Enumeration & Fingerprinting: Identify the security layer (native RDP, TLS, CredSSP/NLA) and leak NTLM host info using nmap NSE scripts and netexec.
  • Credential Attacks & Validation: Validate credentials and NT hashes, perform lockout-aware brute force with crowbar or hydra, and log in via pass-the-hash with xfreerdp.
  • Post-Access Techniques: Hijack sessions with tscon, shadow sessions via mstsc, tunnel TCP over RDP with rdp2tcp, and capture pre/post-auth screenshots.
  • Use Case: On an internal assessment, you find TCP 3389 open on a Windows 2008 R2 host. The Skill guides you to confirm NLA is disabled, capture a pre-auth login screenshot revealing usernames, flag the host as a BlueKeep candidate, and document the finding with evidence and remediation steps.

Quick Start

Ask the AI to enumerate and test the RDP service on a target host at 192.168.1.10 during an authorized engagement, including NLA status and credential validation.

Frequently Asked Questions about pentesting-rdp

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check if NLA is enabled on an RDP server?▼

Run nmap with the rdp-enum-encryption script against port 3389 to identify the negotiated security layer, or use netexec with nxc rdp <IP> which reports whether NLA is required. If NLA is disabled, you can also capture a pre-auth login screenshot with nxc rdp <IP> --nla-screenshot.

How to brute force RDP credentials without locking accounts?▼

Use crowbar or hydra with a small, targeted password list rather than large wordlists, and coordinate with the client about lockout thresholds first. Crowbar supports RDP with crowbar -b rdp -s <IP>/32 -U users.txt -c 'password', which is quieter than aggressive spraying.

Can I log into RDP with an NTLM hash instead of a password?▼

Yes, pass-the-hash RDP logon works when Restricted Admin mode is enabled on the target. Use xfreerdp /u:<user> /pth:<hash> /v:<IP> to get an interactive desktop without knowing the cleartext password.

What is RDP session hijacking with tscon?▼

Session hijacking with tscon lets a user with SYSTEM privileges attach to another user's existing RDP session without knowing their password. Run query user to list session IDs, then tscon <ID> /dest:<SESSIONNAME> to take over the session and inherit that user's privileges.

When should I avoid exploiting BlueKeep (CVE-2019-0708)?▼

BlueKeep exploitation can crash or blue-screen the target host, so it should only be attempted with explicit written authorization, ideally during a maintenance window. For most assessments, flagging legacy OS with NLA disabled as a critical candidate and reporting it is sufficient.

Related Skills

Explore More Software Engineering Skills→
zebbernzebbern
5

port-scan

Identify open ports and running services using naabu, masscan, and nmap.

Community
Intermediate
wgpsecwgpsec
1.6k

report-generate

Generate structured penetration testing reports with CVSS risk ratings and remediation guidance.

Official
Intermediate
starwreckntxstarwreckntx

Lateral Movement Agent

Simulate lateral movement across enterprise networks using credential reuse and remote execution.

Community
Basic
ToanPV90ToanPV90

vulnerability-scanning

Automate vulnerability discovery and prioritization across infrastructure, dependencies, and repositories.

Community
Intermediate