proto-kerberos

Audit Active Directory Kerberos realm configurations, SPN hygiene, and delegation posture.

Updated Jul 30, 2026

Search Tags:#pentesting #hardening #security-audit #active-directory #kerberos #ldap

Ready to run

npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill proto-kerberos

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: proto-kerberos
Source: https://github.com/salmanabdurrahman/pi-pentest-agent/tree/main/skills/proto-kerberos
Command: npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill proto-kerberos

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill provides a secure, read-only framework for auditing Active Directory Kerberos configurations to identify architectural weaknesses without triggering security alerts or performing unauthorized credential attacks.

Core Features & Use Cases

Configuration Review: Audits encryption types, ticket lifetime policies, and pre-authentication requirements to ensure domain hardening.
SPN & Delegation Audit: Identifies high-value service principal names and dangerous delegation configurations like unconstrained delegation or RBCD.
Use Case: A security engineer needs to verify that a domain environment is resistant to Kerberoasting and delegation abuse without running intrusive tools that could lock accounts or trigger detection systems.

Quick Start

Use the proto-kerberos skill to perform a read-only configuration audit of the current domain controller and realm.

Frequently Asked Questions about proto-kerberos

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit Active Directory Kerberos configurations without triggering security alerts?▼

You can audit Active Directory Kerberos configurations safely by performing a read-only security audit of the realm. This approach checks encryption types, ticket lifetimes, and pre-authentication policies via authenticated LDAP without running intrusive tools or credential attacks.

What is the best way to check for dangerous Kerberos delegation configurations in my domain?▼

The best way to check for dangerous Kerberos delegation is to audit service principal names and delegation posture. This identifies high-value SPNs and risky configurations like unconstrained delegation or resource-based constrained delegation (RBCD) without modifying the environment.

How does a read-only LDAP enumeration validate resistance to Kerberoasting?▼

Read-only LDAP enumeration validates Kerberoasting resistance by inspecting service principal name hygiene and account configurations. It identifies architectural weaknesses in the Kerberos realm that expose high-value service accounts to offline ticket cracking.

Can I use non-intrusive Kerberos auditing for Active Directory compliance checks?▼

Yes, you can use non-intrusive Kerberos auditing for Active Directory compliance checks. It performs authenticated, read-only enumeration of domain hardening policies, ensuring risk assessment and compliance validation without locking accounts or manipulating tickets.

What are the limitations of read-only Kerberos security audits?▼

Read-only Kerberos security audits are limited to configuration review and risk assessment; they strictly prohibit credential-based attacks and ticket manipulation. They identify architectural weaknesses but do not perform active exploitation or modify domain controller settings.