skills.rest
defconxt
defconxtCOMMUNITY
Explore all skills by this author →
GitHub

Red Team — Active Directory

Guide Active Directory red team engagements with command-line exploitation techniques.

Updated Aug 23, 2026
Search Tags:#penetration testing#exploitation#cybersecurity#privilege escalation#red team#kerberos#active directory
One-click install
npx skills add https://github.com/defconxt/CIPHER --skill red-team-active-directory
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Red Team — Active Directory
Source: https://github.com/defconxt/CIPHER/tree/main/skills/red-team/active-directory
Command: npx skills add https://github.com/defconxt/CIPHER --skill red-team-active-directory

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill provides a comprehensive playbook for offensive security operations targeting Active Directory environments, enabling efficient discovery, exploitation, and privilege escalation.

Core Features & Use Cases

  • Attack Playbooks: Detailed commands and strategies for Kerberoasting, AS-REP Roasting, DCSync, NTLM relay, ADCS exploitation, and more.
  • Enumeration & Reconnaissance: Tools and techniques for gathering information on users, groups, and domain structure.
  • Privilege Escalation: Methods for escalating privileges within an Active Directory environment.
  • Use Case: A penetration tester needs to identify and exploit vulnerabilities in a client's Active Directory. This Skill provides the exact commands to find misconfigurations, extract credentials, and move laterally to gain domain administrator access.

Quick Start

Use the red-team-active-directory skill to enumerate all users in the domain 'corp.local' using SMB null sessions.

Frequently Asked Questions about Red Team — Active Directory

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform Kerberoasting and AS-REP Roasting attacks in Active Directory?▼

Active Directory exploitation involves attacking Kerberos tickets by extracting service account hashes via Kerberoasting and targeting accounts with pre-authentication disabled via AS-REP Roasting. This Skill provides specific Rubeus and Impacket command examples to execute these credential extraction techniques efficiently during red team operations.

What is the best way to enumerate Active Directory users and domain structure during a penetration test?▼

Enumerating Active Directory users and domain structure is best achieved using BloodHound for graphical mapping and Impacket for SMB null sessions. This Skill details specific reconnaissance commands to gather information on users, groups, and domain configurations for red team engagements.

How do I abuse Active Directory Certificate Services (ADCS) for privilege escalation?▼

Abusing Active Directory Certificate Services for privilege escalation involves exploiting misconfigured certificate templates to escalate privileges. This Skill provides a detailed attack playbook utilizing Certipy commands to identify and exploit ADCS vulnerabilities within target environments.

Can I use Impacket and Rubeus for NTLM relay attacks in an Active Directory environment?▼

Yes, you can use Impacket and Rubeus for NTLM relay attacks in an Active Directory environment. This Skill covers NTLM relay techniques and provides specific command-line examples to intercept and relay authentication for lateral movement and credential extraction.

What steps are required to execute DCSync and gain domain administrator access?▼

Executing DCSync to gain domain administrator access requires extracting password hashes by simulating domain controller replication. This Skill outlines the privilege escalation process and provides exact Impacket commands to perform DCSync and achieve full domain compromise.

Related Skills

Explore More Software Engineering Skills→
jayjpatel9717jayjpatel9717

redteam-orchestration

Automate red team network simulation engagements from reconnaissance to reporting.

Community
Advanced
blacklanternsecurityblacklanternsecurity
253

credential-cracking

Crack password hashes and encrypted files using hashcat and john.

Official
Advanced
woohyun212woohyun212
21

ad-pentest

Perform six-phase Active Directory penetration testing with BloodHound and ADCS enumeration.

Community
Advanced
rahmatullahbossrahmatullahboss

Active Directory Attacks

Test Windows Active Directory security with reconnaissance, credential extraction, and Kerberos attacks.

Community
Advanced