# Windows AD Kerberos Pentesting with the reverse-skill Framework: A Complete Guide

> Master Windows AD Kerberos pentesting with the reverse-skill framework. Discover its modular approach to authorization, tool validation, and credential exploitation for efficient red teaming.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-08

---

**The reverse-skill framework handles Windows AD Kerberos pentesting through a modular `windows-ad` skill that enforces authorization checks, validates tool chains, and executes a graph-first workflow of enumeration, attack path selection, and credential exploitation while automatically logging evidence to a field journal.**

The **reverse-skill** repository by zhaoxuya520 implements a security-oriented "skill-router" architecture designed to standardize penetration testing workflows. For Active Directory and Kerberos assessments, the framework provides a structured approach that ensures repeatability, evidence preservation, and strict authorization controls before executing destructive actions.

## Architecture Overview

The framework operates as a modular skill-router system defined in **[`docs/ARCHITECTURE.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/ARCHITECTURE.md)**. When processing Windows AD Kerberos pentesting requests, the router matches keywords against its routing matrix to invoke the **`windows-ad`** skill defined in **[`skills/windows-ad/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/windows-ad/SKILL.md)**. This skill orchestrates a six-phase workflow that transforms raw network access into documented security findings while maintaining strict operational security boundaries.

## The Six-Phase AD Pentesting Workflow

### Phase 1: Scope Initialization and Authorization

Every assessment begins with a mandatory **`case-init`** step recorded in **[`skills/windows-ad/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/windows-ad/SKILL.md)** (lines 10‑13). The framework requires explicit definition of the `network_profile` and an "ACTION REQUIRED" checklist that confirms all actions are authorized before tool execution begins. This scope-check prevents accidental testing outside defined boundaries and ensures compliance with rules defined in **[`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md)**.

### Phase 2: Tool Chain Validation

Before exploitation, the router consults **[`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md)** to verify the presence of required utilities including **Impacket**, **Certipy**, **BloodHound**, **Rubeus**, **NetExec**, and **Mimikatz**. Missing tools trigger the **`bootstrap-reverse`** self-install routine, implemented in **`skills/scripts/bootstrap-reverse.ps1`** for Windows hosts and **[`kali/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-manifest.json)** for Linux environments, ensuring cross-platform compatibility.

### Phase 3: Enumeration and Graph Generation

The workflow adopts a **graph-first** methodology. Initial enumeration uses **SharpHound** or **bloodhound-python** to generate a complete Active Directory map before selecting attack vectors:

```bash

# SMB enumeration with NetExec

nxc smb <target-range> -u USER -p PASS

# BloodHound data collection

bloodhound-python -d example.local -u USER -p PASS -c All -ns <DC_HOST>

```

This visualization step ensures that destructive actions occur only after the attack surface is fully understood and authorized.

### Phase 4: Attack Path Selection

With the BloodHound map generated, the operator consults **[`skills/windows-ad/references/ad-attack-paths.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/windows-ad/references/ad-attack-paths.md)** to select high-value vectors. The reference document catalogs specific techniques including **Kerberoasting**, **AS-REP roasting**, **ESC-1 certificate abuse**, **ACL-based Domain Admin paths**, and **NTLM relay** opportunities.

```text

# Kerberoasting – extract service account hashes

GetUserSPNs -User USER -Domain example.local | Rubeus kerberoast

# AS-REP roasting – target accounts without pre-authentication

GetNPUsers -User USER -Domain example.local | Rubeus asreproast

# ESC-1 certificate template abuse

certipy template add --san example.com --subject "evil" --domain example.local

# NTLM relay setup

responder -I eth0 -wrf
ntlmrelayx -tf targets.txt -smb2support

```

### Phase 5: Credential Exploitation

Following path selection, the framework executes credential extraction using authorized methods only. The **`windows-ad`** skill explicitly forbids unauthorized **DCSync** or **Golden Ticket** attacks through a "MUST NOT" clause in **[`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md)**.

```bash

# Remote hash extraction via Impacket

secretsdump.py USER:PASS@<DC_HOST>

# Local credential harvesting with Mimikatz

mimikatz # sekurlsa::logonpasswords

```

### Phase 6: Evidence Capture and Reporting

Every command execution automatically logs to the **field-journal**, a structured documentation system that preserves command output and timestamps. The framework runs a self-audit using the checklist in **[`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md)** (lines 80‑84) to verify enumeration preceded exploitation and that credentials are de-identified. Finally, the `docs-generator` produces a structured report of findings.

## Safety Controls and Constraints

The **`windows-ad`** skill enforces multiple safeguards defined in the source documentation. The **self-audit checklist** requires verification that enumeration data exists before launching exploits, mandates credential de-identification in logs, and restricts actions to the pre-defined scope. These controls prevent common operational errors such as testing production environments without authorization or failing to document critical evidence.

## Essential Files and References

- **[`skills/windows-ad/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/windows-ad/SKILL.md)** – Core skill definition containing workflow phases, tool lists, and the authorization checklist.
- **[`skills/windows-ad/references/ad-attack-paths.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/windows-ad/references/ad-attack-paths.md)** – Quick-reference table mapping attack vectors (Kerberoasting, ESC-1, NTLM relay) to specific tool commands.
- **[`docs/ARCHITECTURE.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/ARCHITECTURE.md)** – System architecture diagram showing skill router, bootstrap, and reporting component interactions.
- **`skills/scripts/bootstrap-reverse.ps1`** – PowerShell automation for installing Windows pentesting tools.
- **[`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md)** – Platform-specific constraints and operational rules governing tool usage.

## Summary

- The **reverse-skill** framework routes AD Kerberos tasks through the **`windows-ad`** skill, ensuring standardized workflows.
- A **graph-first approach** requires BloodHound visualization before selecting attack paths like Kerberoasting or certificate abuse.
- **Mandatory authorization checks** via `case-init` and scope validation prevent unauthorized testing against production environments.
- The **tool-index** and **bootstrap-reverse** system automatically validate and install required utilities including Impacket, Certipy, and Rubeus.
- All activities are logged to the **field-journal** with automatic evidence capture and self-audit checklists to ensure compliance.

## Frequently Asked Questions

### What tools does the reverse-skill framework require for Windows AD pentesting?

The **`windows-ad`** skill requires **Impacket/NetExec** for SMB and protocol operations, **BloodHound/SharpHound** for AD enumeration, **Certipy** for certificate abuse, and **Rubeus/Mimikatz** for Kerberos operations and credential extraction. The **[`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md)** validation step ensures these are present before execution begins.

### How does reverse-skill prevent unauthorized exploitation during Kerberos testing?

The framework enforces a **mandatory authorization** phase through `case-init` in **[`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md)** (lines 10‑13) that requires explicit scope definition and an "ACTION REQUIRED" checklist. Additionally, a "MUST NOT" clause explicitly forbids unauthorized DCSync and Golden Ticket attacks, while the self-audit checklist verifies enumeration preceded any exploitation.

### What is the graph-first approach in the windows-ad skill?

The **graph-first** methodology requires operators to generate a complete BloodHound map of the Active Directory environment during the enumeration phase before selecting attack paths. This ensures that destructive actions like Kerberoasting or ACL abuse are taken only after visualizing the attack surface and obtaining proper authorization, as documented in **[`ad-attack-paths.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/ad-attack-paths.md)**.

### How does the framework handle missing penetration testing tools?

If **[`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md)** detects missing utilities, the router automatically invokes **`bootstrap-reverse`**, which executes **`skills/scripts/bootstrap-reverse.ps1`** on Windows or references **[`kali/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-manifest.json)** on Linux to install required tools from winget, GitHub releases, or package managers.