# Security Applications of Reverse-Skill in Active Directory Environments > Discover the security applications of reverse-skill in Active Directory. Learn how this framework streamlines AD assessments, enumeration, exploitation, and reporting for auditable processes. - Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill) - Tags: tutorial - Published: 2026-08-11 --- **The reverse-skill framework provides a modular, routing-driven workflow for Active Directory security assessments, enforcing deterministic, auditable processes across enumeration, exploitation, and reporting phases.** The **reverse-skill** repository by zhaoxuya520 implements a specialized security framework designed for structured AD engagements. Its architecture separates routing logic from execution, ensuring that every Active Directory task follows a predefined, evidence-based pipeline suitable for both red-team operations and blue-team detection validation. ## How Reverse-Skill Routes to AD-Specific Workflows When analysts mention AD-related terms such as "Kerberoast," "AD CS," or "BloodHound," the central routing matrix in [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) matches the **target type Windows AD** and directs requests to the dedicated module at [[`skills/windows-ad/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/windows-ad/SKILL.md)](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/windows-ad/SKILL.md). This routing decision occurs before any command execution, eliminating tool misselection and ensuring proper authorization checks. The routing system operates as a deterministic filter: queries hitting row 78 of [`routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.md) automatically trigger the AD skill's initialization sequence, which includes mandatory case scoping and network profile validation (lines 10-13 of [`windows-ad/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/windows-ad/SKILL.md)). ## Built-In AD Attack Path Reference The framework bundles a concise attack-path reference at [`skills/windows-ad/references/ad-attack-paths.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/windows-ad/references/ad-attack-paths.md) that maps common AD techniques to prerequisites and preferred tooling: | Technique | Prerequisite | Primary Tool | |-----------|--------------|--------------| | **Kerberoast** | SPN-registered account | `GetUserSPNs` / **Rubeus** | | **AS-REP Roast** | No pre-authentication required | `GetNPUsers` | | **ESC-1** (certificate abuse) | Registerable template + forgeable SAN | **Certipy** | | **ESC-8** (enrollment relay) | HTTP enrollment endpoint vulnerable to relay | `ntlmrelayx` | | **ACL → DA escalation** | `GenericAll` on user or group | **BloodHound** | | **NTLM Relay** | Unsigned authentication traffic | **Responder** + relay | This reference table is displayed inline during skill execution, making community-validated techniques instantly searchable without context-switching to external documentation. ## Six-Phase AD Assessment Workflow According to [`docs/ARCHITECTURE.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/ARCHITECTURE.md), the reverse-skill framework implements a *Skill → Routing → Tool Index → Execution* loop. The AD skill specifically follows this structured progression: ### 1. Authorization & Scoping Every engagement begins with mandatory "case-init" and network profile checks. Lines 10-13 of [`windows-ad/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/windows-ad/SKILL.md) enforce this gate, preventing unauthorized operations against production environments. ### 2. Enumeration The skill supports multiple data collection methods: - **Impacket** via `nxc smb` for host and share enumeration - **BloodHound** (`bloodhound-python`) for graph-based relationship mapping - Native PowerShell cmdlets for domain-joined system queries ### 3. Path Scoring BloodHound graphs are consulted to rank privilege-escalation routes by exploitability and impact (line 39 of [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md)). This quantitative approach prevents analysts from chasing low-value attack paths. ### 4. Exploitation The framework orchestrates multiple attack vectors: - Kerberoasting and AS-REP roasting for credential extraction - AD CS abuse via Certipy (ESC-1, ESC-8) - NTLM relay attacks - ACL manipulation for access control escalation ### 5. Evidence Capture Every command execution is recorded as "Evidence" (line 54), creating immutable audit trails for compliance and legal proceedings. This evidence-first approach distinguishes reverse-skill from ad-hoc penetration testing toolchains. ### 6. Self-Check & Documentation The skill concludes with a mandatory checklist (lines 80-84) verifying proper documentation, scope compliance, and artifact preservation. Results are written to `field-journal` with full reports generated via `docs-generator`. ## Practical Command Examples After framework routing completes, analysts execute standardized commands from the AD skill's toolchain. All listed utilities are auto-installed via `bootstrap-reverse.ps1` if missing from the environment. ### Domain Enumeration with Impacket ```bash nxc smb -u -p ``` Enumerates SMB shares, local users, and operating system versions across reachable hosts. ### BloodHound Data Collection ```bash bloodhound-python -d -u -p -c All -ns ``` Gathers group membership, session, ACL, and trust data for Neo4j graph analysis. ### Kerberoasting with Rubeus ```powershell Rubeus.exe kerberoast /domain: ``` Extracts service ticket hashes for SPN-registered accounts. These hashes are offline-crackable with Hashcat. ### AS-REP Roasting ```bash GetNPUsers.exe /output:asrep.txt /domains: ``` Retrieves AS-REP responses from accounts with **Do Not Require Pre-Authentication** enabled—typically service accounts or legacy configurations. ### AD CS Template Abuse ```bash certipy.exe request -template -san ``` Abuses misconfigured certificate templates to obtain forged certificates for authentication bypass (ESC-1 attack path). ### NTLM Relay Operations ```bash responder -I -wrf ntlmrelayx.py -tf targets.txt -smb2support ``` Captures NTLM hashes from multicast name resolution protocols and relays them to vulnerable services. All commands execute only after case scope validation permits the operation. ## Integration with Broader Security Operations The AD skill occupies the **"Windows AD / Kerberos / AD CS"** column in the routing matrix and composes with other reverse-skill modules: - **`attack-chain/`** — Multi-stage attack orchestration - **`pentest-tools/`** — Lateral movement automation - **`threat-hunting/`** — Blue-team detection workbook generation This modularity eliminates custom glue code, allowing security teams to build end-to-end engagement pipelines from standardized components. ## Training and CTF Applications The same AD module powers the CTF orchestrator at [`CTF-Sandbox-Orchestrator/competition-identity-windows/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/CTF-Sandbox-Orchestrator/competition-identity-windows/SKILL.md), enabling safe hands-on training in isolated environments. This reuse ensures that procedures validated in production assessments remain available for skill development without environment drift. ## Summary - **Deterministic routing** via [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) guarantees AD tasks always execute through the specialized module - **Attack-path reference** at [`ad-attack-paths.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/ad-attack-paths.md) centralizes technique-to-tool mappings for rapid lookup - **Six-phase workflow** enforces authorization, enumeration, scoring, exploitation, evidence capture, and documentation - **Evidence-first architecture** supports legal compliance and post-engagement reporting requirements - **Modular composition** with `attack-chain/`, `pentest-tools/`, and `threat-hunting/` enables full-spectrum security operations - **CTF sandbox reuse** provides safe training environments using production-validated procedures ## Frequently Asked Questions ### How does reverse-skill prevent unauthorized AD exploitation? The framework enforces **"Read the SKILL.md before acting"** (routing step 6 in [`routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.md)) combined with mandatory case-init validation at lines 10-13 of [`windows-ad/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/windows-ad/SKILL.md). No commands execute until network profiles and authorization scopes are confirmed, creating deterministic safety gates unsuitable—by design—for rapid, uncontrolled exploitation. ### What tools does the AD skill automatically manage? The skill maintains a toolchain index covering **BloodHound**, **Certipy**, **Impacket**, **Rubeus**, **Responder**, and companion utilities. Missing binaries trigger automatic installation via `bootstrap-reverse.ps1`, ensuring consistent tool availability across engagement environments without manual dependency resolution. ### Can reverse-skill support both offensive and defensive AD operations? Yes. The same routing and evidence infrastructure serves red-team attack path validation and blue-team detection engineering via the `threat-hunting/` module. BloodHound graphs generated during offensive phases become baselines for defensive coverage gap analysis, and the evidence system supports incident response documentation standards. ### How does the attack-path reference stay current with evolving AD techniques? The [`ad-attack-paths.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/ad-attack-paths.md) file follows a community-validated update model: techniques are added when validated against test domains, with prerequisite conditions and tool versions explicitly recorded. This creates searchable, version-controlled documentation rather than static knowledge that decays as AD security evolves.