How to Conduct Windows Active Directory and Kerberos Penetration Testing with reverse‑skill

The reverse‑skill repository provides a modular skill router that structures Windows Active Directory and Kerberos penetration testing into six auditable phases, enforcing authorization checkpoints before executing enumeration, Kerberoasting, or ESC attacks.

The reverse‑skill framework guides security analysts through repeatable, AI‑assisted workflows for enterprise infrastructure testing. For Windows Active Directory and Kerberos penetration testing, the repository implements strict routing logic that separates reconnaissance from exploitation, ensuring every command aligns with predefined operational contracts.

Understanding the reverse‑skill Architecture for AD Testing

The reverse‑skill system operates as a skill router that directs AI agents and human operators through structured security workflows. According to the source code, the entry point for all operations is skills/SKILL.md, which defines the master routing process for selecting specific security domains. Global enforcement rules in RULES.md mandate scope validation, authorization verification, and evidence collection before any active command execution against target infrastructure.

For Active Directory engagements, the framework routes to skills/windows-ad/SKILL.md, which implements a four‑phase methodology: enumeration, path scoring, minimal verification, and cleanup. This workflow is enforced by operational contracts stored in skills/ops/ and initialized through skills/scripts/case-init.ps1, creating a case‑specific scope file that must authorize each technique before deployment.

Windows Active Directory Penetration Testing Workflow

The AD‑specific playbook in skills/windows-ad/SKILL.md outlines a comprehensive lifecycle for conducting authorized penetration tests against Windows domains and Kerberos environments.

Phase 1: Enumeration and Reconnaissance

Initial reconnaissance focuses on gathering domain intelligence without triggering defensive alerts. The framework recommends using NetExec (nxc) for SMB enumeration and user/computer discovery across target ranges.

# Enumerate SMB shares and validate credentials across subnet

nxc smb 10.10.0.0/24 -u administrator -p Passw0rd

BloodHound data collection follows initial host discovery, using bloodhound-python or SharpHound to map attack paths including SPNs for Kerberoasting candidates and ACL misconfigurations.

# Execute BloodHound ingestion for complete domain mapping

bloodhound-python -d corp.local -u administrator -p Passw0rd -c All -ns dc01.corp.local

Phase 2: Attack Path Analysis

Analysts import collected JSON files into BloodHound to prioritize high‑value attack vectors. The reference documentation at skills/windows-ad/references/ad-attack-paths.md catalogs specific paths including Kerberoasting targets, AS‑REP roastable accounts, and NTLM relay opportunities. Path scoring weighs factors like credential exposure risk and lateral movement potential before advancing to exploitation.

Phase 3: Kerberos Attacks (Kerberoasting and AS‑REP Roasting)

Once SPNs are identified, the framework supports Kerberoasting to extract TGS tickets for offline cracking. For accounts lacking pre‑authentication, AS‑REP roasting captures encrypted credentials without domain access.

# Kerberoasting with Rubeus - extract TGS tickets for targeted SPNs

Rubeus.exe kerberoast /service:spn_name /output:kerb.tgs

# AS-REP roasting for accounts with no pre-authentication required

GetNPUsers /domain:corp.local /output:asrep.txt

These techniques are documented in skills/windows-ad/references/ad-attack-paths.md as primary credential harvesting methods against Kerberos implementations.

Phase 4: AD Certificate Services (ESC) Exploitation

For environments running Active Directory Certificate Services (AD‑CS), the playbook outlines ESC attacks including ESC1 and ESC8. Using Certipy, analysts abuse vulnerable certificate templates to escalate privileges or impersonate domain users.

# ESC1 - Request certificate with arbitrary SAN using vulnerable template

certipy certify -domain corp.local -user administrator -p Passw0rd -template User -san host.attacker.com

NTLM relay attacks complement certificate exploitation, combining Responder with ntlmrelayx to capture and relay authentication attempts.

# Start Responder for LLMNR/NBT-NS poisoning

responder -I eth0 -wrf

# Relay captured hashes to target systems

ntlmrelayx.py -tf targets.txt -smb2support

Phase 5: Credential Dumping and Lateral Movement

Post‑exploitation follows successful authentication, using Impacket's secretsdump to extract NTDS.dit contents or LSASS memory. The framework emphasizes that destructive commands require explicit authorization documented in the case scope.

# Dump domain secrets from compromised DC

secretsdump /domain:corp /user:admin /password:Pass123

Golden and silver ticket creation is permitted only when specifically authorized in the case-init scope file, with all actions logged as evidence prior to execution.

Phase 6: Evidence Collection and Cleanup

The final phase mandates comprehensive documentation through skills/ops/ reporting pipelines. Analysts must sanitize credentials from logs, generate command timelines, and validate that all testing artifacts align with the initial authorization boundaries defined in skills/scripts/case-init.ps1.

Critical Source Files for AD Penetration Testing

The reverse‑skill repository organizes AD testing knowledge across specific files that enforce methodology consistency:

• skills/windows-ad/SKILL.md: Primary playbook defining the six‑phase AD testing lifecycle and authorization checkpoints.
• skills/windows-ad/references/ad-attack-paths.md: Quick‑reference matrix of attack vectors including Kerberoasting, AS‑REP roasting, ESC1/ESC8, and NTLM relay configurations.
• skills/RULES.md: Global enforcement of scope boundaries and prohibited actions.
• skills/scripts/case-init.ps1: PowerShell script generating case scaffolding including scope definitions, evidence folders, and timeline templates.
• skills/ops/: Operational contracts defining evidence schemas and reporting pipelines.
• skills/tool-index.md: Inventory of available tools including Impacket, Certipy, BloodHound, and Rubeus.

Summary

• The reverse‑skill framework structures Windows Active Directory and Kerberos penetration testing through a modular router architecture defined in skills/SKILL.md and skills/windows-ad/SKILL.md.
• Six distinct phases enforce methodology: enumeration, path analysis, Kerberos attacks (Kerberoasting/AS‑REP), ESC exploitation, credential dumping, and evidence collection.
• Authorization gates in RULES.md and skills/scripts/case-init.ps1 prevent unauthorized exploitation by requiring case‑specific scope validation.
• Key tools include Rubeus for Kerberoasting, Certipy for ESC attacks, BloodHound for path analysis, and Impacket for credential extraction.
• All actions must be logged as evidence in skills/ops/ contracts before executing destructive commands against domain controllers.

Frequently Asked Questions

What authorization is required before running Kerberoasting attacks in reverse‑skill?

All Kerberos attacks including Kerberoasting and AS‑REP roasting require explicit authorization documented in the case scope file generated by skills/scripts/case-init.ps1. The RULES.md file enforces that no active commands execute until the operator validates scope, target ownership, and evidence collection procedures.

How does reverse‑skill prioritize attack paths during AD assessments?

The framework uses BloodHound graph analysis to identify high‑value paths such as Kerberoastable SPNs, AS‑REP roastable accounts, and AD‑CS template vulnerabilities documented in skills/windows-ad/references/ad-attack-paths.md. Path scoring weighs credential exposure and lateral movement potential before recommending specific exploitation techniques.

Which tools does reverse‑skill recommend for AD Certificate Services attacks?

For ESC attacks including ESC1 and ESC8, the repository specifies Certipy to enumerate and abuse vulnerable certificate templates. Combined with Responder and ntlmrelayx for NTLM relay scenarios, these tools target misconfigured PKI implementations commonly found in enterprise Active Directory environments.

Where is penetration test evidence stored in the reverse‑skill framework?

Evidence collection follows schemas defined in skills/ops/ operational contracts, with specific directories created during case initialization via skills/scripts/case-init.ps1. All commands, outputs, and timelines must be sanitized and stored according to these contracts before the engagement concludes.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}