Active Directory Attacks: Comprehensive Red Team Techniques
Master 6+ essential AD attack tools like Mimikatz and BloodHound.
Automate Kerberos attacks and lateral movement for red team operations.
Red Teaming
Kerberos
Active Directory
Offensive Security
Domain Controller
About This Skill
Master the art of domain dominance with this skill, featuring 7+ essential tools including Mimikatz and BloodHound to execute complex Kerberos attacks and lateral movement.
Quick Start
1Ensure Kerberos clock synchronization is within ±5 minutes
2Initialize your attack platform (Kali or Windows)
3Run BloodHound to visualize attack paths
Example Command
sudo date -s "14 APR 2024 18:25:16"
Core Capabilities
Reconnaissance
Perform deep domain enumeration and identify attack paths using BloodHound and PowerView.
Credential Harvesting
Extract hashes and cleartext passwords using Mimikatz and Responder.
Kerberos Attacks
Execute sophisticated Kerberos-based attacks including Golden/Silver tickets and Rubeus automation.
Lateral Movement
Navigate through the network using Impacket and CrackMapExec to escalate privileges.
Usage Examples
Before
Clock skew > 5 minutes causing Kerberos failure
After
Clock synchronized via net time /domain /set
Before
Low-privilege user access
After
Full Domain Admin dominance
Before
Passive network listening
After
Active poisoning with Responder
SKILL.md
---
name: active-directory-attacks
description: "Provide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and domain dominance for red team operations and penetration testing."
risk: offensive
source: community
author: zebbern
date_added: "2026-02-27"
---
> AUTHORIZED USE ONLY: Use this skill only for authorized security assessments, defensive validation, or controlled educational environments.
<!-- security-allowlist: credential-extraction, kerberos-attacks -->
# Active Directory Attacks
## Purpose
Provide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and domain dominance for red team operations and penetration testing.
## Inputs/Prerequisites
- Kali Linux or Windows attack platform
- Domain user credentials (for most attacks)
- Network access to Domain Controller
- Tools: Impacket, Mimikatz, BloodHound, Rubeus, CrackMapExec
## Outputs/Deliverables
- Domain enumeration data
- Extracted credentials and hashes
- Kerberos tickets for impersonation
- Domain Administrator access
- Persistent access mechanisms
---
## Essential Tools
| Tool | Purpose |
|------|---------|
| BloodHound | AD attack path visualization |
| Impacket | Python AD attack tools |
| Mimikatz | Credential extraction |
| Rubeus | Kerberos attacks |
| CrackMapExec | Network exploitation |
| PowerView | AD enumeration |
| Responder | LLMNR/NBT-NS poisoning |
---
## Core Workflow
### Step 1: Kerberos Clock Sync
Kerberos requires clock synchronization (±5 minutes):
```bash
# Detect clock skew
nmap -sT 10.10.10.10 -p445 --script smb2-time
# Fix clock on Linux
sudo date -s "14 APR 2024 18:25:16"
# Fix clock on Windows
net time /domain /set
# Fake clock without changing system time
faketime -f '+8h' <command>
```
### St
Frequently Asked Questions
FAQ
What tool compatibility is required?
The skill is optimized for Kali Linux and Windows attack platforms using tools like Impacket and Mimikatz.
Who is the target audience for this skill?
It is designed for Red Teamers, Penetration Testers, and Security Engineers performing defensive validation.
How does this differ from standard AD management?
Unlike management, this focuses on offensive techniques like credential harvesting and Kerberos exploitation.
Is there language support for the automation?
Yes, the core tools rely heavily on Python (Impacket) and C# (Rubeus/BloodHound).
What are the expected results after use?
Users can expect domain enumeration data, extracted hashes, and achieved Domain Administrator access.
Discussion
Discussion
0 comments
U
On This Page
Trigger Phrases
Use these phrases to activate this skill in your AI coding assistant:
