Mastering Microsoft Active Directory Attack Techniques
Master 6+ essential AD attack tools like Mimikatz and BloodHound.
Automate Kerberos and lateral movement for red team operations. Start attacking now!
Red Teaming
Kerberos
Active Directory
Cybersecurity
Network Exploitation
About This Skill
This skill provides comprehensive techniques for attacking Microsoft Active Directory environments, covering 6+ essential tools including BloodHound, Mimikatz, and Impacket to achieve domain dominance.
Quick Start
1Ensure Kerberos clock synchronization within ±5 minutes
2Initialize your attack platform (Kali or Windows)
3Run reconnaissance using BloodHound to visualize attack paths
Example Command
sudo date -s "14 APR 2024 18:25:16"
Core Capabilities
Reconnaissance
Perform deep domain enumeration and identify attack paths using BloodHound and PowerView.
Credential Harvesting
Extract hashes and cleartext passwords using Mimikatz and Responder.
Kerberos Attacks
Execute sophisticated Kerberos-based attacks including Golden and Silver ticket creation.
Lateral Movement
Navigate through the network using Impacket and CrackMapExec to escalate privileges.
Usage Examples
Before
System time is 2 hours off, causing Kerberos ticket rejection.
After
Clock synchronized via 'date -s', enabling seamless Kerberos authentication.
Before
Single user access with limited visibility.
After
Full credential extraction and lateral movement capability across the domain.
Before
Raw AD data is difficult to interpret.
After
Clear visual paths from standard user to Domain Admin are identified.
SKILL.md
---
name: active-directory-attacks
description: "Provide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and domain dominance for red team operations and penetration testing."
risk: offensive
source: community
author: zebbern
date_added: "2026-02-27"
---
> AUTHORIZED USE ONLY: Use this skill only for authorized security assessments, defensive validation, or controlled educational environments.
<!-- security-allowlist: credential-extraction, kerberos-attacks -->
# Active Directory Attacks
## Purpose
Provide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and domain dominance for red team operations and penetration testing.
## Inputs/Prerequisites
- Kali Linux or Windows attack platform
- Domain user credentials (for most attacks)
- Network access to Domain Controller
- Tools: Impacket, Mimikatz, BloodHound, Rubeus, CrackMapExec
## Outputs/Deliverables
- Domain enumeration data
- Extracted credentials and hashes
- Kerberos tickets for impersonation
- Domain Administrator access
- Persistent access mechanisms
---
## Essential Tools
| Tool | Purpose |
|------|---------|
| BloodHound | AD attack path visualization |
| Impacket | Python AD attack tools |
| Mimikatz | Credential extraction |
| Rubeus | Kerberos attacks |
| CrackMapExec | Network exploitation |
| PowerView | AD enumeration |
| Responder | LLMNR/NBT-NS poisoning |
---
## Core Workflow
### Step 1: Kerberos Clock Sync
Kerberos requires clock synchronization (±5 minutes):
```bash
# Detect clock skew
nmap -sT 10.10.10.10 -p445 --script smb2-time
# Fix clock on Linux
sudo date -s "14 APR 2024 18:25:16"
# Fix clock on Windows
net time /domain /set
# Fake clock without changing system time
faketime -f '+8h' <command>
```
### St
Frequently Asked Questions
FAQ
What tool compatibility is required?
The skill is compatible with Kali Linux and Windows attack platforms, utilizing tools like Impacket, Mimikatz, and Rubeus.
Who is the target audience?
This skill is designed for Red Teamers, Penetration Testers, and Security Researchers performing authorized assessments.
How does this differ from standard AD management tools?
Unlike management tools used for administration, this skill focuses on offensive techniques like credential harvesting and lateral movement.
Is there specific language support?
The core tools used, such as Impacket, are Python-based, making it highly extensible for Python developers.
What are the expected results of using this skill?
Users can expect to achieve domain enumeration, credential extraction, and eventually Domain Administrator access.
Discussion
Discussion
0 comments
U
On This Page
Trigger Phrases
Use these phrases to activate this skill in your AI coding assistant:
