Run any Skill in Manus with one click

pentest-active-directory

Stars5

Forks2

UpdatedJune 9, 2026 at 03:59

Active Directory and hybrid Entra ID penetration testing. Use when the user mentions BloodHound, SharpHound, SOAPHound, AzureHound, RustHound, Kerberoast, AS-REP roast, Golden/Silver/Diamond/Sapphire ticket, DCSync, DCShadow, NTLM relay, ntlmrelayx, ADCS ESC1-ESC15+, EKUwu, Certipy, ACL abuse (GenericAll/WriteDACL/WriteOwner/shadow credentials), GPO abuse, NoPac, ZeroLogon, PetitPotam, DFSCoerce, PrinterBug, krbrelayup, AAD Connect, MSOL_, Pass-Through Auth, Seamless SSO, AdminSDHolder, SID History, krbtgt, or any "domain compromise" task.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

thau0x01

thau0x01/ai-pentest-kb

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Information Security AnalystsComputer and Mathematical Occupations·SOC 15-1212

SKILL.md

readonly

name

pentest-active-directory

description

Pentest — Active Directory

Apply 05-active-directory/ from the pentest-templates library.

Library root

$PENTEST_LIBRARY — caminho absoluto deste repositório clonado (definido pelo instalador; veja INSTALL.md).

Read 05-active-directory/00-overview.md first.

Phase order

05-active-directory/01-enumeration-unauth.md — domain ID, DC location, anonymous LDAP, Kerberos username enum, SMB/LDAP signing posture.
05-active-directory/02-enumeration-authd.md — full BloodHound collection, share content, ACL audit, ADCS template inventory, delegation inventory, LAPS posture.
05-active-directory/03-bloodhound-analysis.md — pre-built queries, custom Cypher, Tier-0 mapping, cross-domain paths.
05-active-directory/04-kerberos-attacks.md — Kerberoast, AS-REP, delegation chains, ticket forgery.
05-active-directory/05-credential-attacks.md — spraying, NTLM relay, LSASS, NTDS, DPAPI, GPP, LAPS, SCCM, shadow credentials.
05-active-directory/06-acl-abuse.md — GenericAll/Write/WriteDACL, ForceChangePassword, AddKeyCredentialLink.
05-active-directory/07-gpo-abuse.md — GPO write, scheduled task injection, MSI deployment.
05-active-directory/08-adcs-attacks.md — ESC1-ESC15 catalog (incl EKUwu).
05-active-directory/09-trusts.md — cross-domain SID History, forest trust, SID filtering audit.
05-active-directory/10-lateral-movement.md — PtH/PtT/OPtH, native protocols.
05-active-directory/11-privesc-domain.md — DCSync, ZeroLogon, NoPac, coercion → relay → DA.
05-active-directory/12-azure-ad-hybrid.md — AAD Connect, PTA, Seamless SSO, AD FS attacks.
05-active-directory/13-persistence.md — Golden/Silver/Diamond/Sapphire, AdminSDHolder, SID History, ACL backdoor, ADCS persistence.

How to operate

Always run BloodHound first when authenticated; many later decisions depend on graph paths.
For OPSEC engagements use SOAPHound (LDAP-only collector) over SharpHound; for offline analysis use RustHound or BloodHound.py.
ADCS: enumerate templates with Certipy find before attempting ESCx; map ESC1-15 catalog to template ACLs in 08-adcs-attacks.md.
Coercion → relay chains: choose coercer (PetitPotam / DFSCoerce / PrinterBug / WSPCoerce) by target OS + signing posture.
Hybrid: walk the on-prem ↔ cloud bridges in 12-azure-ad-hybrid.md — AAD Connect host is Tier-0.
Document IOCs for every persistence primitive (Golden Ticket = krbtgt double-rotation required to invalidate).

When NOT to use

Cloud-only Entra ID (no on-prem AD) → pentest-cloud plus 05-active-directory/12-azure-ad-hybrid.md for hybrid bridges.
Generic Windows server compromise without AD → pentest-infra-internal.

Pre-conditions

Network reachability to a domain-joined segment.
Optionally low-priv domain credentials.
BloodHound CE 8.x installed; Certipy, Rubeus, Mimikatz/NanoDump, ntlmrelayx, mitm6, impacket, NetExec ready.

OPSEC

BloodHound default rate alerts NDR. Use --throttle 250 --jitter 30 minimum; SOAPHound for stealth.
Coercion attacks trigger Defender for Identity / ATA — coordinate with SOC.
Krbtgt rotation must be DOUBLE to invalidate Golden Tickets.
ZeroLogon resets DC machine password — many ROEs forbid; restoration required if used.
Kerberos username enum produces 4768/4771 — visible.

References inside the library

Cheatsheet: cheatsheets/active-directory.md.
Tooling: tool-mappings/05-active-directory-tools.md.
Frameworks: frameworks/mitre-attack-enterprise.md.
The Hacker Recipes: https://www.thehacker.recipes/ad/movement.
Lab walkthrough: playbooks/03-goad-walkthrough.md.

More from this repository

same repository

engagement-management

thau0x01/ai-pentest-kb

Engagement-lifecycle management — pre-engagement scoping, ROE drafting, authorisation letters, threat modeling, CVSS scoring, finding write-up, executive summary, technical report, retest scoping, remediation validation. Use when the user mentions scope a pentest, ROE template, rules of engagement, get-out-of-jail letter, authorisation letter, scope statement, communications plan, blackout window, escalation matrix, threat modeling, STRIDE, PASTA, attack tree, threat actor profile, CVSS scoring, finding template, executive summary, technical report, retest, remediation validation, regression coverage, engagement kickoff, or evidence chain of custody.

2026-06-095

engagement-retest

thau0x01/ai-pentest-kb

Plan and execute a pentest retest — re-scope, re-execute the validation steps from prior findings, detect regressions, and write the retest report. Use when the user mentions retest, re-test, remediation validation, regression coverage, "verify the fixes", "validate remediation", retest scoping, retest report, posture trajectory, or compares "before vs after" findings.

2026-06-095

engagement-scoping

thau0x01/ai-pentest-kb

Drive the pre-engagement scoping conversation and produce the scope statement, Rules of Engagement, authorisation letter, and communications plan. Use when the user mentions kickoff, scoping a pentest, drafting ROE, rules of engagement, scope statement, authorisation letter, get-out-of-jail letter, communications plan, blackout window, escalation matrix, ROE drift, third-party hosting carve-out, social-engineering allowance, time-window restrictions, or evidence-handling rules.

2026-06-095

pentest-ai-llm

thau0x01/ai-pentest-kb

LLM-backed application, AI agent, and AI/ML supply-chain penetration testing. Use when the user mentions LLM pentest, AI red team, prompt injection (direct or indirect), jailbreak, DAN, Crescendo, GCG, many-shot jailbreak, system prompt leakage, RAG poisoning, embedding poisoning/inversion, vector DB attack, MCP / Model Context Protocol abuse, tool poisoning, agent excessive agency, function-call abuse, output handling chains (XSS/SSRF/SQLi via LLM output), training-data extraction, membership inference, modelscan/picklescan, Hugging Face poisoned model, garak, PyRIT, promptmap, Augustus, Spikee, OWASP LLM01-LLM10, MITRE ATLAS, or unbounded consumption / cost amplification.

2026-06-095

pentest-cheatsheet

thau0x01/ai-pentest-kb

Surface a one-page pentest cheatsheet for fast field recall. Use when the user asks for a "quick command", "cheatsheet", "one-liner", "what's the syntax for X", "remind me how to do Y", "give me the recon snippets", "AD cheatsheet", "lateral-movement one-liners", "AWS quick commands", "Azure quick commands", "mobile cheatsheet", "initial access cheatsheet", or any request that wants tools/commands without methodology overhead.

2026-06-095

pentest-checklist-lookup

thau0x01/ai-pentest-kb

Resolve a stable pentest-template checklist ID (e.g. WEB-AUTHN-04, AD-KRB-02, CLD-AWS-IAM-07, IOT-FW-05, RT-INIT-03, LLM-PI-03) to its full methodology, references, mappings, how-to-test block, and accept criteria. Use when the user mentions a checklist ID, asks to "look up <ID>", "what does <ID> say", "show me <ID>", "find checklist items mapped to CVE-XXXX", "find items mapped to ATT&CK Tnnn", "find items by CWE-NNN", or wants to navigate the templates by stable identifier.

2026-06-095

name

pentest-active-directory

description

Pentest — Active Directory

Apply 05-active-directory/ from the pentest-templates library.

Library root

$PENTEST_LIBRARY — caminho absoluto deste repositório clonado (definido pelo instalador; veja INSTALL.md).

Read 05-active-directory/00-overview.md first.

Phase order

05-active-directory/01-enumeration-unauth.md — domain ID, DC location, anonymous LDAP, Kerberos username enum, SMB/LDAP signing posture.
05-active-directory/02-enumeration-authd.md — full BloodHound collection, share content, ACL audit, ADCS template inventory, delegation inventory, LAPS posture.
05-active-directory/03-bloodhound-analysis.md — pre-built queries, custom Cypher, Tier-0 mapping, cross-domain paths.
05-active-directory/04-kerberos-attacks.md — Kerberoast, AS-REP, delegation chains, ticket forgery.
05-active-directory/05-credential-attacks.md — spraying, NTLM relay, LSASS, NTDS, DPAPI, GPP, LAPS, SCCM, shadow credentials.
05-active-directory/06-acl-abuse.md — GenericAll/Write/WriteDACL, ForceChangePassword, AddKeyCredentialLink.
05-active-directory/07-gpo-abuse.md — GPO write, scheduled task injection, MSI deployment.
05-active-directory/08-adcs-attacks.md — ESC1-ESC15 catalog (incl EKUwu).
05-active-directory/09-trusts.md — cross-domain SID History, forest trust, SID filtering audit.
05-active-directory/10-lateral-movement.md — PtH/PtT/OPtH, native protocols.
05-active-directory/11-privesc-domain.md — DCSync, ZeroLogon, NoPac, coercion → relay → DA.
05-active-directory/12-azure-ad-hybrid.md — AAD Connect, PTA, Seamless SSO, AD FS attacks.
05-active-directory/13-persistence.md — Golden/Silver/Diamond/Sapphire, AdminSDHolder, SID History, ACL backdoor, ADCS persistence.

How to operate

Always run BloodHound first when authenticated; many later decisions depend on graph paths.
For OPSEC engagements use SOAPHound (LDAP-only collector) over SharpHound; for offline analysis use RustHound or BloodHound.py.
ADCS: enumerate templates with Certipy find before attempting ESCx; map ESC1-15 catalog to template ACLs in 08-adcs-attacks.md.
Coercion → relay chains: choose coercer (PetitPotam / DFSCoerce / PrinterBug / WSPCoerce) by target OS + signing posture.
Hybrid: walk the on-prem ↔ cloud bridges in 12-azure-ad-hybrid.md — AAD Connect host is Tier-0.
Document IOCs for every persistence primitive (Golden Ticket = krbtgt double-rotation required to invalidate).

When NOT to use

Cloud-only Entra ID (no on-prem AD) → pentest-cloud plus 05-active-directory/12-azure-ad-hybrid.md for hybrid bridges.
Generic Windows server compromise without AD → pentest-infra-internal.

Pre-conditions

Network reachability to a domain-joined segment.
Optionally low-priv domain credentials.
BloodHound CE 8.x installed; Certipy, Rubeus, Mimikatz/NanoDump, ntlmrelayx, mitm6, impacket, NetExec ready.

OPSEC

BloodHound default rate alerts NDR. Use --throttle 250 --jitter 30 minimum; SOAPHound for stealth.
Coercion attacks trigger Defender for Identity / ATA — coordinate with SOC.
Krbtgt rotation must be DOUBLE to invalidate Golden Tickets.
ZeroLogon resets DC machine password — many ROEs forbid; restoration required if used.
Kerberos username enum produces 4768/4771 — visible.

References inside the library

Cheatsheet: cheatsheets/active-directory.md.
Tooling: tool-mappings/05-active-directory-tools.md.
Frameworks: frameworks/mitre-attack-enterprise.md.
The Hacker Recipes: https://www.thehacker.recipes/ad/movement.
Lab walkthrough: playbooks/03-goad-walkthrough.md.