Menu
Decision tree for Active Directory enumeration. Maps enumeration tasks to tools, defines priority signals, and specifies what findings trigger deeper investigation. Use during the enumeration phase of network operations.
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Basé sur la classification professionnelle SOC
| name | ad-enumeration-playbook |
| description | Decision tree for Active Directory enumeration. Maps enumeration tasks to tools, defines priority signals, and specifies what findings trigger deeper investigation. Use during the enumeration phase of network operations. |
Systematic enumeration produces the attack surface map that drives exploitation. Follow this decision tree to maximize coverage with minimum noise.
Execute in this order. Each phase feeds the next — skip nothing.
Establish the AD landscape before enumerating objects.
| Task | Tool | Command Pattern |
|---|---|---|
| Identify domain controllers | netexec SMB scan + identify DCs | netexec_smb across target range |
| Domain/forest trust relationships | netexec LDAP --trusted-for-delegation or SharpView get_domain_trust | Trust direction determines lateral movement feasibility |
| Password policy | netexec SMB --pass-pol | Must retrieve before any credential spraying |
| Domain functional level | netexec LDAP or SharpView get_domain | Determines available attack techniques |
| Task | Tool | Priority Signal |
|---|---|---|
| All domain users | netexec LDAP --users or SharpView get_domain_user | High-privilege groups, service accounts, descriptions with passwords |
| All domain groups | netexec LDAP --groups or SharpView get_domain_group | Domain Admins, Enterprise Admins, custom admin groups |
| Group membership (recursive) | SharpView get_domain_group_member with recurse | Nested group memberships reveal hidden admin access |
| Kerberoastable accounts (SPNs) | netexec LDAP --kerberoasting or SharpView get_domain_user with SPN filter | Immediate attack signal — queue for Kerberoasting |
| AS-REP roastable accounts | netexec LDAP --asreproast or SharpView get_domain_user with PreauthNotRequired | Immediate attack signal — queue for AS-REP roasting |
| Task | Tool | Priority Signal |
|---|---|---|
| All domain computers | SharpView get_domain_computer | Operating system versions, stale accounts |
| Sessions and logged-on users | SharpView get_net_session, get_net_loggedon | Where high-value users are logged in |
| Local admin access | SharpView find_local_admin_access | Hosts where current creds have admin |
| Shares and sensitive files | netexec SMB --shares, SharpView find_domain_share | READ/WRITE shares, sensitive file names |
| Task | Tool | Priority Signal |
|---|---|---|
| Unconstrained delegation | SharpView get_domain_computer with Unconstrained filter | High-value attack target — Kerberos relay |
| Constrained delegation | SharpView get_domain_computer or get_domain_user with delegation filter | S4U2Proxy exploitation paths |
| RBCD candidates | BloodyAD bloodyad_get_writable or SharpView ACL queries | Objects where you can write msDS-AllowedToActOnBehalfOfOtherIdentity |
| Interesting ACLs | SharpView find_interesting_domain_acl | GenericAll, WriteDACL, WriteOwner on high-value targets |
| AD CS templates | Certipy find | Vulnerable templates (ESC1-ESC8) |
When enumeration reveals these signals, queue the corresponding action:
| Signal | Next Action |
|---|---|
| User with SPN | Kerberoast → crack → test credential |
| User with PreauthNotRequired | AS-REP roast → crack → test credential |
| Writable object (GenericAll, WriteDACL) | Plan ACL abuse via BloodyAD |
| Unconstrained delegation host | Plan Kerberos relay via Krbrelayx |
| Constrained delegation | Plan S4U exploitation via Impacket |
| AD CS vulnerable template | Plan certificate abuse via Certipy |
| Share with READ access | Access and review for credentials/configs |
| User description containing password hints | Test as credential |
| Stale computer accounts | Potential machine account takeover |
| Need | First Choice | Alternative |
|---|---|---|
| Bulk user/group enumeration | netexec LDAP | SharpView (more filters) |
| SMB share enumeration | netexec SMB --shares | SharpView get_net_share |
| ACL analysis | SharpView find_interesting_domain_acl | BloodyAD bloodyad_get_writable |
| Trust enumeration | SharpView get_domain_trust | netexec LDAP |
| Session enumeration | SharpView get_net_session | netexec SMB --sessions |
| Kerberoastable discovery | netexec LDAP --kerberoasting | SharpView with SPN filter |
| Certificate enumeration | Certipy find | — |
| DNS enumeration | BloodyAD bloodyad_get_dnsdump | SharpView get_domain_dns_record |
Pre-engagement reconnaissance workflow using HackerOne MCP tools to enumerate program scope, study prior disclosures, and identify high-value targets. Use when starting a new HackerOne program engagement, building an asset inventory, or planning target selection before active testing.
Pre-submission eligibility check for bug bounty findings. Catches ineligible patterns, AI/scanner false positives, and generates impact justification for borderline lows. Use before writing a report or when assessing whether a finding is worth reporting.
Static code analysis for DOM-based vulnerabilities in client-side JavaScript -- source/sink enumeration via grep and AST tools, data flow tracing, sanitization assessment, and framework-specific sink detection. Use when performing pre-commit reviews, auditing large codebases without dynamic execution, or triaging minified code for XSS issues.
Create custom jxscout analyzers (regex, derived, or script-based) and retrigger analysis. Use when the user wants to find specific code patterns across all project files, add new match kinds, or extend jxscout's static analysis capabilities.
Use when the user wants to connect to Jira, Confluence, or Compass — search issues with JQL, read or create issues and pages, link content across products, or set up Atlassian auth. The connector — not security tradecraft.
Use when the user wants to connect to Azure DevOps — query Boards work items with WIQL, read PRs, inspect pipeline runs, create or update work items and wiki pages, or set up ADO auth. The connector — not security tradecraft.
