Is the Active Directory Attack skill free?

Yes. The skill itself is free from hypnguyen1209/offensive-claude. SkillProof publishes the install command and an independent test verdict at no cost.

What is the Active Directory Attack SkillProof Score?

7.6/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 5/10, docs & honesty 4/5.

How do I install Active Directory Attack?

Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.

Can I use Active Directory Attack with Cursor, Copilot, Gemini CLI, Codex or other AI tools?

The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.

Active Directory Attack

Reference playbook for attacking Windows AD: Kerberoasting, ADCS, coercion/relay, DCSync

by hypnguyen1209 · hypnguyen1209/offensive-claude

Works with setup

Install — copy the command Download source ↗

Test report

Verdict: Works with setup
Score: 7.6/10
Tested: Jul 31, 2026
Environment: Claude Code 2.x (agent harness)
Upstream re-checked: Aug 10, 2026 · 2c363ee

Fetched SKILL.md and confirmed valid frontmatter (name+description). Spot-checked 4 of 6 scripts via raw fetch (all HTTP 200) and ran py_compile on each — all parse cleanly (ad_recon.py 187 lines, kerberoast_audit.py 122, adcs_esc_finder.py 155, rbcd_takeover.py 106); grep for exfil/base64/hardcoded C2 found only a legit ntlmrelayx target template string. Could NOT measure output vs baseline: every technique (bloodhound-python, certipy, impacket-secretsdump, the coerce/relay chain) requires a live Active Directory domain controller and an external toolchain I cannot stand up, so any artifact would just restate the skill's attack ordering. Repo README ships a curl|bash one-liner and a plugin install that overwrites ~/.claude/CLAUDE.md via a SessionStart hook — noted as smells; the SKILL.md and scripts themselves are clean.

Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works

Installs cleanly 5/5
Triggers reliably 5/5
Output vs. baseline 5/10
Docs & honesty 4/5

What Active Directory Attack does

A red-team reference skill for exploiting Windows Active Directory domains: Kerberos roasting and delegation, coercion plus NTLM/Kerberos relay, ADCS ESC1-16 certificate abuse, ticket forgery, DCSync, dMSA BadSuccessor, and BloodHound attack-path enumeration. Triggers when the user has a domain foothold and asks to escalate toward Domain Admin, roast service accounts, abuse certificate templates, or run relay/coercion chains. Ships six recon/audit scripts and six deep-dive reference files, but executing the actual attacks requires a live domain controller and the external toolchain (impacket, certipy, netexec, bloodhound).

How to install Active Directory Attack

git clone --depth 1 https://github.com/hypnguyen1209/offensive-claude.git /tmp/active-directory-attack-src
mkdir -p ~/.claude/skills
cp -R /tmp/active-directory-attack-src/skills/active-directory-attack ~/.claude/skills/active-directory-attack
# Reference/playbook skill only. Running the attacks needs external tools NOT bundled:
#   pip install impacket certipy-ad netexec ldap3 bloodhound-ce
#   plus rubeus/mimikatz/SharpSuccessor (Windows) and a LIVE target domain + DC.
# For authorized penetration testing / lab use only.
# NOTE: the repo README also offers `curl -sL .../install.sh | bash` and a
#   plugin marketplace install that registers a SessionStart hook and OVERWRITES
#   ~/.claude/CLAUDE.md — the manual copy above avoids both.

Skills live in ~/.claude/skills/ (global) or .claude/skills/ (per-project). Restart Claude Code after installing.

Commands — how to trigger Active Directory Attack

/active-directory-attack Reference playbook for attacking Windows AD: Kerberoasting, ADCS, coercion/relay, DCSync

It also activates on plain-language prompts like these:

Enumerate attack paths in this AD domain with BloodHound
Test for Kerberoastable service accounts
Check this domain for ADCS ESC1 misconfigurations

Frequently asked questions

Is the Active Directory Attack skill free?: Yes. The skill itself is free from hypnguyen1209/offensive-claude. SkillProof publishes the install command and an independent test verdict at no cost.
Does Active Directory Attack work with Claude Code?: We tested it with Claude Code 2.x (agent harness) on Jul 31, 2026. Verdict: Works with setup. Fetched SKILL.md and confirmed valid frontmatter (name+description). Spot-checked 4 of 6 scripts via raw fetch (all HTTP 200) and ran py_compile on each — all parse cleanly (ad_recon.py 187 lines, kerberoast_audit.py 122, adcs_esc_finder.py 155, rbcd_takeover.py 106); grep for exfil/base64/hardcoded C2 found only a legit ntlmrelayx target template string. Could NOT measure output vs baseline: every technique (bloodhound-python, certipy, impacket-secretsdump, the coerce/relay chain) requires a live Active Directory domain controller and an external toolchain I cannot stand up, so any artifact would just restate the skill's attack ordering. Repo README ships a curl|bash one-liner and a plugin install that overwrites ~/.claude/CLAUDE.md via a SessionStart hook — noted as smells; the SKILL.md and scripts themselves are clean.
What is the Active Directory Attack SkillProof Score?: 7.6/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 5/10, docs & honesty 4/5.
How do I install Active Directory Attack?: Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
Can I use Active Directory Attack with Cursor, Copilot, Gemini CLI, Codex or other AI tools?: The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.