Is the Offensive Active Directory skill free?

Yes. The skill itself is free from SnailSploit/Claude-Red. SkillProof publishes the install command and an independent test verdict at no cost.

What is the Offensive Active Directory SkillProof Score?

9.2/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 9/10, docs & honesty 4/5.

How do I install Offensive Active Directory?

Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.

Can I use Offensive Active Directory with Cursor, Copilot, Gemini CLI, Codex or other AI tools?

The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.

Offensive Active Directory

AD red-team methodology: Kerberoasting to ADCS ESC1-15 to DCSync, for authorized engagements

by SnailSploit · SnailSploit/Claude-Red

Tested · Works

Install — copy the command Download source ↗

Test report

Verdict: Tested · Works
Score: 9.2/10
Tested: Jul 10, 2026
Environment: Claude Code 2.x (agent harness)
Upstream re-checked: Aug 10, 2026 · 46a1b79

For an ADCS ESC1 escalation, recall got the concept right but was fuzzy on exact syntax; the doc gave exact certipy command lines and a full misconfig table, though one of its own source links no longer resolves.

Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works

Installs cleanly 5/5
Triggers reliably 5/5
Output vs. baseline 9/10
Docs & honesty 4/5

What Offensive Active Directory does

A condensed offensive methodology for internal Active Directory penetration tests: BloodHound/PowerView recon, credential harvesting (Kerberoasting, ASREProast, NTLM relay, LLMNR poisoning), ACL and delegation abuse, ADCS ESC1-ESC15 exploitation, lateral movement, persistence, and MDI/Defender for Identity evasion. Triggers when a user is doing an authorized on-prem or hybrid AD/Entra red-team assessment and needs attack-path commands, not defensive hardening guidance.

How to install Offensive Active Directory

git clone https://github.com/SnailSploit/Claude-Red
cd Claude-Red
mkdir -p ~/.claude/skills
cp -r Skills/active-directory/offensive-active-directory ~/.claude/skills/offensive-active-directory

Skills live in ~/.claude/skills/ (global) or .claude/skills/ (per-project). Restart Claude Code after installing.

Commands — how to trigger Offensive Active Directory

/offensive-active-directory AD red-team methodology: Kerberoasting to ADCS ESC1-15 to DCSync, for authorized engagements

It also activates on plain-language prompts like these:

Walk me through Kerberoasting during our authorized AD pentest
Show ADCS ESC1 exploitation steps for this internal red-team engagement
Help plan lateral movement and DCSync for our authorized AD assessment

Frequently asked questions

Is the Offensive Active Directory skill free?: Yes. The skill itself is free from SnailSploit/Claude-Red. SkillProof publishes the install command and an independent test verdict at no cost.
Does Offensive Active Directory work with Claude Code?: We tested it with Claude Code 2.x (agent harness) on Jul 10, 2026. Verdict: Tested · Works. For an ADCS ESC1 escalation, recall got the concept right but was fuzzy on exact syntax; the doc gave exact certipy command lines and a full misconfig table, though one of its own source links no longer resolves.
What is the Offensive Active Directory SkillProof Score?: 9.2/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 9/10, docs & honesty 4/5.
How do I install Offensive Active Directory?: Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
Can I use Offensive Active Directory with Cursor, Copilot, Gemini CLI, Codex or other AI tools?: The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.