Kerberos Attacks

Kerberos Attacks is a Quality skill for Claude Code, published by ADScanPro in Claude-AD.

176 stars28 forkson ADScanPro/Claude-ADAdded 2026/09/08+5% in starsRepository updated 2026/08/24

active-directoryactive-directory-securityadcsbloodhoundclaudeclaude-codeclaude-code-pluginclaude-skillsdcsynckerberoastingkerberosntlm-relayoffensive-securitypenetration-testingpentestingred-team

Install in seconds

Install Kerberos Attacks

Copy Kerberos Attacks into your Claude Code skills folder. Run the command in your terminal, or review the source on GitHub before installing.

terminal

npx degit https://github.com/ADScanPro/Claude-AD/tree/main/skills/kerberos-attacks ~/.claude/skills/kerberos-attacks

Requires Node.js. Downloads this skill only — not the rest of the repository — into your Claude Code skills folder.

Without Node.js

git clone https://github.com/ADScanPro/Claude-AD.git

Clones the whole repository, then copy the skill’s own directory into your skills folder yourself.

In this catalog

Source file: skills/kerberos-attacks/SKILL.md in ADScanPro/Claude-AD
Installs to: ~/.claude/skills/kerberos-attacks
Collection: One of 8 skills cataloged from this repository
Category: Quality — 1897 skills

What Kerberos Attacks does

Kerberos Attacks covers Kerberoasting, AS-REP roasting, and delegation abuse in Active Directory using standard tools. Use it when you need commands, hash formats, event IDs, and remediation for Kerberos-based attack paths.

Kerberos Attacks is cataloged under Quality on DirSkills. Kerberos Attacks comes from a repository tagged active-directory, active-directory-security, adcs, bloodhound and claude.

Documentation

README

Excerpt

Kerberos Attacks

Standard-tooling playbook for the four Kerberos abuse families you meet on almost every internal AD engagement. You drive every tool yourself. This skill tells you what each attack is, the exact command, how the loot looks and how to crack it, what the DC logs, and what the remediation write-up should say.

Requirements before you touch these: valid domain credentials (any user is enough for Kerberoasting and delegation reads; AS-REP roasting needs only a username list), correct DNS pointing at the DC, and clock skew under 5 minutes or Kerberos rejects your tickets (KRB_AP_ERR_SKEW). Sync with sudo ntpdate <dc-ip> or faketime.

1. Kerberoasting

MITRE ATT&CK: T1558.003 (Steal or Forge Kerberos Tickets: Kerberoasting)

This is the opening of the README. Read the full README on GitHub.

Commands Kerberos Attacks provides

Slash commands named in this skill’s SKILL.md, listed in the order they first appear.

/nowrap

Frequently asked about Kerberos Attacks

What else does ADScanPro publish alongside Kerberos Attacks?
Kerberos Attacks is one of 8 skills that DirSkills catalogs from ADScanPro/Claude-AD, the repository it ships in. Its siblings there include AD CS Attacks, AD Environment Constraints and AD Methodology. Each one is a separate skill with its own page in this directory, installs the same way Kerberos Attacks does, and is maintained by ADScanPro in that same repository. The rest of the collection is listed on the ADScanPro/Claude-AD page.
How does Kerberos Attacks compare to other Quality skills?
Kerberos Attacks ranks #1704 by stars among the 1897 Quality skills in this catalog. The most-starred ones next to it are Benchmark, Benchmark Optimization Loop and API Design Patterns. DirSkills ranks by the star count of the repository each skill ships in, so that order reflects how popular those repositories are rather than any review of Kerberos Attacks against them. Open each page to compare what they document and how they install.