Active Directory Kerberos Attacks

This is a comprehensive Kerberos attack reference covering the full spectrum from AS-REP roasting and Kerberoasting to golden/silver/diamond/sapphire ticket forgery and all three delegation abuse patterns. What stands out is the practical distinction between ticket types (golden vs diamond vs sapphire) with actual detection trade-offs, plus the resource-based constrained delegation walkthrough that includes the MAQ check and rbcd.py setup most guides skip. The attack chain routing to related skills (ACL abuse, ADCS, NTLM relay) is smart since Kerberos attacks rarely happen in isolation. Commands cover both Impacket and Rubeus with specific flags like /tgtdeleg for forcing RC4 tickets that crack faster. If you're doing AD pentesting beyond basic enumeration, you'll reference the delegation section and ticket comparison table constantly.

skills.sh installs: 3.8K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill active-directory-kerberos-attacks --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: Kerberos Attack Playbook — Expert AD Attack Guide

AI LOAD INSTRUCTION: Expert Kerberos attack techniques for AD environments. Covers AS-REP roasting, Kerberoasting, golden/silver/diamond/sapphire tickets, delegation attacks, pass-the-ticket, and overpass-the-hash. Base models miss ticket type distinctions, delegation chain nuances, and detection-evasion trade-offs.

0. RELATED ROUTING

Before going deep, consider loading:

active-directory-acl-abuse for ACL-based AD attacks often chained with Kerberos
active-directory-certificate-services for ADCS-based persistence (golden certificate)
ntlm-relay-coercion for NTLM relay attacks that complement Kerberos abuse
windows-lateral-movement after obtaining tickets for lateral movement