pinkpixel-dev/performing-kerberoasting-attack
SKILLS/performing-kerberoasting-attack/SKILL.md
Kerberoasting is a post-exploitation technique that targets service accounts in Active Directory by requesting Kerberos TGS (Ticket Granting Service) tickets for accounts with Service Principal Names
$ install --global
skillsauthnpx skillsauth add pinkpixel-dev/skills-collection-2 performing-kerberoasting-attackInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Aug 9, 2026, 3:15 AM330.2s7 files scanned
SKILL.md
- name:
- performing-kerberoasting-attack
- description:
- Kerberoasting is a post-exploitation technique that targets service accounts in Active Directory by requesting Kerberos TGS (Ticket Granting Service) tickets for accounts with Service Principal Names
- domain:
- cybersecurity
- subdomain:
- red-teaming
- tags:
- [red-team, adversary-simulation, mitre-attack, exploitation, post-exploitation, kerberoasting, active-directory, credential-access]
- version:
- 1.0
- author:
- mahipal
- license:
- Apache-2.0
Performing Kerberoasting Attack
Legal Notice: This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.
Overview
Kerberoasting is a post-exploitation technique that targets service accounts in Active Directory by requesting Kerberos TGS (Ticket Granting Service) tickets for accounts with Service Principal Names (SPNs) set. These tickets are encrypted with the service account's NTLM hash, allowing offline brute-force cracking without generating failed login events. It is one of the most common privilege escalation paths in AD environments because any domain user can request TGS tickets.
When to Use
- When conducting security assessments that involve performing kerberoasting attack
- When following incident response procedures for related security events
- When performing scheduled security testing or auditing activities
- When validating security controls through hands-on testing
Prerequisites
- Familiarity with red teaming concepts and tools
- Access to a test or lab environment for safe execution
- Python 3.8+ with required dependencies installed
- Appropriate authorization for any testing activities
MITRE ATT&CK Mapping
- T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting
- T1087.002 - Account Discovery: Domain Account
- T1069.002 - Permission Groups Discovery: Domain Groups
Workflow
Phase 1: SPN Enumeration
- Enumerate accounts with SPNs using LDAP queries
- Filter for user accounts (not computer accounts)
- Identify accounts with elevated privileges (adminCount=1)
- Prioritize accounts with weak password policies
Phase 2: TGS Ticket Request
- Request TGS tickets for identified SPN accounts
- Extract ticket data in crackable format (hashcat/john compatible)
- Ensure RC4 encryption is requested when possible (easier to crack)
- Document all requested tickets
Phase 3: Offline Cracking
- Use hashcat mode 13100 (Kerberos 5 TGS-REP etype 23) for RC4 tickets
- Use hashcat mode 19700 (Kerberos 5 TGS-REP etype 17) for AES-128
- Use hashcat mode 19800 (Kerberos 5 TGS-REP etype 18) for AES-256
- Apply targeted wordlists and rules based on password policy
Phase 4: Credential Validation
- Validate cracked credentials against domain
- Assess access level of compromised accounts
- Map accounts to BloodHound attack paths
- Document for engagement report
Tools and Resources
| Tool | Purpose | Platform | |------|---------|----------| | Rubeus | Kerberoasting and ticket manipulation | Windows (.NET) | | Impacket GetUserSPNs.py | Remote Kerberoasting | Linux/Python | | PowerView | SPN enumeration | Windows (PowerShell) | | hashcat | Offline password cracking | Cross-platform | | John the Ripper | Offline password cracking | Cross-platform |
Detection Indicators
- Event ID 4769: Kerberos Service Ticket Request with RC4 encryption (0x17)
- Anomalous TGS requests from a single account in short timeframe
- TGS requests for services the user normally does not access
- Honeypot SPN accounts with alerting on ticket requests
Validation Criteria
- [ ] SPN accounts enumerated and documented
- [ ] TGS tickets extracted in crackable format
- [ ] Offline cracking attempted with appropriate wordlists
- [ ] Cracked credentials validated
- [ ] Access level of compromised accounts assessed
Related Skills
pinkpixel-dev/performing-lateral-movement-with-wmiexec
tools
VerifiedTrustedCommunity
Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.
1SKILL.mdUpdated Aug 9, 2026
pinkpixel-dev/performing-lateral-movement-detection
data-ai
VerifiedTrustedCommunity
Detects lateral movement techniques including Pass-the-Hash, PsExec, WMI execution, RDP pivoting, and SMB-based spreading using SIEM correlation of Windows event logs, network flow data, and endpoint telemetry mapped to MITRE ATT&CK Lateral Movement (TA0008) techniques.
1SKILL.mdUpdated Aug 9, 2026
pinkpixel-dev/performing-kubernetes-penetration-testing
tools
VerifiedTrustedCommunity
Kubernetes penetration testing systematically evaluates cluster security by simulating attacker techniques against the API server, kubelet, etcd, pods, RBAC, network policies, and secrets. Using tools
1SKILL.mdUpdated Aug 9, 2026
pinkpixel-dev/performing-kubernetes-etcd-security-assessment
testing
VerifiedTrustedCommunity
Assess the security posture of Kubernetes etcd clusters by evaluating encryption at rest, TLS configuration, access controls, backup encryption, and network isolation.
1SKILL.mdUpdated Aug 9, 2026