From cybersec-toolkit
Requests Kerberos TGS tickets for service accounts with SPNs and performs offline cracking to extract credentials. Useful for AD privilege escalation during red team engagements.
How this skill is triggered — by the user, by Claude, or both
Slash command
/cybersec-toolkit:performing-kerberoasting-attackThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.
Legal Notice: This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.
Kerberoasting is a post-exploitation technique that targets service accounts in Active Directory by requesting Kerberos TGS (Ticket Granting Service) tickets for accounts with Service Principal Names (SPNs) set. These tickets are encrypted with the service account's NTLM hash, allowing offline brute-force cracking without generating failed login events. It is one of the most common privilege escalation paths in AD environments because any domain user can request TGS tickets.
| Tool | Purpose | Platform |
|---|---|---|
| Rubeus | Kerberoasting and ticket manipulation | Windows (.NET) |
| Impacket GetUserSPNs.py | Remote Kerberoasting | Linux/Python |
| PowerView | SPN enumeration | Windows (PowerShell) |
| hashcat | Offline password cracking | Cross-platform |
| John the Ripper | Offline password cracking | Cross-platform |
npx claudepluginhub 26zl/cybersec-toolkit --plugin cybersec-toolkitRequests Kerberos TGS tickets for service accounts with SPNs and performs offline cracking to extract credentials. Useful for AD privilege escalation during red team engagements.
Guides Kerberoasting attacks in Active Directory: enumerate SPN accounts via LDAP, request TGS tickets, crack offline with hashcat or John the Ripper. For authorized red teaming and security testing.
Performs Kerberoasting attacks using Impacket's GetUserSPNs to extract and crack Kerberos TGS tickets for Active Directory service accounts during authorized security testing.