Claude-AD - Active Directory pentest methodology for Claude Co

项目说明

<di="center">

Claude-AD

Acti pentest methodology for Claude Code.

![Claude Code plugin]()

Skills, agents and commands that gi the playbook for an internal Acti assessment: the phase order, the en constraints that break your tooling, the telemetry each technique lea, and how a finding maps to a compliance control. It dri tooling (netexec, impacket, certipy, bloodyAD, BloodHound CE). You still run the engagement; Claude carries the method.

</div>

---

What this is

Every AD assessment follows the same spine: map before you exploit, harvest the easy credentials before you spray, collect the graph before you reason about paths. That spine, plus the hundred small constraints a hardened domain throws at you (NTLM disabled, AES-only Kerberos, LDAP channel binding, SPNs that must be FQDNs), is what separates an operator who finishes the engagement from one who spends a day debugging in.

Claude-AD encodes that method as Claude Code skills so Claude runs the standard tools in the right order, reads the en correctly, and tells you what each step will look like to a defender.

It covers:

It orchestrates third-party tools. BloodHound CE (Apache-2.0), impacket, certipy, netexec and bloodyAD do the work; Claude-AD is the method that drives them.

Install

Claude-AD is a Claude Code plugin. From inside Claude Code:

The first line registers this repo as a marketplace; the second installs the plugin. Once installed, the skills load automatically when you work on an AD engagement, and the commands (/ad-scope, /ad-recon, /ad-attack-paths) are a.

Layout

Scope and ethics

This is for authorized engagements only: your own lab, a domain you are contracted to test, a CTF. The exploitation agents ask for confirmation before any action that modifies the directory (a password reset, a group add, an RBCD write), and note where rollback applies. Use it where you ha to.

Where Claude-AD ends and ADscan begins

Claude-AD gives you the method. It tells Claude what to run, in what order, what each technique looks like on the wire, and which compliance control it touches. You still dri tool by hand and read every result yourself.

ADscan is the engine. It runs the whole chain from a low-pri user to Domain Admin on its own, on-prem, with guardrails and rollback, and turns the result into a report with control IDs a DORA, NIS2 or ENS auditor will accept. Where this repo hands Claude the playbook, ADscan is the tool that executes it end to end and writes the e.

ADscan is free and source-a. If the manual method here is useful and you want it run and mapped for you, that is what it is for.

Prior art and references

Claude-AD stands on the shoulders of the community. The techniques it encodes are documented in depth at The Hacker Recipes, the reference every skill here points back to for exact syntax. It sits alongside the growing set of Claude Code security collections (Claude-OSINT, Claude-BugHunter, claude-pentest), filling the Acti gap those bundles leave open. The tooling it drives (BloodHound CE, impacket, certipy, netexec, bloodyAD) is the work of their respecti.

Contributing

New techniques, sharper detection guidance, corrections to the compliance mapping: open an issue or a PR. Keep it AD-internal and keep the commands real.

License

MIT. See LICENSE. ADscan itself is a separate product under the Business Source License 1.1 (source-a).

---

_{Keywords: Acti penetration testing · Claude Code skills · red team · Kerberoasting · AS-REP roasting · ADCS ESC1-ESC17 · DCSync · ACL abuse · NTLM relay & coercion (PetitPotam, PrinterBug, DFSCoerce) · Kerberos delegation · BloodHound CE attack paths · OPSEC & MDI telemetry · DORA / NIS2 / ENS compliance mapping · netexec · impacket · certipy · bloodyAD.}

项目信息

开发语言：未知

Star 数：209

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Active Directory pentest methodology for Claude Code: skills, agents and slash commands for internal AD red-team work (Kerberoasting, ADCS ESC1-17, DCSync, ACL abuse, NTLM relay, delegation), with per-technique OPSEC/telemetry notes. Drives netexec, impacket, certipy, bloodyAD, BloodHound CE.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。