MCP App StoreMCP App StoreThis skill guides an agent through the process of performing a Kerberoasting attack within an Active Directory environment. It focuses on requesting Service Tickets (TGS) for accounts with Service Principal Names (SPNs), extracting the encrypted hashes, and cracking them offline to obtain plaintext passwords of high-privilege service accounts.
Use this skill during red-teaming engagements or authorized security assessments when you have compromised a standard domain user account and need to escalate privileges to a service account or Domain Admin.
impacket-GetUserSPNs and Rubeus for hash extraction, and hashcat for offline cracking.Suitable for security-focused agents operating in a Linux/Windows hybrid environment (e.g., Kali Linux), such as Claude Code or specialized red-team agents.
This skill has not been reviewed by our automated audit pipeline yet.
Active Directory Security Audit
Comprehensive AD security auditing using MITRE ATT&CK, covering ADCS, GPOs, ACLs, and Kerberos attacks.
BOLA & IDOR Hunting
Advanced methodology for detecting Broken Object Level Authorization and Insecure Direct Object References in APIs.
Active Directory Kerberos Attack Playbook
Expert-level guide for executing Kerberos-based attacks in AD environments, including roasting, ticket forging, and delegation abuse.
Analyzing Ransomware Leak Site Intelligence
Collect and analyze ransomware data-leak site (DLS) postings to extract victim, group, sector, and timeline intelligence for threat hunting and risk assessment.
Evaluating Threat Intelligence Platforms
Guides procurement, evaluation, and proof-of-concept testing for Threat Intelligence Platforms (MISP, OpenCTI, ThreatConnect, Anomali, EclecticIQ) based on inte
Performing Threat Modeling with OWASP Threat Dragon
Use OWASP Threat Dragon to create data-flow diagrams, apply STRIDE/LINDDUN threat classifications, and generate threat-model reports to guide secure design revi
Tabletop Exercise Designer
Design and generate CISA-aligned cybersecurity tabletop exercises, facilitator guides, participant materials, technical atomics, and SOP gap analyses for incide
Scanner Skill — Decepticon
High-volume codebase scanner that shards work, ranks suspicious locations, and promotes a concise set of candidates for deeper analysis.
AD Overview (Decepticon)
Playbook and workflows for Active Directory offensive operations: BloodHound ingestion, Kerberoasting, ADCS ESC scanning, DCSync and LAPS extraction.
Red Team Tools & Methodology
Automate professional red teaming and bug bounty workflows, from subdomain enumeration to vulnerability discovery.
ISC-Bench
Benchmark and pipeline for evaluating model safety (Internal Safety Collapse) using the TVD framework; builds prompts, runs models, extracts harmful content, an