Active Directory Forest Trust Attack
FreeAudit and enumerate Active Directory forest trust relationships.
Free · Opens the source repo
What Active Directory Forest Trust Attack does
The Active Directory Forest Trust Attack skill is designed for security professionals conducting assessments of Active Directory (AD) forest trust configurations. By leveraging Impacket, this skill enables users to enumerate trust relationships and analyze the security posture of these trusts. It focuses on critical areas such as SID filtering, SID history abuse detection, and inter-realm Kerberos ticket assessments, which are essential for identifying potential vulnerabilities in multi-forest environments.
This skill is particularly useful during red team operations or security audits where understanding trust relationships can reveal paths for privilege escalation and lateral movement. Users can perform detailed analyses that include querying trust attributes, checking SID filtering status, and identifying foreign security principals in trusted domains. The output is a comprehensive JSON report that not only lists trust relationships but also highlights risks and provides remediation recommendations.
To effectively use this skill, practitioners must have domain credentials with read access to AD trust objects and network access to Domain Controllers. It is intended for authorized security testing and should only be used in environments where permission has been granted. This ensures that the skill is employed ethically and within legal boundaries, making it a valuable tool for penetration testers and security auditors alike.
When to use it
Use this skill during security assessments of Active Directory environments, particularly when evaluating forest trusts and their configurations.
When not to use it
Avoid using this skill in environments where you do not have explicit permission to conduct security testing, as unauthorized use is illegal.
What you can build with it
Red Team Engagements
Utilize this skill during red team operations to assess the security of Active Directory forest trusts and identify potential attack vectors.
Security Audits
Employ this skill for scheduled security audits to validate the configuration and security of forest trusts in Active Directory.
Incident Response
Incorporate this skill into incident response procedures when investigating security events related to Active Directory trusts.
How to install Active Directory Forest Trust Attack
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/performing-active-directory-forest-trust-attack --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Performing Active Directory Forest Trust Attack
Overview
Active Directory forest trusts enable authentication across organizational boundaries but introduce attack surface if misconfigured. This skill uses impacket to enumerate trust relationships, analyze SID filtering configuration, detect SID history abuse vectors, perform cross-forest SID lookups via LSA/LSAT RPC calls, and assess inter-realm Kerberos ticket configurations for trust ticket forgery risks.
When to Use
- When conducting security assessments that involve performing active directory forest trust attack
- When following incident response procedures for related security events
- When performing scheduled security testing or auditing activities
- When validating security controls through hands-on testing
Prerequisites
- Python 3.9+ with
impacket,ldap3 - Domain credentials with read access to AD trust objects
- Network access to Domain Controllers (ports 389, 445, 88)
- Authorized penetration testing engagement or lab environment
Legal Notice: This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.
Steps
- Enumerate forest trust relationships via LDAP trusted domain objects
- Query trust attributes and SID filtering status for each trust
- Perform SID lookups across trust boundaries using LsarLookupNames3
- Enumerate foreign security principals in trusted domains
- Check for SID history on cross-forest accounts
- Assess trust direction and transitivity for lateral movement paths
- Generate trust security audit report with risk findings
Expected Output
- JSON report listing all trust relationships, SID filtering status, foreign principals, trust direction/transitivity, and risk assessment
- Cross-forest attack path analysis with remediation recommendations
Frequently asked questions about Active Directory Forest Trust Attack
Similar skills
Cloudflare Security Audit
Perform authorized security audits on codebases.
Authenticated Scan with OpenVAS
Perform deep vulnerability scans using OpenVAS with credentials.
Active Directory Penetration Test
Conduct focused AD penetration tests with ease.
Active Directory BloodHound Analysis
Visualize Active Directory attack paths and risks.
Orchestrating LLM Attacks with PyRIT
Automate multi-turn adversarial attacks against LLMs.
Operating Sliver C2
Deploy and manage Sliver C2 for red-team engagements.