E-KER
kerbrute
Kerberos pre-authentication tool for enumerating valid Active Directory usernames and testing passwords.
OVERVIEW
kerbrute abuses Kerberos pre-authentication (the initial AS-REQ/AS-REP exchange) to check whether a username exists on a domain: a valid username returns a pre-auth-required or successful response, while an invalid one returns a distinct principal-unknown error, all without completing a full logon. Because a failed guess never reaches the point of generating a Windows logon-failure event, the technique is comparatively quiet compared to SMB or LDAP-based username enumeration.
Beyond plain username enumeration (userenum), it supports password spraying a single password across a user list (passwordspray) and bruteforcing single accounts, always talking raw KRB5 over UDP/TCP 88 to the domain controller rather than going through a Windows API.
USE CASES
Practical use cases
- 01
Turning a guessed or scraped list of candidate names into a confirmed list of valid domain usernames.
- 02
Running a low-and-slow password spray of one known-weak password across the confirmed username list.
- 03
Building the initial user list an engagement needs before AS-REP roasting or Kerberoasting.
- 04
Validating naming-convention guesses (e.g. first.last) against the real directory before wider enumeration.
QUICK START
When scope includes a domain controller and a candidate username list, to confirm which accounts exist before attempting password spraying or targeted attacks.
- Confirm the domain controller and username-guessing scope are authorized.
- Build or obtain a candidate username wordlist matching the target naming convention.
- Resolve the domain's realm name and confirm UDP/TCP 88 reaches the DC.
- Run userenum against the DC to get back the confirmed valid usernames.
- Feed the confirmed list into a low-and-slow password spray only if that is separately authorized.
kerbrute userenum -d target.local --dc 10.10.10.10 users.txtBEFORE YOU RUN IT
What to check before running it
Kerberos pre-auth enumeration is comparatively low-noise since failed guesses skip the normal Windows logon-failure event, but successful and failed AS-REQ attempts are still visible in DC Kerberos event logs (4768/4771) to anyone watching for them.
Account lockout policies still apply to the passwordspray and bruteuser modes — throttle attempts and confirm the lockout threshold with the client before running either.
Username enumeration and password guessing against a live domain controller require explicit scope and written authorization; treat any confirmed account as sensitive data.