Kerbrute

Kerbrute

Purpose

Use this skill for narrowly bounded Kerberos username and authentication validation in approved AD environments.

Phase Fit

• Primary: Discovery and Reconnaissance, Vulnerability Analysis
• Secondary: Retest and Closure

Use When

• Need to validate a small username hypothesis against Kerberos.
• Need to measure whether the domain leaks useful identity information.
• Need a repeatable retest for a specific Kerberos exposure.

Avoid When

• Broad user enumeration or password checks are not explicitly approved.
• Lockout risk or monitoring thresholds are unclear.

Inputs

• Approved domain and controller
• Narrow user list
• Lockout thresholds and rate expectations

Procedure

1. Keep the user set tightly scoped.
2. Use the lowest rate that answers the question.
3. Stop as soon as the identity hypothesis is confirmed or disproved.
4. Coordinate with defenders if alert validation is in scope.
5. Preserve the exact domain and user list for retest.

Command Syntax

Replace sample domains and user lists with approved in-scope values.

# User enumeration (does not cause lockouts)
kerbrute userenum -d contoso.com --dc 10.10.10.10 users.txt -o contoso-valid-users.txt

# User enumeration with safe mode (stops on lockout)
kerbrute userenum -d contoso.com --dc 10.10.10.10 users.txt --safe

# Single-password spray (only with explicit written approval)
kerbrute passwordspray -d contoso.com --dc 10.10.10.10 valid-users.txt 'Password2024!'

# Brute-force a single known account
kerbrute bruteuser -d contoso.com --dc 10.10.10.10 passwords.txt auditor

# Add delay between requests to reduce lockout risk
kerbrute userenum -d contoso.com --dc 10.10.10.10 users.txt --delay 500

Evidence to Capture

• Whether the tested user set produced valid identity signals
• Domain controller and rate context
• Any alerting or lockout behavior observed

Safety Boundaries

• Do not use for broad spraying or unapproved brute-force activity.
• Stop immediately if lockouts or service instability appear.