# Kerbrute

> Use for tightly scoped Kerberos user enumeration and low-impact authentication checks during authorized internal pentests. Trigger on approved identity validation, username hypothesis testing, and controlled Kerberos exposure review.

- Skill: `timsonner/kerbrute` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/kerbrute`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/kerbrute/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/kerbrute

---


# Kerbrute

## Purpose

Use this skill for narrowly bounded Kerberos username and authentication validation in approved AD environments.

## Phase Fit

- Primary: Discovery and Reconnaissance, Vulnerability Analysis
- Secondary: Retest and Closure

## Use When

- Need to validate a small username hypothesis against Kerberos.
- Need to measure whether the domain leaks useful identity information.
- Need a repeatable retest for a specific Kerberos exposure.

## Avoid When

- Broad user enumeration or password checks are not explicitly approved.
- Lockout risk or monitoring thresholds are unclear.

## Inputs

- Approved domain and controller
- Narrow user list
- Lockout thresholds and rate expectations

## Procedure

1. Keep the user set tightly scoped.
2. Use the lowest rate that answers the question.
3. Stop as soon as the identity hypothesis is confirmed or disproved.
4. Coordinate with defenders if alert validation is in scope.
5. Preserve the exact domain and user list for retest.

## Command Syntax

Replace sample domains and user lists with approved in-scope values.

```bash
# User enumeration (does not cause lockouts)
kerbrute userenum -d contoso.com --dc 10.10.10.10 users.txt -o contoso-valid-users.txt

# User enumeration with safe mode (stops on lockout)
kerbrute userenum -d contoso.com --dc 10.10.10.10 users.txt --safe

# Single-password spray (only with explicit written approval)
kerbrute passwordspray -d contoso.com --dc 10.10.10.10 valid-users.txt 'Password2024!'

# Brute-force a single known account
kerbrute bruteuser -d contoso.com --dc 10.10.10.10 passwords.txt auditor

# Add delay between requests to reduce lockout risk
kerbrute userenum -d contoso.com --dc 10.10.10.10 users.txt --delay 500
```

## Evidence to Capture

- Whether the tested user set produced valid identity signals
- Domain controller and rate context
- Any alerting or lockout behavior observed

## Safety Boundaries

- Do not use for broad spraying or unapproved brute-force activity.
- Stop immediately if lockouts or service instability appear.