Tool for performing Kerberos pre-authentication brute-forcing, user enumeration, and password spraying against Active Directory.
kerbrute userenum -d {domain} -U {userlist} --dc {dc-ip} 🌍 domain → domain 📎 userlist 🌍 dc-ip → ip kerbrute userenum -d {domain} -U {userlist} --dc {dc-ip}Sandbox: execFile · Timeout: 300s
security.ad.kerberos.bruteforce security.ad.kerberos.userenum security.ad.kerberos.passwordspray security.ad.kerberos.preauth | Name | Type | Required | Default | Description | Aliases |
|---|---|---|---|---|---|
domain | string | Yes | - | Domain FQDN (e.g. evilcorp.local) | -d, --domain |
user | string | No | - | Single username for testing | -u, --user |
userlist | file | No | - | File containing list of usernames | -U, --userlist |
password | string | No | - | Single password for spraying | -p, --password |
passwordlist | file | No | - | File containing list of passwords | -P, --passwordlist |
threads | integer | No | 10 | Number of concurrent threads | -t, --threads |
dc-ip | string | No | - | Domain controller IP address | --dc, --dc-ip |
output | string | No | - | Output file for results | -o, --output |
verbose | boolean | No | Enable verbose output | -v, --verbose | |
delay | integer | No | 0 | Delay in milliseconds between requests | --delay |
timeout | integer | No | 5 | Timeout in seconds for each request | --timeout |
safe | boolean | No | Safe mode — stop on account lockout risk | -s, --safe | |
hash_file | boolean | No | - | hashes to file | --hash-file, -REP |
no_save | boolean | No | - | Do not save results to file | --no-save |
s | boolean | No | - | Safe mode — stop on lockout | -s, --safe |
Inputs
network.target.ip Domain controller IP
domain.name Target domain name
credential.username Single username for enumeration
credential.userlist File path to list of usernames
Outputs
security.credential.hash Captured Kerberos pre-authentication hashes
network_trafficfilesystem_write Produces
security.credential.hashConsumes
network.target.ipdomain.namecredential.usernamecredential.userlist| Resource | Value |
|---|---|
| CPU | low |
| Memory | 32 MB |
| Network | medium |
| Disk I/O | low |
Enumerate valid usernames via Kerberos pre-auth
kerbrute userenum -d evilcorp.local -U usernames.txt --dc 10.10.10.1Password spray one password across all users
kerbrute passwordspray -d evilcorp.local -U usernames.txt -p Password123 --dc 10.10.10.1Brute-force password for a single user
kerbrute bruteforce -d evilcorp.local -u administrator -P passwords.txt --dc 10.10.10.1Enumerate users with verbose output and safe mode
kerbrute userenum -d evilcorp.local -U usernames.txt --dc 10.10.10.1 -v -sPassword spray with custom thread count and delay
kerbrute passwordspray -d evilcorp.local -U usernames.txt -p Passw0rd --dc 10.10.10.1 -t 5 --delay 1000kerbrute is a Go-based tool for performing Kerberos pre-authentication attacks against Active Directory, including user enumeration, password spraying, and brute-forcing.
| Subcommand | Description |
|---|---|
userenum |
Enumerate valid domain users via Kerberos AS-REP |
passwordspray |
Spray a single password across multiple users |
bruteforce |
Brute-force passwords for known users |
winrmbrute |
Kerberos-based WinRM brute-force (deprecated) |
kerbrute sends AS-REQ packets to the domain controller. If the user exists, Kerberos responds with KDC_ERR_PREAUTH_REQUIRED; if the user does not exist, it responds with KDC_ERR_C_PRINCIPAL_UNKNOWN. This allows user enumeration without ever sending a password.