Enumerate Active Directory usernames and test passwords via Kerberos pre-authentication.
npx skills add https://github.com/AeonDave/malskill --skill kerbrute
Please help me install this Agent Skill. Skill: kerbrute Source: https://github.com/AeonDave/malskill/tree/main/offensive-tools/windows/kerbrute Command: npx skills add https://github.com/AeonDave/malskill --skill kerbrute
This Skill automates the enumeration of valid Active Directory usernames and performs password spraying attacks against them, helping to identify weak credentials and discover valid accounts stealthily.
Use the kerbrute skill to enumerate valid usernames from the file 'users.txt' in the 'corp.local' domain, targeting the domain controller at '10.10.10.1'.
High-intent search queries and answers about installing and using this skill.
Active Directory username enumeration using Kerberos pre-authentication identifies valid accounts by analyzing Key Distribution Center (KDC) errors. This method is stealthier because it is less likely to trigger standard authentication logging alerts.
Performing a password spray attack against AD users involves testing a single common password against a list of enumerated usernames. This approach efficiently identifies accounts with weak credentials without risking account lockout policies.
Yes, you can extract AS-REP hashes for offline cracking when users do not require Kerberos pre-authentication. The tool retrieves these ticket granting ticket (TGT) requests automatically when probing the domain controller.
Yes, Kerberos user enumeration avoids standard authentication logging because it leverages pre-authentication errors rather than actual logon attempts. This makes it significantly stealthier than traditional SMB or LDAP enumeration techniques.
Yes, you can brute force a specific Active Directory user or test a batch of user:password pairs. The tool supports both single-user brute-forcing and batch credential attacks against the target domain controller.
cas-bigdatalabRemove or replace IPv4 and IPv6 addresses in text using regular expressions.
wgpsecCrack password hashes offline with hashcat across multiple hash types.
yv1ingIdentify live hosts and open ports within an authorized network scope.
blacklanternsecurityTest username-password combinations against SMB, Kerberos, LDAP, SSH, and web forms.
