Kerbrute

Kerbrute is a Go-based tool designed to efficiently brute force and enumerate AD accounts through Kerberos Pre-Authentication, making it faster and potentially stealthier than traditional password guessing methods. Instead of generating standard failed logon events (4625), it validates usernames and credentials by sending a single UDP frame to the DC, allowing account enumeration and authentication attempts with minimal noise. It supports multiple modes, including user enumeration, password spraying, and credential testing, while offering options for threading, logging, and safe execution to prevent account lockouts.

User Enumeration

kerbrute userenum -d domain.local --dc 10.10.10.10 /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt

Password Spray

Brute Force