Skip to content
HackIndex.io
Kerberos
Service

Kerberos

Kerberos is AD's auth protocol. Attackers enumerate users, SPNs, and KDCs, then exploit via AS-REP roasting, Kerberoasting, ticket forging, delegation abuse, and ccache reuse for lateral movement

:88 9 guides 4 phases
1 min read Created: Dec 28, 2025 Updated: Jul 14, 2026

Kerberos is the default authentication protocol in Active Directory environments, running on TCP and UDP port 88. Nmap identifies it as kerberos-sec. It handles ticket-based authentication between clients, services, and the Key Distribution Center (KDC) on domain controllers.

Kerberos is a prime target in AD pentesting. AS-REP Roasting extracts hashes for accounts that do not require pre-authentication. Kerberoasting requests service tickets and cracks them offline to recover service account passwords. Ticket forgery attacks (Golden Ticket, Silver Ticket) grant persistent, elevated access.

Enumerate user accounts and SPNs with tools like kerbrute, GetUserSPNs.py, and GetNPUsers.py from Impacket. Finding Kerberos on a target confirms an Active Directory domain and identifies the domain controller, which shapes the rest of the engagement.

Enumeration

Valid users, SPNs, AS-REP targets, realm and KDC discovery guides

4

Kerberos SPN enumeration

Enumerate Service Principal Names (SPNs) via Kerberos to identify service accounts, enabling targeted Kerberoasting attacks against AD environments.

Jan 4, 2026 • 4 min read

Kerberos Valid User Enumeration

Enumerate valid AD usernames via Kerberos pre-auth errors using tools like Kerbrute, exploiting AS-REQ responses to identify existing accounts without authentication.

Jan 3, 2026 • 4 min read

Vulnerability Discovery

Find AS-REP roastable and Kerberoastable accounts via key tools

2

Kerberoastable Service Accounts

Identify service accounts with SPNs vulnerable to Kerberoasting by extracting and cracking TGS tickets offline to compromise Active Directory credentials.

May 15, 2026 • 4 min read

Kerberos Pre-Authentication Not Required

Identifies accounts with DONT_REQUIRE_PREAUTH set, enabling AS-REP roasting attacks to capture and offline-crack Kerberos hashes without credentials.

May 15, 2026 • 3 min read

Exploitation

Kerberos attacks: roasting, ticket forging, and delegation abuse

2

Lateral Movement

Reuse ccache files and keytabs on Linux to move laterally in AD

1
Kerberos Ticket Reuse from Linux

Kerberos Ticket Reuse from Linux

Exploiting cached Kerberos tickets on Linux via ccache files and keytabs to authenticate as other users and move laterally across AD environments.

Mar 16, 2026 • 5 min read