# Kerberos

> Kerberos is AD's auth protocol. Attackers enumerate users, SPNs, and KDCs, then exploit via AS-REP roasting, Kerberoasting, ticket forging, delegation abuse, and ccache reuse for lateral movement

- **URL:** https://hackindex.io/services/kerberos
- **Type:** Service
- **Default ports:** 88
- **Tags:** kerberos, active-directory, windows, authentication, ticket-granting, lateral-movement
- **Published:** 2025-12-31
- **Updated:** 2026-07-14

Kerberos is the default authentication protocol in Active Directory environments, running on **TCP and UDP port 88**. Nmap identifies it as `kerberos-sec`. It handles ticket-based authentication between clients, services, and the Key Distribution Center (KDC) on domain controllers.

Kerberos is a prime target in AD pentesting. AS-REP Roasting extracts hashes for accounts that do not require pre-authentication. Kerberoasting requests service tickets and cracks them offline to recover service account passwords. Ticket forgery attacks (Golden Ticket, Silver Ticket) grant persistent, elevated access.

Enumerate user accounts and SPNs with tools like `kerbrute`, `GetUserSPNs.py`, and `GetNPUsers.py` from Impacket. Finding Kerberos on a target confirms an Active Directory domain and identifies the domain controller, which shapes the rest of the engagement.

## Phases

- [Enumeration](https://hackindex.io/services/kerberos/enumeration.md): Valid users, SPNs, AS-REP targets, realm and KDC discovery guides (4 guides)
- [Vulnerability Discovery](https://hackindex.io/services/kerberos/vulnerability-discovery.md): Find AS-REP roastable and Kerberoastable accounts via key tools (2 guides)
- [Exploitation](https://hackindex.io/services/kerberos/exploitation.md): Kerberos attacks: roasting, ticket forging, and delegation abuse (2 guides)
- [Lateral Movement](https://hackindex.io/services/kerberos/lateral-movement.md): Reuse ccache files and keytabs on Linux to move laterally in AD (1 guides)