Skip to content
HackIndex.io

Kerberos:

Enumeration

Valid users, SPNs, AS-REP targets, realm and KDC discovery guides

4 guides • Created Dec 28, 2025 • Updated Mar 29, 2026
4 guides

Kerberos SPN enumeration

Enumerate Service Principal Names (SPNs) via Kerberos to identify service accounts, enabling targeted Kerberoasting attacks against AD environments.

Jan 4, 2026 • 4 min read

Kerberos Valid User Enumeration

Enumerate valid AD usernames via Kerberos pre-auth errors using tools like Kerbrute, exploiting AS-REQ responses to identify existing accounts without authentication.

Jan 3, 2026 • 4 min read

Kerberos enumeration extracts information about the domain through the authentication protocol itself. Techniques include SPN discovery to map services to accounts, user enumeration via AS-REQ responses, inspecting ticket contents for domain details, and identifying service accounts that may be vulnerable to further attacks.

The subpages cover the specific tools and methods for querying Kerberos without needing domain credentials, as well as authenticated enumeration for deeper insight.