Kerberos:
Enumeration
Valid users, SPNs, AS-REP targets, realm and KDC discovery guides
Kerberos SPN enumeration
Enumerate Service Principal Names (SPNs) via Kerberos to identify service accounts, enabling targeted Kerberoasting attacks against AD environments.
Kerberos Valid User Enumeration
Enumerate valid AD usernames via Kerberos pre-auth errors using tools like Kerbrute, exploiting AS-REQ responses to identify existing accounts without authentication.
Kerberos enumeration extracts information about the domain through the authentication protocol itself. Techniques include SPN discovery to map services to accounts, user enumeration via AS-REQ responses, inspecting ticket contents for domain details, and identifying service accounts that may be vulnerable to further attacks.
The subpages cover the specific tools and methods for querying Kerberos without needing domain credentials, as well as authenticated enumeration for deeper insight.