5. Kerberos Username Enumeration

You're now moving into Kerberos username enumeration using kerbrute.

📍 You already have:

Domain name: megachange.nyx ✅

DC IP: 192.168.10.4 ✅

🔐 What is it?

You’re trying to find valid usernames in a Windows domain using the Kerberos protocol — without needing a password.

This is helpful for:

• AS-REP Roasting

• Kerberoasting

• Password spray/brute-force attacks

🧰 Tool: kerbrute

It asks the Domain Controller (DC): "Hey, does this username exist?"

If the DC replies in a certain way, that means the username is valid — without triggering account lockout 🚫🔒

🖥️ Example Command:

bashCopyEdit./kerbrute userenum --dc 192.168.10.4 -d megachange.nyx /path/to/userlist.txt

🔍 What each part means:

• ./kerbrute → runs the tool (assuming you're in the same folder)

• userenum → tells it to do username enumeration

• --dc 192.168.10.4 → IP of the Domain Controller

• -d megachange.nyx → the Domain Name (from LDAP)

• /path/to/userlist.txt → a list of usernames to try

---

📝 Output:

kerbrute will show the valid username:

[+] VALID USERNAME: [e-mail]

---

✅ Summary in 1 Line:

You use kerbrute to check which usernames exist in a Windows domain by asking the Kerberos service, without needing any password.