# 5. Kerberos Username Enumeration

You're now moving into Kerberos username enumeration using kerbrute.

### 📍 You already have: &#xD;

Domain name: megachange.nyx ✅

DC IP: 192.168.10.4 ✅

### 🔐 What is it?

You’re trying to **find valid usernames** in a Windows domain using the **Kerberos protocol** — without needing a password.

This is helpful for:

* **AS-REP Roasting**
* **Kerberoasting**
* **Password spray/brute-force attacks**

### 🧰 Tool: `kerbrute`

It asks the **Domain Controller (DC)**:\
&#xNAN;_"Hey, does this username exist?"_

If the DC replies in a certain way, that means the username is valid — **without triggering account lockout** 🚫🔒

#### 🖥️ Example Command:

```bash
bashCopyEdit./kerbrute userenum --dc 192.168.10.4 -d megachange.nyx /path/to/userlist.txt
```

**🔍 What each part means:**

* `./kerbrute` → runs the tool (assuming you're in the same folder)
* `userenum` → tells it to do **username enumeration**
* `--dc 192.168.10.4` → IP of the **Domain Controller**
* `-d megachange.nyx` → the **Domain Name** (from LDAP)
* `/path/to/userlist.txt` → a **list of usernames** to try

<figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FU8nLUm7uXSgjPXQnzr1m%2Fimage.png?alt=media&#x26;token=d1252f65-7463-42ac-9400-6c8f38bfca2d" alt=""><figcaption></figcaption></figure>

***

#### 📝 Output:

kerbrute will show the valid username:

```
[+] VALID USERNAME: alfredo@megachange.nyx
```

***

#### ✅ Summary in 1 Line:

> You use `kerbrute` to check which usernames exist in a Windows domain by asking the Kerberos service, without needing any password.
