Kerbrute

Brute/enumerate AD accounts via Kerberos.

KaliParrothigh

pkg: kerbrute

Kerbrute quietly enumerates valid AD usernames and sprays passwords using Kerberos pre-auth.

Syntax

kerbrute userenum -d {domain} {users}

Example

kerbrute userenum -d corp.local users.txt

Validates which usernames exist in the domain without SMB noise.

Options & flags

What each switch does. Toggle them in the builder below to assemble a command.

`userenum`	Enumerate valid usernames.
`passwordspray`	Spray one password across users.
`bruteuser`	Brute one user with a password list.
`-d` <corp.local>	AD domain.
`--dc` <10.0.0.1>	Domain controller IP.

Command builder

Tick options (and fill any values) to build a ready-to-copy command.

kerbrute

userenumEnumerate valid usernames.passwordspraySpray one password across users.bruteuserBrute one user with a password list.-dAD domain.--dcDomain controller IP.

Usage examples

kerbrute userenum -d corp.local users.txt

Validate which usernames exist.

kerbrute passwordspray -d corp.local users.txt Spring2026!

Spray one password across users.

Advantages

Stealthier than SMB spraying
Fast user enumeration

Disadvantages

Lockout risk on sprays
Needs DC reachability

Related commands

CrackMapExec

Swiss-army knife for AD/SMB networks.

Frequently asked questions

What is Kerbrute used for?

Kerbrute quietly enumerates valid AD usernames and sprays passwords using Kerberos pre-auth.

What is an example Kerbrute command?

A common example is: kerbrute userenum -d corp.local users.txt — Validates which usernames exist in the domain without SMB noise.

Is Kerbrute part of Kali Linux?

Yes. Kerbrute ships with Kali Linux (and Parrot OS). If missing, install it with: sudo apt install kerbrute.

What category of security tool is Kerbrute?

Kerbrute is a Password Attacks tool with a high-risk profile when run against a live target.

Try recon tools live

Run real scans against a domain you control, stage by stage.

Open the lab →