Kerbrute User Enumeration

Kerberos user enumeration without authentication

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool

kerbrute

Category

Enumeration / Kerberos

Platform

linux

Requires

no credentials

Protocols

KERBEROS

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

kerbrute userenum --dc '<ip>' -d '<domain>' <wordlist>

Examples

kerbrute userenum --dc '192.168.1.100' -d 'CORP.LOCAL' /usr/share/wordlists/seclists/Usernames/Names/names.txt

Tags

kerbrute kerberos users enumeration