AS-REP Roasting

AS-REP Roasting targets domain accounts configured without Kerberos preauthentication. A request for such an account can return encrypted AS-REP material susceptible to offline password guessing. Directory discovery requires LDAP read access; a separately scoped candidate username list can be tested through the KDC. When the target KDC is Internet-reachable, that request can be made without an internal foothold; the exposure and target must be in scope. Password guessing happens offline, so it does not submit password attempts to the domain controller.