Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

RTT· red team

RTT · red team

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Search techniques, tools, commands…⌘K

No scenario

No scenario · all techniques in scope

IdleStatus

0Scenarios

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Back to Tools

Kerberoasting Tools

Credential Harvester

Credentials & User Impersonation

Domain Enumeration

Examples of separate, alternative tools for requesting Kerberos TGS service tickets for service accounts with SPNs and exporting ticket material for offline password testing. The Targeted Kerberoast example is a distinct ACL-abuse path: for accounts selected from an input list, it may temporarily write servicePrincipalName where the authenticated principal has write permission, request a ticket, and attempt cleanup after ticket/hash handling. Its current upstream cleanup is not in a finally block, so an exception or interruption can leave the temporary value behind. This record groups multiple tools and therefore does not identify one executable or one common software version.

Source

https://github.com/swisskyrepo/InternalAllTheThings/blob/203bb0c0b290bf7c9158c32d43523b8d66f292c1/docs/active-directory/ad-roasting-kerberoasting.md

Language

Python, PowerShell, C#

References

github.com exploit-db.com github.com netexec.wiki github.com

+13 more

Extended Details

RESTRICTED_ACCESS_BLUR_MARKER