Our take
Inactiveno commits in over a year- Activity
- 20
- Community
- 13
- Issues
- 21
- Pull requests
- 21
- Fewer contributors than 86% of the projects we track
Kerbrute remains a focused Kerberos assessment CLI, but its inactive development and heavily concentrated contributions make it a less reassuring choice for new long-term dependencies.
Good fit if
- You need its specific Kerberos username-enumeration or credential-testing commands for an authorized internal assessment.
- Your environment can use Go 1.13-compatible tooling or an available prebuilt binary, and you can manage account lockout risk.
- You are comfortable validating an inactive Apache-2.0 project before using it operationally.
Look elsewhere if
- You require recent releases, active maintenance, or ongoing issue and pull-request handling.
- Your environment cannot tolerate failed authentication attempts or possible account lockouts.
- You need a supported authentication-testing platform beyond the Kerberos workflows documented here.
All health signals
| Last commit | 2024-08-20 (2.2 years ago) |
|---|---|
| Commits, last 90 days | 0 |
| Releases, last 12 months | 0 (latest v1.0.3, 2019-12-15) |
| Contributors | 2 (top contributor: 97% of commits) |
| Issues closed, last 90 days | 0 |
| Pull requests merged, last 90 days | 0 |
| Project age | 7 years |
Checked on 2026-11-08 with the GitHub API.
Overview
Kerbrute is a Go command-line tool built on jcmturner’s pure-Go gokrb5 Kerberos implementation. It helps security practitioners enumerate valid Active Directory accounts and test credentials through Kerberos pre-authentication, without requiring a separately installed Kerberos client. The README frames it for use on internal Windows domains with access to a Domain Controller.
It supports Linux, Windows, and macOS binaries. Username enumeration does not cause login failures, while password testing can increment failed-login counts and lock accounts, so the modes have different operational risks.
Key Features
- Enumerates domain usernames by sending Kerberos ticket requests without pre-authentication.
- Tests a password wordlist against one user with
bruteuser. - Tests one password against a user list with
passwordspray. - Checks username-and-password pairs from a file or standard input with
bruteforce. - Uses multiple threads by default, with thread count and request delay options.
- Can stop its threads when an account is reported locked out with
--safe. - Supports selecting a Domain Controller directly or discovering the KDC through DNS.
- Provides precompiled binaries for Linux, Windows, and macOS through the releases page.
Use Cases
- Internal penetration testers can identify valid domain usernames before planning authorized authentication tests.
- Red teams can check a controlled list of credentials against an Active Directory domain during an approved assessment.
- Security teams can assess password exposure using a limited password spray, when they understand and accept account lockout risk.
- Operators can run Kerberos account checks from Linux, Windows, or macOS without installing a separate Kerberos client.
What you need
Detected in the repository
- Go 1.13 or newer (from go.mod)
License in plain words
Apache-2.0permissive
- Commercial use: yes
- Modify and redistribute: yes
- You must keep: the license, the NOTICE file and a note of your changes
- Share your changes: no
- Includes an explicit patent grant from the contributors:
A summary, not legal advice: the LICENSE file is what applies.
Getting Started
Download a binary for your platform from the latest releases page. For a Go installation, the README documents:
go get github.com/ropnop/kerbrute
See the README for command options and safety details.
Considerations
The project is marked inactive: it has had no commits in over a year and no release in over a year. Its last listed release is from 2019, and the measured contribution history is concentrated mostly in one person, with two contributors overall. No recent issue closures or merged pull requests are recorded, so teams should not assume current maintenance or timely support.
Credential-testing modes can cause failed-login events and lock accounts. The --safe option can halt work when an account is reported locked out, but it does not remove the risk of failed attempts. Username enumeration is less disruptive, but the README notes that it generates Windows event ID 4768 when Kerberos logging is enabled. The project requires Go 1.13 when building from source, and is licensed under Apache-2.0.
Found this useful?
Share it with someone who would like kerbrute.