{"name":"kerbrute: Enumerate and Test Active Directory Accounts with Kerberos","description":"Kerbrute is a Go CLI built on the pure-Go gokrb5 library for enumerating Active Directory usernames and testing credentials through Kerberos pre-authentication. It targets internal domain assessments, but its releases and development are inactive.","github":"https://github.com/ropnop/kerbrute","url":"https://osrepos.com/repo/ropnop-kerbrute","source":"osrepos.com","sourceDescription":"This repository profile is provided by osrepos.com, an open source repository discovery platform.","repositoryProfile":"https://osrepos.com/repo/ropnop-kerbrute","generatedFor":"open source discovery and AI-assisted research","markdown":"https://osrepos.com/repo/ropnop-kerbrute.md","json":"https://osrepos.com/repo/ropnop-kerbrute.json","topics":["go","cli","security","cybersecurity","kerberos","active-directory","password-spraying"],"keywords":["go","cli","security","cybersecurity","kerberos","active-directory","password-spraying"],"stars":null,"summary":"Kerbrute is a Go CLI built on the pure-Go gokrb5 library for enumerating Active Directory usernames and testing credentials through Kerberos pre-authentication. It targets internal domain assessments, but its releases and development are inactive.","content":"## Overview\n\nKerbrute is a Go command-line tool built on jcmturner’s pure-Go `gokrb5` Kerberos implementation. It helps security practitioners enumerate valid Active Directory accounts and test credentials through Kerberos pre-authentication, without requiring a separately installed Kerberos client. The README frames it for use on internal Windows domains with access to a Domain Controller.\n\nIt supports Linux, Windows, and macOS binaries. Username enumeration does not cause login failures, while password testing can increment failed-login counts and lock accounts, so the modes have different operational risks.\n\n## Key Features\n\n- Enumerates domain usernames by sending Kerberos ticket requests without pre-authentication.\n- Tests a password wordlist against one user with `bruteuser`.\n- Tests one password against a user list with `passwordspray`.\n- Checks username-and-password pairs from a file or standard input with `bruteforce`.\n- Uses multiple threads by default, with thread count and request delay options.\n- Can stop its threads when an account is reported locked out with `--safe`.\n- Supports selecting a Domain Controller directly or discovering the KDC through DNS.\n- Provides precompiled binaries for Linux, Windows, and macOS through the [releases page](https://github.com/ropnop/kerbrute/releases).\n\n## Use Cases\n\n- Internal penetration testers can identify valid domain usernames before planning authorized authentication tests.\n- Red teams can check a controlled list of credentials against an Active Directory domain during an approved assessment.\n- Security teams can assess password exposure using a limited password spray, when they understand and accept account lockout risk.\n- Operators can run Kerberos account checks from Linux, Windows, or macOS without installing a separate Kerberos client.\n\n## Our Take\nKerbrute remains a focused Kerberos assessment CLI, but its inactive development and heavily concentrated contributions make it a less reassuring choice for new long-term dependencies.\n\n**Good fit if:**\n- You need its specific Kerberos username-enumeration or credential-testing commands for an authorized internal assessment.\n- Your environment can use Go 1.13-compatible tooling or an available prebuilt binary, and you can manage account lockout risk.\n- You are comfortable validating an inactive Apache-2.0 project before using it operationally.\n\n**Look elsewhere if:**\n- You require recent releases, active maintenance, or ongoing issue and pull-request handling.\n- Your environment cannot tolerate failed authentication attempts or possible account lockouts.\n- You need a supported authentication-testing platform beyond the Kerberos workflows documented here.\n\n## Project Health\n\n| Signal | Value |\n|---|---|\n| Status | **Inactive**: no commits in over a year |\n| Last commit | 2024-08-20 (2.2 years ago) |\n| Commits, last 90 days | 0 |\n| Releases, last 12 months | 0 (latest v1.0.3, 2019-12-15) |\n| Contributors | 2 (top contributor: 97% of commits) |\n| Issues closed, last 90 days | 0 |\n| Pull requests merged, last 90 days | 0 |\n| Project age | 7 years |\n\nChecked on 2026-11-08 with the GitHub API.\n\n## Project Facts\n\n- Language: Go\n- License: Apache-2.0\n- Stars: 3.5k\n- Forks: 492\n- Archived: no\n\n## What You Need\n\nDetected in the repository:\n\n- Go 1.13 or newer (from go.mod)\n\n## Getting Started\n\nDownload a binary for your platform from the [latest releases page](https://github.com/ropnop/kerbrute/releases/latest). For a Go installation, the README documents:\n\n```sh\ngo get github.com/ropnop/kerbrute\n```\n\nSee the [README](https://github.com/ropnop/kerbrute#readme) for command options and safety details.\n\n## License in Plain Words\n\n**Apache-2.0** (permissive).\n\n- Commercial use: yes\n- Modify and redistribute: yes\n- You must keep: the license, the NOTICE file and a note of your changes\n- Share your changes: no\n- Includes an explicit patent grant from the contributors\n\nA summary, not legal advice: the LICENSE file is what applies.\n\n## Considerations\n\nThe project is marked inactive: it has had no commits in over a year and no release in over a year. Its last listed release is from 2019, and the measured contribution history is concentrated mostly in one person, with two contributors overall. No recent issue closures or merged pull requests are recorded, so teams should not assume current maintenance or timely support.\n\nCredential-testing modes can cause failed-login events and lock accounts. The `--safe` option can halt work when an account is reported locked out, but it does not remove the risk of failed attempts. Username enumeration is less disruptive, but the README notes that it generates Windows event ID 4768 when Kerberos logging is enabled. The project requires Go 1.13 when building from source, and is licensed under Apache-2.0.","metrics":{"detailViews":3,"githubClicks":1},"dates":{"published":null,"modified":"2026-11-08T04:03:24.000Z"}}