> For the complete documentation index, see [llms.txt](https://wiki.bufu-sec.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wiki.bufu-sec.com/active-directory/enumeration/kerbrute.md).

# Kerbrute

## Overview

* Get precompiled binary for OS from <https://github.com/ropnop/kerbrute/releases>
* Does not trigger failed log on event
* Brute-force by sending only a single UDP frame to the KDC
* Enumerate users on the domain from a wordlist

## User Bruteforcing

```bash
# Username enumeration
kerbrute userenum --dc CONTROLLER.local -d CONTROLLER.local User.txt
```