search

ropnop / kerbrute

A tool to perform Kerberos pre-auth bruteforcing
Apache License 2.0
2.65k stars 415 forks source link

Scan for user=password #10

Closed 61106960 closed 5 years ago

61106960 commented 5 years ago

Every onsite pentest I have faced so far, at least a couple of users had been set with username=password. I think it could be helpful to add to the bruteuser module some kind of username=password.

ropnop commented 5 years ago

I definitely see the value in that, but I'm hesitant to add that kind of logic to kerbrute. In my opinion, it's better to keep the tool somewhat "dumb" and just test what it's explicitly told to.

But...that got me thinking of a better approach to this and I decided to add a new command to kerbrute that accepts username:password combinations from a file or from stdin. That way its really easy to generate a list of username:username combos and feed it to the tool to test (as well as any other password combinations you'd like). With stdin, you could feed a script directly to kerbrute and test for a wide variety of combinations and default passwords.

Check out this branch and tell me what you think: https://github.com/ropnop/kerbrute/tree/feature/test_combos

Would that satisfy your use case?

61106960 commented 5 years ago

Great, that was the thing I was searching for. Works great! Thank you very much and keep doing your great work.

ropnop commented 5 years ago

Changed my mind :) i added a --user-as-pass option to password spray in #13 let me know how it works out!