Kerberos-Related Attacks
We validate this area during scoped assessments, documenting impact and remediation guidance.
Why it matters
- Kerberoasting: Attackers request service tickets for service accounts and attempt to crack them offline to obtain passwords. - Silver Ticket Attack: Attackers forge a service ticket for specific services using the service account’s password hash. - Golden Ticket Attack: Attackers forge a TGT using the KRBTGT account hash (domain admin access). - Ticket Renewal Attacks: Attackers renew expired tickets if they have access to the TGT or service ticket and its renewal key. - Pass-the-Ticket (PTT): Attackers steal or capture Kerberos tickets (TGTs/service tickets) to impersonate users/services. - Pass-the-Hash (PTH): Attackers use stolen password hashes to authenticate instead of Kerberos tickets.
How we test it
Our operators follow a structured checklist for this topic, adapted to your API surface and authentication model.
Testing approach
- Structured validation of Kerberos-Related Attacks during scoped assessment.
- Evidence captured with reproducible steps for your engineering team.
What we look for
- Misconfigurations and control gaps related to Kerberos-Related Attacks.
- Exploitable paths that could affect confidentiality, integrity, or availability.
Related topics
| Topic | Summary |
|---|---|
| Active Directory (AD) - Basics Understanding | Within Active Directory, there are three built-in groups that comprise the highest privilege groups in the director |
| Active Directory (AD) Terminology | We validate this area during scoped assessments, documenting impact and remediation guidance. |
| DLL | A DLL (Dynamic Link Library) is a file format used in Microsoft Windows environments to contain code, data, and resources that can be used by multiple programs simultaneously. DLLs help modularize applications, allowing them to share common functions without duplicating code acr… |
| Extended Active Directory (AD) Terminology | We validate this area during scoped assessments, documenting impact and remediation guidance. |
| I. Active Directory Enumeration | We validate this area during scoped assessments, documenting impact and remediation guidance. |
| II. Local Privilege Escalation | We validate this area during scoped assessments, documenting impact and remediation guidance. |