Cyber Security Notes

Enumerating Users

Cyber Security Notes

Index
Attacking Web Applications
Attacking Web Applications
Binary Exploitation
Binary Exploitation
- How to use GDB
Cryptography
Cryptography
- Pretty Good Privacy (PGP)
- Asymmetric Encryption
  Asymmetric Encryption
  - RSA
    RSA
    
    RSA Attacks
    
    RSA Basics
- Symetric Encryption
  Symetric Encryption
  - AES
    AES
    
    AES Basics
General Pentesting
General Pentesting
- Data Exfiltration
- Miscellaneous Tools
- Miscellaneous Services
- Pivoting
- Port Scanning
- Password Attacks
  Password Attacks
  - Offline Password Attacks
  - Online Password Attacks
Miscellaneous
Miscellaneous
- Machine Learning & AI Attacks
  Machine Learning & AI Attacks
  - Creating Malicious Tensorflow Models
Pentesting Linux
Pentesting Linux
- Priviliage Escalation
- Linux - Stabilisation & Post Exploitation
Pentesting Windows
Pentesting Windows
- Creating Robust Reverse Shells
- Enumerating Windows
- Network Enumeration
- Windows - Stabilisation & Post Exploitation
- Windows Commands
- Windows Local Persistence
- Windows Privilage Escalation
- Windows Tools
- Active Directory
  Active Directory
  - Enumerating Users Enumerating Users
    Table of contents
    
    Port 139/445 - SMB
    
    Enum4linux
    
    Enumerating Users via Kerberos
    
    Kerbrute
  - Hashes & Tokens
    Hashes & Tokens
    
    ASREPRoasting
    
    Dumping Hashes
  - Post Exploitation
    Post Exploitation
    
    Enumaration of Active Directory
  - Remote Management
    Remote Management
    
    evil-winrm
- Windows Services
  Windows Services
  - Pentesting MS-SQL
  - SMB Protocol
Reverse Engineering & Forensics
Reverse Engineering & Forensics
- Memory Analysis
  Memory Analysis
- Reversing Python
  Reversing Python
  - Decompile .elf & .exe Binaries.md

Enumerating Users¶

Port 139/445 - SMB¶

Enum4linux¶

enum4linux -a <IP>

Enumerating Users via Kerberos¶

Kerbrute¶

kerbrute userenum --dc 10.10.125.64 -d spookysec.local userlist.txt

# just get the usernames
grep -oP '(?!E:\s*)(\S*)(?=@)'

kerbrute userenum --dc 10.10.125.64 -d spookysec.local userlist.txt -o kerbrute_output.txt
grep -oP '(?!E:\s*)(\S*)(?=@)' kerbrute_output.txt > usernames.txt

# or just use this command
kerbrute userenum --dc 10.10.125.64 -d spookysec.local userlist.txt | grep -oP '(?!E:\s*)(\S*)(?=@)'