Active Directory

GetNPUsers.py

AS-REP roasting via Impacket.

adkerberos

getnpusers.py — terminal

$ GetNPUsers.py domain/ -usersfile users.txt -no-pass

What it does

GetNPUsers.py finds Active Directory accounts that don't require Kerberos pre-authentication and extracts their AS-REP hashes for offline cracking. It's a common first foothold in a domain.

Source

https://github.com/fortra/impacket ↗

More Active Directory tools

CrackMapExecSwiss-army knife for AD network post-exploitation.ImpacketPython toolkit of network-protocol scripts.enum4linux-ngSMB and Windows enumeration.LDAPDomainDumpDump Active Directory contents via LDAP.

Need hosted scanning instead of local tooling?

Run a scan in the browser →