A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
Three years ago on an engagement in Frankfurt, I spent four hours trying to crack NetNTLMv2 hashes from Responder while my colleague next to me ran Kerbrute against a 48,000-username wordlist and had valid credentials in twelve seconds. Twelve. Seconds. He validated 56 users, sprayed Welcome1, and owned the domain before I finished my first Hashcat run.
The lesson: username enumeration with Kerbrute is stupidly fast and doesn't trigger account lockouts. It abuses Kerberos pre-authentication behavior. When you send a TGT request for a non-existent user, the KDC returns PRINCIPAL UNKNOWN. For a valid user, it prompts for pre-authentication. No failed login event. No lockout counter increment. Just a clean yes/no on existence.
48,705 usernames tested. 56 valid. Twelve seconds. The jsmith.txt list from the statistically-likely-usernames GitHub repo covers the flast format (first initial + last name). If the organization uses a different format, combine this with linkedin2username output to cover first.last, f.last, and other variations.
SMB NULL sessions are a legacy misconfiguration from in-place upgrades of older Domain Controllers. Windows Server 2003 and earlier allowed anonymous enumeration by default. If you find this, you just got the entire user list plus RIDs without any credentials. You can also pull the password policy with getdompwinfo, which tells you the lockout threshold before you start spraying.
Welcome1 or Spring@2024 satisfy this requirement while remaining trivially guessable. The lockout threshold matters more though. Get it before you spray.Lockout threshold of 5, auto-unlock after 30 minutes. You can safely spray 2-3 passwords per 31-minute window without risking lockouts. But 'safely' doesn't mean 'carelessly.' I've seen a pentester lock out 800 accounts because he misread the policy and sprayed 10 passwords in rapid succession. The client's CISO was not amused.
You now have 56 validated usernames, the password policy, and the lockout threshold. The stage is set. Next up: you're going to poison some LLMNR requests and watch NetNTLMv2 hashes roll in like it's Christmas morning.
Finish the lesson once you have worked through the material. This awards ★ 30 XP.