Kerberoasting & AS-REP roasting

When it applies

You have valid domain credentials (kerberoasting) or just a username list (AS-REP). Both recover plaintext passwords offline by cracking Kerberos-issued material — no lockout risk.

Why it works

• Kerberoasting: any authenticated user can request a service ticket (TGS) for any account with an SPN; part of it is encrypted with the service account's password hash. Crack it offline.
• AS-REP roasting: accounts with "do not require Kerberos preauth" hand out an AS-REP encrypted with the user's key to anyone — no creds needed, just the username.