← Back to Academy

Academy Node

User Enumeration

User enumeration means you have valid domain usernames to test against Kerberos, SMB, LDAP, or password attacks.

Beginner100 XPFinding

Why it matters

Most AD attack paths need usernames before roasting, spraying, or auth validation.

How to identify it

  • LDAP users dump
  • SMB/RPC enum
  • Emails/naming pattern
  • Share files with usernames

BloodHound indicators

  • User nodes present

NetExec commands

nxc smb 192.168.184.141 --users
nxc ldap 192.168.184.141 -d xutslabs.local -u ba_low -p 'Password123' --users

Impacket commands

impacket-lookupsid xutslabs.local/guest@192.168.184.141 -no-pass

Linux commands

kerbrute userenum -d xutslabs.local --dc 192.168.184.141 users.txt

Expected output

  • Valid usernames
  • RID cycling output
  • Kerbrute VALID USERNAME

Success looks like

  • Have usernames.txt
  • Can check ASREP/SPN/spray

Failure looks like

  • No anonymous enum
  • Lockout concerns

Troubleshooting

  • Generate multiple formats
  • Use LDAP once creds found

Common mistakes

  • Spraying too early
  • Bad username formatting
  • Ignoring first.last patterns

Alternative attacks

  • SMB shares
  • Web content
  • RPC null session

What to try next

  • ASREP roast
  • Kerberoast
  • Password spray only if safe

Recommended next lessons

ASREP Roast

ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.

Kerberoast

Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.

GenericWrite

GenericWrite means you can modify certain attributes on the target AD object.

GenericAll

GenericAll is effectively full control over the target AD object.