Kerberoasting Simulator
Request a service ticket for a weak-password service account, then crack the offline-crackable hash it hands you.
Any authenticated domain user can request a service ticket for any service account — and part of that ticket is encrypted with the account's password hash. Request it, take it offline, and crack at your leisure with nothing to detect.
How to use it
- Identify service accounts with an SPN.
- Request a service ticket for one.
- Crack the returned hash offline.
What to take away
The request itself is legitimate
Requesting a service ticket is ordinary Kerberos behaviour. That is what makes this quiet — the attack is the offline cracking, which your network never sees.
Service accounts are the weak point
They often have old passwords set by hand, excessive privileges, and no rotation policy. A 25-character random password makes the attack pointless.
Frequently asked questions
What is an SPN?
A Service Principal Name — the identifier mapping a service to the account running it. Accounts with an SPN are the ones that can be Kerberoasted, which makes finding them step one.
How is Kerberoasting mitigated?
Group Managed Service Accounts with automatic long random passwords, AES encryption types rather than RC4, least privilege for service accounts, and alerting on unusual ticket request volume.
Where this fits in the course
This security lab pairs with Path 16 — Advanced — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- Active Directory Attack Lab — A guided walkthrough of BloodHound-style graph recon, Kerberoasting a weak service account, and forging a Golden Ticket.
- Password Cracking Lab — Four hashed passwords, one wordlist. See exactly which ones fall to a dictionary attack and which survive it — and why.
- Windows Privesc Playground — A misconfigured service runs as SYSTEM with a writable binary path. Replace it and escalate — no exploit needed.
- Hash Identifier — Paste a hash and get likely algorithms, guessed from its length and character set.