Username Enumeration

Username enumeration is an information-gathering technique where an attacker determines which usernames or accounts are valid in a system without knowing their passwords.

It is a pre-attack (reconnaissance) technique, not an exploit by itself, but it significantly reduces the effort of later attacks such as password spraying, brute force, phishing, or credential stuffing.

---

Let's imagine that we already have a list of different usernames, and we need to find those that are actually present:

Kerberos is one of the most common vectors for username enumeration in Active Directory environments.

The Key Distribution Center (KDC) responds differently when:

• a Kerberos principal exists

• a Kerberos principal does not exist

We can use Kerbrute to validate usernames via Kerberos:

┌──(hacker@attack-machine)-[~/]
└─$ kerbrute userenum --dc 10.82.131.252 -d spookysec.local userlist.txt 

    __             __               __     
   / /_____  _____/ /_  _______  __/ /____ 
  / //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
 / ,< /  __/ /  / /_/ / /  / /_/ / /_/  __/
/_/|_|\___/_/  /_.___/_/   \__,_/\__/\___/                                        

Version: v1.0.3 (9dad6e1) - 12/17/25 - Ronnie Flathers @ropnop

2025/12/17 18:06:28 >  Using KDC(s):
2025/12/17 18:06:28 >   10.82.131.252:88

2025/12/17 18:06:28 >  [+] VALID USERNAME:       [email protected]
2025/12/17 18:06:31 >  [+] VALID USERNAME:       [email protected]
2025/12/17 18:06:34 >  [+] VALID USERNAME:       [email protected]
2025/12/17 18:06:35 >  [+] VALID USERNAME:       [email protected]
2025/12/17 18:06:51 >  [+] VALID USERNAME:       [email protected]
2025/12/17 18:06:59 >  [+] VALID USERNAME:       [email protected]
2025/12/17 18:07:15 >  [+] VALID USERNAME:       [email protected]
2025/12/17 18:07:22 >  [+] VALID USERNAME:       [email protected]

---

We can get users from SMB with NetExec:

┌──(hacker@attack-machine)-[~/]
└─$ nxc smb 10.82.131.252 -u svc-admin -p management2005 --users
SMB         10.82.131.252   445    ATTACKTIVEDIREC  [*] Windows 10 / Server 2019 Build 17763 x64 (name:ATTACKTIVEDIREC) (domain:spookysec.local) (signing:True) (SMBv1:False)                                                                                                                                                                         
SMB         10.82.131.252   445    ATTACKTIVEDIREC  [+] spookysec.local\svc-admin:management2005 
SMB         10.82.131.252   445    ATTACKTIVEDIREC  -Username-                    -Last PW Set-       -BadPW- -Description-                                               
SMB         10.82.131.252   445    ATTACKTIVEDIREC  Administrator                 2020-09-17 22:53:28 0       Built-in account for administering the computer/domain 
SMB         10.82.131.252   445    ATTACKTIVEDIREC  Guest                         <never>             0       Built-in account for guest access to the computer/domain 
SMB         10.82.131.252   445    ATTACKTIVEDIREC  krbtgt                        2020-04-04 18:40:08 0       Key Distribution Center Service Account 
SMB         10.82.131.252   445    ATTACKTIVEDIREC  skidy                         2020-04-04 18:44:07 0        
SMB         10.82.131.252   445    ATTACKTIVEDIREC  breakerofthings               2020-04-04 18:51:31 0        
SMB         10.82.131.252   445    ATTACKTIVEDIREC  james                         2020-04-04 18:51:53 0        
SMB         10.82.131.252   445    ATTACKTIVEDIREC  optional                      2020-04-04 18:52:32 0        
SMB         10.82.131.252   445    ATTACKTIVEDIREC  sherlocksec                   2020-04-04 18:52:56 0        
SMB         10.82.131.252   445    ATTACKTIVEDIREC  darkstar                      2020-04-04 18:53:17 0        
SMB         10.82.131.252   445    ATTACKTIVEDIREC  Ori                           2020-04-04 18:53:46 0        
SMB         10.82.131.252   445    ATTACKTIVEDIREC  robin                         2020-04-04 18:54:08 0        
SMB         10.82.131.252   445    ATTACKTIVEDIREC  paradox                       2020-04-04 18:54:29 0        
SMB         10.82.131.252   445    ATTACKTIVEDIREC  Muirland                      2020-04-04 18:55:01 0        
SMB         10.82.131.252   445    ATTACKTIVEDIREC  horshark                      2020-04-04 18:55:29 0        
SMB         10.82.131.252   445    ATTACKTIVEDIREC  svc-admin                     2020-04-04 18:57:56 0        
SMB         10.82.131.252   445    ATTACKTIVEDIREC  backup                        2020-04-04 19:57:05 0        
SMB         10.82.131.252   445    ATTACKTIVEDIREC  a-spooks                      2020-09-17 23:02:20 0        
SMB         10.82.131.252   445    ATTACKTIVEDIREC  [*] Enumerated 17 local users: THM-AD

This vector does not always work and is frequently restricted in hardened environments.

---

Enumerate users with RPC:

┌──(hacker@attack-machine)-[~/]
└─$ rpcclient -U "svc-admin" 10.82.131.252 
Password for [WORKGROUP\svc-admin]:
rpcclient $> enumdomusers
user:[Administrator] rid:[0x1f4]
user:[Guest] rid:[0x1f5]
user:[krbtgt] rid:[0x1f6]
user:[skidy] rid:[0x44f]
user:[breakerofthings] rid:[0x450]
user:[james] rid:[0x451]
user:[optional] rid:[0x452]
user:[sherlocksec] rid:[0x453]
user:[darkstar] rid:[0x454]
user:[Ori] rid:[0x455]
user:[robin] rid:[0x456]
user:[paradox] rid:[0x457]
user:[Muirland] rid:[0x458]
user:[horshark] rid:[0x459]
user:[svc-admin] rid:[0x45a]
user:[backup] rid:[0x45e]
user:[a-spooks] rid:[0x641]

---

Native Windows Commands:

Run net user /domain to list all domain users with basic details like usernames.

PowerShell:

Get-ADUser -Filter * -Properties * | Select Name, SamAccountName, Enabled fetches all enabled users with key attributes (requires ActiveDirectory module).

---

OpSec Note:

Username enumeration is not stealthy.

Although individual requests may be legitimate, mass enumeration creates clear behavioral anomalies:

• repeated authentication failures

• sequential username testing

• Kerberos AS-REQ anomalies

• unusual SMB / RPC enumeration patterns

---

Why Username Enumeration Is Dangerous:

• efficient password spraying

• targeted phishing campaigns

• account lockout abuse (DoS)

• Kerberos-based credential attacks

• faster lateral movement