Alternatives to Kerbrute
Enumerates Active Directory usernames and tests passwords through Kerberos. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
Kerbrute
Enumerates Active Directory usernames and tests passwords through Kerberos.
Replacements
Listings that take over the same core job as Kerbrute.
NetExec
Assess network services during authorized enterprise security tests.
NetExec covers many network services and authentication testing in one toolkit instead of focusing only on Kerberos username enumeration and password spraying.
Impacket
Python library and tool collection for working with network protocols.
Impacket is a Python library and script collection with Kerberos and SMB implementations, giving lower-level building blocks rather than a single Kerberos spraying binary.
Hydra
Network logon testing tool that checks credentials across many protocols.
Hydra tests logins across many protocols such as SSH and RDP rather than using Kerberos pre-authentication, and its traffic is noisier and more likely to lock accounts.
Similar software
Related functionality, not a direct replacement.
BloodHound Community Edition
Maps attack paths through Active Directory and Entra ID relationships.
Responder
LLMNR, NBT-NS and mDNS testing tool for internal network assessments.
enum4linux-ng
Inspect information exposed by Windows and Samba services.
Certipy
Audit Active Directory Certificate Services configurations.
SharpHound
A C# collector that gathers Active Directory data for attack path analysis in BloodHound.
ADRecon
A PowerShell script that gathers Active Directory information and builds an Excel report of the environment.
