AS-REP Roasting
Learn why accounts without Kerberos pre-authentication can expose material for offline password auditing in an authorized assessment.
Learn why accounts without Kerberos pre-authentication can expose material for offline password auditing in an authorized assessment.
Requirements
- A discoverable domain account without pre-authentication
- Network access to a domain controller
- Explicit testing authorization
Detection
- Monitor pre-authentication-free ticket requests
- Review accounts configured without Kerberos pre-authentication
Remediation
- Require Kerberos pre-authentication
- Use strong managed credentials and review exception accounts