Crack Kerberoast TGS-REP and AS-REP roasting tickets. All encryption types: RC4, AES-128, AES-256. Modes 13100, 18200, 19600, 19700, 19800, 19900.
Submit Kerberos Hash →Kerberoasting is an Active Directory attack where an authenticated domain user requests TGS tickets for service accounts. These tickets are encrypted with the service account's password hash, allowing offline cracking without triggering lockouts.
Tools like Rubeus, GetUserSPNs.py (Impacket), and Invoke-Kerberoast extract these tickets for hashcat.
Most common and fastest. RC4-encrypted tickets use the NTLM hash as the key. Speed comparable to raw NTLM.
PBKDF2 (4096 iterations), significantly slower than RC4. Found in environments that disabled RC4.
Same PBKDF2 (4096 iterations) as AES-128 with larger key. Strongest Kerberos encryption, ~1000x slower than RC4.
Targets accounts with "Do not require Kerberos preauthentication." Tools: GetNPUsers.py, Rubeus asreproast.
Most common AS-REP hash. Same speed as TGS-REP RC4.
Slower AES variants. When DC enforces AES-only authentication.
| Attack | Encryption | Mode | Speed |
|---|---|---|---|
| TGS-REP | RC4 (etype 23) | 13100 | Fast |
| TGS-REP | AES-128 (etype 17) | 19600 | Medium |
| TGS-REP | AES-256 (etype 18) | 19700 | Medium |
| AS-REP | RC4 (etype 23) | 18200 | Fast |
| AS-REP | AES-128/256 | 19800/19900 | Medium |
Svc_[name][year]!All Kerberos types: from $150 per hash. Bulk pricing available. No result = no charge.
Send your TGS-REP hash. Free assessment within hours.