---
id: 5133
title: "Kerberoasting without SPNs"
source_domain: swarm.ptsecurity.com
source_url: "https://swarm.ptsecurity.com/kerberoasting-without-spns/"
published_at: "2020-08-19T14:26:44Z"
tags: ["pentesting", "active-directory", "kerberos", "methodology"]
phying_url: "https://phying.com/item/5133"
lang: en
---

# Kerberoasting without SPNs

## Summary

How to Kerberoast without knowing any SPNs: by requesting service tickets for fabricated SPN strings that still map to target accounts, attackers can obtain tickets encrypted with the account key and crack them offline — useful when SPN enumeration is noisy or unavailable.

## Intelligence Metadata

- **Sources:** swarm.ptsecurity.com
- **Published:** 2020-08-19T14:26:44Z
- **Original:** https://swarm.ptsecurity.com/kerberoasting-without-spns/
- **Phying News:** https://phying.com/item/5133