Impacket AD ToolkitStep-by-step reference: test Active Directory labs with Impacket secretsdump, kerberoasting & relay. Lab only.FAQ

What is Impacket?

Impacket is a free, open-source Python toolkit for network protocols, maintained by Fortra. Its example scripts implement the standard Active Directory attack chain: AS-REP roasting, kerberoasting, hash dumping, lateral movement, and relay attacks.

Is using Impacket legal?

Impacket itself is legitimate security software. Running its attacks against any network without explicit written permission is illegal. Practice only in isolated labs like GOAD or HackTheBox, or under a signed authorization.

How do I install Impacket?

Run pipx install impacket, or install inside a Python venv with pip install impacket. Verify with secretsdump.py and keep the tooling on a dedicated lab VM, never on production machines.

What is AS-REP roasting?

Accounts with Kerberos pre-authentication disabled hand out crackable hashes to anyone who asks. GetNPUsers.py collects them and hashcat mode 18200 cracks them offline. The fix is enabling pre-authentication on every account.

What is kerberoasting?

Service tickets are encrypted with the service account password hash, so anyone can request and crack them offline. GetUserSPNs.py with -request collects them for hashcat mode 13100. Strong managed service passwords are the defense.

What does secretsdump do?

It extracts password hashes from SAM, LSA secrets, and the NTDS database of lab domain controllers. Treat all output as live credentials: encrypt, crack inside the lab, and wipe it afterward.

What is ntlmrelayx?

It relays captured NTLM authentication to target services instead of cracking it. It needs an attacker position in the lab network and pairs with Responder. Enforce SMB signing and HTTPS to blunt it.

Why do I get clock skew errors?

Kerberos requires client and server clocks within minutes. Sync your lab VM clock to the domain controller with ntpdate or chrony and retry.

All tools · Sitemap · Games