Username_Enumeration
A list of both fisrtnames and lastnames has been discovered in the /Team endpoint of the target web application.
Username Generation
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/nagoya]
└─$ python3 ~/Tools/username_gen_v2.py -w names.txt > possible_usernames.txtGenerating all the possible username combinations
Validation
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/nagoya]
└─$ kerbrute userenum --dc nagoya.nagoya-industries.com -d NAGOYA-INDUSTRIES.COM ./possible_usernames.txt -t 200
__ __ __
/ /_____ _____/ /_ _______ __/ /____
/ //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
/ ,< / __/ / / /_/ / / / /_/ / /_/ __/
/_/|_|\___/_/ /_.___/_/ \__,_/\__/\___/
Version: v1.0.3 (9dad6e1) - 04/23/25 - Ronnie Flathers @ropnop
2025/04/23 14:55:37 > Using KDC(s):
2025/04/23 14:55:37 > nagoya.nagoya-industries.com:88
2025/04/23 14:55:37 > [+] VALID USERNAME: matthew.harrison@NAGOYA-INDUSTRIES.COM
2025/04/23 14:55:37 > [+] VALID USERNAME: terry.edwards@NAGOYA-INDUSTRIES.COM
2025/04/23 14:55:37 > [+] VALID USERNAME: rebecca.bell@NAGOYA-INDUSTRIES.COM
2025/04/23 14:55:37 > [+] VALID USERNAME: scott.gardner@NAGOYA-INDUSTRIES.COM
2025/04/23 14:55:37 > [+] VALID USERNAME: brett.naylor@NAGOYA-INDUSTRIES.COM
2025/04/23 14:55:37 > [+] VALID USERNAME: holly.matthews@NAGOYA-INDUSTRIES.COM
2025/04/23 14:55:37 > [+] VALID USERNAME: craig.carr@NAGOYA-INDUSTRIES.COM
2025/04/23 14:55:37 > [+] VALID USERNAME: abigail.hughes@NAGOYA-INDUSTRIES.COM
2025/04/23 14:55:37 > [+] VALID USERNAME: frances.ward@NAGOYA-INDUSTRIES.COM
2025/04/23 14:55:37 > [+] VALID USERNAME: melissa.mitchell@NAGOYA-INDUSTRIES.COM
2025/04/23 14:55:37 > [+] VALID USERNAME: anne.jenkins@NAGOYA-INDUSTRIES.COM
2025/04/23 14:55:37 > [+] VALID USERNAME: sylvia.king@NAGOYA-INDUSTRIES.COM
2025/04/23 14:55:37 > [+] VALID USERNAME: emma.miah@NAGOYA-INDUSTRIES.COM
2025/04/23 14:55:37 > [+] VALID USERNAME: joanna.wood@NAGOYA-INDUSTRIES.COM
2025/04/23 14:55:37 > [+] VALID USERNAME: iain.white@NAGOYA-INDUSTRIES.COM
2025/04/23 14:55:37 > [+] VALID USERNAME: melanie.watson@NAGOYA-INDUSTRIES.COM
2025/04/23 14:55:37 > [+] VALID USERNAME: kirsty.norris@NAGOYA-INDUSTRIES.COM
2025/04/23 14:55:37 > [+] VALID USERNAME: wayne.hartley@NAGOYA-INDUSTRIES.COM
2025/04/23 14:55:37 > [+] VALID USERNAME: patrick.martin@NAGOYA-INDUSTRIES.COM
2025/04/23 14:55:37 > [+] VALID USERNAME: fiona.clark@NAGOYA-INDUSTRIES.COM
2025/04/23 14:55:37 > [+] VALID USERNAME: bethan.webster@NAGOYA-INDUSTRIES.COM
2025/04/23 14:55:37 > [+] VALID USERNAME: kate.watson@NAGOYA-INDUSTRIES.COM
2025/04/23 14:55:37 > [+] VALID USERNAME: elaine.brady@NAGOYA-INDUSTRIES.COM
2025/04/23 14:55:37 > [+] VALID USERNAME: andrea.hayes@NAGOYA-INDUSTRIES.COM
2025/04/23 14:55:37 > [+] VALID USERNAME: christopher.lewis@NAGOYA-INDUSTRIES.COM
2025/04/23 14:55:37 > [+] VALID USERNAME: megan.johnson@NAGOYA-INDUSTRIES.COM
2025/04/23 14:55:37 > [+] VALID USERNAME: damien.chapman@NAGOYA-INDUSTRIES.COM
2025/04/23 14:55:37 > [+] VALID USERNAME: joanne.lewis@NAGOYA-INDUSTRIES.COM
2025/04/23 14:55:37 > Done! Tested 308 usernames (28 valid) in 0.115 secondsAttempting to validate the newly generated usernames against the target KDC returned positive results.
Additionally, the username convention that the target organization uses has been identified; <FIRSTNAME>.<LASTNAME>
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/nagoya]
└─$ awk '{print $7}' tmp.txt | cut -d '@' -f1 > users.txtSaving those discovered domain users into a file; users.txt
Additional
Provided that the username convention that the target organization uses has been identified, <FIRSTNAME>.<LASTNAME>, I could attempt to enumerate more users
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/nagoya]
└─$ python3 ~/Tools/username_generator.py
Choose username format:
1) hsimpson
2) h.simpson
3) homersimpson
4) homer.simpson
5) hjsimpson
6) homerjsimpson
7) homerjaysimpson
8) homersimpsonb
Option: 4
Mail domain (example: ...@domain.com) [Default: none]:
Domain (example: domain\...) [Default: none]:
Names file path: /usr/share/seclists/Usernames/Names/names-usa-top1000.txt
Surnames file path: /usr/share/seclists/Usernames/Names/familynames-usa-top1000.txt
Output file [Default: results.txt]:
Output saved in results.txtCreating an additional wordlist, following the disclosed username convention
Saved as results.txt
Validation (Additional)
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/nagoya]
└─$ kerbrute userenum --dc nagoya.nagoya-industries.com -d NAGOYA-INDUSTRIES.COM ./results.txt -t 200
__ __ __
/ /_____ _____/ /_ _______ __/ /____
/ //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
/ ,< / __/ / / /_/ / / / /_/ / /_/ __/
/_/|_|\___/_/ /_.___/_/ \__,_/\__/\___/
Version: v1.0.3 (9dad6e1) - 04/23/25 - Ronnie Flathers @ropnop
2025/04/23 15:17:49 > Using KDC(s):
2025/04/23 15:17:49 > nagoya.nagoya-industries.com:88
2025/04/23 15:17:50 > [+] VALID USERNAME: MEGAN.JOHNSON@NAGOYA-INDUSTRIES.COM
2025/04/23 15:17:58 > [+] VALID USERNAME: PATRICK.MARTIN@NAGOYA-INDUSTRIES.COM
2025/04/23 15:18:02 > [+] VALID USERNAME: CHRISTOPHER.LEWIS@NAGOYA-INDUSTRIES.COM
2025/04/23 15:18:02 > [+] VALID USERNAME: JOANNE.LEWIS@NAGOYA-INDUSTRIES.COM
2025/04/23 15:18:04 > [+] VALID USERNAME: SYLVIA.KING@NAGOYA-INDUSTRIES.COM
2025/04/23 15:18:08 > [+] VALID USERNAME: MELISSA.MITCHELL@NAGOYA-INDUSTRIES.COM
2025/04/23 15:18:11 > [+] VALID USERNAME: TERRY.EDWARDS@NAGOYA-INDUSTRIES.COM
2025/04/23 15:18:11 > [+] VALID USERNAME: TERRY.EDWARDS@NAGOYA-INDUSTRIES.COM
2025/04/23 15:18:14 > [+] VALID USERNAME: REBECCA.BELL@NAGOYA-INDUSTRIES.COM
2025/04/23 15:18:18 > [+] VALID USERNAME: FRANCES.WARD@NAGOYA-INDUSTRIES.COM
2025/04/23 15:18:18 > [+] VALID USERNAME: FRANCES.WARD@NAGOYA-INDUSTRIES.COM
2025/04/23 15:18:20 > [+] VALID USERNAME: MELANIE.WATSON@NAGOYA-INDUSTRIES.COM
2025/04/23 15:18:20 > [+] VALID USERNAME: KATE.WATSON@NAGOYA-INDUSTRIES.COM
2025/04/23 15:18:22 > [+] VALID USERNAME: JOANNA.WOOD@NAGOYA-INDUSTRIES.COM
2025/04/23 15:18:25 > [+] VALID USERNAME: ANNE.JENKINS@NAGOYA-INDUSTRIES.COM
2025/04/23 15:18:27 > [+] VALID USERNAME: ABIGAIL.HUGHES@NAGOYA-INDUSTRIES.COM
2025/04/23 15:18:33 > [+] VALID USERNAME: ANDREA.HAYES@NAGOYA-INDUSTRIES.COM
2025/04/23 15:18:33 > [+] VALID USERNAME: ANDREA.HAYES@NAGOYA-INDUSTRIES.COM
2025/04/23 15:18:37 > [+] VALID USERNAME: MATTHEW.HARRISON@NAGOYA-INDUSTRIES.COM
2025/04/23 15:18:52 > [+] VALID USERNAME: SCOTT.GARDNER@NAGOYA-INDUSTRIES.COM
2025/04/23 15:18:55 > [+] VALID USERNAME: HOLLY.MATTHEWS@NAGOYA-INDUSTRIES.COM
2025/04/23 15:19:11 > [+] VALID USERNAME: CRAIG.CARR@NAGOYA-INDUSTRIES.COM
2025/04/23 15:19:12 > [+] VALID USERNAME: DAMIEN.CHAPMAN@NAGOYA-INDUSTRIES.COM
2025/04/23 15:20:33 > [+] VALID USERNAME: ELAINE.BRADY@NAGOYA-INDUSTRIES.COM
2025/04/23 15:23:42 > Done! Tested 2000000 usernames (24 valid) in 352.864 secondsSame result N/A