Kerberoasting Attack Next Step
A network security analyst, while conducting penetration testing, is aiming to identify a service account password using the Kerberos authentication protocol. They have a valid user authentication ticket (TGT) and decided to carry out a Kerberoasting attack. In the scenario described, which of the following steps should the analyst take next?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The attack tests knowledge of the Kerberoasting workflow, where the common trap is confusing the pre-requisite (requesting the ticket) with the post-exploitation tool usage (Mimikatz).
This question identifies the immediate next step in a Kerberoasting attack after obtaining a TGT. It establishes that requesting a service ticket is the critical action required to obtain the encrypted hash for offline cracking.
Option C is the most common wrong answer because candidates assume the goal is immediate extraction; however, Mimikatz is used later to decrypt the obtained ticket, not to request it.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The correct next step is to request a service ticket (ST) for the target Service Principal Name (SPN). In a Kerberoasting attack, the attacker uses their valid TGT to authenticate to the Key Distribution Center (KDC) and requests an ST for a specific service account. The KDC returns this ticket encrypted with the service account's NTLM password hash.Why the Other Options Are Wrong
Option A is incorrect because Kerberoasting is an active attack requiring interaction with the KDC, not passive sniffing. Option B refers to PRINCE, which is a password cracking algorithm used after the hash is obtained, not during the ticket acquisition phase. Option C describes using Mimikatz to extract credentials from memory or process dumps, which is a separate technique or a subsequent step, but cannot happen until the service ticket is actually requested and received.Community Comment Notes
Community members overwhelmingly selected D, noting that while Mimikatz (Option C) is associated with credential dumping, it is not the step taken immediately after having a TGT in this specific context. As one user noted, "according to the handbook, the next step in the attack after TGT is the Service Ticket Request." Another commenter clarified that Option C is not used to target a specific account directly in this flow, reinforcing D as the procedural next step.Exam Strategy
When analyzing attack chains, always look for the immediate sequential step. Do not jump to the final result (cracking) if the prerequisite action (obtaining the data) hasn't been performed yet.
Frequently Asked Questions
Why is Mimikatz not the correct next step?
Mimikatz extracts credentials from memory or processes. In Kerberoasting, you must first actively request the encrypted service ticket from the KDC before any extraction or offline cracking can occur.
What is the difference between TGT and ST in this attack?
A TGT is used to authenticate to the KDC. An ST is requested from the KDC for a specific service account and contains the encrypted hash of that service account's password, which is the target of Kerberoasting.