minikerberos

What it is and what it does

Minikerberos is a pure-Python Kerberos client library designed for both programmatic use and pentesting. It implements the Kerberos protocol with support for multiple authentication methods—password-based, AES/RC4 keys, and PKINIT (certificate-based)—alongside both blocking and asynchronous client APIs. The library powers other security tools like pypykatz, aiosmb, and msldap, and ships with command-line utilities for common Kerberos operations.

For pentesters, it provides ready-to-use tools for TGT/TGS ticket fetching, kerberoast attacks, S4U2self/S4U2proxy delegation attacks, CCACHE file manipulation, and NT hash recovery. For developers, it offers a consistent API across sync and async contexts, making it suitable for integration into larger security frameworks or automation scripts.

Use it for:

• Perform kerberoast attacks to extract service account hashes for offline cracking.
• Request TGT and TGS tickets programmatically using password or certificate credentials.
• Exploit Kerberos Resource-based Constrained Delegation (RBCD) with S4U2proxy.
• Recover NT hashes from PKINIT certificate-based authentication.
• Convert and edit CCACHE files for ticket manipulation in penetration tests.
• Integrate Kerberos authentication into Python security tools or automation frameworks.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

A pure-Python Kerberos client library supporting password, certificate (PKINIT), and key-based authentication with both synchronous and asynchronous APIs.

Yes, if you need a pure-Python Kerberos client for pentesting or security research. The library is permissively licensed, has low install friction, and no known vulnerabilities. However, the 289-day gap between last commit and latest release suggests maintenance is infrequent—verify that its PKINIT and delegation features meet your current threat model before relying on it for production security work.

Install

minikerberos on PyPI

pip install minikerberos

uv add minikerberos

poetry add minikerberos

Installing minikerberos

Before you install

Low friction installation with six runtime dependencies; last commit 2025-10-29 but no release in 289 days suggests the project is in a maintenance holding pattern rather than actively developed.

License in practice

MIT license (permissive) allows commercial and private use with minimal restrictions.

Quickstart

pip install minikerberos

from minikerberos.client import KerberosClient
client = KerberosClient(target='user@REALM')
# Use client for TGT/TGS requests or kerberoast operations

Requires Python >= 3.6; depends on asn1crypto, oscrypto, asysocks, unicrypto, tqdm, and six.

Verify before relying

• Whether the library's async API is production-ready or primarily for development/testing.
• Current compatibility with modern Windows certificate stores and PKINIT implementations.
• Whether the command-line tools (minikerberos-getTGT, minikerberos-kerberoast, etc.) are actively maintained for pentesting workflows.

Package facts

Evidence: minikerberos-0.4.9-py3-none-any.whl

Tags

More Security packages