Installation • Quick start • Usage • CLI reference • Documentation • Contributing
Credential validation tool for Active Directory Domain Services.
CredWolf tests username and secret combinations (passwords, NT hashes, Kerberos keys, or ticket files) against a domain controller and reports which credentials are valid. It also supports username enumeration via Kerberos to discover valid AD accounts without causing login attempts. It is designed for authorized penetration testing, red team engagements, and security audits where you need to verify whether recovered or suspected credentials are active.
Warning: This tool is intended for authorized security testing only. You must have explicit written permission from the system owner before testing credentials against any Active Directory environment. Unauthorized access to computer systems is illegal.
- NTLM + Kerberos — validate credentials over SMB, LDAP, LDAPS, and Kerberos pre-authentication (UDP/TCP)
- Every secret type — passwords, NT hashes (bare + LM:NT), RC4 keys, AES128 keys, AES256 keys, and ticket files (ccache/kirbi with auto-detection)
- Username enumeration — discover valid AD accounts via Kerberos without triggering login failures or lockouts; ASREProastable accounts flagged automatically
- Username case correction — when using Kerberos AES authentication, the KDC returns the correct username casing in the salt. CredWolf detects this and uses the corrected name in all output
- 88+ credential permutations — every meaningful combination of user sources, secret sources, encryption types, and transports
- Paired files — user:password, user:hash, and user:key files for pre-matched credential testing
- Machine-parseable output —
domain/user:secret@typeformat, easy to grep or pipe - Safety-first errors — clock skew stops execution immediately, per-user skip on unknown/revoked principals, detailed account status detection
- Rate limiting —
--delay,--jitter, and--max-lockoutsto avoid triggering lockout policies - Validation only — no post-authentication activity by design
| Protocol | Transport | Secret types |
|---|---|---|
| NTLM | SMB (default), LDAP, LDAPS | Password, NT hash |
| Kerberos | UDP (default), TCP | Password, RC4 key, AES128 key, AES256 key, ticket (ccache/kirbi) |
| Username enumeration | UDP (default), TCP | None required |
pip install credwolf
# or
pipx install credwolf
# or
uv tool install credwolfThe cw command is also installed as a shorthand for credwolf.
See the installation guide for source and Docker options.
# Validate a password over SMB
$ credwolf -d evil.corp ntlm --dc-ip 10.0.0.1 -u Administrator -p 'Password1!'
[+] evil.corp/Administrator:Password1!@password
# Validate an NT hash (pass-the-hash)
$ credwolf -d evil.corp ntlm --dc-ip 10.0.0.1 -u Administrator --hash 7facdc498ed1680c4fd1448319a8c04f
[+] evil.corp/Administrator:7facdc498ed1680c4fd1448319a8c04f@nt_hash
# Validate an AES256 key over Kerberos (pass-the-key)
$ credwolf -d evil.corp kerberos --kdc-ip 10.0.0.1 -u Administrator --aes256-key 9b12da6a4bdc263c1ac8f6302dc071e6e84321a263fa48784534b1ae43db2925 --transport tcp
[+] evil.corp/Administrator:9b12da6a4bdc263c1ac8f6302dc071e6e84321a263fa48784534b1ae43db2925@aes256_key
# Enumerate valid usernames (no login attempts, no lockout risk)
$ credwolf -d evil.corp userenum --kdc-ip 10.0.0.1 -U users.txt
[+] evil.corp/Administrator
[+] evil.corp/svc_backup — no_preauth (ASREProastable)
[*] Enumeration complete: 2/5 users foundSee the full usage guide and CLI reference for all options.
git clone https://github.com/StrongWind1/CredWolf.git
cd CredWolf
uv sync # install dev dependencies
make check # run lint + typecheck + testsSee CONTRIBUTING.md for contribution guidelines.
Built on Impacket. Inspired by CrackMapExec, Kerbrute, smartbrute, and SprayHound.
![@dependabot[bot]](https://avatars.githubusercontent.com/in/29110?s=64&v=4){kind=small}