Credential validation tool for Active Directory Domain Services.
Installation • Quick start • Usage • CLI reference • Documentation • Contributing
CredWolf tests username and secret combinations (passwords, NT hashes, Kerberos keys, or ticket files) against a domain controller and reports which credentials are valid. It also supports username enumeration via Kerberos to discover valid AD accounts without causing login attempts. It is designed for authorized penetration testing, red team engagements, and security audits where you need to verify whether recovered or suspected credentials are active.
- NTLM + Kerberos - validate credentials over SMB, LDAP, LDAPS, and Kerberos pre-authentication (UDP/TCP)
- Every secret type - passwords, NT hashes (bare + LM:NT), RC4 keys, AES128 keys, AES256 keys, and ticket files (ccache/kirbi with auto-detection)
- Username enumeration - discover valid AD accounts via Kerberos without triggering login failures or lockouts; ASREProastable accounts flagged automatically
- Username case correction - when using Kerberos AES authentication, the KDC returns the correct username casing in the salt. CredWolf detects this and uses the corrected name in all output
- 88+ credential permutations - every meaningful combination of user sources, secret sources, encryption types, and transports
- Paired files - user:password, user:hash, and user:key files for pre-matched credential testing
- Machine-parseable output -
domain/user:secret@typeformat, easy to grep or pipe - Safety-first errors - clock skew stops execution immediately, per-user skip on unknown/revoked principals, detailed account status detection
- Rate limiting -
--delay,--jitter, and--max-lockoutsto avoid triggering lockout policies - Validation only - no post-authentication activity by design
| Protocol | Transport | Secret types |
|---|---|---|
| NTLM | SMB (default), LDAP, LDAPS | Password, NT hash |
| Kerberos | UDP (default), TCP | Password, RC4 key, AES128 key, AES256 key, ticket (ccache/kirbi) |
| Username enumeration | UDP (default), TCP | None required |
Validate a recovered password against a domain controller over SMB:
$ credwolf -d evil.corp ntlm --dc-ip 10.0.0.1 -u Administrator -p 'Password1!'
[+] evil.corp/Administrator:Password1!@passwordInstall with uv:
uv tool install git+https://github.com/StrongWind1/CredWolf
# or, from PyPI:
uv tool install credwolfThe cw command is also installed as a shorthand for credwolf.
See the installation guide for source and Docker options.
# Validate a password over SMB
$ credwolf -d evil.corp ntlm --dc-ip 10.0.0.1 -u Administrator -p 'Password1!'
[+] evil.corp/Administrator:Password1!@password
# Validate an NT hash (pass-the-hash)
$ credwolf -d evil.corp ntlm --dc-ip 10.0.0.1 -u Administrator --hash 7facdc498ed1680c4fd1448319a8c04f
[+] evil.corp/Administrator:7facdc498ed1680c4fd1448319a8c04f@nt_hash
# Validate an AES256 key over Kerberos (pass-the-key)
$ credwolf -d evil.corp kerberos --kdc-ip 10.0.0.1 -u Administrator --aes256-key 9b12da6a4bdc263c1ac8f6302dc071e6e84321a263fa48784534b1ae43db2925 --transport tcp
[+] evil.corp/Administrator:9b12da6a4bdc263c1ac8f6302dc071e6e84321a263fa48784534b1ae43db2925@aes256_key
# Enumerate valid usernames (no login attempts, no lockout risk)
$ credwolf -d evil.corp userenum --kdc-ip 10.0.0.1 -U users.txt
[+] evil.corp/Administrator
[+] evil.corp/svc_backup - no_preauth (ASREProastable)
[*] Enumeration complete: 2/5 users foundSee the full usage guide and CLI reference for all options.
git clone https://github.com/StrongWind1/CredWolf.git
cd CredWolf
uv sync # install dev dependencies
make check # run lint + typecheck + testsSee CONTRIBUTING.md for contribution guidelines.
Built on Impacket. Inspired by CrackMapExec, Kerbrute, smartbrute, and SprayHound.
Other projects in this collection:
- AD-SecretGen - derive AD password hashes and Kerberos keys from a password
- NTDSWolf - offline NTDS.dit parser and credential extractor
- KerbWolf - Kerberos roasting and hash extraction toolkit
- Kerberos - Kerberos in Active Directory: protocol, security, and attacks
CredWolf is intended for authorized penetration testing, red team engagements, and security audits only. You must have explicit written permission from the system owner before testing credentials against any Active Directory environment. Unauthorized access to computer systems is illegal. The authors are not responsible for any misuse or damage caused by this tool.