Hacker Directory — Understand what you hack.Hacker Directory — Understand what you hack.
Continue learning
TR

Protocol Lab: Kerberos

Examine AS, TGS and AP messages step by step, with explicit key ownership and resource decisions.

Follow a ticket’s journey step by step.

  1. Start with the normal flow and locate WS01, DC01 and FS01.
  2. Use Next to send the message; read who receives it and which fields can be opened.
  3. Change one condition and compare the same step; open key and message details when needed.

Distinguish a carried ticket from a decryptable reply, and authentication from resource authorization.

The mechanism explained by this model

The model is a synthetic teaching example. It does not execute Windows API calls or real cryptography. Interactive controls require JavaScript; the mechanism is also explained in the linked lessons.

AS, TGS, and AP flow: The difference between a TGT and a service ticket

Three message exchanges over TCP/UDP 88 between the Kerberos client (WS01), the domain controller (DC01) in the KDC role, and the host (FS01) on which the target service runs. The decision points are LSA/Kerberos SSP (client), KDC service (DC) and SSPI acceptance on the service side in Windows. The boundary of this lesson is the structure of the KDC response: PAC content at 06.05, SPN ownership at 06.03, pre-authentication detail at 06.04.