Skip to content

README.md

Latest commit

 

History

History
318 lines (226 loc) · 9.02 KB

README.md

File metadata and controls

318 lines (226 loc) · 9.02 KB
Raw

ADUserGen 🔑

A fast, no-dependency Python tool that generates common Active Directory username formats from a list of employee full names — designed for pentesting and CTF challenges.

📖 Table of Contents

Overview

In many Active Directory pentesting scenarios and CTF challenges, the attack chain looks like this:

Web App (employee list)  →  collect names  →  ADUserGen  →  kerbrute  →  valid accounts

The tedious middle step — manually generating every possible username variation for each person — is what ADUserGen automates.

Give it a names.txt file with one Firstname Lastname per line and it outputs a deduplicated usernames.txt with 16 common AD username formats per person, ready to feed into kerbrute or any other username enumeration tool.

How It Works

For each name in your input file, ADUserGen generates all common username patterns seen in real AD environments. It handles middle names gracefully (they are ignored), strips non-alpha characters, and deduplicates the final output globally — so if two people generate the same variant (e.g. two people named John), it only appears once.

Generated Username Formats

For a name like John Doe, the following 16 variants are generated:

Format Example Description
first.last john.doe dot-separated, full
last.first doe.john reversed dot-separated
firstlast johndoe concatenated
lastfirst doejohn reversed concatenated
fi.last j.doe first initial + dot + last
li.first d.john last initial + dot + first
filast jdoe first initial + last
lifirst djohn last initial + first
first.li john.d first + dot + last initial
last.fi doe.j last + dot + first initial
firstli johnd first + last initial
lastfi doej last + first initial
first john first name only
last doe last name only
fi.li j.d initials dot-separated
fili jd initials concatenated

Requirements

  • Python 3.10+ (uses list[str] type hints — no third-party packages needed)

Check your version:

python3 --version

Installation

No install required — just clone and run:

git clone https://github.com/gonzxph/ADUserGen.git
cd ADUserGen

Or download the script directly:

curl -O https://raw.githubusercontent.com/gonzxph/ADUserGen/main/ADUserGen.py

Usage

Basic Usage

python ADUserGen.py -l names.txt

This reads names.txt and writes usernames.txt in the current directory.

All Options

usage: ADUserGen.py [-h] -l NAMES_FILE [-o OUTPUT_FILE] [-v] [--no-banner] [--version]

options:
  -h, --help            show this help message and exit
  -l, --list  FILE      input file with full names (one 'Firstname Lastname' per line)
  -o, --output FILE     output file for generated usernames (default: usernames.txt)
  -v, --verbose         print each name and every username variant generated from it
  --no-banner           suppress the ASCII art banner (useful for scripting / piping)
  --version             show program version and exit

Examples

Minimal — use defaults:

python ADUserGen.py -l names.txt

Custom output filename:

python ADUserGen.py -l names.txt -o candidates.txt

Verbose — see every variant as it's generated:

python ADUserGen.py -l names.txt -o usernames.txt -v

Suppress banner (for clean scripting):

python ADUserGen.py -l names.txt --no-banner

Check version:

python ADUserGen.py --version

Built-in help:

python ADUserGen.py -h

Workflow: Web OSINT → AD Username Enum

This is the typical CTF / pentest scenario ADUserGen is built for:

Step 1 — Harvest employee names

Browse the target web application and collect names from the "Our Team", "About Us", or "Staff" pages. Save them to names.txt:

Alice Johnson
Bob Martinez
Carol White
David Lee

Step 2 — Generate username candidates

python ADUserGen.py -l names.txt -o usernames.txt -v

Example verbose output:

    _   ____  _   _                 _____
   /_\ |  _ \| | | |___  ___ _ __  | ____|_ __  _   _ _ __ ___
  / _ \| | | | | | / __|/ _ \ '__| |  _| | '_ \| | | | '_ ` _ \
 / ___ \ |_| | |_| \__ \  __/ |    | |___| | | | |_| | | | | | |
/_/   \_\____/ \___/|___/\___|_|    |_____|_| |_|\__,_|_| |_| |_|

  ADUserGen v1.0.0 — AD Username Generator for Pentesting & CTF

[*] Alice Johnson
    => alice.johnson, johnson.alice, alicejohnson, johnsonalice, a.johnson, j.alice, ...

[*] Bob Martinez
    => bob.martinez, martinez.bob, bobmartinez, martinezbob, b.martinez, m.bob, ...

[+] Names processed : 4
[+] Lines skipped   : 0
[+] Usernames       : 56 unique
[+] Saved to        : usernames.txt

[*] Validate with kerbrute:
    kerbrute userenum --dc <DC_IP> -d <DOMAIN> usernames.txt

Step 3 — Enumerate valid users with kerbrute

kerbrute userenum --dc <DC_IP> -d <DOMAIN> usernames.txt

Example kerbrute output:

2024/01/01 12:00:00 >  [+] VALID USERNAME: a.johnson@corp.local
2024/01/01 12:00:00 >  [+] VALID USERNAME: bob.martinez@corp.local

Step 4 — Continue your attack chain

With valid usernames confirmed you can proceed to:

  • AS-REP Roasting — check for accounts with Kerberos pre-auth disabled:

    impacket-GetNPUsers <DOMAIN>/ -usersfile usernames.txt -no-pass -dc-ip <DC_IP>

  • Password Spraying — try common passwords against valid users:

    kerbrute passwordspray --dc <DC_IP> -d <DOMAIN> usernames.txt 'Password123!'

  • SMB Enumeration — check access with discovered credentials:

    netexec smb <DC_IP> -u usernames.txt -p 'Password123!' --continue-on-success

Input File Format

One full name per line. First and last name separated by a space:

John Doe
Jane Smith
Alice Johnson

Middle names are handled gracefully — ADUserGen uses the first word as the first name and the last word as the last name, so middle names are simply ignored:

John Michael Doe    →  treated as: John Doe
Mary Anne O'Brien   →  treated as: Mary OBrien (special chars stripped)

Lines that can't be parsed (fewer than two words) are skipped with a warning:

[!] Line 3 skipped (expected 'Firstname Lastname'): 'Administrator'

Output

A plain text file with one username per line, globally deduplicated and ordered:

john.doe
doe.john
johndoe
doejohn
j.doe
...

The output is compatible with any tool that accepts a username wordlist: kerbrute, CrackMapExec, NetExec, impacket tools, Hydra, Medusa, etc.

Combining with Kerbrute

kerbrute is the recommended tool for validating the generated usernames against an AD domain. It performs Kerberos pre-authentication enumeration which is fast, stealthy, and doesn't trigger account lockouts (by default).

Install kerbrute:

# Download from releases
wget https://github.com/ropnop/kerbrute/releases/latest/download/kerbrute_linux_amd64
chmod +x kerbrute_linux_amd64
mv kerbrute_linux_amd64 /usr/local/bin/kerbrute

Enumerate users:

kerbrute userenum --dc <DC_IP> -d <DOMAIN> usernames.txt -o valid_users.txt

One-liner — generate and immediately validate:

python ADUserGen.py -l names.txt --no-banner && \
kerbrute userenum --dc <DC_IP> -d <DOMAIN> usernames.txt

Ethical Use / Disclaimer

This tool is intended for:

  • Authorized penetration testing on systems you have explicit written permission to test
  • CTF (Capture the Flag) challenges on dedicated lab platforms (HackTheBox, TryHackMe, PwnTillDawn, etc.)
  • Security research in isolated lab environments

Unauthorized use of this tool against systems you do not own or have explicit permission to test is illegal and unethical.

The author assumes no liability for misuse. Always obtain proper written authorization before conducting any penetration test.

Made for the pentesting & CTF community. If this helped you pop a box, consider giving it a ⭐