AS-REP Roasting.

An Active Directory attack that requests Kerberos AS-REP messages for accounts with pre-authentication disabled, then cracks the returned encrypted blob offline to recover the user's password. It belongs to the Attacks & Threats category of cybersecurity.

An Active Directory attack that requests Kerberos AS-REP messages for accounts with pre-authentication disabled, then cracks the returned encrypted blob offline to recover the user's password.

AS-REP Roasting is an offline password-cracking attack against Active Directory accounts that have Kerberos pre-authentication disabled (the "Do not require Kerberos preauthentication" flag, DONT_REQ_PREAUTH). Normally, pre-authentication forces a client to prove knowledge of its password before the Key Distribution Center (KDC) issues an authentication ticket. When it is turned off, any unauthenticated attacker can ask the KDC for an AS-REP for that account; part of the reply is encrypted with a key derived from the user's password hash. The attacker captures this blob and runs it through tools such as Hashcat (mode 18200) or John the Ripper to recover weak passwords offline, without triggering account lockouts. Unlike Kerberoasting, it does not even require a valid domain account to enumerate vulnerable users. Defenses include avoiding the pre-auth-disabled flag, enforcing strong passwords, and monitoring for AS-REQ activity lacking pre-authentication.

Defences for AS-REP Roasting typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: ASREP Roasting, AS-REP Roast.