Sprocket Security researcher (elohhs)

New Capabilities

Published the technique and opened the Impacket pull request as 1hunio

A new Kerberos attack can take an attacker from one compromised account to full control of a domain, even when the target account has no service principal name (SPN, the identifier Kerberos uses for services). Sprocket Security's Hunter Wade published the technique in October 2026, combining two known methods: reflective resource-based constrained delegation and user-to-user authentication. In the proof of concept, the chain reached domain administrator and extracted credentials from a domain controller.

Updated Nov 1