Which tool is used to perform AS-REP roasting attacks?

• A. Golden Tickets
• B. Fingerprint Attack
• C. Rubeus
• D. Markov-Chain Attack

Answer: (C)

AS-REP roasting targets Kerberos accounts that don’t require pre-auth. When such an account is queried, the KDC returns an AS-REP that contains an encrypted portion derived from the user's password. That encrypted data can be cracked offline to recover the password or its hash. Rubeus is a Windows-focused Kerberos abuse tool that includes the asreproast capability, which automates collecting AS-REP responses by issuing AS-REQs with no pre-auth and then extracting the encrypted data for offline cracking. This makes it the practical choice for performing AS-REP roasting.

The other options relate to different Kerberos abuse techniques or password-guessing methods that don’t implement the AS-REP roasting workflow. Golden Tickets forge TGTs using the krbtgt hash, not AS-REP data. Fingerprint Attack and Markov-Chain Attack describe distinct methods not aligned with this roasting process.