Penetration Testing
A module library manager for Metasploit Framework, organizing exploits, payloads, encoders, and auxiliary modules for penetration testing an...
Impacket
Impacket is a collection of Python classes for working with network protocols, widely used by penetration testers for Windows and Active Directory attacks including SMB, Kerberos, and NTLM relay.
Penetration Testing
open-source
active-directory
python
protocol-library
Overview
Impacket is a free and open-source collection of Python classes for working with network protocols, originally created by Core Security and now maintained by Fortra. It provides low-level programmatic access to protocols including SMB, MSRPC, NTLM, Kerberos, LDAP, MSSQL, and WinRM, and ships with a large set of example scripts that have become standard tools in Active Directory penetration testing. Well-known utilities include secretsdump.py for credential extraction, psexec.py, wmiexec.py, smbexec.py, and atexec.py for remote command execution, GetUserSPNs.py and GetNPUsers.py for Kerberoasting and AS-REP roasting, ntlmrelayx.py for NTLM relay attacks, and smbserver.py for hosting shares. Impacket is included by default in Kali Linux and is a foundational library for many other offensive security tools.
Primary Use Cases
✔
Extracting credentials from Windows systems using secretsdump.py to dump SAM, LSA secrets, and NTDS.dit during Active Directory penetration tests.
✔
Remote command execution on Windows hosts using psexec.py, wmiexec.py, smbexec.py, and atexec.py during authorized red team operations.
✔
Kerberos attacks including Kerberoasting with GetUserSPNs.py and AS-REP roasting with GetNPUsers.py to obtain crackable service account hashes.
Frequently Asked Questions
Yes. Impacket is released under the Apache 2.0 license and is maintained by Fortra. It is free for both personal and commercial use, and it is included by default in Kali Linux and many other security distributions.
As of September 2026, the current stable release is Impacket 0.13.x, with ongoing updates to Kerberos, SMB, LDAP, and MSSQL protocol support, as well as fixes for modern Windows Server and Active Directory environments.
Yes. Impacket is a legitimate dual-use tool. Penetration testers and red teams use it in authorized engagements, while real-world attackers, including ransomware operators and APT groups, also use Impacket utilities for lateral movement and credential theft. This is why defenders monitor for Impacket-related activity in logs and endpoint telemetry.
Yes. Impacket is designed as a library first and a collection of scripts second. Security engineers can import its protocol classes into their own Python tools to build custom SMB clients, Kerberos requesters, LDAP enumerators, or MSSQL connectors for red team tooling, detection engineering, or research.
Yes. Impacket is written in Python and runs on Linux, macOS, and Windows, provided the required Python dependencies are installed. It is most commonly used from Linux-based penetration testing distributions such as Kali, but it works cross-platform.
Metadata
Official Website
Visit Website
Category Info
Penetration Testing covers tools used to simulate real-world attacks against systems, networks, and applications in authorized engagements to identify and validate exploitable vulnerabilities.
Added On
September 16, 2026
Last Updated
September 16, 2026
Related Security & OSINT Tools
Identity Security
BloodHound is an open-source Active Directory and Azure AD attack path analysis tool that uses graph theory to reveal hidden privilege escal...
Threat Detection
MITRE ATT&CK Navigator is a free web-based tool for visualizing, annotating, and comparing coverage of adversary tactics and techniques from...