password-attacks

Password Attacks

Full-spectrum credential attack skill covering offline hash cracking, online service brute forcing, domain password spraying, targeted wordlist generation, Kerberos ticket attacks, and credential stuffing with breach data. Choose the right attack class, tool, and OPSEC posture based on the scenario.

Why This Matters

Weak, reused, and default credentials remain the most common initial access vector across every engagement type. A single cracked hash can escalate from low-privilege foothold to domain admin. Password spraying bypasses per-account lockout policies. Breach credential reuse turns old leaks into fresh access. This skill covers every angle.

Decision Tree — Choosing Your Attack

Before touching a tool, classify the scenario:

Do you have hashes/credentials offline?
├── YES → OFFLINE ATTACKS
│   ├── Know the hash type? → hashcat/john with correct mode
│   ├── Unknown hash type? → hashid/hash-identifier first
│   ├── Windows hashes (NTLM)? → hashcat -m 1000, pass-the-hash
│   ├── Kerberos tickets? → references/kerberos-attacks.md
│   └── Need custom wordlist? → references/wordlist-generation.md
│
└── NO → ONLINE ATTACKS
    ├── Single target, known creds format? → Hydra/Medusa
    ├── Domain/AD environment? → Password spraying (crackmapexec/kerbrute)
    ├── Have breach data for target users? → Credential stuffing
    ├── Web login form? → Hydra http-post-form / Patator
    └── Need to avoid lockout? → Spray with lockout-aware timing

Methodology — Execution Order

Phase 1 — Intelligence Gathering

Before attacking, gather intelligence that shapes your approach:

1. Password policy: Minimum length, complexity, lockout threshold, lockout duration, password history
2. Target users: Enumerate valid usernames (LDAP, Kerberos, web user enumeration, OSINT)
3. Hash types: Identify exact hash algorithm if you have offline hashes
4. Service versions: Protocol-specific quirks affect tool selection
5. Prior findings: Check if credentials were already found in other phases