pentest-credentials

name	pentest-credentials
description	Credential testing methodology — hash crack selection, wordlist generation, password spray (advisory), default cred audit. Triggers on credential testing, hash crack, Hashcat, John the Ripper, password spray, wordlist generation, cupp, CeWL, Crunch, hashid, default password, credential stuffing.
license	MIT
compatibility	Works with Claude Code
allowed-tools	Read Write Edit Bash Grep
metadata	{"author":"badi","homepage":"https://github.com/fatihkan/badi-skills/tree/main/skills/pentest-credentials","badi-version":">=1.24.0","category":"pentest","scope":"advisory","inspired-by":"0xSteph/pentest-ai-agents credential-tester"}

pentest-credentials

Credential testing methodology. Offline hash crack + targeted wordlist + default cred audit. Online brute requires a scope declaration and account-lockout-policy awareness.

Triggers

• "I found a hash, how do I crack it"
• "crack with hashcat / john"
• "generate a wordlist"
• "password spray"
• "default cred audit"
• "credential stuffing test"

Hash Identification

# hashid (offline)
hashid "$2y$12$abcd..."                       # bcrypt detect
hashid "5f4dcc3b5aa765d61d8327deb882cf99"     # MD5

# haiti (modern alt)
haiti "$2y$12$abcd..."

Common hash modes (hashcat):

Hash	Mode	Command Example
MD5	0	hashcat -m 0 hash.txt wordlist.txt
SHA1	100	hashcat -m 100 ...
bcrypt	3200	hashcat -m 3200 ... (slow)
NTLM	1000	hashcat -m 1000 ...
NetNTLMv2	5600	from Responder
Kerberos AS-REP	18200	from GetNPUsers.py
Kerberos TGS-REP	13100	from GetUserSPNs.py
WPA2 (hash22000)	22000	from hcxpcapngtool
MS-SQL 2012+	1731	T-SQL hash
LSA secrets	5500 (NetNTLMv1)	Responder

Wordlist Strategy

Ready-Made Wordlists

rockyou.txt              — 14M (classic baseline)
SecLists/Passwords/*     — 1500+ specialized
Probable-Wordlists/      — statistically ordered
WeakPass dataset         — large merged set

Target-Specific Generation

# CeWL — scrape words from the site (QUIET)
cewl https://example.com -m 5 -w cewl-target.txt

# cupp — passwords from a user profile (offline interactive)
cupp -i
# Answer: name, date, pet, company, etc. -> target.txt

# Mentalist (GUI / CLI) — rule-based combine

# Crunch — pattern-based
crunch 8 12 -t Spring@^^^^ > crunch.txt        # Spring@2026, Spring@1990, ...

# hashcat rule sets
hashcat -m 1000 hash.txt rockyou.txt -r rules/best64.rule -r rules/d3ad0ne.rule
hashcat -m 0 hash.txt --increment -a 3 ?l?l?l?l?l?d?d?d  # mask attack

Mutation Rules

# Common mutation: Title + year + special
cat words.txt | sed 's/$/2026!/' >> mutated.txt
cat words.txt | sed 's/$/123/' >> mutated.txt
cat words.txt | awk '{print toupper(substr($0,1,1)) substr($0,2)}' >> mutated.txt

# Automated with Hashcat rules
hashcat --stdout words.txt -r rules/leetspeak.rule | sort -u > leet.txt

Password Spray (Advisory, Scope-Required)

1. Learn the target system's lockout policy
   (typical: 3-5 wrong -> 30-min lock)
2. One password across all users, rotate at 5-minute intervals
3. Outside working hours (logging is easier to miss during the day)
4. Common password list: Spring2026!, Welcome1, Company123

# AD environment (NetExec)
nxc smb <dc> -u users.txt -p 'Spring2026!' --continue-on-success

# O365 / Azure AD
go365 -h o365.com -u users.txt -p password.txt --type spray --delay 300

# Goal: 1-2 hits without triggering lockout

Default Cred Audit

# Nuclei default-creds template
nuclei -u <target> -t default-logins/ -severity high,critical

# Hydra single test
hydra -L users.txt -P passwords.txt <target> ssh -t 4 -f

Common defaults:

• admin/admin
• admin/password
• root/toor
• Cisco/cisco
• Tomcat Manager: admin/admin, manager/manager
• Jenkins anonymous read

Credential Stuffing Test (Authorized)

• Old breach data for the client's own domain (HIBP API + paid lookup)
• User cred reuse rate: 5-10% (industry average)
• Test result: how many employees log in with old breach creds

Offline Crack Strategy

1. Detect the hash type (hashid)
2. Fast wordlist: rockyou + rule (5 min)
3. Slow down: rockyou + leetspeak + special (30 min)
4. Targeted: CeWL + cupp + mask (1-2 hours)
5. Fail -> Hashcat mask: bruteforce 8-10 char
6. Still fail -> hash dehashing (DB leak)

Output Template

## Credential Test — <engagement>

### Hash Crack Results
| User | Hash Type | Crack Time | Password |
|------|-----------|------------|----------|
| svc-backup | NetNTLMv2 | 4 hours | Backup2024 |
| svc-deploy | NetNTLMv2 | (timeout) | (could not crack) |

### Password Spray Results
- Tested: "Welcome1" against 50 users
- Hit: 2 users (4%)
  - dev-test (confirmed after a lockout-avoidance test)
  - finance-tmp

### Finding Impact
- Crackable password: weak policy (Backup2024 — known pattern)
- Default cred: 4% of users on Welcome1 — not changed during onboarding

Out-of-Scope

• Locking out a production account (exceeding rate limits)
• Out-of-authorization credential exfil (engagement scope only)
• Mass credential stuffing (3rd party dataset)