Password Attacks — Hub
External: Internal All The Things — Password Spraying
Tools to crack captured hashes offline or brute/spray logins against live services.
Recreate hashes manually: Manual Hash Generation
OSCP workflow: Capture hash (Responder, Kerberoast,
/etc/shadow, DB dump) → identify type → Hashcat or John → use recovered creds for evil-winrm, SSH, Impacket.
Install: Installation - Kali Setup > 📌 Password attacks
📌 Tools in This Folder
| Note | Use case |
|---|---|
| Hashcat | GPU-accelerated offline hash cracking (NTLM, Kerberos, etc.) |
| John | CPU cracking, unshadow, auto-detect hash types |
| Hydra | Online login brute — SSH, FTP, HTTP, SMB, RDP, etc. |
| keepass-password-dumper | KeePass memory dump (CVE-2023-32784) + kpcli for .kdbx |
| Office Documents | Password-protected xlsx/docx — office2john → msoffcrypto / LibreOffice |
| CeWL | Spider site → custom wordlist for Hydra / spraying |
📌 Hash → Tool Quick Reference
| Hash source | Mode / tool |
|---|---|
| NTLMv2 (Responder) | Hashcat -m 5600 |
| Kerberoast TGS | Hashcat -m 13100 |
/etc/shadow | unshadow → John or Hashcat -m 1800 — see Registry Hives and Linux Equivalents |
| SAM + SYSTEM (Windows) | secretsdump LOCAL → Hashcat -m 1000 |
| MSSQL / MySQL dump | Hashcat -m 1731 / -m 300 |
| AS-REP roast | Hashcat -m 18200 |
KeePass .kdbx | keepass-password-dumper · keepass2john · Hashcat -m 13400 · kpcli |
📌 Online vs Offline
OFFLINE (have hash file) → Hashcat / John
ONLINE (live service login) → Hydra / Kerbrute / CrackMapExec / [[nxcspray]]
Hydra -e flag: -e n null · -e s same-as-user · -e r reverse · -e nsr all three → Hydra > 📌 5) Extra Checks (`-e`)
Pair online attacks with user lists built via Text Processing / Kerbrute / CeWL (site-specific words).