Password Bruteforcing

Password Attack Type
Dictionary attack
Brute force
Traffic interception
Man In the Middle
Key Logging
Social engineering

Methods of Bruteforce Attacks

Attack	Description
Online Brute Force Attack	Attacking a live application over the network, like HTTP, HTTPs, SSH, FTP, and others
Offline Brute Force Attack	Also known as Offline Password Cracking, where you attempt to crack a hash of an encrypted password.
Reverse Brute Force Attack	Also known as username brute-forcing, where you try a single common password with a list of usernames on a certain service.
Hybrid Brute Force Attack	Attacking a user by creating a customized password wordlist, built using known intelligence about the user or the service.

Bruteforcing default credentials

/opt/useful/SecLists/Passwords/Default-Credentials

Creating Personalized Worlist

$ cupp -i

___________
   cupp.py!                 # Common
      \                     # User
       \   ,__,             # Passwords
        \  (oo)____         # Profiler
           (__)    )\
              ||--|| *      [ Muris Kurgas | [e-mail] ]
                            [ Mebus | https://github.com/Mebus/]


[+] Insert the information about the victim to make a dictionary
[+] If you don't know all the info, just hit enter when asked! ;)

Password Policy

sed -ri '/^.{,7}$/d' william.txt            # remove shorter than 8
sed -ri '/[!-/:-@\[-`\{-~]+/!d' william.txt # remove no special chars
sed -ri '/[0-9]+/!d' william.txt            # remove no numbers

Mangling

GitHub - digininja/RSMangler: RSMangler will take a wordlist and perform various manipulations on it similar to those done by John the Ripper with a few extras.GitHub

GitHub - sc0tfree/mentalist: Mentalist is a graphical tool for custom wordlist generation. It utilizes common human paradigms for constructing passwords and can output the full wordlist as well as rules compatible with Hashcat and John the Ripper.GitHub

Custom Username List

GitHub - urbanadventurer/username-anarchy: Username tools for penetration testingGitHub

./username-anarchy Bill Gates > bill.txt