Brute Force

Credential Stuffing

hashcat -m 3000 -a 3 hash.txt

john --format=lm hash.txt

john --format=nt hash.txt

hashcat -m 1000 -a 3 hash.txt

john --format=netntlm hash.txt

hashcat -m 5500 -a 3 hash.txt

john --format=netntlmv2 hash.txt

hashcat -m 5600 -a 3 hash.txt

hashcat64.exe -a 0 -m 2100 --status -r .\OneRuleToRuleThemAll.rule -o found.txt hashes.txt rockyou.txt

hashcat64.exe -m 13100 hash passwords.txt --rules .\OneRuleToRuleThemAll.rule -O -w 3

Zip password cracker, similar to fzc, zipcrack

fcrackzip -D -v -u -p /word/list/ fileZip

unshadow passwd shadow > result

john --wordlist=/....../rockyou.txt result

RSA Keys' passphrases can be brute-forced using JTR by converting the key to the appropriate input format john can work with:

ssh2john id_rsa > id_rsa.john; john –wordlist=/usr/share/wordlists/rockyou.txt id_rsa.john