The title is slightly confusing but what I mean is that if you are brute forcing every combination of a password, (not using leaked dictionaries like Rockyou.txt,) you can generate custom wordlists with tools such as crunch, and then brute…
SSH Private Key Looting Wordlists. A Collection Of Wordlists To Aid In Locating Or Brute-Forcing SSH Private Key File Names.LFI for Lateral Movement? Gain SSH Access? ?file=../../../../../../../../home/user/.ssh/id_rsa?file=../../../../../../../../home…
Theoretical question – Say we have a randomly generated password with 80-bit entropy, stored as a single-round, unsalted SHA256 hash. For a determined attacker with current (2024) technology, what would be the cost of bruteforcing it, in t…
I have a microservice which sole purpose is to serve as a cache for other microservices. The point of the cache is to speed up processing, but the strong password hash algo counter that purpose. (Company policy require all service to be se…
OS: Ubuntu 20.04 on VMWare, tool: John the ripper
The whole system is up-to-date
The file has 1000 hashed passwords. There are 40 rules provided, a small word list is provided to help crack part of the password. Length is from 1 to 8
Metho…
There is a lot of online tools to bruteforce online server like hydra and offline with hashes like hashcat. Yet it seems very weird that there is not a single offline bruteforcing app for software. Like if a make a python app that requires…
I’m working on a lab on PortSwigger.com titled Username enumeration via different responses. While using ffuf to solve the lab, the output keeps returning a 400 status code.
So far this is what I’ve tried. Here is the request payload file,…
This is a password recovery project, which is more complex than just generated a wordlist, since using my tries (see below) it seems to be not enough to just generate a wordlist.
I’m trying to recover my old Bitcoin wallet, which I created…
Simple script to generate graphs and charts on hashcat (and john) potfile and ntds Install git clone https://github.com/Orange-Cyberdefense/graphcatcd graphcatpip install . Helper $ graphcat.py -husage: graphcat.py [-h] -potfile hashcat.potfile -…
I’m currently trying to crack a password-hash in hashcat.
But I’m facing a problem and can’t figure out how to solve it.
I have to substitute the same char with a different rule sometimes (something like sa> OR sa0).
Is there an easy wa…
