OSCP notesExtended library
Browse tracks

Notes / Brute Forcing

Brute Forcing

Check the relevant lockout policy before online guessing; a tool's thread count does not establish a safe rate. First test recovered credentials against the specific service and account context. Offline cracking does not submit login attempts. Web forms require a stable failure indicator and valid session/CSRF state.

Default Credentials

Note: Note: SecLists and WordList Compendium also include default passwords lists.

Wordlists

Wordlist Generation

CeWL

cewl example.com -m 3 -w wordlist.txt
Parameters
  • -m <length>: Minimum word length.
  • -w <file>: Write the output to <file>.

Crunch

Simple wordlist.

crunch 6 12 abcdefghijk1234567890\@\! -o wordlist.txt

String permutation.

crunch 1 1 -p target pass 2019 -o wordlist.txt

Patterns.

crunch 9 9 0123456789 -t @target@@ -o wordlist.txt
Parameters
  • <min-len>: The minimum string length.
  • <max-len>: The maximum string length.
  • <charset>: Characters set.
  • -o <file>: Specifies the file to write the output to.
  • -p <charset or strings>: Permutation.
  • -t <pattern>: Specifies a pattern, eg: @@pass@@@@.
    • @ will insert lower case characters
    • , will insert upper case characters
    • % will insert numbers
    • ^ will insert symbols

Password Profiling

CUPP

cupp -i
Parameters
  • -i: Interactive uestions for user password profiling.

Word Mangling

john

john --wordlist=wordlist.txt --rules --stdout
Parameters
  • --wordlist <file>: Wordlist mode, read words from <file> or stdin.
  • --rules[:CustomRule]: Enable word mangling rules. Use default or add [:CustomRule].
  • --stdout: Output candidate passwords.

Note: Note: Custom rules can be appended to John’s configuration file john.conf.

Services

FTP

Hydra

hydra -l USER -P /PATH/passwords.txt -t 1 -f -o ftp-found.txt TARGET ftp
Parameters
  • -l <user>: login with user name.
  • -P <passwords file>: login with passwords from file.
  • -f: exit after the first found user/password pair.

Read accepted pairs in ftp-found.txt, then verify the login and permissions with the FTP client. -t 1 limits concurrency, not the account's lockout risk. Stop and reassess on lockout or repeated connection errors. For supplied user:pass pairs, use the paired-credential form instead of combining every username with every password. Hydra usage.

FTP on a nonstandard port 
hydra -l USER -P /PATH/passwords.txt -t 1 -f -s PORT -o ftp-found.txt TARGET ftp

Confirm that PORT actually speaks FTP; SSH/SFTP is a different service. Follow the service's TLS requirements rather than treating a TLS negotiation failure as an incorrect password.

SMB

Hydra

hydra -v -t1 -l Administrator -P /usr/share/wordlists/rockyou.txt -f 10.0.0.3 smb
Parameters
  • -v: verbose mode.
  • -t <tasks>: run <tasks> number of connects in parallel. Default: 16.
  • -l <user>: login with user name.
  • -P <passwords file>: login with passwords from file.
  • -f: exit after the first found user/password pair.

NSE Script

sudo nmap --script smb-brute -p U:137,T:139 10.0.0.3

SSH

Hydra

hydra -v -t 1 -l USER -P /PATH/TO/WORDS -f TARGET ssh

Web Applications

HTTP Basic Auth 

hydra -L users.txt -P /usr/share/wordlists/rockyou.txt example.com http-head /admin/

HTTP Digest 

hydra -L users.txt -P /usr/share/wordlists/rockyou.txt example.com http-get /admin/

HTTP POST Form 

hydra -l admin -P /usr/share/wordlists/rockyou.txt example.com https-post-form "/login.php:username=^USER^&password=^PASS^&login=Login:Not allowed"
Parameters
  • -l <user>: login with user name.
  • -L <users-file>: login with users from file.
  • -P <passwords file>: login with passwords from file.
  • http-head | http-get | http-post-form: service to attack.

HTTP Authenticated POST Form

To add the session ID to the options string, simply append the Cookie header with the session ID, like so: :H=Cookie\: security=low; PHPSESSID=if0kg4ss785kmov8bqlbusva3v

hydra -l admin -P /usr/share/wordlists/rockyou.txt example.com https-post-form "/login.php:username=^USER^&password=^PASS^&login=Login:Not allowed:H=Cookie\: PHPSESSID=if0kg4ss785kmov8bqlbusva3v"

Miscellaneous

Combo (Colon Separated) Lists

Hydra

Use a colon separated login:pass format, instead of -L/-P options.

hydra -v -C /usr/share/seclists/Passwords/Default-Credentials/ftp-betterdefaultpasslist.txt -f 10.0.0.3 ftp
Parameters
  • -v: verbose mode.
  • -C <user:pass file>: colon-separated “login:pass” format.
  • -f: exit after the first found user/password pair.

Medusa

The combo files used by Medusa should be in the format host:username:password, separated by colons. If any of these three values are missing, the relevant information should be provided either as a global value or as a list in a separate file.

sed s/^/:/ /usr/share/seclists/Passwords/Default-Credentials/ftp-betterdefaultpasslist.txt > /tmp/cplist.txt
medusa -C /tmp/cplist.txt -h 10.0.0.3 -M ftp
Parameters
  • -u <user>: login with user name.
  • -P <passwords file>: login with password from file.
  • -h: target hostname or IP address.
  • -M: module to execute.

\

Prepare tools used on this page

Use the shared Kali workspace preparation first. Optional tools are not additional mandatory passes. Skip a clone when its reviewed checkout already exists.

Prepare CUPP

Optional Kali wordlist profiler. It creates a local wordlist, not permission to spray accounts. Upstream.

sudo apt install cupp

Check on Kali:

cupp -h
Prepare SecLists

Shared wordlists used by the web/password procedures. Available as a Kali package but not guaranteed by the default toolset; inspect the selected file and its size. Upstream.

sudo apt install seclists

Check on Kali:

test -s /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt
ls /usr/share/seclists/Passwords
Prepare Probable Wordlists

Optional data collection, not an executable installation. Inspect sizes and choose one relevant dictionary; do not concatenate every list or treat it as a required download. Upstream.

git clone --depth 1 https://github.com/berzerk0/Probable-Wordlists.git "$HOME/oscp/tools/repos/probable-wordlists"

Check on Kali:

git -C "$HOME/oscp/tools/repos/probable-wordlists" rev-parse --short HEAD
Prepare WordList Compendium

Optional data collection, not an executable installation. Inspect sizes and choose one relevant dictionary; do not concatenate every list or treat it as a required download. Upstream.

git clone --depth 1 https://github.com/Dormidera/WordList-Compendium.git "$HOME/oscp/tools/repos/wordlist-compendium"

Check on Kali:

git -C "$HOME/oscp/tools/repos/wordlist-compendium" rev-parse --short HEAD
Prepare Google fuzzing dictionaries

Optional data collection, not an executable installation. Inspect sizes and choose one relevant dictionary; do not concatenate every list or treat it as a required download. Upstream.

git clone --depth 1 https://github.com/google/fuzzing.git "$HOME/oscp/tools/repos/google-fuzzing"

Check on Kali:

git -C "$HOME/oscp/tools/repos/google-fuzzing" rev-parse --short HEAD
Prepare Jhaddix content-discovery list

Optional web-path dictionary. Inspect the list and select a sensible scope/rate; its presence is not a reason to repeat complete discovery. Upstream.

mkdir -p "$HOME/oscp/tools/artifacts/wordlists"
curl -fL https://gist.githubusercontent.com/jhaddix/b80ea67d85c13206125806f0828f4d10/raw/content_discovery_all.txt -o "$HOME/oscp/tools/artifacts/wordlists/content_discovery_all.txt"

Check on Kali:

wc -l "$HOME/oscp/tools/artifacts/wordlists/content_discovery_all.txt"
Prepare CrackStation dictionary

Optional human-password subset, roughly 247 MiB compressed / 684 MiB expanded. Select only if useful and allow disk space for both files. Expected archive SHA256: 201f8815c71a47d39775304aa422a505fc4cca18493cfaf5a76e608a72920267. The full list is about 15 GiB expanded and is not part of this setup. Upstream.

mkdir -p "$HOME/oscp/tools/artifacts/wordlists"
curl -fL https://crackstation.net/files/crackstation-human-only.txt.gz -o "$HOME/oscp/tools/downloads/crackstation-human-only.txt.gz"
gzip -dk "$HOME/oscp/tools/downloads/crackstation-human-only.txt.gz"
mv "$HOME/oscp/tools/downloads/crackstation-human-only.txt" "$HOME/oscp/tools/artifacts/wordlists/"

Check on Kali:

sha256sum "$HOME/oscp/tools/downloads/crackstation-human-only.txt.gz"
wc -l "$HOME/oscp/tools/artifacts/wordlists/crackstation-human-only.txt"