10 entries tagged “Brute Force”. Browse all tags
The John the Ripper quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Identify a hash, convert a ZIP or SSH key with a *2john script, run wordlist and rule attacks, crack NT and sha512crypt, mask a known pattern, fork across CPU cores, and read the pot file honestly.
The Wfuzz quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Fuzz paths, query and POST parameters, headers, cookies, and virtual hosts, filter custom-404 noise by size, brute a login with two markers, encode payloads on the fly, and proxy through Burp.
The Stegseek quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Brute-force a Steghide passphrase against rockyou, extract the hidden payload, confirm a carrier with seed mode, batch many files, and identify what you recovered before opening it.
The CeWL quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Crawl an authorized site, build a wordlist from its own words, tune depth and length, harvest emails and document authors, rank by frequency, then feed hydra, john, and hashcat.
The Hashcat quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Pick the exact hash mode, run dictionary, rule, mask, and hybrid attacks, crack NTLM, sha512crypt, WPA, and Kerberoast hashes, read the status screen, and resume long jobs.
The Hydra quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Test SSH/FTP/SMB/RDP and database logins, brute an HTTP form with a fail or success marker, spray one password lockout-safe, tune tasks and rate, save hits, and resume an aborted run, all inside scope.
The Mr. Robot virtual machine (VM) is an exciting challenge inspired by the hit TV series Mr. Robot. It features three hidden keys, progressively increasing in difficulty.
WordPress user enumeration via wpscan plus SSH brute-force gain a foothold, then a cracked KeePass database yields a filename that triggers a root cron job for root credentials.
Layered web encoding (Base64/Brainfuck/QR) leaks usernames for FTP brute-force, an SSH key upload yields a shell, then a PATH-hijacked SUID binary gives root.
A WordPress login brute-forced with wpscan plants a PHP reverse shell in a theme's 404.php, then passwordless sudo nmap escalates to root.
Type to search · / or Ctrl+K to open · ↑↓ to move · Enter to open · Esc to close
