/bruteforce

description: Password brute force and hash cracking against target services
allowed-tools: ToolSearch, Bash, Read, Write
argument-hint: <service> <target>

Brute Force Attack

Service: `$1` Target: `$2`

Execute password attacks using Hexstrike MCP tools.

Step 1: Load Tools

Use ToolSearch to load:

• `hydra_attack` — online password brute forcing
• `john_crack` — offline password/hash cracking
• `hashcat_crack` — GPU-accelerated hash cracking
• `netexec_scan` — network credential testing (SMB/SSH/WinRM)

Step 2: Identify Attack Type

Map the service to the appropriate approach:

**Online brute force** (live service login):

• ssh, ftp, http-post-form, http-get, rdp, smb, telnet, vnc, mysql, mssql, postgres
• Tool: `hydra_attack`

**Offline hash cracking** (captured hashes):

• md5, sha1, sha256, sha512, bcrypt, ntlm, kerberos, wordpress
• Tool: `john_crack` or `hashcat_crack`

**Network credential testing**:

• smb, ssh, winrm, ldap, mssql, rdp
• Tool: `netexec_scan`

Step 3: Online Brute Force (if applicable)

Run `hydra_attack` with:

• Target service and port
• Username list or single username
• Password list (check for existing wordlists in `attack/` directory)
• Appropriate thread count (lower for rate-limited services)
• Service-specific options (e.g., http-post-form with login path and failure string)

Step 4: Hash Cracking (if applicable)

For captured hashes, choose the right tool:

• **john_crack** — good for many hash types, rule-based attacks
• **hashcat_crack** — faster for GPU-friendly hashes, more attack modes

Run with:

• Hash file or hash value
• Wordlist + rules for dictionary attack
• Or mask for brute force pattern

Step 5: Results

Report found credentials clearly: | Username | Password | Service | Status | |----------|----------|---------|--------|

**IMPORTANT**: Handle credentials responsibly. Only test credentials within authorized scope.