/password-attacks

name: password-attacks
description: |
  This skill should be used when the user mentions "brute force", "password cracking",
  "hydra", "hashcat", "john the ripper", "credential stuffing", "password spray",
  "password spraying", "hash cracking", "wordlist", "dictionary attack", "mask attack",
  "rainbow table", "NTLM", "NTLMv2", "bcrypt", "Kerberoast", "Kerberoasting",
  "AS-REP roasting", "AS-REP roast", "golden ticket", "silver ticket", "ticket attack",
  "kerbrute", "crackmapexec", "medusa", "patator", "ncrack", "crowbar",
  "online attack", "offline attack", "credential attack", "credential testing",
  "hash identification", "hashid", "hash-identifier", "hash mode",
  "rule-based attack", "hybrid attack", "combinator attack", "prince attack",
  "CeWL", "CUPP", "crunch", "Mentalist", "wordlist generation",
  "custom wordlist", "targeted wordlist", "password policy",
  "account lockout", "lockout avoidance", "rate limiting", "login brute force",
  "SSH brute force", "RDP brute force", "FTP brute force", "SMB brute force",
  "HTTP form brute force", "web login attack", "credential reuse",
  "breach credentials", "combo list", "proxy rotation",
  "domain password spray", "Active Directory password", "AD credentials",
  "pass the hash", "pass the ticket", "overpass the hash",
  "hashpump", "hash length extension", "DPAPI", "SAM dump", "LSASS",
  "secretsdump", "mimikatz", "LaZagne", "credential dump",
  "rockyou", "seclists", "OneRuleToRuleThemAll",
  or discusses cracking passwords, testing credentials, or attacking authentication
  mechanisms in any protocol or service.
version: 2.0.0

Password Attacks

Full-spectrum credential attack skill covering offline hash cracking, online service brute forcing, domain password spraying, targeted wordlist generation, Kerberos ticket attacks, and credential stuffing with breach data. Choose the right attack class, tool, and OPSEC posture based on the scenario.

Why This Matters

Weak, reused, and default credentials remain the most common initial access vector across every engagement type. A single cracked hash can escalate from low-privilege foothold to domain admin. Password spraying bypasses per-account lockout policies. Breach credential reuse turns old leaks into fresh access. This skill covers every angle.

Decision Tree — Choosing Your Attack

Before touching a tool, classify the scenario:

Do you have hashes/credentials offline?
├── YES → OFFLINE ATTACKS
│   ├── Know the hash type? → hashcat/john with correct mode
│   ├── Unknown hash type? → hashid/hash-identifier first
│   ├── Windows hashes (NTLM)? → hashcat -m 1000, pass-the-hash
│   ├── Kerberos tickets? → references/kerberos-attacks.md
│   └── Need custom wordlist? → references/wordlist-generation.md
│
└── NO → ONLINE ATTACKS
    ├── Single target, known creds format? → Hydra/Medusa
    ├── Domain/AD environment? → Password spraying (crackmapexec/kerbrute)
    ├── Have breach data for target users? → Credential stuffing
    ├── Web login form? → Hydra http-post-form / Patator
    └── Need to avoid lockout? → Spray with lockout-aware timing

Methodology — Execution Order

Phase 1 — Intelligence Gathering

Before attacking, gather intelligence that shapes your approach:

1. **Password policy**: Minimum length, complexity, lockout threshold, lockout duration, password history 2. **Target users**: Enumerate valid usernames (LDAP, Kerberos, web user enumeration, OSINT) 3. **Hash types**: Identify exact hash algorithm if you have offline hashes 4. **Service versions**: Protocol-specific quirks affect tool selection 5. **Prior findings**: Check if credentials were already found in other phases

# Check for existing credential findings
node ${CLAUDE_PLUGIN_ROOT}/scripts/findings-tracker.js search credential
node ${CLAUDE_PLUGIN_ROOT}/scripts/findings-tracker.js search password

# Check what techniques have already been tried
node ${CLAUDE_PLUGIN_ROOT}/scripts/techniques-tracker.js search "brute\|spray\|crack\|password"

Phase 2 — Hash Identification (Offline Only)

When you have hashes, identify them before cracking. Wrong mode = wasted time.

# Automated identification
hashid '<hash_value>'
hashid -m '<hash_value>'  # Show hashcat mode numbers

# hash-identifier (interactive but useful for ambiguous hashes)
hash-identifier

**Quick identification by format:**

| Format | Type | Hashcat Mode | |--------|------|-------------| | 32 hex chars | MD5 or NTLM | 0 or 1000 | | 40 hex chars | SHA1 | 100 | | 64 hex chars | SHA256 | 1400 | | 128 hex chars | SHA512 | 1700 | | `$2a$`/`$2b$`/`$2y$` + 60 chars | bcrypt | 3200 | | `$6$` + salt + `$` + 86 chars | SHA512crypt (Linux) | 1800 | | `$5$` + salt + `$` + 43 chars | SHA256crypt (Linux) | 7400 | | `$1$` + salt + `$` + 22 chars | MD5crypt | 500 | | `$P$` or `$H$` + 31 chars | phpass (WordPress) | 400 | | `$apr1$` + salt + `$` + 22 chars | Apache MD5 | 1600 | | `user::domain:challenge:hash:blob` | NetNTLMv2 | 5600 | | `$krb5tgs$23$*...` | Kerberos TGS-REP (RC4) | 13100 | | `$krb5tgs$17$*...` | Kerberos TGS-REP (AES128) | 19600 | | `$krb5tgs$18$*...` | Kerberos TGS-REP (AES256) | 19700 | | `$krb5asrep$23$...` | AS-REP (RC4) | 18200 |

See `references/hash-cracking.md` for exhaustive hash type reference and cracking strategies.

Phase 3 — Offline Cracking

**Hashcat** (GPU-accelerated, preferred for speed): Load: `ToolSearch` -> `select:mcp__hexstrike-ai__hashcat_crack`

# Dictionary attack
hashcat -m <mode> -a 0 hashes.txt /usr/share/wordlists/rockyou.txt

# Dictionary + rules
hashcat -m <mode> -a 0 hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule

# Mask attack (8-char: uppercase + 6 lower + digit)
hashcat -m <mode> -a 3 hashes.txt '?u?l?l?l?l?l?l?d'

# Hybrid: wordlist + mask append
hashcat -m <mode> -a 6 hashes.txt /usr/share/wordlists/rockyou.txt '?d?d?d?d'

# Show cracked passwords
hashcat -m <mode> hashes.txt --show

**John the Ripper** (C