Credential Testing Tools

Question 1

Hashcat (Credential Harvesting Tools)

Answer 1

• A free password recovery tool that is included with Kali Linux and is available for Linux, OS X, and Windows. It includes a very wide range of hashing algorithms and password cracking methods. Hashcat purports itself to be the fastest recovery tool available.
• *Relies on GPU/CPU

Question 2

Hydra (Credential Harvesting Tools)

Answer 2

*A free network login password cracking tool that is included with Kali Linux. It supports a number of authentication protocols, repeated attempts

Question 3

Medusa (Credential Harvesting Tools)

Answer 3

*A command-line-based free password cracking tool that is often used in brute force password attacks on remote authentication servers. It purports itself to specialize in parallel attacks, with the ability to locally test 2,000 passwords per minut

Question 4

CeWL (Credential Harvesting Tools)

Answer 4

*A Ruby app that crawls websites to generate word lists that can be used with password crackers such as John the Ripper. It is included with Kali Linux.

Question 5

John the Ripper (Credential Harvesting Tools)

Answer 5

*A free password recovery tool available for Linux, 11 versions of Unix, DOS, Win32, BeOS, and OpenVMS. It is included with Kali Linux.

Question 6

Cain and Abel (Credential Harvesting Tools)

Answer 6

• A free password recovery tool available for Windows that is sometimes classified as malware by some antivirus software.
• Windows password cracker, conducts network sniffing and task cracking

Question 7

Mimikatz (Credential Harvesting Tools)

Answer 7

• targets windows machines to extract plaintext passwords, hashes, PIN codes, and Kerberos tickets from the machines memory
• can be used for pass the hash, pass the ticket, and creating golden tickets
• *An open source tool that enables you to view credential information stored on Microsoft Windows computers. It is also included with Kali Linux.

Question 8

Patator (Credential Harvesting Tools)

Answer 8

• multi purpose brute force attack, supports modules for different target services

Question 9

Dirbuster (Credential Harvesting Tools)

Answer 9

• brute force tool for directories and file names on web/application servers

Question 10

W3AF (Credential Harvesting Tools)

Answer 10

*Web Application Attack and Audit Framework, Python, tool to find and exploit any web app vulnerabilities