campuspowerful

Let me first say that I'm doing nothing illegal. I'm doing this for learning purposes only. Using my own virtual network.

1. Download Rockyou Password List

So I am trying to SSH into a server and say I know there is a user called urbasnlug so ssh urbanslug@ipadress but I need the root passoword.

I have a wordlist that contained only strings without alphanumeric strings. How would I use this wordlist to crack a password that has an alphanumeric password which is of mixed cases but the number in the password never goes past 100

Say the wordlist had the strings:password

How could I use these list to crack a password such as PaSSword99.Maybe in ways other than with the use of word lists.

Download Now VSDC Video Editor Pro: The video editor is intended for editing video files and creating videos of any complexity involving various visual and audio effects. The program offers rich functionality and yet has a simple and intuitive interface, allowing you to create videos with a bare minimum of efforts. Vsdc video editor pro.

If you can't help me at least tell me why you can't.

I can write a C or Python module to do this but I know that there has to be something out there that already exists.

migrated from security.stackexchange.comJul 15 '13 at 13:45

This question came from our site for information security professionals.

3 Answers

So you have two things to achieve here. The first is generating the set of passwords you wish to try. The second is throwing that list of passwords against your server.

The first problem is a classic use case of John The Ripper, you can have it read in your wordlist, apply some mangling rules (such as appending 0-99 to each word, permuting cases etc), and output a final, complete password list.

The second problem is quite easy to solve once you have the password list. You could just loop over the passwords in bash, but if you're really lazy, Metasploit has an SSH scanner that reads a password list for you.

Of course, breaking this down into two stages means you are storing the huge password list as a file. In general you would be more likely to pipe the output from John The Ripper to your SSH scanner, rather than using an intermediate file.

First off it will be difficult to get the root password if you are only logged in as a normal user. However, there are different ways of getting 'root' which I believe go beyond the scope of this forum.

Nonetheless, I don't get the correlation of where you wordlist comes to play if already know the characters present in the root password;which would mean you have the root password anyway.

Download Rockyou Password List

Try and use Hashcat to try and retrieve password. You however need a wordlist eg rockyou.txt or any of those available in the OpenWall site (makers of John the Ripper, which is another tool which is only as good as your wordlist.

i think it will be easier (faster?) to get root via a local exploit, read /etc/shadows and crack that password

Not the answer you're looking for? Browse other questions tagged passwordscracking or ask your own question.