Credential Testing Tools

Question 1

Hashcat

Answer 1

a fast password recovery tool that helps break complex password hashes.

Question 2

Medusa

Answer 2

ntended to be a speedy, massively parallel, modular, login brute-forcer.

Question 3

Hydra

Answer 3

a brute-forcing tool that helps penetration testers and ethical hackers crack the passwords of network services. Hydra can perform rapid dictionary attacks against more than 50 protocols. This includes telnet, FTP, HTTP, HTTPS, SMB, databases, and several other services.

Question 4

CeWL

Answer 4

(Custom Word List generator) is a ruby app which spiders a given URL, up to a specified depth, and returns a list of words which can then be used for password crackers such as John the Ripper. Optionally, CeWL can follow external links.

Question 5

John the Ripper

Answer 5

a free password cracking software tool.[3] Originally developed for the Unix operating system, it can run on fifteen different platforms (eleven of which are architecture-specific versions of Unix, DOS, Win32, BeOS, and OpenVMS). It is among the most frequently used password testing and breaking programs[4] as it combines a number of password crackers into one package, autodetects password hash types, and includes a customizable cracker.

Question 6

Cain

Answer 6

WAS (deprecated) a password recovery tool for Microsoft Windows. It could recover many kinds of passwords using methods such as network packet sniffing, cracking various password hashes by using methods such as dictionary attacks, brute force and cryptanalysis attacks.

Question 7

Mimikatz

Answer 7

well known to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory. mimikatz can also perform pass-the-hash, pass-the-ticket or build Golden tickets.

Question 8

Patator

Answer 8

multi-purpose brute-forcer, with a modular design and a flexible usage. Currently it supports the following modules: ftp_login : Brute-force FTP. ssh_login : Brute-force SSH. telnet_login : Brute-force Telnet.

Question 9

DirBuster

Answer 9

a multi threaded java application designed to brute force directories and files names on web/application servers.

Question 10

w3af

Answer 10

an open-source web application security scanner. The project provides a vulnerability scanner and exploitation tool for Web applications. It provides information about security vulnerabilities for use in penetration testing engagements.