Mercurial > hg > anonet-resdb

comparison contrib/splicex/src/manual @ 688:2e33b56d4f0d draft

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
SpliceX improvements
author resdb <resdb@d3v11-VM.(none)>
date Sun, 23 Oct 2011 08:31:11 -0500
parents
children 24a6ba1d8657
comparison
equal deleted inserted replaced
687:f471a2bca6ff 688:2e33b56d4f0d
1 .TH SpliceX "" "" "" ""
2 __________ _ _ __ __ ______
3 / / / / ___| _ __ | (_) ___ ___\\ \\/ / / / / /
4 / / / /\\___ \\| '_ \\| | |/ __/ _ \\\\ / / / / /
5 / / / / ___) | |_) | | | (_| __// \\ / / / /
6 /_/_/_/ |____/| .__/|_|_|\\___\\___/_/\\_\\/_/_/_/
7 |_|
8
9 .:Brute Force Utilities For GNU/Linux:.
10
11
12 SpliceX is free software: you can redistribute it and/or modify it under
13 the terms of the GNU General Public License as published by the Free
14 Software Foundation, either version 3 of the License, or (at your option)
15 any later version.
16
17 SpliceX is distributed in the hope that it will be useful, but WITHOUT
18 ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
19 FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
20 for more details. <http://www.gnu.org/licenses/>
21
22
23
24 .SH
25 OPTIONS
26
27 --help Show help display and exit
28
29 --command Parse passwords to this command
30
31 --dictionary Path to custom dictionary(wordlist)
32
33 --rtfm Show manual page and exit
34
35 --restore Path to restore file
36
37 --save Directory path to create save file
38
39 --test Test output of command
40
41 --time Manipulate timed iterations
42
43 --usernames Path to username list
44
45 --exh-l Use an exhaustive attack with letters only
46
47 --exh-n Use an exhaustive attack with numbers only
48
49 --exh-s Use an exhaustive attack with special characters only
50
51 --exh-ln Use an exhaustive attack with letters and numbers only
52
53 --exh-ls Use an exhaustive attack with letters and special
54 characters only
55
56 --exh-ns Use an exhaustive attack with numbers and special
57 characters only
58
59 --exh-all Use an exhaustive attack with all characters
60
61 --exh-custom Use an exhaustive attack with custom characters
62
63 --stdout Print only passwords to stdout
64
65 -A Use alphabetical mixing module
66
67 -B Use backwords module
68
69 -C Use alternating caps module
70
71 -L Use "L337" speak module
72
73 -M Use MD5 module
74
75 -N Use numerical mixing module
76
77 -R Use regular words module
78
79 -S Use special mixing module
80
81 --mix-custom Use custom mixing module
82
83 --wep-5 Use 5 character WEP module
84
85 --wep-13 Use 13 character WEP module
86
87 --wep-* Use 5 and 13 character WEP module
88
89 --letters Use letter characters
90
91 --numbers Use number characters
92
93 --specials Use special characters
94
95 --char-all Use all characters
96
97 --no-char Override character usage
98
99 --char-length Start and end with set character lengths
100
101 --custom Use custom characters
102
103 --deshadow Crack shadow hash sums
104
105 --get-shadow Get the shadow info for a user
106
107 --set-shadow Use the shadow info from a file
108
109 --se-module Use the social engineering module
110
111 --create Create a dictionary
112
113 --debug Enable debugging
114
115 .SH
116 DICTIONARIES
117
118 splicex comes equipped with its own dictionary but is
119 .br
120 designed to use custom dictionaries as well. The
121 .br
122 dictionary should be in the following format: a plain
123 .br
124 text file with one word per line, no spaces between
125 .br
126 words, letters only. You do not have to follow the
127 .br
128 above guideline exactly but it is strongly suggested.
129 .br
130 IE:
131
132 ============= NOT ACTUAL LINE ON FILE ===============
133 .br
134 qwerty
135 .br
136 john
137 .br
138 linux
139 .br
140 newpass
141 .br
142 princess
143 .br
144 hacker
145 .br
146 ============= NOT ACTUAL LINE ON FILE ===============
147
148 .SH
149 USERNAMES
150
151 splicex is capable of cycling through usernames as it
152 .br
153 would a dictionary. There is no default username list
154 .br
155 on splicex. The username list should be in the
156 .br
157 following format: a plain text file with one word per
158 .br
159 line, no spaces between words, letters only. You do
160 .br
161 not have to follow the above guideline exactly but it
162 .br
163 is strongly suggested.
164 .br
165 IE:
166
167 ============= NOT ACTUAL LINE ON FILE ===============
168 .br
169 john
170 .br
171 admin
172 .br
173 root
174 .br
175 david
176 .br
177 fred
178 .br
179 ============= NOT ACTUAL LINE ON FILE ===============
180
181 .SH
182 SAVING AND RESTORING
183
184 splicex is capable of restarting where it was stopped
185 .br
186 by using the --restore switch followed by the full path to
187 .br
188 a splicex.save file. DO NOT modify these files or
189 .br
190 splicex may receive an error or not load at all.
191 .br
192 When restoring, if you set the --test switch you must
193 .br
194 manually set it again or splicex will not test for
195 .br
196 specified output. If saving splicex's status, then
197 .br
198 splicex will save to the specified directory as
199 .br
200 splicex.save. If splicex.save already exists it will
201 .br
202 be overwritten so change the name of any original
203 .br
204 copies if you want to keep them. If saving a splicex
205 .br
206 session you should stop the process using the
207 .br
208 appropriate terminal feature before killing splicex
209 .br
210 to avoid corrupting the save file.
211
212 --save="/path/to/save/directory/"
213
214 --restore="/path/to/splicex.save/"
215 .SH
216 MODULES
217
218 -A -B -C -L -M -N -R -S --mix-custom --wep-5 --wep-13 --wep-* --se-module
219 .br
220 splicex comes equipped with several modules that mangle
221 .br
222 the words in the selected dictionary to create probable
223 .br
224 password combinations. You may use as many of these
225 .br
226 modules as you want. Some modules can take a few or more
227 .br
228 minutes to enhance a dictionary depending on the size
229 .br
230 of the selected dictionary.
231
232 -A Alphabetical Mixing Module:
233 .br
234 This module puts several combinations of alphabet
235 .br
236 characters inside the words in the selected
237 .br
238 dictionary. IE:
239
240 pZassword
241 .br
242 pCatssword
243 .br
244 passworKd
245 .br
246 passwoJrLd
247 .br
248 ...
249
250 -B Backwards Module:
251 .br
252 This module creates backwards words from the
253 .br
254 selected dictionary. IE:
255
256 drowssap
257 .br
258 ...
259
260 -C Capitalization Module:
261 .br
262 This module recreates the words in the selected
263 .br
264 dictionary with alternating capitalizations.
265 .br
266 IE:
267
268 Password
269 .br
270 PAssword
271 .br
272 PaSsWoRd
273 .br
274 pAsSwOrD
275 .br
276 passwoRD
277 .br
278 ...
279
280 -L L337 Speak Module:
281 .br
282 This module converts the words in the selected
283 .br
284 dictionary to several versions of "l337 speak".
285 .br
286 IE:
287
288 p4ssword
289 .br
290 p455w0rd
291 .br
292 pa5sword
293 .br
294 ps@$$word
295 .br
296 ...
297
298 -N Numerical Mixing Module:
299 .br
300 This module puts several combinations of number
301 .br
302 characters inside the words in the selected
303 .br
304 dictionary. IE:
305
306 p2assword
307 .br
308 p5a8ssword
309 .br
310 passwor0d
311 .br
312 passwo6r9d
313 .br
314 ...
315
316 -R Regular Words Module:
317 .br
318 This module tells splicex to use the words in a
319 .br
320 selected dictionary as they are listed.
321
322
323 -S Special Mixing Module:
324 .br
325 This module puts several combinations of special
326 .br
327 characters inside the words in the selected
328 .br
329 dictionary. IE:
330
331 p!assword
332 .br
333 p@a$ssword
334 .br
335 passwor(d
336 .br
337 passwo-r+d
338 .br
339 ...
340
341 --mix-custom Custom Mixing Module:
342 .br
343 This module puts several combinations of user
344 .br
345 selected characters inside the words from the
346 .br
347 selected character list. IE:
348
349 p!assword
350 .br
351 p@a$ssword
352 .br
353 passwor(d
354 .br
355 passwo-r+d
356 .br
357 ...
358
359 --mix-custom's list should only contain one character per
360 .br
361 line on a plain text file. If you select this
362 .br
363 module then modules -A, -N, -S will be ignored.
364 .br
365 IE:
366
367 ============= NOT ACTUAL LINE ON FILE ===============
368 .br
369 j
370 .br
371 1
372 .br
373 @
374 .br
375 0
376 .br
377 z
378 .br
379 ============= NOT ACTUAL LINE ON FILE ===============
380
381 If -A, -N, and/or -S options are selected then
382 .br
383 the modules will be combined. see also --char-all. IE:
384
385 pZa!ssword
386 .br
387 p0atssword
388 .br
389 passwor7d
390 .br
391 passwo*rLd
392 .br
393 ...
394
395 -M MD5 Module:
396 .br
397 This module generates md5 hash sums for
398 .br
399 words listed in the selected dictionary.
400 .br
401 IE:
402
403 5912d7bfd10f631f1715bf85bbb72d97
404 .br
405 966e8fda594333563c02fa4b69765a5e
406 .br
407 900bc885d7553375aec470198a9514f3
408 .br
409 97f014516561ef487ec368d6158eb3f4
410 .br
411 ...
412
413
414 --wep-*, --wep-5, --wep-13 WEP Modules:
415 .br
416 these two modules strip 5 or 13 character
417 .br
418 words from the selected dictionary and produce
419 .br
420 WEP compatible hex passwords. If your dictionary
421 .br
422 does not contain 5 or 13 character words then
423 .br
424 splicex will likely give an error.
425
426
427 --se-module Social Engineering Module:
428 .br
429 see the social engineering section below for
430 .br
431 details.
432
433 .SH
434 CHARACTERS
435
436 splicex appends alternating character tags to the beginning
437 .br
438 and/or ending of each password. By default splicex will use
439 .br
440 all standard keyboard characters but you can choose to use
441 .br
442 specific combinations. If one or more of the following
443 .br
444 options is omitted then only the selected options will be
445 .br
446 used ; they will be combined.
447
448 --letters Use letter characters
449 .br
450 Apassword
451 .br
452 passwordA
453 .br
454 abCpassword
455 .br
456 passwordxYz
457 .br
458 ...
459
460 --numbers Use numbers characters
461 .br
462 1password
463 .br
464 password1
465 .br
466 123password
467 .br
468 password098
469 .br
470 ...
471
472 --specials Use specials characters
473 .br
474 $password
475 .br
476 password^
477 .br
478 %)!password
479 .br
480 password#*@
481 .br
482 ...
483
484 --custom Use custom characters from a list
485 .br
486 $password
487 .br
488 password^
489 .br
490 %)!password
491 .br
492 password#*@
493 .br
494 ...
495
496 --custom list should only contain one character per
497 .br
498 line on a plain text file. If you select this
499 .br
500 module then other character flags will be ignored.
501 .br
502 If the custom list matches the selected dictionary
503 .br
504 then splicex will run in exhaustive mode.
505 .br
506 IE:
507
508 ============= NOT ACTUAL LINE ON FILE ===============
509 .br
510 j
511 .br
512 1
513 .br
514 @
515 .br
516 0
517 .br
518 z
519 .br
520 ============= NOT ACTUAL LINE ON FILE ===============
521
522 --letters, --numbers, and/or --specials
523 .br
524 Apassword6&
525 .br
526 7passwordA
527 .br
528 a*Cpassword9
529 .br
530 a}password0Yz
531 .br
532 ...
533
534 --no-char Override character usage
535 .br
536 This option tells splicex not to make
537 .br
538 any character additions to passwords.
539
540 --char-length Start and end with set character lengths
541 .br
542 This option tells splicex to start and stop with a set
543 .br
544 amount of characters. IE:
545
546 The following will start with one character added and
547 .br
548 end with 3:
549 .br
550 splicex --char-length='1, 3'
551
552 The following will generate only 6 character passwords:
553 .br
554 splicex --exh-custom='MyCharacters.txt' --char-length='6, 6'
555
556 .SH
557 SOCIAL ENGINEERING
558
559 --se-module Social Engineering Module:
560 .br
561 splicex is equipped with a social engineering module to create
562 .br
563 concatenated words from the selected dictionary. This module
564 .br
565 allows for "Module Stacking". IE, if you select other other
566 .br
567 modules when setting this flag then compiled words will also
568 .br
569 be incorporated into the algorithm as if they appeared on the
570 .br
571 the selected dictionary itself.
572
573 .SH
574 DESHADOW
575
576 splicex comes with its own small program to compare a created hash
577 .br
578 sum, those found in /etc/shadow with an existing one given through
579 .br
580 user input. When using the deshadow option you will need to set
581 .br
582 exactly one of the --get-shadow or --set-shadow options. There is no
583 .br
584 need to use the --command or the --test flags when using this option
585 .br
586 because the values for each will be preset.
587
588 --get-shadow Get the shadow info for a user
589 .br
590 see examples below for usage details.
591
592 --set-shadow Use the shadow info from a file. This file should be
593 .br
594 in plain text and contain only one line with the
595 .br
596 following syntax:
597
598 ============= NOT ACTUAL LINE ON FILE ===============
599 .br
600 $HashingMethod$SaltValue$ActualHashItself
601
602 ============= NOT ACTUAL LINE ON FILE ===============
603
604 If you need to see an example Shadow entry you may
605 .br
606 use the following command:
607
608 cat /etc/shadow | grep -i "$USER"
609
610 .SH
611 EXHAUSTIVE
612
613 splicex is capable of mounting a standard exhaustive attack.
614 .br
615 An exhaustive attack is a sure\-fire method to crack any
616 .br
617 password but this can also take large amounts of time
618 .br
619 depending on the length of a password. If it's necessary to
620 .br
621 use an exhaustive bruteforcing algorithm you may do so with
622 .br
623 one of the following options:
624
625 --exh-l
626 .br
627 This attack uses only letters.
628
629 --exh-n
630 .br
631 This attack uses only numbers.
632
633 --exh-s
634 .br
635 This attack uses only special characters.
636
637 --exh-ln
638 .br
639 This attack uses only letters and numbers.
640
641 --exh-ls
642 .br
643 This attack uses only letters and special characters.
644
645 --exh-ns
646 .br
647 This attack uses only numbers and special characters.
648
649 --exh-all
650 .br
651 This attack uses all characters.
652
653 --exh-custom
654 .br
655 This attack uses custom characters in a character list. IE:
656 .br
657 --exh-custom='CharList.txt'
658 .br
659 A character list should be in the following syntax:
660
661 ============= NOT ACTUAL LINE ON FILE ===============
662 .br
663 j
664 .br
665 1
666 .br
667 @
668 .br
669 0
670 .br
671 z
672 .br
673 ============= NOT ACTUAL LINE ON FILE ===============
674
675 .SH
676 STDOUT
677
678 splicex has the option to skip the command and test flags
679 .br
680 and print only the created passwords to stdout. This is a
681 .br
682 useful flag if you're going to pipe the output to stdin
683 .br
684 on another program.
685
686 --stdout
687 .br
688 The output will look similar to the following:
689 .br
690 password
691 .br
692 qwerty
693 .br
694 123magick
695 .br
696 newpass
697 .br
698 john1965
699
700 .SH
701 REGEXP
702
703 splicex can create some regexp type functions
704 .br
705 using existing options:
706
707 splicex --command='echo onePASSWORDthree' --test='onetwothree' --exh-l
708
709 splicex --command='echo johnPASSWORD65' --test='john1965' --exh-custom='MyList.txt'
710
711 splicex --command='echo ilovePASSWORD' -R --no-char --test='iloveqwerty'
712
713 you may also want to see --se-module for more specific attacks.
714
715 .SH
716 CONTROLS
717
718 splicex contains some options worth going over again.
719
720 --command='<insert command> PASSWORD' #must contain regexp 'PASSWORD'
721
722 --time='10, 1' #timed iterations
723
724 --custom='file.txt', -U 'file.txt', --dictionary='file.txt',
725 .br
726 --exh-custom='file.txt' #custom wordlists and/or character lists
727
728 --no-char #useful flag to only use the generated wordlist
729 .br
730 #no characters will be appended to the passwords
731
732 --stdout #prints only passwords
733
734 --debug #helps to troubleshoot
735
736 .SH
737 EXAMPLES
738
739 splicex --command="unrar -pPASSWORD t file.rar" --test="All OK" -R
740
741 splicex --command="sshpass -pPASSWORD ssh user@host" --dictionary="wordlist" -L
742
743 splicex --command="smbclient -L 192.168.1.0 -Uusername%PASSWORD" -L
744
745 splicex --deshadow --get-shadow="root" -R
746
747 splicex --deshadow --set-shadow="/home/user/shadow.txt" -R
748
749 splicex\\
750 .br
751 --command="echo PASSWORD | aircrack-ng -b 00:11:22:33:44:55 -w - *.cap"\\
752 .br
753 --wep-5 --wep-13 --no-char --dictionary='MyWords.txt'\\
754 .br
755 --test='KEY FOUND'
756
757 splicex --command='curl --user <user[:PASSWORD]> https://www.example.com' -R
758