Top 13 Password Cracking Tools in Kali Linux 2020.1

Kali Linux includes some of the best password attack tools that necessary for every security professional and pentester. I have included a list of the best tool Kali Linux 2020.1 offers for password attacking. All of these tools are open-source and available in Kali full images by default.

CeWL tool:

It is a ruby language-based tool that connects a unique URL to a definite depth; it follows external links and outputs a list of words that are used for password crackers like John’s password cracking tool. It can also be launched in command line terminal windows, files already bagged FAB that uses raw data extractions methods to create lists from already downloaded.

Crunch tool:

This password attack tool generates a wordlist where standard or customized character set can be specified for usage. It generates all the possible password combinations in a very quick process. It can also break up the results by file size and support in case of any difficulty. It supports numbers, symbols. Crunch supports uppercase and lowercase letters and also generates a status report of multiple files.

Hashcat tool:

This is one of the most popular, fast, and expert password recovery tools. It supports 5 unique attack modes for 300 plus highly-optimized hashing algos. It can support CPU, GPU, and many more hardware accelerators and helps to work on distributed password cracking. It has numerous different options to support multiple arguments during password recovery.

John the ripper toolkit:

“John the ripper” is a fast and reliable toolkit that contains numerous cracking modes, and it is highly customizable and configurable according to your requirements. By default, John can work with many hash types, including traditional DES, bigcrypt, FreeBSD MD5, Blowfish, BSDI extended DES, Kerberos, and MS Windows LM hashes. It also supports other DES-based tripcodes, but they need to be configured. It can also work on SHA hashes and Sun MD5 hashes. It also supports OpenSSH private keys, PDF files, ZIP, RAR archives, Kerberos TGT.

It has many scripts for various purposes such as unafs (warning about weak passwords), unshadows (passwords and shadows files combined), unique (duplicates are removed from wordlist).

Medusa tool:

Medusa is a brute-forcer login tool that is a very fast, reliable, and modular design. It supports many services that allow remote authentication. It supports multi thread-based parallel testing, and it also has flexible user input, a modular design that can support independent brute force services. It also supports many protocols such as SMB, HTTP, POP3, MSSQL, SSH version 2, and many more.

Ncrack tool:

A very fast network authentication cracking tool that helps organizations to secure their networks against password attacks. It searches for poor passwords by testing their hosts and networking devices. It has several components and works like the NMAP tool having a dynamic engine to work on network feedback. It has fast and reliable auditing services for multiple hosts. It is very easy to use and has sophisticated brute force attacks, timing templates, and a flexible interface for complete control of the network processes. It supports multiple protocols such as SSH, FTP, HTTPS, TELNET, IMAP, SIP, SMB, PostgreSQL, MS-SQL, MySQL, MongoDB, and many more.

Ophcrack tool:

Ophcrack is an opensource windows password cracking tool. It is based on rainbow tables and is very efficient. It has a graphical user interface as well as a command-line interface and supports multi-platforms. It has audit mode, brute force mode, debugging mode, loading hashes.

Wordlists utility:

The wordlists is a password attack tool that includes a wordlist and symlinks to several password files that are in the Kali Linux distro. The package is pre-installed in Kali Linux 2020.1, and it is an open-source tool so it can be downloaded.

Hydra tool:

This password attack tool is a centralized parallel login crack with several attack protocols. It is highly flexible, quick, reliable, and customizable for the addition of new modules. This tool can obtain unauthorized access remotely to a system, and that is very important for security professionals. It works with Cisco AAA, Cisco authorization, FTP, HTTPS GET/POST/PROXY, IMAP, MySQL, MSSQL, Oracle, PostgreSQL, SIP, POP3, SMTP, SSHkey, SSH and many more.

Mimikatz tool:

Mimikatz is a C language tool that works with windows security. It extracts passwords, PINs, Hash codes, and Kerberos tickets from host memory and saves it in a plain text file. It executes three services, i.e., pass the ticket, pass the hash, and built Golden tickets. This is an open-source tool and comes pre-installed in Kali Linux 2020.1 update.

Chntpw:

This tool helps to view information and change passwords in windows NT/2000 based DB files. This tool overwrites old passwords. It has a simple registry editor that can revoke or invoke registries in the windows database file. This tool can also be used as offline password recovery utility; just add this to custom image disk.

THC-pptp-bruter tool:

This brute forcer tool works against pptp VPN endpoints. It is a standalone package and uses TCP port 1723. It supports MSchapV2 authentication and is tested against enormous cisco gateways and windows files. This brute force tool tries 300 passwords in a second and exploits a vulnerability in Microsoft anti-brute-force operation.

Rsmangler tool:

This tool gets a wordlist and then do different operations on it just like John the Ripper tool. It takes an input of words and generates all of these transformations and the acronym of words, and then it is applied to other mangles.

Conclusion:

All of these password attack tools are open-source and can be downloaded from the Kali repository or GitHub Repository.