Tools

The classic WiFi security auditing suite — packet capture, deauthentication and injection, and WEP/WPA-PSK key cracking, in one tightly integrated toolset.

airmon-ng start wlan0\nairodump-ng wlan0mon\naircrack-ng -w rockyou.txt capture.cap

Interactive wordlist generator that builds candidate passwords from personal-info keywords plus configurable leet/case/special-character mutations, similar in spirit to CUPP with more mangling options.

bopscrk -w words.txt

When a UART header is identified but the baud rate is not, quickly cycle through the common rates and watch for readable boot text instead of guessing one at a time.

for baud in 9600 19200 38400 57600 115200; do
  echo "--- trying $baud ---"
  timeout 3 picocom -b $baud -q /dev/ttyUSB0
done

Takes an Nmap/Masscan GNMAP/XML output and automatically brute-forces every service it recognises using Medusa under the hood — no manual target/service mapping needed.

brutespray --file scan.gnmap -u users.txt -p rockyou.txt

One of the original S3-bucket-name brute-forcing tools — checks a wordlist of candidate names for existence and public read access.

ruby bucket_finder.rb wordlist.txt

Resolves a large subdomain candidate list against a set of trusted public resolvers far faster than looping dig/host over each name.

massdns -r resolvers.txt -t A -o S -w results.txt subdomains.txt

C reimplementation of the WPS brute-force PIN attack (an alternative to Reaver with different timing/retry behaviour against flaky APs).

bully -b AA:BB:CC:DD:EE:FF wlan0mon

Scans a network for services still running their vendor-default credentials, using a large built-in database of default logins across routers, cameras, admin panels and more.

changeme 10.10.10.0/24

Rotates password-spray traffic through cloud provider IPs (via FireProx-style API Gateway proxying) so login attempts against Okta/O365/OWA are not all seen from one source IP.

python3 credmaster.py -m O365 -u users.txt -p Summer2026! -s okta

Common User Passwords Profiler — interviews you about a target's personal details (name, pet, birthdate) and generates a targeted candidate password list from the answers.

cupp -i

A maintained, searchable reference of default usernames/passwords for hundreds of network appliances, admin panels and IoT devices, saving a wiki-diving detour mid-engagement.

A web content scanner that looks for existing (and hidden) objects by bruteforcing a wordlist against a target — one of the original tools in this space, still bundled in Kali.

dirb http://target/ /usr/share/wordlists/dirb/common.txt

Pulls the live user list and password policy straight from Active Directory before spraying, so lockout thresholds are respected automatically.

Invoke-DomainPasswordSpray -Password Summer2026! -OutFile sprayed.txt

Brute-force and dictionary password cracker for ZipCrypto-protected archives — the go-to before reaching for bkcrack's known-plaintext approach.

fcrackzip -u -D -p rockyou.txt secret.zip

Enumerates Google Cloud Storage bucket names for a target and checks the current (or anonymous) credentials for read/write/delete access on anything found.

python3 gcpbucketbrute.py -k target

A fast Go-based bruteforcer for directories/files, DNS subdomains, virtual hosts and S3 buckets — the everyday content-discovery default for a lot of testers.

gobuster dir -u http://target -w wordlist.txt -x php,txt,bak

The world's fastest password-recovery tool — GPU-accelerated cracking across hundreds of hash modes, from a straight dictionary attack to rule-based and mask attacks.

hashcat -m 1000 -a 0 hashes.txt rockyou.txt

Captures WPA/WPA2 handshakes and PMKIDs straight off the air (including from clientless APs) without needing a connected station to deauth.

sudo hcxdumptool -i wlan0mon -o capture.pcapng --enable_status=1

Converts hcxdumptool/airodump-ng captures into hashcat/John-crackable formats (22000, PMKID) — the modern replacement for the old cap2hccapx pipeline.

hcxpcapngtool -o hashes.22000 capture.pcapng

A parallelised network login cracker supporting dozens of protocols (SSH, FTP, HTTP forms, RDP, SMB…) — the go-to tool the moment you have a login form and a wordlist.

hydra -l admin -P passwords.txt ssh://10.10.10.10

A long-standing password cracker supporting hundreds of hash and cipher types, with the community "jumbo" fork adding formats and features far beyond the base distribution.

john --wordlist=rockyou.txt hashes.txt

Hardware tool that brute-forces which pins on an unlabelled header are JTAG or UART, and at what configuration, before any actual debugging can start.

picocom /dev/ttyUSB0 -b 115200

Brute-forces the HMAC secret used to sign a JWT (HS256/HS384/HS512), turning a weak signing key into a fully forgeable token.

jwt-cracker eyJhbGciOi... abcdefghijklmnopqrstuvwxyz 6

Quickly bruteforces and enumerates valid Active Directory usernames via Kerberos pre-authentication — much quieter than an LDAP bind sweep since failed guesses barely touch the event log.

kerbrute userenum -d domain.local --dc 10.10.10.10 users.txt

Searches Exchange/Office 365 mailboxes for sensitive strings (passwords, "VPN", etc) and can password-spray OWA/EWS — post-compromise mailbox pillaging in one PowerShell module.

Invoke-SelfSearch -Mailbox [email protected] -Terms "password"

Fast, modular, parallel network login brute-forcer supporting a wide range of services (SSH, FTP, SMB, MySQL, RDP, VNC, etc), the classic alternative to Hydra.

medusa -h 10.10.10.5 -u admin -P rockyou.txt -M ssh

GUI wordlist generator that lets you build mangling rule chains (leetspeak, appended years, case toggling) visually and export them for Hashcat/John.

Password sprays Microsoft Online (Azure AD/O365) accounts and, from the login response, distinguishes valid credentials from lockouts, MFA prompts and disabled accounts.

python3 msolspray.py --userlist users.txt --password Summer2026!

High-speed network authentication cracker from the Nmap project, built for large-scale login testing (RDP, SSH, VNC, WinRM, etc) with timing profiles similar to Nmap's.

ncrack -p rdp --user admin -P rockyou.txt 10.10.10.5

Actively-maintained fork/successor of CrackMapExec — swiss-army-knife for AD network protocols: authentication spraying, command execution, hash dumping and share enumeration over SMB/WinRM/LDAP/MSSQL/RDP/SSH.

nxc smb 10.10.10.0/24 -u users.txt -p pass --shares

Username enumeration and password spraying against Office 365/Azure AD, supporting several login endpoints so it keeps working when Microsoft tweaks one response format.

python3 o365spray.py --validate -d corp.com

Generic, module-based brute-forcer (dozens of modules — SSH, SMTP, HTTP forms, ZIP passwords, DNS, etc) written to avoid the false-positive/false-negative quirks of other bruteforcers.

patator ssh_login host=10.10.10.5 user=admin password=FILE0 0=rockyou.txt

Analyses a leaked or cracked password list and reports the most common base words, lengths and patterns — used to tune a follow-up wordlist or mangling rules against the same target.

ruby pipal.rb cracked.txt

Offline WPS PIN recovery from a single handshake exchange (the "pixie dust" attack) against APs with weak random-number generation, instead of an online brute force.

pixiewps -e <PKE> -r <PKR> -s <E-Hash1> -z <E-Hash2> -a <Authkey> -n <E-Nonce>

Password lists sorted by real-world frequency (most-likely-first) rather than alphabetically, so a time-boxed cracking run tries the probable candidates before the unlikely ones.

Wraps massdns for reliable bulk DNS resolving and subdomain brute-forcing, with automatic wildcard detection so a wildcard DNS record does not flood results with false positives.

puredns bruteforce wordlist.txt example.com -r resolvers.txt

The original online WPS PIN brute-forcer, kept alive as a community fork after the upstream project went unmaintained; still the reference implementation the WPS attack is named after.

reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv

The most famous password wordlist in the field — 14 million real passwords leaked from the 2009 RockYou breach, still the default dictionary for a first hashcat/John pass.

Word-mangling tool (leetspeak substitutions, case flips, appended years/symbols) that expands a small seed wordlist into a much larger set of realistic password variants.

rsmangler --file words.txt > mangled.txt

Abuses Exchange client access protocols (MAPI/HTTP, Autodiscover) for brute-forcing and, historically, for gaining remote code execution via malicious Outlook rules/forms.

ruler --domain corp.com brute --users users.txt --passwords pass.txt

The single most-used wordlist collection in the field — usernames, passwords, URLs, fuzzing payloads and more, curated and maintained, and bundled by default in Kali.

ProjectDiscovery wrapper around massdns for subdomain brute-forcing and resolution, built to plug into the rest of their recon toolchain.

shuffledns -d example.com -w wordlist.txt -r resolvers.txt

Password-spraying tool targeting Microsoft 365 across multiple undocumented authentication endpoints, built to keep working as Microsoft changes its login flow.

spray365 spray --credential-list creds.txt

Wraps password spraying against Lync/Skype for Business and OWA with sane delays and lockout-avoidance logic baked in.

./atomizer.py owa 10.10.10.5 users.txt Summer2026!

Dictionary brute-forcer for steghide-protected files, wrapping steghide itself in a loop over a wordlist — Stegseek is the faster modern replacement for the same job.

stegcracker image.jpg rockyou.txt

Extremely fast steghide passphrase cracker (thousands of times faster than brute-forcing steghide itself) that tries an entire wordlist against a JPEG/BMP/WAV/AU carrier.

stegseek carrier.jpg rockyou.txt

Modular password-spraying tool with built-in modules for O365, Okta, OWA and more, plus optional proxying and Slack notifications for long-running sprays.

trevorspray -U users.txt -p Summer2026! --module o365enum

High-throughput HTTP request engine (Python-scripted) built for large brute-force jobs and race-condition testing that would be too slow through a regular intercepting proxy.

Site hosting large curated password wordlists (compiled from breaches and generated sets) plus a hash-lookup search, aimed squarely at cracking rather than fuzzing.

Python rewrite of the "point it at every visible network" Wi-Fi auditing wrapper — automates monitor mode, handshake/PMKID capture and WPS attacks via aircrack-ng/hcxtools/reaver/bully.

sudo wifite --dict /path/to/wordlist.txt
# target one BSSID only:
sudo wifite -e "Target-SSID" --dict wordlist.txt