raikia / credninja Goto Github PK

Prevent user account lockouts by tracking to see if it was valid previously. If it was valid, don't warn on "invalid creds". if it never was successful, prompt to continue.

If you timestamp NTUSER.DAT inside the user folder, its a lot more accurate than just the home folder itself. However, it would require more than just 1 additional request per system

Using the C# assembly CredNinja, if you pass a password with a comma in it, the creds don't get parsed properly. Offending code.

Command:
CredNinja.exe --creds Domain\Username:Pass,word --hosts 127.0.0.1 --users --os

Output:
Host                Username                 Password            Result              Info

--------------------------------------------------------------------------------------------------------------------

ERROR: Credential "'" does not contain delimiter ":"

Hi, slight improvement, noticed CredNinja requires -a --accounts argument when using the --scan argument to scan for hosts with only SMB open.

./CredNinja.py -s 192.168.100.125 --scan
CredNinja.py: error: the following arguments are required: -a/--accounts

You don't need a set of credentials to scan for SMB on hosts.

Add password as Hash
Thx

Sometimes it's usefull to bruteforce different combinations of logins and hashes

Sometimes you want to limit the number of hosts to scan (random selection out of host file is fine).

title

All input files should allow commented out lines to ignore the line