{"id":5373,"date":"2022-01-05T17:55:56","date_gmt":"2022-01-05T09:55:56","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=5373"},"modified":"2022-01-05T17:56:20","modified_gmt":"2022-01-05T09:56:20","slug":"credninja-test-credential-validity-of-dumped-credentials-or-hashes","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2022\/01\/credninja-test-credential-validity-of-dumped-credentials-or-hashes\/","title":{"rendered":"CredNinja &#8211; Test Credential Validity of Dumped Credentials or Hashes"},"content":{"rendered":"<p>CredNinja is a tool to quickly test credential validity of dumped credentials (or hashes) across an entire network or domain very efficiently.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2022\/01\/CredNinja-Test-Credential-Validity-of-Dumped-Credentials-or-Hashes-640x359.png\" alt=\"CredNinja - Test Credential Validity of Dumped Credentials or Hashes\" width=\"640\" height=\"359\" class=\"alignnone size-medium wp-image-5585\" srcset=\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2022\/01\/CredNinja-Test-Credential-Validity-of-Dumped-Credentials-or-Hashes-640x359.png 640w, https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2022\/01\/CredNinja-Test-Credential-Validity-of-Dumped-Credentials-or-Hashes.png 1024w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/><\/p>\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-3033787195489589\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- Darknet Responsive Post Ad Links [previously link ad unit] -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-3033787195489589\"\r\n     data-ad-slot=\"5456620019\"\r\n     data-ad-format=\"auto\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<p>At the core of it, you provide it with a list of credentials you have dumped (or hashes, it can pass-the-hash) and a list of systems on the domain (the author suggests scanning for port 445 first, or you can use &#8220;&#8211;scan&#8221;). It will tell you if the credentials you dumped are valid on the domain, and if you have local administrator access to a host. <\/p>\n<h2>Usage of CredNinja to Test Credential Validity of Dumped Credentials or Hashes<\/h2>\n<pre>\r\n\r\n   .d8888b.                       888 888b    888 d8b           d8b          \r\n  d88P  Y88b                      888 8888b   888 Y8P           Y8P          \r\n  888    888                      888 88888b  888                            \r\n  888        888d888 .d88b.   .d88888 888Y88b 888 888 88888b.  8888  8888b.  \r\n  888        888P\"  d8P  Y8b d88\" 888 888 Y88b888 888 888 \"88b \"888     \"88b \r\n  888    888 888    88888888 888  888 888  Y88888 888 888  888  888 .d888888 \r\n  Y88b  d88P 888    Y8b.     Y88b 888 888   Y8888 888 888  888  888 888  888 \r\n   \"Y8888P\"  888     \"Y8888   \"Y88888 888    Y888 888 888  888  888 \"Y888888 \r\n                                                                888          \r\n                                                               d88P          \r\n                                                             888P\"           \r\n\r\n                    v2.3 (Built 1\/26\/2018) - Chris King (@raikiasec)\r\n\r\n                         For help: .\/CredNinja.py -h\r\n\r\nusage: CredNinja.py -a accounts_to_test.txt -s systems_to_test.txt\r\n                    [-t THREADS] [--ntlm] [--valid] [--invalid] [-o OUTPUT]\r\n                    [-p PASSDELIMITER] [--delay SECONDS %JITTER]\r\n                    [--timeout TIMEOUT] [--stripe] [--scan]\r\n                    [--scan-timeout SCAN_TIMEOUT] [-h] [--no-color] [--os]\r\n                    [--domain] [--users] [--users-time USERS_TIME]\r\n\r\nQuickly check the validity of multiple user credentials across multiple\r\nservers and be notified if that user has local administrator rights on each\r\nserver.\r\n\r\nRequired Arguments:\r\n  -a accounts_to_test.txt, --accounts accounts_to_test.txt\r\n                        A word or file of user credentials to test. Usernames\r\n                        are accepted in the form of \"DOMAIN\\USERNAME:PASSWORD\"\r\n  -s systems_to_test.txt, --servers systems_to_test.txt\r\n                        A word or file of servers to test against. This can\r\n\t\t\tbe a single system, a filename containing a list of\r\n\t\t\tsystems, a gnmap file, or IP addresses in cidr notation.\r\n\t\t\tEach credential will be tested against each of these\r\n                        servers by attempting to browse C$ via SMB\r\n\r\nOptional Arguments:\r\n  -t THREADS, --threads THREADS\r\n                        Number of threads to use. Defaults to 10\r\n  --ntlm                Treat the passwords as NTLM hashes and attempt to\r\n                        pass-the-hash!\r\n  --valid               Only print valid\/local admin credentials\r\n  --invalid             Only print invalid credentials\r\n  -o OUTPUT, --output OUTPUT\r\n                        Print results to a file\r\n  -p PASSDELIMITER, --passdelimiter PASSDELIMITER\r\n                        Change the delimiter between the account username and\r\n                        password. Defaults to \":\"\r\n  --delay SECONDS %JITTER\r\n                        Delay each request per thread by specified seconds\r\n                        with jitter (example: --delay 20 10, 20 second delay\r\n                        with 10% jitter)\r\n  --timeout TIMEOUT     Amount of seconds wait for data before timing out.\r\n                        Default is 15 seconds\r\n  --stripe              Only test one credential on one host to avoid spamming\r\n                        a single system with multiple login attempts (used to\r\n                        check validity of credentials). This will randomly\r\n                        select hosts from the provided host file.\r\n  --scan                Perform a quick check to see port 445 is available on\r\n                        the host before queueing it up to be processed\r\n  --scan-timeout SCAN_TIMEOUT\r\n                        Sets the timeout for the scan specified by --scan\r\n                        argument. Default of 2 seconds\r\n  -h, --help            Get help about this script's usage\r\n  --no-color            Turns off output color. Written file is always\r\n                        colorless\r\n\r\nAdditional Information Retrieval:\r\n  --os                  Display the OS of the system if available (no extra\r\n                        request is being sent)\r\n  --domain              Display the primary domain of the system if available\r\n                        (no extra request is being sent)\r\n  --users               List the users that have logged in to the system in\r\n                        the last 6 months (requires LOCAL ADMIN). Returns\r\n                        usernames with the number of days since their home\r\n                        directory was changed. This sends one extra request to\r\n                        each host\r\n  --users-time USERS_TIME\r\n                        Modifies --users to search for users that have logged\r\n                        in within the last supplied amount of days (default\r\n                        100 days)\r\n\r\n<\/pre>\n<p>The tool really shines on large networks where it can parse a large amount of hosts quite quickly.<\/p>\n<p>It is intended to be run on Kali Linux<\/p>\n<p>You can download CredNinja here:<\/p>\n<p><a href=\"https:\/\/github.com\/Raikia\/CredNinja\/archive\/refs\/heads\/master.zip\">CredNinja-master.zip<\/a><\/p>\n<p>Or read more <a href=\"https:\/\/github.com\/Raikia\/CredNinja\">here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>CredNinja is a tool to quickly test credential validity of dumped credentials (or hashes) across an entire network or domain very efficiently. At the core of it, you provide it with a list of credentials you have dumped (or hashes, it can pass-the-hash) and a list of systems on the domain (the author suggests scanning [&hellip;]<\/p>\n","protected":false},"author":25,"featured_media":5585,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"none","_seopress_titles_title":"CredNinja - Test Credential Validity of Dumped Credentials","_seopress_titles_desc":"CredNinja is a tool to quickly test credential validity of dumped credentials (or hashes) across an entire network or domain very efficiently.","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[9],"tags":[],"featured_image_src":"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2022\/01\/CredNinja-Test-Credential-Validity-of-Dumped-Credentials-or-Hashes.png","featured_image_src_square":"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2022\/01\/CredNinja-Test-Credential-Validity-of-Dumped-Credentials-or-Hashes.png","author_info":{"display_name":"Darknet","author_link":"https:\/\/www.darknet.org.uk\/author\/darknet\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/5373"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=5373"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/5373\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media\/5585"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=5373"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=5373"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=5373"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}