Wordlist mode

Single-crack mode

Incremental mode

External mode

bucket_finder.rb words --download

gsutil ls gs://findit

gcpbucketbrute.py -u -k names

basicblobfinder.py namelist

Files can be both enumerated and downloaded.

Files can only be downloaded.

Files can only be enumerated.

Files can be uploaded.

The script required to create the list of user accounts may be detected by EDR tools.

A high number of login attempts could trigger an account lockout.

Compared to other password-cracking methods, using wordlists takes the longest amount of time.

It is not a bad idea; looping through a list of passwords is more efficient than trying the same password on each user account.

Hydra

Aircrack-ng

Mimikatz

netsh

Password spraying

Password guessing

Hash table

Crypto smashing

https://s3.azure.com/BUCKETNAME

https:// CONTAINERNAME.blob.windows.com/

https://www.microsoft.com/storage/v1/b/BUCKETNAME

https://ACCOUNTNAME.blob.core.windows.net/CONTAINERNAME

Standard error

Standard input and output

Standard input

Standard output

Deploying Exploit Guard and virtualization isolation

Requiring NTLMv2 password hashes

Deploying multi-factor authentication

Requiring long passphrases rather than complex passwords

Blowfish

MD5

SHA-256

SHA-512