Kali Linux

Kraken : A Multi-Platform Distributed Brute-Force Password Cracking System

Kraken is an online distributed brute force password cracking tool. It allows you to parallelize dictionaries and crunch word generator based cracking across multiple machines both as a web app in a web browser and as a standalone electron based client. Kraken aims to be easy to use, fault tolerant and scalable.

I wrote Kraken because I wanted to learn more about offensive security and to write an easy solution to overcome the limitation of using a single device when attempting distribute brute force workloads.

Installation

Server and Browser Client

Kraken is a dockerized application using docker-compose which will launch the db (Postgres), s3 compliant file storage (Minio), the server and the browser client. You can find the docker-compose file at the root directory of the repository. You can deploy it using the following command:

docker-compose up

Kraken’s Browser Client should be accessible at:

  • HTTP : localhost:8080 (use server url http://localhost:5000/api [default])
  • HTTPS : https://localhost:8443 (use server url https://localhost:8443/api)

Note: To run the Browser Client from a remote machine, you MUST use HTTPS for both server url and browser url. Eg. If you are hosting the server on 192.168.1.2, then browser client will be available at https://192.168.1.2:8443 and the server url should be https://192.168.1.2:8443/api

To upload password lists or dictionaries, upload them to Minio Console at localhost:9001. View steps below for a detailed guide Otherwise, you can generate word lists dynamically using crunch. See crunch options and how to use them here: crunch man page

Kraken’s server runs on localhost:5000 and also hosts swagger documentation at localhost:5000/swagger.

Portable Desktop Client

The desktop client is an electron based portable application and can be run on Mac, Windows and Linux. Due to sensitive permissions required to function, it is highly recommended that you compile and it yourself by cloning the repo and using :

cd kraken-client
npm install
npm run electron-start

Windows

Note: Window EXE portable client needs to run in the folder with its hashcat dependencies. Hashcat files can be dowloaded from their home page or here. Ive included a compressed zip file with the portable executable and required hashcat files. They can be downloaded:

  • Portable Exe
  • Compressed Zip
Linux

Releases include a Linux AppImage which only requires hashcat to be installed.

  • AppImage

Install hashcat:

sudo apt-get install hashcat

You will have to give AppImage permission via properties to execute.

R K

Recent Posts

ROADTools: The Modern Azure AD Exploration Framework

ROADTools is a powerful framework designed for exploring and interacting with Microsoft Azure Active Directory…

3 hours ago

How to Enumerate Microsoft 365 Groups Using PowerShell and Python

Microsoft 365 Groups (also known as M365 Groups or Unified Groups) are at the heart…

3 hours ago

SeamlessPass: Using Kerberos Tickets to Access Microsoft 365

SeamlessPass is a specialized tool designed to leverage on-premises Active Directory Kerberos tickets to obtain…

1 day ago

PPLBlade: Advanced Memory Dumping and Obfuscation Tool

PPLBlade is a powerful Protected Process Dumper designed to capture memory from target processes, hide…

1 day ago

HikPwn : Simple Scanner For Hikvision Devices With Basic Vulnerability Scanning

HikPwn: Comprehensive Guide to Scanning Hikvision Devices for Vulnerabilities If you’re searching for an efficient…

2 days ago

Comments in Bash Scripts

What Are Bash Comments? Comments in Bash scripts, are notes in your code that the…

1 week ago