CredAttack — Credential Attacks Toolkit

⚠️ LEGAL NOTICE — Authorised security testing ONLY.
Using this tool against systems you do not own or have explicit written permission to test is illegal under the Computer Fraud and Abuse Act (US), Computer Misuse Act (UK), and equivalent laws worldwide. See SECURITY.md.

---

Table of Contents

• What is CredAttack?
• Attack Modes
• Supported Protocols
• Architecture
• Quick Start
• Installation
• CLI Reference
• Password Mutation Engine
• Default Credentials Database
• Proxy Rotation
• HTML Reports
• Configuration & Environment Variables
• Docker
• Testing
• Project Structure
• Contributing

---

What is CredAttack?

CredAttack is a modular, production-grade credential testing suite for authorised penetration testing engagements. It covers the full credential-attack lifecycle:

Phase	CredAttack Capability
Reconnaissance	Default creds DB (200+ pairs), smart username-derived pattern generation
Attack	17 protocol attackers, 6 attack modes, multi-target campaigns
Evasion	Lockout detection, configurable rate limiting, jitter, proxy rotation
Reporting	JSONL audit log, Jinja2 HTML report, found-creds banner + file dump

---

Attack Modes

Mode	Command	Description
Dictionary	ssh, ftp, smb, …	Wordlist against one user
Spray	spray	One password across a user list (lockout-safe)
Combo	combo	Every user × every password
Smart	smart	Username/company-derived pattern generation
Defaults	defaults	Try 200+ known service defaults
Multi-target	multi	Same attack across a list of hosts
Full pipeline	full	All protocols, one report

---

Supported Protocols

#	Protocol	Module	Default Port	Notes
1	SSH	ssh.py	22	paramiko, key/password auth
2	FTP	ftp.py	21	Active & passive mode
3	HTTP Form	http_form.py	80/443	Auto CSRF token detection
4	HTTP Basic	http_basic.py	80	RFC 7617
5	HTTP Digest	http_digest.py	80	RFC 7616
6	SMB	smb.py	445	impacket, NTLM
7	RDP	rdp.py	3389	impacket NLA
8	SMTP	smtp.py	587	STARTTLS
9	POP3	pop3.py	110	APOP support
10	IMAP	imap.py	143	STARTTLS
11	MySQL	mysql.py	3306	mysql-connector-python
12	MSSQL	mssql.py	1433	pymssql
13	Redis	redis_proto.py	6379	AUTH command
14	MongoDB	mongodb.py	27017	pymongo
15	WinRM	winrm.py	5985	NTLM, pywinrm
16	LDAP	ldap_proto.py	389	ldap3, rootDSE auto-detect
17	Telnet	telnet.py	23	raw TCP
18	VNC	vnc.py	5900	Raw DES challenge-response

---

Architecture

credattack.py          ← thin shim: `python credattack.py ...` from a checkout
│
├── credattack/cli.py   ← CLI (Typer) — 8 attack-mode subcommands; also the
│                          `credattack` console script when pip-installed
├── credattack/core/
│   ├── config.py      ← Pydantic v2 Settings, CREDATTACK_* env-var overrides
│   ├── engine.py      ← AttackEngine (ThreadPoolExecutor + Rich progress UI)
│   ├── lockout.py     ← LockoutDetector (sliding-window, thread-safe)
│   ├── proxy.py       ← ProxyRotator (round-robin, health-check, demotion)
│   ├── mutator.py     ← PasswordMutator (leet, seasonal, suffix, keyboard-walk…)
│   ├── result.py      ← AttemptResult + SessionReport dataclasses
│   ├── report.py      ← Jinja2 HTML report generator
│   └── logger.py      ← Rich logging + JSONL audit writer
│
├── credattack/protocols/
│   └── *.py           ← 18 ProtocolAttacker implementations
│
├── credattack/data/
│   ├── default_creds.json    ← 200+ real default credential pairs
│   ├── smart_patterns.json   ← 140+ enterprise password templates
│   └── wordlists/            ← Per-service default password lists
│
└── tests/             ← 50+ pytest tests (unit + protocol mocks)

---

Quick Start

# Clone and set up
git clone https://github.com/amibhai/credential-attacks-toolkit.git
cd credential-attacks-toolkit
python -m venv .venv && source .venv/bin/activate   # Windows: .venv\Scripts\activate
pip install -r requirements.txt

# Check version
python credattack.py --version

# Dry-run (no connections made — verify your word lists)
python credattack.py ssh -t 192.168.1.100 -u admin -P wordlists/common_passwords.txt --dry-run

# Real SSH dictionary attack
python credattack.py ssh -t 192.168.1.100 -u admin -P /path/to/rockyou.txt

# Password spray (rate-limited, lockout-safe)
python credattack.py spray -t 192.168.1.100 --protocol ssh -U users.txt -p "Summer2024!" --delay 30

# Smart mode — generate patterns from username + company
python credattack.py smart -t 192.168.1.100 --protocol ssh -u john.doe --company ACME

# Try service defaults
python credattack.py defaults -t 192.168.1.100 --protocol mysql

# Multi-target campaign
python credattack.py multi --targets hosts.txt --protocol ssh -U users.txt -P passes.txt

---

Installation

Option A — pip + virtualenv (recommended)

python -m venv .venv
source .venv/bin/activate        # Windows: .venv\Scripts\activate
pip install --upgrade pip
pip install -r requirements.txt

Option B — Makefile shortcuts

make install      # core deps
make install-dev  # + pytest-cov, ruff, mypy

Option C — pip install (editable or from a wheel)

pip install -e .          # core deps only
pip install -e .[full]    # + SMB/RDP/MySQL/MSSQL/Redis/MongoDB/WinRM/LDAP
pip install -e .[dev]     # + pytest/ruff/mypy

credattack --version      # console script, equivalent to `python credattack.py`

Option D — Docker

docker build -t credattack -f docker/Dockerfile .
docker run --rm credattack --help

# Mount your wordlists and collect output
docker run --rm \
  -v $(pwd)/wordlists:/app/wordlists:ro \
  -v $(pwd)/output:/app/output \
  credattack ssh -t 192.168.1.100 -u admin -P wordlists/common_passwords.txt

---

CLI Reference

Global options

python credattack.py [OPTIONS] COMMAND [ARGS]...

Options:
  -V, --version    Show version and exit.
  --help           Show help.

Common flags (available on all protocol commands)