Credential Discovery with HackFast CredCruncher: Complete DeHashed Integration Guide

The Power of Credential Discovery in Penetration Testing

Credential discovery is often the difference between a failed penetration test and a successful compromise. Breach databases contain billions of leaked credentials that attackers use daily, but most penetration testers struggle to efficiently search, analyze, and leverage this data during assessments.

HackFast CredCruncher revolutionizes credential discovery by integrating directly with DeHashed—one of the largest breach databases—and providing intelligent analysis tools that help you identify password patterns, crack hashes, and discover credential reuse across your target environment.

Understanding HackFast CredCruncher

CredCruncher is HackFast's comprehensive credential discovery and analysis tool, available exclusively to HackFast+ subscribers. It combines powerful breach database searching with intelligent analysis capabilities:

• DeHashed Integration: Direct access to billions of leaked credentials
• Multi-Vector Search: Search by email, username, domain, IP address, or password hash
• Auto Crunch Mode: Automatically discover credentials for all domains in your project
• Pattern Analysis: Identify password patterns and policies
• Hash Cracking: Integrated hash analysis and cracking recommendations
• AI-Powered Insights: Get intelligent recommendations based on discovered credentials

Getting Started: Basic Credential Search

CredCruncher supports multiple search types, each optimized for different reconnaissance scenarios:

Email Search

Search for credentials associated with specific email addresses. This is perfect when you've discovered employee emails during OSINT reconnaissance:

# In HackFast CredCruncher:
Search Type: Email
Query: john.doe@targetcompany.com

# Results show:
- Password (if plaintext available)
- Hashed passwords (MD5, SHA1, SHA256)
- Source breach database
- Breach date
- Additional metadata

Domain Search

Discover all leaked credentials for a target domain. This is incredibly powerful for identifying password patterns and common credentials used across the organization:

# Search all credentials for a domain
Search Type: Domain
Query: targetcompany.com

# Results include:
- All email addresses from the domain
- Password patterns
- Common passwords used
- Breach sources and dates

Username Search

Find credentials by username when email addresses aren't available. Useful for social media reconnaissance:

# Search by username
Search Type: Username
Query: johndoe

# May reveal:
- Associated email addresses
- Password reuse across platforms
- Breach history

IP Address Search

Discover credentials associated with specific IP addresses. Useful when investigating compromised systems:

# Search by IP
Search Type: IP Address
Query: 192.168.1.100

# Can reveal:
- Historical credential usage
- Associated accounts
- Breach context

Auto Crunch: Automated Domain Credential Discovery

HackFast+ Premium Feature: Auto Crunch mode automatically discovers credentials for all domains associated with your project. This powerful feature:

1. Extracts all domains from your project's IP addresses and hostnames
2. Searches DeHashed for each domain systematically
3. Organizes results by domain and breach source
4. Provides summary statistics and pattern analysis

This automation saves hours of manual searching and ensures you don't miss any credential opportunities during your assessment.

Advanced Analysis: Pattern Recognition and Hash Cracking

CredCruncher goes beyond simple credential retrieval—it helps you analyze and leverage discovered data:

Password Pattern Analysis

When multiple credentials are discovered, CredCruncher identifies patterns:

• Common password structures (e.g., "CompanyName2024!")
• Password policy compliance
• Seasonal patterns (passwords with years, months)
• Reused passwords across accounts

Hash Analysis and Cracking

When credentials are stored as hashes, CredCruncher helps you:

• Identify hash types (MD5, SHA1, SHA256, bcrypt, etc.)
• Generate cracking commands with appropriate tools
• Suggest wordlists based on discovered patterns
• Track cracking progress and results

# CredCruncher generates optimized cracking commands:
hashcat -m 0 -a 0 hash.txt /usr/share/wordlists/rockyou.txt
john --format=Raw-MD5 hash.txt --wordlist=rockyou.txt

# For discovered patterns, suggests custom wordlists:
hashcat -m 0 -a 3 hash.txt ?a?a?a?a?a?a?a?a --increment

Vector Analysis: Intelligent Credential Testing

HackFast+ Exclusive: Vector Analysis mode helps you systematically test discovered credentials:

1. Target Selection

Select IP addresses from your project to test credentials against. CredCruncher integrates with Shodan to gather service information automatically.

2. Service Identification

For each target, CredCruncher identifies services that accept credentials:

• SSH (port 22)
• FTP (port 21)
• RDP (port 3389)
• Web login portals
• Database services (MySQL, PostgreSQL, etc.)
• Email services (SMTP, IMAP, POP3)

3. Credential Testing

CredCruncher generates testing commands for each service:

# SSH testing
hydra -l username -P passwords.txt ssh://target.com

# FTP testing
hydra -l username -P passwords.txt ftp://target.com

# Web form testing
hydra -l username -P passwords.txt target.com http-post-form \
  "/login:username=^USER^&password=^PASS^:Invalid"

4. AI-Powered Insights

After analysis, CredCruncher's AI provides intelligent recommendations:

• Most promising credential combinations
• Service-specific attack strategies
• Brute force optimization suggestions
• Alternative attack vectors if credentials fail

Integration with OSINT Map

CredCruncher seamlessly integrates with HackFast's OSINT Map feature. When you discover credentials for people in your OSINT mapping, you can:

• Automatically link credentials to people profiles
• Track which credentials work on which systems
• Map credential reuse across the organization
• Build comprehensive attack chains using credential data

Real-World Penetration Testing Workflow

Here's how professional pentesters use CredCruncher:

Phase 1: Initial Reconnaissance

1. Use OSINT Map to discover employee emails and usernames
2. Extract target domains from your project
3. Run Auto Crunch to discover all domain credentials

Phase 2: Credential Analysis

1. Review discovered credentials and identify patterns
2. Prioritize credentials based on target roles and access levels
3. Analyze hashes and generate cracking commands

Phase 3: Credential Testing

1. Use Vector Analysis to identify target services
2. Test credentials systematically across services
3. Document successful authentications

Phase 4: Attack Chain Integration

1. Add successful credentials to your Attack Chain
2. Use credentials for privilege escalation
3. Document credential reuse in your report

Best Practices for Credential Discovery

• Always start with domain-wide searches to understand password patterns
• Use Auto Crunch early in your assessment to maximize discovery time
• Prioritize credentials based on target roles and access levels
• Test credentials systematically—don't skip services
• Document all credential testing attempts for your report
• Use pattern analysis to inform password policy recommendations
• Integrate credential findings with other HackFast tools for comprehensive attacks

Ethical Considerations and Legal Compliance

When using CredCruncher, remember:

• Only test credentials on systems you're authorized to test
• Respect rate limits and don't abuse DeHashed API access
• Document credential discovery methodology in your report
• Provide recommendations for improving password policies
• Help clients understand the risk of credential reuse

Conclusion: Master Credential Discovery

Credential discovery is a critical component of modern penetration testing. HackFast CredCruncher eliminates the manual effort of searching breach databases, analyzing patterns, and testing credentials. With DeHashed integration, intelligent analysis, and seamless workflow integration, you can discover and leverage credentials more efficiently than ever.

Ready to transform your credential discovery workflow? CredCruncher is available exclusively toHackFast+ subscribers. Upgrade today to unlock automated credential discovery, pattern analysis, vector testing, and AI-powered insights that professional penetration testers rely on.