keepass2john
Extracts the master-password hash from a .kdbx for cracking.
It turns a KeePass database (`.kdbx`) into a hash john or hashcat can attack offline. Finding a `.kdbx` on a share or in a user's profile is a major hit: inside are all their passwords, protected by a single master key. keepass2john extracts that key's material, and if the master is weak, a while of cracking opens the whole keyring. It is one of the most profitable harvests in corporate post-exploitation.
Family Cracking & wordlists
Flags <file.kdbx>
Concepts KeePass Cracking, Hash Cracking, Credential Hunting
Cheatsheet Encrypted containers & files
Installation
# ships with John the RipperUseful commands
Reference tool: it does not yet appear in a published machine on the blog, but it is part of the arsenal for its everyday use.