During a penetration testing lab, I have obtained access to a .kdb file of a KeePass 1.25 (password management).

Therefore I tried to find a way to obtain the file key file or key and after researching the internet a while I have not found any exploit or vulnerability.

Due to the fact that it is a lab, after all, my question is:

Do I really have to brute force the key or there is a smart shortcut?

  • Have you tried brute forcing it? I know it's common for the passwords in pen testing labs to be in the rockyou password list. Commented Aug 8, 2018 at 17:30
  • 1
    @Mrdeep problem is I am doing a manual bruteforce for the moment as the keepass version is below version 2. But yes I getting password from rockyou Commented Aug 8, 2018 at 17:34
  • 1
    you should be able to use keepass2john to get the hash and something like hashcat to brute force. See here: rubydevices.com.au/blog/how-to-hack-keepass Commented Aug 8, 2018 at 18:16

2 Answers 2


There is no short cut. Brute forcing it is the way to go.


It's possible (but unlikely in real-world practice) that the database is protected only by a key file. KeePass v2 also allows a Windows account option. If this is the case, it would be trivial to break into the database just by finding the key file.

Luckily for you, KeePass itself remembers not only the last-used database, but also its file location, the file location of any key file, and whether or not a password was used to open it. For example, in KeePass2, you might see this in the user's config file:


I'm not sure exactly where or how KeePass v1 stores this information, but it should be similar. Check the file locations here: https://keepass.info/help/base/configuration.html

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .