John the Ripper

.htpasswd exposed, DES hash cracked

Directory brute-forcing a private bug bounty target turned up a world-readable .htpasswd whose descrypt hash, once cracked, opened four staging and development subdomains.