Hello and welcome back to this tutorial.
Now this thing has finished.
As you can see, it says "no column(s) found"
This can happen. Perfectly legit thing to happen.
Let's try something else.
You see there is a table user, but there are no columns in it
so nothing has been placed within it
and that can be a pain, but oh well.
It does happen from time to time.
I deliberately left it here just so I can show it to you.
Let's try a different one.
Let's try the one that I know that there's useful stuff in.
So "dvwa --tables"
Excellent
It immediately fetches it.
Now keep in mind that I am doing this locally.
So the web server is on the same machine from which the attack is being generated
and that gives me a speed advantage.
That gives me a tremendous speed advantage
that enables me to do something really fast.
However if you are out there on the net and if you have a slow connection
if the database is far away
and even worse, if the connection is bad on the other end
this can take a while.
So these things tend to take good amount of time
and don't be surprised if it runs for a while
because that's just the reality that we have to accept and live with.
Anyway, we got users, we got guestbook
so let's have a look at users
because I noted there was something useful there
but you won't know
so go through all of them.
If you're doing a genuine pen test, go through everything that you can get.
Go through every single day table, go through every single column
go through every single database
and see what is in there.
I cannot emphasize this enough how many times that people suffer needlessly
primarily because they were just too lazy to go through the stuff that they already had.
So let's just go ahead and type in "-T users"
and you cannot tabify anything here.
You gotta type in everything pretty much manually
which is a drag, but that's the way it is.
Press ENTER
Excellent! So there we go.
This finished really fast.
As I said, this is not going to be the case in the real world
or maybe it will, but it is very unlikely
primarily because of the speed limitations.
Anyway, we got a column here.
We have a type
Type tells us what sort of information is stored within this column.
For example, "int" is number.
So, an integer
That's the English word for it.
Integer is a whole number
So 123456, or 0
If by any chance it says "unsigned int", then it doesn't have any negative numbers
but if it just "int"
It can be, I don't know, minus 12345
Whatever
Now 1.26 is not an integer.
It is a floating point number.
So if you have "int", basically just means numbers.
That's it
"varchar" I'm pretty sure that's just characters, strings.
Some sort of strings placed in there
It could be like complex strings, where you...
Sorry, not complex strings
just regular strings, where you can have spaces.
It could be these strings
where you have like every individual characters or something like that.
I'm not exactly sure how that works.
I would have to revise some of my programs because I'm not really good with theory
but I can make it work in practice.
Anyway, soon enough you will see what is contained within those columns
and then you'll be able to judge for yourselves.
If I've made some mistakes here, please forgive me.
So just go ahead and delete this
and type in "-C user"
and this is basically column
So C for column, T for table, D for database
Really simple
Plain English language
There aren't any complicated sets of commands that you need to type in here.
For example, here the only thing that you need to pay attention at
is the limiter for cookies.
So, semicolon basically takes apart two types of cookies
and you it specify here.
The cookie, and you specify it here
and just say equals, equals, and this.
So no big deal there.
Mainly just equal signs, slashes, colons, semicolons, etc.
dashes, but when you're passing arguments to a program
usually those arguments will reflect their purpose.
For example, you want to list columns
What are you gonna do? Type -C for colons.
You want tables? -T for tables
Databases? -D for databases
Very simple
You don't teach through invest much thought into it.
It's plain and simple English language
and if I want more than one column
I can just type in comma and specify another one.
It's pretty easy
so no big deal there.
I can say "password", and I'm gonna go ahead...
Sure, let's take the first name and last name as well.
"first_name, last_name"
Excellent
These things can be pretty long and you don't want to type all of them
So, why not? Well you don't have the screen for it basically.
If you have too many of these things, they will crowd your screen
and you won't be able to see anything.
You won't be able to make heads or tails out of it.
So just take a smaller amount of columns at a time
like take two or three, maybe four.
I have pretty big screen here -- Let's see if it's going to fit or not.
Okay, so shutting down.
What happened here?
Okay, I probably misspelled something.
Okay, let's just take user and password
and then take first name and last name separately.
Ugh, come on, what are you doing to me?
Let's check the command out once more
Ugh, of course. I've been taking it all but I didn't dump it anywhere
I'm a brilliant person
"do you want to store hashes to a temporary fie for eventual further processing with other tools"
Now, what just happened to me...
These things tend to happen to anyone, no matter at what level
so don't worry about it.
Just don't lose your nerves over it.
I cannot emphasize enough how important it is to stay calm.
If you can stay calm
leave the machine as it is, lock it
go have a walk or something or take a glass of water
or tea, whatever
Come back after 15 minutes and continue working.
Believe me, you will figure out a solution far faster than just smashing against your keyboard
or something of a kind.
Anyway, it says "1337", "Hack", "Me", and then we have some sort of hash here.
That's probably a password
depending on how we actually use this.
So it says "fetching columns 'user, first_name, last_name, password"
What do we got here?
Ah, there we go
So apparently these are "admin", "admin", "admin"
"gordonb"
So this is the first name, this is the last name
and what on earth have I requested here?
Let's just have a look.
Apparently this is the user.
So that would be the username, I'm guessing
but we will see this very shortly
but just by looking at this, you can conclude a lot.
So I'm guessing this is the first name, this is the last name
this is the password, and this is what you type in as a user.
Yup, gordonb
and it says "Gordon", and then "Brown", and then a hash.
Yup, I do believe that I am correct
Next up, as I said, there's this question it's asking you.
So you can store these hashes, and then individually crack them
because you cannot use them as they are.
You need to actually figure out a password from this.
If the password is shorter
if it's some sort of a word from an English dictionary or something like that
combined with some numbers or something of a kind
yes sure, it can be cracked within a reasonable amount of time.
If you have some sort of a password like me on my main machine...
No, you're just not gonna be able to crack it.
Even if you were able to crack eight million pass attempts per second
attempt to crack it eight million times per second
it would take you more than a decade
Far more than a decade
I can't calculate that
but usually that means that the password is longer than, I don't know, eight characters
and that it has all sorts of things it it
I don't know, like numbers, signs, capital letters, lower case letters, etc
This can be problematic, especially in the realm of 12 or 13
then goodbye.
You're not going to be able to crack this hash.
You're better off at attempting to do something else
but anyway, for this for this tutorial
we're going to try to crack it with a default dictionary that is here
but you could also at implement other dictionaries and you can use other tools as well
to crack these hashes.
You can implement customized dictionaries, you can implement custom ranges
and then generate passwords from those ranges to attempt to crack this
and stuff of a kind.
There are a good amount of options out there for you but
but just a reminder
You would not believe, I mean you literally would not believe the sort of passwords people use
on their main servers, on their gateway routers
which are the entry points to their networks and the building or something like that.
I don't know, I have seen passwords literally on a router
which is used to exit onto the internet for a company
Username "admin", password "admin"
How fascinating can that be?
I don't know, people actually sometimes don't pay attention to these things
but there are a large amount of passwords out there
which simply are not of any use.
If you can get the hash, you will crack it for sure
So be optimistic as far as that part is concerned
but from time to time, you will encounter somebody that actually uses proper passwords
and you simply won't be able to do anything but the hash there
but there are always other methods, as I said
Anyway, you can store them, but I don't want store them.
Let's give SQL map to actually crack them with a default dictionary.
There is a dictionary based attack, so you can type in yes
"default dictionary file"
Okay, so you can use as default and you can specify a custom file.
Custom dictionary file you can download from the net.
Just type in dictionary files for password brute force or something like that.
You can get them pretty much on a lot of places on the net.
Try to find the ones that is most suited to your purpose.
In your search queries on the net, type in what sort of a password are you trying to crack.
Perhaps what type of site is it or something of a kind.
You can also have "file with a list of the directory files", which is very interesting as well.
So you can have a list of the directory files within a file
and you can try multiple dictionaries from websites.
The good thing with this is that you don't need necessarily store all the dictionaries on your computer
because they can be pretty large.
You can store a couple, try them out, delete them, download a couple of others
try them out and so on and so forth.
Anyway, I'm just gonna use the default one, which is press ENTER
"do you want to use common password suffixes?"
No, I don't want them.
Let's see what you're gonna do, how you're gonna crack it.
It says "multiprocessing hash cracking is currently not supported on this platform"
I am on a virtual machine, so give me give me a break here.
This is working as fast as it possibly can.
It only has one processor core assigned to it if I didn't actually do anything
So you see there is stuff happening here
It's doing some of the things
"do you want to crack them via a dictionary-based attack?"
Okay, I think this is asking me for my current username and password that I am using.
Sure, why not?
You see it says admin admin admin
That's what I've been using.
It says "password"
and there is the hash for a password and then there is the actual password
last_name, first_name, user
If we go back up, you can see that we have actually retrieved pretty much everything
for other users on the site.
So we've cracked this one, we've cracked this, cracked this one, this one as well
and okay, I do admit this is generally not the type of a password people will use
but they will probably use something relatively similar.
Maybe they'll be a couple of numbers or something like that
which is nothing too difficult to crack, especially if it's a dictionary word or an English name.
That's gonna fly for sure
Anyway, you can use these credentials to log into a website and basically obtain access
especially if you can log in as admin.
That's kind of ridiculous, but yeah
Anyway, what I want to say here is...
I don't know, sometimes people have asked me
"Well, you have the hash. Like why can't you do that?"
"Why can't you pass it as a password? Isn't that the same thing?"
No, not really because the website on the other end
it takes this word as a password
it runs it through some sort of mathematical algorithm
which converts it into this.
It encrypts it in essence, and then it compares what has encrypted here
and compares the encrypted form of this.
So it compares the encrypted form of "Charley" to the encryption
which is stored within its own tables somewhere on the server disks
If you were to pass this in, this would get encrypted
and it wouldn't be the same as the encrypted version of Charley.
So you can't actually pass this.
There is a method called "Pass the hash" for Windows password cracking
but that is a subject for another time.
If you wish, feel free to take a look at it on the net.
Anyway, I bid you farewell and I hope to continue this in the follow-up tutorial.
We'll see what we will do there.
Until then, I bid you farewell.