Hello everybody and welcome to this tutorial.
Today I am going to open up a chapter on brute forcing methods, I would say.
Here I will include how to crack hashes
how you can actually attack a website with brute force
How we can perform a brute force attack on a website
in order to try to guess the combination of usernames and passwords
but more importantly
you do need to know that there is a way to crack those hashes
and how you can crack them.
So basically I will go over a couple of tools
One of them will be findmyhash, which is online tool
Another one, which is extremely popular
it's called John the Ripper
and then we'll jump into hydra
which actually enables you to attempt multiple usernames and passwords
on a website
and in such a way brute force them.
If it manages to guess them, you will login.
Although it does require some rather painful parameters
so we'll see how that goes.
It can be a drag with parameters sometimes
because you need to figure them out
but usually everybody pretty much get the hang of it
they tried a couple of times and eventually it works out.
Fortunately for us, the very first tool that I'm going to try today is rather simple.
Plain text, plain tool, and it's called findmyhash
"findmyhash --help
You will see even the Help menu doesn't have that many options.
So these are examples
These valid options
Look at this --
So it only has three valid options.
It says "If your hash cannot be cracked
...search it in Google and show all the results"
"Note: This option ONLY works with -h ( one hash input) option"
F for files
You can have a file of hashes.
So there are a few things to take into consideration
when creating a file of different hashes.
So it says "one hash per line"
Nothing in between, so you type one hash and press ENTER
You copy/paste the next one and press ENTER
and so on and so forth
and all of them have to be of the same type.
Up above straight from the beginning
you have types of hashes which are supported.
So MD4, MD5, GOST, SHA512
and so on and so forth.
So these are the ones that are supported
Any other, I'm afraid it's not going to work with this program.
Here you have the general syntax
and the general syntax...
You can disregard this portion of the syntax.
You don't need to type this in.
You can just type in findmyhash
and then the rest.
Let's just go down
Excellent
Clear the screen
Also, another thing to take into consideration
that you have a lot of websites out there
which you can use to attempt to decrypt your stuff.
Here I'm using like MD5lab.com
and I have requested that it decrypts a certain hash.
The hash that I've actually asked it to decrypt is "hey223!!"
and this is it
Now it's highly unlikely that you will be able to decrypt this
on your local computer
primarily because it contains three sets of...
Rather you have letters, you have numbers
and then you have these signs as well, which is an exclamation mark.
If it was hey223, you'd probably break it
but with exclamation marks, it's gonna be a bit more difficult.
Anyway, I'm just gonna Control C this.
I want to save to see if it actually manages to finish later
so I can show you
because you should always remember that you have a lot of resources
out there on the net that you can utilize and those machines
and those machines are probably a lot faster than your local machines
as they are server machines
So if you can find something for free, great!
If you can't, oh well.
Anyway, let's go and type in "findmyhash"
and we're gonna say it's gonna be MD5, as this is a really common one.
I do believe that this is the one used in the database
that we've previously cracked.
So if you extract hashes, such as those from a database
you can crack them in this fashion
"-h" for hash, and then we need to go ahead and create a hash.
I don't know...What are we gonna type in here?
Let's use something simple to begin with
and then later we can use more complex things
but I want to primarily use something simple now
so that it finishes in some reasonable amount of time
as opposed to having to wait for an hour or something like that.
So let's just type on "hey" -- That's quite simple
and we'll try...
Let's just leave this one works out and then we can try another one.
This one should go relatively fast
and there we go.
It is analyzing it with different things.
Going straight through, you can see the sights here as well.
So it's going it's going it's going...and it's done
so the following hashes were cracked
This is so weird...Somebody didn't bother to put a statement somewhere
but oh well, the tool is free
so my credits to the authors of the tool
but a single statement could actually fix this.
If you have a single hash, it should be written "hash was cracked"
If you have multiple hashes, it can say "The following hashes were cracked"
Anyway, that's really doesn't matter.
It has no effect to the functioning of our tool
and you can see surely enough, there's a hash here
and you can see the word, that was hash as well
so no big deal there.
Let's try something a bit more complex.
Is this done? Uh, no
It's probably not gonna finish, but anyway, what the hell
I might as well try 123
Let's try hey123
So letters and numbers, and increased length as well
Paste, press ENTER
and it's going.
This might take a bit longer
However, I just wanna show you...
if it becomes too long before I actually finish what I have to say
if it continues after I've said what I wanted to say, I'm gonna stop it
but no
Apparently no
So a six character password including numbers and digits is cracked.
Let's just try one more for the fun of it.
So, hey123
I don't know, let's leave 123
Let's just increase this to hey in capital letters and let's add an exclamation mark.
I purely doubt that it is gonna be able to crack this.
Maybe because I used hey and 123
but let's see
If it does crack it, I'm going to be amazed
because just adding those those strange characters
that you generally don't see in passwords or usernames
like exclamation marks, asterisk signs, greater than, less than, etc.
You really make it a lot more difficult for any sort of brute forcing software
to actually crack it, primarily because...
Okay, so if you have letters and numbers
you have a fixed amount of characters.
It's a smaller number and if you use characters
oh man, that increases the amount of possible combinations exponentially
because, I don't know, you have like 10 possible numbers
and then you have the English alphabet
but if you have all these numbers and all these other signs
like quotation marks, single quotation marks, double quotation marks
parentheses, brackets, curly brackets, percentages and percent signs
slashes back, slashes pipes...
Yeah, the amount of combinations is staggering
and yeah. it's unlikely it will be cracked.
Just like with this one that we're doing now
we are unable to crack it.
Even though it's fairly simple
it just has an exclamation mark here
but people, as I've said
generally, in a significant amount of cases, definitely about 50%
do not use these sort of marcations in their passwords
primarily because it's hard to remember
and a lot of people don't tend to log in these days into anything.
They just stay logged in, or Firefox remembers their passwords
or Chrome or whatever
and they don't want such passwords.
I mean, this exclamation mark is not a general thing, trust me.
People generally don't put it hey123
and that's gonna cracked
but in any case, it looks like it won't actually manage to crack it.
If it does, I will let you guys know, but I purely doubt that it will.
I do believe that this is usually the last one that runs
but in any case, I want to bid you farewell
and in the next tutorial, we will actually use some other tools
I do believe it's gonna be John the Ripper.
Okay, so there we go
It wasn't actually cracked.
Yeah, it can't actually crack this one
but let's see if we can so some Google searching with it.
Let's see...How does the syntax for this one go?
"Google doesn't have any results. Sorry!"
So yeah, you're not going to be able to crack this hash
but what you can do is basically copy it.
There's one more thing that I've done here
but here's what you can do as well to duplicate the procedure .
Just copy it here
Let's see what Google has to say for real
There's MD5decoder.org
and that seems to be the only site with this particular hash
and this is in some foreign language
but it doesn't really matter.
Hashes are universal in all languages, apparently.
Nope, this is not where we need to be
but if you have a website like MD5lab.com
you can copy/paste it there.
I can't copy/paste it actually here now
because there's this cracking process underway
but if you are using this site for the first time
you're going to get a prompt here.
Just copy/paste the hash and click on decrypt
Maybe they will have more luck than you.
Anyway, in the follow-up tutorial
as I said, we'll try out some other tools and see how our luck serves us there.
Until then, I bid you farewell and I hope to see you there.