Hello everybody and welcome to this tutorial.
Today I'm gonna go over a tool called hydra.
It will enable you to actually attack websites about login form
which actually have login forms.
Most of them do have login forms.
It's pretty much on all the websites today.
You can log in somewhere on some portion of the site, or something of a kind.
Anyway, it is important to mention that this attack functions
regardless whether the protocol is HTTPS or HTTP
because I'm going to be using the vulnerable app
I'm going to be using HTTP
but it's going to work just fine on HTTPS, no problems.
So regardless of the encryption, it's gonna work.
Don't worry about it.
Anyway, what does Hydra do for us? How does it help us?
Well, it simply enables us to try multiple login credentials over a period of time.
So you can try out, I don't know
20,000 user names with 20,000 passwords, and so on and so forth.
You get the general idea of this.
Anyway, let me just go ahead and minimize this.
Type in "hydra"
and I'm gonna get a menu here for Hydra.
Not a lot of things here
It might seem like a lot, but believe me, it is not.
So you have the note from the author of Hydra.
This is a bit of an interesting segment here this.
It says "Please do not use in military or secret service organizations, or for illegal purposes"
and down below, you have the syntax
and I know that the syntax, when you look at it like this
it seems somewhat strange or difficult to comprehend
but believe me, it is not.
It is rather simple. Of that, you can rest assured.
All of these brackets and stuff like that can seem a bit complex, but we're gonna go over those things
and by the end of this tutorial, you will figure out most of these things.
They're not complicated as they might seem in the syntax part.
Down below, you immediately see the amount of options that Hydra has are not substantial.
I mean, there's just a few of them here.
There's not that many, so it's not that difficult.
You have basically the ability to pass in with a lowercase L
To pass in a single login username
or with a capital L to pass a file leading to a dictionary of user names.
You might wonder how to create these word lists
but you can find some of them on the net.
However, in a lot of cases, it is a lot better to actually create them yourselves
depending on the site that you are attacking.
You want to be able to customize them.
You want to adapt them to your own needs.
For example, let's say that there is a company somewhere
and that company has a profile on LinkedIn or something like that
and it has a list of its employees there
or you can at least find some of the employees that work for the company on LinkedIn there.
So they would probably have something like standardized user names for employee accounts.
Basically what that means is that you either have first name dot last name
or first name space last name
or just last name, nothing in between
or something of a kind.
So you can get those first names and last names
and you can generate a dictionary from there into a file.
To generate a dictionary basically means just put the things that you want to try out into a file
and that's it.
So just put the names in there
and that's not a really big deal.
You can also use crunch if you wish, in order to generate them by default.
It's not that difficult.
It's a pretty simple and straightforward procedure.
Anyway, down below you have lower case P for password.
You can pass in a single password and then try it against multiple user names.
Not a bad idea, but it can be a bad, primarily because there is a low probability of success
but if you have managed to gather some information
if you know something more
usually people use brute force when they acquired at least some bits and portions of information
that you can really acquire a realistically by just browsing the web.
You can also pass a password file, you can pass a username file and a password file
and that's gonna use combinations from both.
Anyway, down below there is a very neat option
There's -C, and then you specify a file.
Where it says file, you just specify the path of that file.
Same thing goes for here and here.
Here, instead of login, you would just type in a login name
and here, instead of a pass, you would just type in the password that you wish to try
as opposed to writing a path to a file here.
Anyway, -C FILE
It's a colon separated thing
so you can type in a login user name and right next to user name, you can type in a password.
It says here "instead of -L/-P options"
Now you might think "Oh well, who's gonna make this tedious list" or something like that
and "Sure, I can download it somewhere from the net...
...but why not use them separately and see what I can get from there"
Well, how about this?
Now I have personally used this -C for routers.
Now for example, a small firm
they have different routers within their buildings somewhere for wireless, and those were of one brand
and they had their main default gateway, which was the exit to the outer world
which was completely different brand
and then they had their interior routers from the main gateway cable goes this router
and then this router covers wireless this room, and so on and so forth.
You get the idea There was a whole spread .
Then I used -C to test out the default user names and passwords
for all those routers
just see if any of those routers actually contains a default username
or a default username/password combination.
Now there aren't a lot of them, but different manufacturers
and I know you think "Oh well, why do you need it?"
"It's just admin admin, right? You can just put in one entry"
Well, no
Different manufacturers have different default credentials on their routers.
Sure a lot of the time, let's face it, it's just admin admin
but for some manufacturers, it can be ubmt for both username and password, I think
it can be root
and then for password, it can be toor -- just reverse of root
and you have these variations that you can find
and that you can just type in default router passwords
and you can find all of them pretty much.
So I just loaded up the list and attempted these.
This saves you a lot of time...
It can raise flags because default credentials have been attempted
but it doesn't raise any flags in a sense that you're not making too many attempts
I mean, you're making a couple of attempts per router moving on
a couple of attempts moving on, and so on and so forth
and with that, you can pretty scan the entire network
whether it contains default credentials.
If any of them contains default credentials
yo have immediately found one weakness that you can write in your report.
With that said, it's a bit of an easy test which saves you a lot of time.
Anyway, down below you can use this in combination with -C
and let me tell you something --
Your home routers usually get probed twice or thrice per day by some IP address from God knows where
probing it for default credentials.
Pretty much everyone's routers gets probed with this once.
You can pass a file with a -M option, which is a list of servers to attack.
Basically a list of IP addresses
and people from different parts of the world, they tend to pass these files
and they pass every single IP on the planet.
They basically mass scan the internet.
They use Nmap to mass scan the internet
and then they load up live hosts with IP addresses to this fire
and then pass this file to Hydra, which in turn, attempts default login credentials
and if the default login credentials succeed
then they can be passed to different scripts that can do different things.
So basically, people have been known to alter DNS settings on massive scales
because you get maybe a million routers which had default credentials in their homes
and you redirect all of their DNS requests to yourself.
You can imagine the possibilities.
I mean, you will be able to do a lot.
From redirecting all of their traffic to a certain site
to basically zombifying them, making them bots or something of a kind.
The options are countless.
It would be even pointless to start listing them
but anyway, that's what people do generally.
If you check out the log files, usually they'll get probed once or twice, maybe thrice, per day.
Anyway, the best way to protect this is to simply to change the default user credentials
and as soon as the script sees that the default ones are not used, who cares.
It's just going to move on.
Also different telecoms in different countries
use different default credentials for different router brands.
These default credentials are always public.
Most of the time they're public
and you can actually find them out on the net.
So in a certain country, there are different credentials for that particular internet service provider
that it uses on its router.
So just before you'd conduct any sort of brute force attack
don't just go all out and try to hammer your way.
Rather instead, do a bit of research.
Do a bit of footprinting.
Try to figure out any additional information that can actually help you out.
Anything is useful.
Anything new that you learn is useful
and it can significantly lower the time of your brute force attack.
It can significantly reduce the possibility of a red flag.
Down below, you have an option -- It's -t for TASKS
Basically, this is the amount of threads that's gonna run.
Threads are processes which can run simultaneously or give an illusion of simultaneous operations.
It says "run TASKS number of connects in parallel (per host, default: 16)"
So, per one host, it's going to attempt 16 connections at relatively the same time.
The differences are trivial, like nano seconds
so it doesn't really matter.
Pretty sure it's nano second.
It could be some other measurement, but it doesn't matter.
The difference between the execution of the threads.
Anyway, you can specify a different amount of threads
depending on what your processor can handle and depending on how obvious you want this attack to be.
because somebody on the other side is gonna see that there are a lot of connections coming in
at pretty much the same time, so it's gonna be obvious that there something amiss
and you have -U
We're gonna skip that for now.
-h is a complete help
and okay, there are some other options down below
but for the time being, they're not that important.
I would strongly advise you to check them out
as they also provide for different factors of attack.
For the time being, I want to show you how to attack a website login
and what I've told you now is specifically related to that purpose.
Anyway, let's just go ahead and see how a Hydra command would look like.
So you just type in "hydra" and "-l" for a user
Actually, you have an example here
but look at this part is not difficult.
So this anybody can do, but that is not what we are here for to do.
We need to get this part.
This is for a FTP server, which is something we're not gonna do today.
You can see for FTP it's really simple.
There isn't really that much logic to it.
Rather instead,we want to do attack a HTTP web site.
Same procedure would apply for HTTPS, if I'm not mistaken.
It's going to work for HTTPS for sure
but I do believe that pretty much the same procedure applies.
You just need specify that it's HTTPS.
Anyway, what we need is these field names.
So we need a field name of username and we need to field name of passwords.
So what we need to do is right-click on the website, inspect element
Sorry, not inspect element
View selection source
Excellent
Most of the time you're gonna see view page source.
So you will need to be able to find username fields and password fields in order to actually do this
and you will also need the login submit button.
You can also do this burp suite.
I've showed you this in the previous tutorial.
In the SQL injections, where we've actually extracted a cookie.
Using exactly the same procedure, you can also get these things as well
but in this tutorial, I wanted to show a bit of a different method.
perhaps a bit easier method
to actually figure these things out
but it's pretty easy here
primarily because it can get these individual sections and take a look at them like this
but if we, for example, open up any other website like Kali docs
view page source
you can see how a page source would look like.
It's clumsy, it's long
I'm not saying this code is clumsy but it might appear like that
and it's pretty long, so yeah, it's gonna take a while.
I mean, you're gonna find it eventually, but it might take a while to actually figure out where is what.
I would suggest using a CTRL F option and type in...
Okay, this particular website doesn't have a login form, if I'm correct.
Yep, it doesn't actually have a login form, but it doesn't matter.
You just type in user name and hit CTRL F or something of a kind
and then just sweep through the source of website
in order to find whatever it is that you're looking for this
In this particular case, we are looking for the user name and password forms.
So go ahead and right-click view page source.
In our case, view section source
because this allows you to see actually different sections .
It's a lot easier that way.
What we will need here it is name, which will be username
and password for the field is password.
We will need these two, we will need the portion of the address
and we will also need the IP address of the server.
So this is the IP address of our server.
How to find the IP address of that particular server, I showed that in the previous tutorials.
So those are the things that we're going to need in the follow-up tutorial
where we will actually conduct a brute forcing attack.
I did take this time to actually explain all the options, because Hydra can be complicated from time to time
especially with this last section
pass the username and pass the password.
You need to pass additional parameters, which can get a little bit tricky.
You will see soon why.
Anyway, I bid you all farewell and I hope to see you in the follow-up tutorial.