Hello everybody and welcome to this tutorial.
Today I'm just gonna go ahead and start using Hydra immediately.
You can see that I have like a hundred thousand things open down below
but you don't have to concern yourselves with all of them.
Now I have ran command before and I have it here, so let's just go over it
but before we do, a quick thing to do is just do "nano passlist"
Excellent
So I've created a password list for myself here.
Now of course, this would be pretty stupid thing to do
if you were actually cracking a password somewhere on a website.
Rather instead, you should definitely download a password list from somewhere.
There are plenty of them on the net, just type in "Password lists" for dictionary attacks.
You won't find a shortage of them, I guarantee it to you
but why should you do what I did?
Why didn't I just download itfrom the net?
Well, hydra is notorious for not doing what you intended to.
I mean, the tool does function
the tool is properly coded, the code is fine
but because of the parameters that people tend to pass to it, especially for HTTP and HTTPS versions of attack
when you are attacking a website login form
it gets confused a lot, in between what is a proper user name
and what are proper login credentials and what are not, because you need to provide a message to Hydra.
Once it receives that message, it knows that the credentials are false
and every time it doesn't receive that message, it will assume that the credentials are correct.
Hydra doesn't actually do anything else
and because of this, it can get confused a lot
and you do need to pass that long URL parameter for login site.
So there are some problems that can happen
and that is why it is good to create your own password list that is very short
and to test out your attack.
Test it out on your local web server or test it out on the server that you wish to attack.
If you can log into that server with some sort of visitor guest account or something like that
just create some nonsensical account with nonsensical information there
that would be great
and see if these attacks work.
Try out these passwords.
If it finds the right password, great
and don't just run the test once, run it like two or four times
Not in a row preferably, but over a period of two days or something like that, or more
and if both tests find successful passwords
then you know that Hydra is functioning just fine.
What you do not want to do is load up a dictionary of eight million passwords and like 10 million user names
and start your brute forcing attack over the period of a couple of weeks
just to find out in the end that you actually failed to pass the right parameters.
Two weeks of wasted time.
So just create a fire like this. It's pretty simple.
Type in nano, and then space, name of your file just like I've typed in a second ago
and then you can type in whatever youwant here.
It doesn't really matter
CTRL O to save, press ENTER center for pass list
That's gonna be the name of our pass list here
and CTRL X to exit.
You can name it any way you like, quite literally.
It doesn't really matter.
Let's go ahead here and clear the screen there.
Now what we need to do is find the command that I used
Excellent
So it says Hydra, and then -l for admin, space -P for password
The IP address of the server, the method.
Okay, so there's a difference here -- Previous one was "get". This one is "post"
The reason for that --
I'm actually attacking the front login site of the damn vulnerable app with Hydra.
I have discovered some of the complications inside
so I didn't put you through it, as you'll get a lot of errors and problems around it
and generally you won't want that.
To be quite honest, that is not a realistic scenario in the first place
primarily because you will have already logged into something
and then while you're logged into something
you want to brute force another login behind the login.
I don't know, I suppose you can find such scenarios in the world
but it is not very likely that you will encounter that.
Far more likely option to encounter is the one that we're seeing here before us
and this is far more realistic anyway.
So I've already attempted to log in and says login failed.
If I reload the site, I'm going to burp suite, so I'm just going to forward this.
Excellent
So we have this - DVWA
We can copy this, as I have shown you in the previous tutorial.
The procedure is exactly the same. There are no differences here
but I just wanna show you that you can also do this in burp suite in a very nice fashion.
So you can go here into headers
and you can immediately see what you are requesting here.
You will, of course, disregard regard the HTTP/1.1 request
Rather instead, you will just copy this first part of this header
You got some hex here
that's completely relevant to us
but you also have it here.
It says get, and then you have it here.
Again in the same form, but you can actually copy/paste from here while from headers.
I don't know, it's possible, but you have to like cut it and do stuff to it.
Here you can just do this, and then copy/paste to wherever you want it.
Anyway, even though the method is "get" to call the website, we are yet to attempt a login.
So if I forward this...
Excellent
and now I'm going to attempt to log n
Excellent
So you see here, it's a post.
As soon as you don't see your credentials being passed in the URL space of your browser
it should be post, if I'm not mistaken.
If they are passed in the URL, it's "get"
but just try some random login. Just smash on your keyboard
and you can also figure it out on burp suite.
You can use the burp suite in the same way as I've shown you in the previous tutorials
and here you can figure out that it's post
but anyway, you don't actually need to use burp suite
I showed you how you can get it from page source.
Pretty much that is a universal rule for any site out there
and here you can see the username fields and password fields, etc.
You can even get the session ID here
but all of that you can get through your browser.
Also, one more thing to note is that the security is set on high.
Anyway, I'm just going to go ahead and forward this
minimize this, as I don't really need it
and come back into the Hydra command.
So, "http-post-form", space
and then I open up my quotation marks.
We need to type in "DVWA-1.0.8/login php
Now, we've actually copied this part up to here
and then I've type in a colon in order to separate the fields.
The next field that I need to use his username
Do I still have it here? No
Okay, so it's just easier for me to look at in burp suite now
but you can look at it wherever you like, in Firefox as well.
Just go ahead and forward that information.
Will this work? Yup, there we go.
So here you see username=
Again, you can do all of this the way I showed you the previous tutorial.
Just extract information from page source
but it's a bit easier to see them in burp suite.
username=, and then I would of course copy that part
and here you go.
Surely enough it says username=
I've copied that part.
Now this is the part that belongs to the website
and this part here belongs to Hydra.
So you type in ^USER^
Now this part tells Hydra where to insert username
and this is the field name on the website, equals, and then Hydra will insert values there
and "&password"
Again, in burp suite, you can see that it's actually n percent sign and then password.
Forget about these.
This random value here.
This is just a username that I've basically smashed my fingers against the keyboard
and attempted to log in, just to get this form here
and that I just get this information here that I am utilizing now.
So the extension of this field is basically "&password="
and then we have it here again
We open up carrots signs.
Basically like quotation, but I don't know, they said it's gonna be carrot signs
and in between them, just type in PASS
Write it exactly as I've type in here.
So for password, it's PASS
and for username, it's USER
but these field names, I suppose they can be changed
depending on what the developer has intended them to be, but it doesn't matter.
I don't know, instead of password, you can say pin or something of a kind
but you do need to check that with a website
and the source code of the website you can view by right-click View Source
or use a burp suite proxies, as I've shown in the previous tutorials.
and then you will be able to figure it out.
So pass the password
You have "&login"
So let's just go to the burp suite and see what's up there.
So it does really say that the extension of this field is &login, and it equals login
It is so indeed and we copy/paste it here.
There is no need to actually do any alterations there.
Login Hydra will not insert anything there.
The third field that we need to pass
This is one field
This is the second field
and this will be a third field.
The third field actually is the marker field.
That is something that Hydra is looking for, and if it gets that
It knows that it's an invalid combination of a username and the passwords.
It says here at the bottom of page "login failed"
So just try to find some message after you have typed in some random credentials and press login.
Find a message that basically says "login failed"
This login failed can be on any portion of the site, but it will be there.
Don't worry about it. There is always a message when you fail to log in.
So you just copy/paste that message here.
Okay, so you can obviously copy it from here, but you can also view selection source
and then you got login failed there as well.
I can't actually click on view page source here.
It's still loading or messing up with burp suite, I guess
but it does not really matter.
This message won't be the same/
It will vary from one site to next, and its position will vary from one site to the next
and even if I have shown you the source code for this particular site
I mean, you can see it yourselves it's going to be in one place
but just try opening up any other site
and do a deliberate failed login.
Just type in some random credentials and then you right-click View Source.
You will see that you get a different message.
It doesn't necessarily have to say login failed.
It can just say failed or incorrect username and password or something of a kind.
The messages will be different.
There is no direct procedure to determine this other than by just reasoning.
Just take a look at your screen and just view the message
then view the source code and copy it from there.
Anyway, quotations closed here base
space, -V for verbose output.
Why capital V? I think that's for extra verbose output, if I'm not mistaken.
I think that's why I placed it there, but I'm pretty sure that the lower case would function the same.
Anyway, if I press ENTER now, this is gonna go and work
even though there are just a few...
You see actually it tries them all out
because the amount of threads that it's running is 16.
You increase the amount of threads by adding a -T space.
I think it supports a maximum of 6432 threads, I'm not sure.
It also depends on your actual computer.
How much it can handle.
Anyway, it says on port 80 [http-post-form]
and then it says login:admin, password is password
Now it is always a good idea to do a lot of research prior to doing this
primarily because you won't necessarily have some sort of complex login credentials
because they are rarely found anywhere
primarily because people don't bother with that
but you will want to know more about those login credentials.
You will want to learn at least something before you attempt to do this sort of attack
because if you know nothing, this sort of attack can last for an eternity of time
and you're most likely gonna get discovered by the administrator.
Also I advise you to use this in combination with some sort of proxy or something of a kind.
Also a very nice thing to do is to go ahead and click on applications.
Kali Linux, Passwords Attacks, Online Attacks, Hydra-gtk
and here you have a graphical user interface for Hydra
Here you can choose like single target, target list, specify a port
You can specify all these things by a command line as well.
You can specify a protocol here.
Down here you can say ssl, use the ssl, be verbose, show attempts, debug, complete help
and at the bottom of this screen that I am spinning now
you can see the actual command is down there.
That command changes as you change value.
So I'm gonna say ftp
You can see it changed to ftp.
I'm gonna say HTTP proxy
It's also changed, but you can't see the whole thing.
Now it says HTTP proxy
The letters are pretty small here, but doesn't really matter.
Just take a look at this graphical user interface too if you are interested.
All of these things you can do by command line.
All of them. There's no difference there.
You can specify a user name, user name list, password, use colon separated file
try login as password, try empty password, try reverse login
Pretty much self explanatory things.
Number of tasks here it's set to default to 16, but you can increase.
You can also tell it to exit after first pair found per host
if you're passing of filed multiple hosts
and you can say at exit after first pair found on a global level.
So if you find some login credentials for any of the hosts, just stop.
Here you can specify a proxy to be used.
Not a bad idea either.
Where it says HTTP/HTTPS URL, there you would pass these parameters
There you would pass what is in the quotation marks here, or something of a kind, if I'm not mistaken
but I'm just showing you this if you're curious, so feel free to explore
and here it starts.
It says Start, Stop, Save Output, Clear Output
Clear Output clears the screen and Save Output saves it to a file.
Self-explanatory as well
Anyway, I just wanted to show you that
as I said, if you are curious or something of a kind
but this is how you should use the command line tool via terminal.
Always better to learn it this way
Always better to use it this way
but if you wanna play around with the graphics as well, feel free to do so.
I do encourage you to do both.
Anyway, I bid you all farewell
and I urge you to experiment more with Hydra.
Try different parameters, try different places legally
and see how that works out for you
because this part will continuously change
and it will be different from one website to the other.
This part won't change, this part won't change
but everything else within the quotation marks will pretty much change from one website to the other.
This part is straightforward, as I said.
There isn't that much thought that you need to invest here.
It's fairly easy, but invest a lot of time into figuring this part out
and once that works out, the rest is easy.
It's always gonna work, no problems.
Anyway, now I bid you farewell
and I hope to see you in the next tutorial.