Hello everybody and welcome to this tutorial. Today, I'm just gonna go ahead
and start using Hydra. Immediately, you can see that I have like 100,000
things open down below, but you don't have to concern yourselves with all of
them. Anyway, let me just zoom this in a little bit, there we go, full screen,
fantastic! Now I have ran a command before and I have it here, so let's just
go over it. But, before we do, a quick thing to do is just do nano passlist,
excellent! So, I've created a password list for myself here. Now, of course, this
would be a pretty stupid thing to do if you were actually cracking a password
somewhere on a website, rather instead you can definitely download a password
list from somewhere. There are plenty of them on the net. Just type in
password list for dictionary attacks. You won't find a
shortage of them, I guarantee it to you. But, why should you do this then,
what I did? Why didn't I just download it from the net?
Well, Hydra is notorious for not doing what you intended it to do. I mean, the tool
does function. The tool is properly coded, the code is fine, but the parameters,
because of the parameters that people tend to pass to it, especially for
HTTP and HTTPS versions of attack when you are attacking a website login form,
it gets confused a lot in between what is a proper username and what is,
what are proper login credentials and what are not. Because you need to provide
a message to Hydra, a message that will basically, once it receives that
message it knows that the credentials are false,
and every time it doesn't receive that message it will assume that the
credentials are correct. Hydra doesn't actually do anything else, and because of
this it can get confused a lot, and you do need to pass that long URL parameter
for the login site. So, there are some problems that can happen, and that is why
it is good to create your own password list that is very short, and to test out
your attack. Test it out on your local web server, or test
it out on the server that you wish to attack.
If you can log into that server with some sort of visitor or guest
account, or something like that, just create some nonsensical account with
nonsensical information there, that would be great. And see if this attack works,
try out these passwords. If it finds the right password, great! And don't just run
the test once, run it like 2-4 times. Not in a row, preferably, but over the
period of two days, or something like that or more. And if both tests find
successful passwords, then you're good to go, then you know that Hydra is
functioning fine. What you do not want to do is load up a dictionary of eight
million passwords, and like ten million user names, and start your brute forcing
attack over the period of a couple of weeks, just to find out in the end that
you actually failed to pass the right parameters. Two weeks of wasted time. So,
just create a file like this, it's pretty simple. Type in nano, and then space, name
of your file, just like I've typed in a second ago, and then you can type in
whatever you want here, it doesn't really matter.
Ctrl + O to save, press ENTER for passlist, that's gonna be the name for our passlist
here, and Ctrl + X to exit. You can name it anyway you like quite literally, it doesn't
really matter. Let's go ahead and clear the screen there. Now what we need to do
is find that command that I've used, excellent! So, it says hydra, and then - l
for admin, space - P for pass list, capital P, the IP address of the server
the method. Okay, so, there's a difference here. The previous one was get, this one
is post. Reason for that, I'm actually attacking the front login site of the
damn vulnerable app with Hydra. I have discovered some of the complications
inside, so I didn't want to put you through it as you would get a lot of
errors and problems around it, and generally you will want, and that, I'll
be quite honest, that is not a realistic scenario in the first place.
Primarily, because you will already have logged into something, and then while you're
logged into something you want to brute-force something behind, you want to
brute-force another login behind the login. Which is, I don't know, there are,
I suppose you can find such scenarios in the world, but it is not
very likely that you will encounter that. A far more likely option to encounter is
the one that we are seeing here before us, and this is far more realistic, anyway.
So, I've already attempted to login, it says login failed. If I reload the site,
I'm going to burp suite, so I'm just gonna forward this, excellent! So, we have
this DVWA, we can copy this as I've showed you in the previous tutorial. The
procedure is exactly the same, there are no differences here, but, yeah, I just want
to show you that you can also do this in burp suite in a very nice fashion. So, you
can go here into Headers, and you can immediately see the what you are
requesting here. You will of course this regard the HTTP/1.1
request, rather instead you will just copy this first header, first part of
the header. You got some hex here, that's completely irrelevant to us, some Params here,
anyway. But, you also have it here, it says GET, and then you have it here, again, in
the same form, but you can actually copy/paste it from here from Headers.
I don't know, it's possible, but you have to like cut it and do stuff to it.
Here you can just do this, and then copy/paste wherever you want. Anyway, even
though the method is get to call the website, we are yet to attempt a login. So,
if I forward this, excellent, and now I'm gonna attempt to login. Where is it,
excellent! So, you see here it's post. As soon as you don't see your
credentials being passed in the URL space of your browser, it should be post,
if I'm not mistaken. If they're passed in the URL it's get, but just try some
random login, smash against your keyboard, and you can also figure it out in burp suite.
So, you can use the burp suite in the same way I've showed in the previous
tutorials, and here you can figure out that it's post. But, anyway, you don't
actually need to use burp suite. I've showed you how you can get it from page
source. Pretty much that is a universal rule for any site out there, and here you
can see the username fields, and password fields, etc. You can even get the
session ID here, but all of that you can get through your browser. Also, one more
thing to note is that the security is set on high. Anyway, I'm just gonna go
ahead and forward this, minimize this as I don't really need it, and come back
into the Hydra command. So, http-post-form, space, and then I open up my
quotation marks. We need to type in /DVWA-1.0.8/login.php.
Now, we've actually copied this part up till
here, and then I've typed in a colon in order to separate
the fields. The next field that I need to use is username. Do I still have it here?
No, okay. So, it's just easier for me to look at it in burp suite now, but you can
look at it wherever you like, in Firefox as well. Just go ahead and forward that
information, will this work, tell me, yup, there we go.
Excellent! So, here you see username equals, again, you can do all of this the
way I showed you in the previous tutorial. Just extract the information from
page source, but it's a bit easier to see them in burp suite. Username equals, and
then I would, of course, copy that part, and here you go. Surely enough it says
username equals, I've copied that part. Now this is the part that
belongs to the website, and this part here belongs to Hydra. So, you type in a
caret sign, user with capital letters, and then caret sign again to close it. This
part tells Hydra where to insert the username,
and this is the field name on the website, equals,
and then Hydra will insert values there. Ampersand sign, password. Again, in burp suite you
can see that it's actually ampersand sign and then password, forget about this random
value here. This is just a username that I basically smashed my fingers against
the keyboard, and attempted a login just to get this form here, and that I just
get this information here which I can later on utilize, that I am utilizing now.
So, the next field is, not the next field but the extension to this field, is,
basically, ampersand sign, password equals, and then we have it here again, ampersand sign,
password equals. We open up carrot signs, basically like rotation, but I don't know
what they just said, okay, it's gonna be carrot signs. And in between them just
type in PASS exactly as I've typed it in here. So, for password it's
always PASS, and for username it's USER, basically, just all capital letters.
You are telling Hydra, but these field names I suppose they
can be changed depending on what the developer has intended them to be, but it
doesn't matter. I don't know, somewhere instead of a password you can say pin, or
something of a kind, but you do need to check that with the website. In the
source code of the website that you can view by right click, view source, or use a
a burp suite proxy as I've showed in the previous tutorials, and then you will be
able to figure it out. I've showed, yeah, nevermind, excellent! So, past the
password you have ampersand sign, login. So, let's just go to the burp suite and see what's
up there. So, it does really say that the extension of this field is ampersand sign,
login, and it equals login. It is so indeed, and we copy it and paste it here,
there is no need to actually do any alterations there. Login will equal login.
Hydra that will not insert anything there.
Now, the third field that we need to pass, so this is one field,
colon, this is the second field, colon again here, and this will be a third
field. Now the third field, actually, is the
marker field. So, that is something that Hydra is looking for, and
if it gets that it knows that it's an invalid
combination of a username and the password. If we just open up our browser
back up again, it says here at the bottom of the page login failed. So, just try
to find some message after you have typed in some random credentials,
whatever, and press login, find a message that basically says login
failed. This login failed, I don't know, it can be on any portion of this
site, but it will be there, don't worry about it. There is always a message when
you fail to login. So, you just copy/paste that message here. If you, okay, so
obviously you can copy it from here, but you can also say view selection source,
and then you got log-in failed there as well. I can't actually click on view page
source here, it's still loading something messing up with burp suite, I guess? But,
it doesn't really matter. This message won't be the same, it will
vary from one site to the next, and its position will vary from one site to the
next. Even if I had shown you the source code for this particular site, I
mean you can see it yourselves, it's gonna be in one place. But, just try
opening up any other site and do a deliberate fail of login. Just type in
some random credentials and then do a right click view source, you will see
that you get a different message. It doesn't necessarily need to
say login failed, it can just say failed, or incorrect username and
password, or something of a kind. The messages will be different, there is no
direct procedure to determine this other than just by saying reasoning. Just take
a look at your screen and view the message, then view the source code and
copy it from there. Anyway, quotation marks closed here, space
-V for verbose output. Why capital V? I think that's
extra verbose output if I'm not mistaken, I think that's why I placed it there,
but I'm pretty sure that the lowercase v would function just the same. Anyway, if I
press ENTER now this is gonna go and work, even though there are just a few,
you see it actually tries them all out because the amount of threads that it's
running is 16. You can increase the amount of threads by adding a -t,
space, I think it supports a maximum of 64 threads, I'm not sure. It also depends on
your actual computer, how much it can handle. Anyway, it says on port 80, http-
post-forum, host, and then it says login: admin, password is password. Now it is
always a good idea to do a lot of research prior, as I've stated in the
previous tutorial, prior to doing this. Primarily, because you won't necessarily
have some sort of complex login credentials because they're rarely found
anywhere, primarily because people don't bother with that, but you will want to
know more about those login credentials. You will want to learn at least
something before you attempt to do this sort of an attack, because if you know
nothing this sort of an attack can last for an eternity of time, and you're most
likely gonna get discovered by the administrator.
Also, I advise you to use this in combination with some sort of a proxy, or
something of a kind. Also, a very nice thing to do is to go ahead and click on
applications, Kali Linux, password attacks, online attacks, Hydra-gtk, and here you
have a graphical user interface for Hydra-gtk. For Hydra, just gtk for
graphics. Here you can choose like single target, target list, specify a port, you
can specify all these things via command line as well. You can specify a
protocol here. Down here you can say SSL, use the SSL, be
verbose, show attempts, debug, complete help after failure. And at the bottom of
this screen that I'm spinning now, you can see that the actual command is down
there, that command changes as you change value. So, I'm gonna say FTP,
you can see it changed to FTP. I'm gonna say HTTP proxy and it's also changed, but you
can't see the whole thing...come on. Yep, there we go. It says now HTTP proxy.
The letters are pretty small here, but it doesn't really matter. Just take a look
at this graphical user interface tool if you are interested, all of these things
you can do via command line. All of them, there's no difference there. You can
specify a username, username list, password, use colon separated files, try
login as password, try empty password, try reverse login. Pretty much
self-explanatory things. Number of tasks here is set by default to 16, but
you can increase it. You can also tell it to exit after first pair found per a host.
If you're passing a file of multiple hosts, you can say exit after first
pair found on a global level. So, if you find some login credentials for any of
the hosts, just stop. Here you can specify a proxy to be used, not a bad idea
either. So, it says specific, where it says HTTP/HTTPS URL, there you would
pass these parameters. There you would pass what is
in the quotation marks here, something of a kind, if I'm not mistaken, but I'm just
showing you if you're curious. So, feel free to explore. And here
it starts, you say start, stop, save output, clear output. Clear output clears the
screen, save output saves it to a file. Self-explanatory as well. Anyway, I just
wanted to show you that, as I said, if you are curious, or something about kind. But,
this is how you should use it, use the command-line tool via terminal. Always
better to learn it this way, always better to use it this way. But, you know,
if you want to play around with the graphics as well feel free to do so, I do
encourage you to do both. Anyway, I bid you all farewell, and I urge you to
experiment more with Hydra and try different parameters, try different
places, legally, and see how that works out for you because this part will
continuously change, and it will be different from one website to the other.
This part won't change, this part won't change, but everything else within the
quotation marks will pretty much change from one website to the other. This part
is straightforward. As I said, there isn't that much thought that you
need to invest here, it's fairly easy. But, invest a lot of time into figuring this
part out, and once that works out the rest is easy. It's always gonna work, no
problems. Anyway, now I bid you farewell, and I hope to see you in the next
tutorial.