Hello everybody and welcome to this tutorial. Today, I am going to open up a
chapter on brute-forcing methods, I would say, and these will include, here I will
include how to crack hashes, how you can actually attack a website with a brute
force, how we can perform a brute force attack on a website in order to
try to guess the combination of usernames and passwords. But, more
importantly, you do need to know that there is a way to crack those hashes, and
how you can crack them. So, basically, I will go over a couple of tools, one of
them will be findmyhash which is an online tool. Also, another one which is
extremely popular is called John the Ripper, and then we'll jump into Hydra
which actually enables you to attempt multiple usernames and
passwords on a website, and in such a way brute force them. If it manages to guess
them, you will login. Although, it does require some rather painful parameters,
so we'll see how that goes. It can be a drag with parameters sometimes
because you need to figure them out on a website, but usually everybody pretty
much gets the hang of it. They try it a couple of times and eventually it works
out. Fortunately for us, the very first tool that I'm
going to try today is rather simple, plain tool, and it's called
findmyhash, findmyhash --help. You will see even the help menu doesn't have
that many options. So, these are examples, valid options look at this, so it
only has three valid options. It says, if your hash cannot be cracked, search it in
google and show all the results. Note: This option only works with -h (one hash
input) option. -f for files, you can have a file of hashes, so there are a few things
to take into consideration when creating a file of different hashes. So, it says
one hash per line, nothing in between. So you type in one hash, you press
Enter, you copy/paste it, excellent, press ENTER, and so on and so forth, and all of
them have to be of the same type. Up above, straight in the beginning,
you have types of hashes which are supported. So, you have MD4, MD5, GOST,
SHA512, and so on and so forth. So, these are the
ones that are supported. Any other I'm afraid it's not gonna work with this
program. Here you have the general syntax, and the general syntax you can actually
disregard this portion of the syntax, you don't need to type this
in. You can just type in findmyhash and then the rest. Let's just go down,
excellent, clear the screen. Also, another thing to take into consideration is that
you have a lot of websites out there which you can use to attempt to decrypt
your stuff, here I'm using md5lab.com, and I've
requested it decrypts a certain hash. The hash that I've actually asked
it to decrypt is hey223!! and this
is it. Now, it is highly unlikely that you will be able to decrypt this on your
local computer, primarily because it contains three sets of, rather you have
letters, you have numbers, and then you have these signs as well which is an
exclamation mark. If it was hey223 you would probably break it, but with
exclamation marks it's gonna be a bit more difficult. Anyway, I'm just gonna
control + C this. I want to save this to see if it actually manages
to finish later, so I can show you.
Because you should always remember that you have a ton load of resources out
there on the net that you can utilize, and those machines are probably a lot
faster than your local machines as they are are server machines. So, if you can find
something for free, great! If you can't, oh well. Anyway, let's
go and type in findmyhash, and we're gonna say that it's
gonna be md5, as this is a really common one. I do
believe that this is the one used in the database that we've previously cracked,
so if you extract hashes such as those from a database you can crack them
in this fashion.
-h for hash, and now we need to go ahead and create a hash. I don't know, what are
we gonna type in here? Let's use something simple to begin with, and then
later on we can use more complex things. But, I want to primarily use
something simple now so that it finishes in some reasonable amount of time,
as opposed to having to wait for an hour or something
like that. So, let's just type in hey, that's quite
simple, and let's just see if this one works out and then we can try
another one. I think this one should go relatively fast, and there we
go. It is analyzing it with different things, we're going straight through, we
can see the sites here as well. So, it's going, it's going, it's going, and it's
done. So, the following hashes were cracked, this is so weird that
somebody actually didn't bother to put an if statement somewhere.
But, oh, well. The tool is free, so my credits to the authors of the tool, but a
single if statement could actually fix this. If you have a
single hash it should be written the following hash was cracked, and if you
have multiple hashes it can say the following hashes were cracked. Anyway,
that really doesn't matter, it has no effect to the functioning of our tool,
and you can see surely enough there's a hash here, and you can see the word that
was hashed as well. So, no big deal there. Let's try something a bit more complex
Is this done? No, it's probably not gonna
finish, but, anyway. What the hell, I might as well try hey123.
Let's try hey123. So, letters and numbers, and increased length as well.
Paste, press ENTER, and it's going.
This might take a bit longer, however I just want to show you, if
it becomes too long before it actually finises what I have to say, if it
continues after I said what I wanted to say, I'm gonna stop it, but, no, apparently
no. So, a six character password including numbers and digits is cracked,
let's just try one more for the fun of it. So, hey123, I don't know, let's
leave 123, let's just increase this to Hey with a capital letter, and let's add
an exclamation mark. I purely doubt that it's gonna be able to crack this, maybe
because I've used Hey123, but let's see if it does crack it. I'm gonna
be amazed. Because just adding those strange characters that you
generally don't see in passwords or user names, like exclamation marks, asterisk
signs, greater than, lesser than, etc., you really make it a lot more
difficult for any sort of brute-forcing software to actually crack
it. Primarily, because, OK, so if you have letters and numbers you have a certain
amount of possible, you have a fixed amount of characters. It's a smaller
number, and if you use characters, oh man, that increases the amount of possible
combinations exponentially. Because, I don't know, you have
ten possible numbers, and then you have the English alphabet,
but if you have all these numbers and all these other signs,
like quotation marks, single quotation marks, double quotation marks, parentheses,
brackets, curly brackets, percentages, and %, slashes, back slashes, pipes, yeah, the
amount of combination is staggering, and yeah, it's unlikely that we crack it. Just
like with this one that we're doing now, we are unable to crack it even though
it's fairly simple, it just has an exclamation mark
here, but people, as I said, generally in a significant amount of cases, definitely
above 50%, do not use these sort of characters in their passwords.
Primarily, because it's hard to remember. And a lot of people don't tend to log in
these days and do anything, they just stay logged in or Firefox remembers their
passwords, or Chrome, or whatever, and they don't want such passwords. I mean,
this exclamation mark is not a general thing, trust me.
People generally don't put it in. It would usually be hey123, and that's gonna
get cracked. But, in any case, it looks like that it won't actually manage to
crack it. If it does I will let you guys know, but purely doubt it that it will.
I do believe that this is usually the last one it runs. But, in any
case, I want to bid you farewell, and in the next tutorial we will actually use
some other tools. I do believe it's gonna be John the Ripper. Okay, so there we go,
it wasn't actually cracked. Yeah, it can't actually crack this one,
but let's see if we can do some google searching with it. No, no, no, don't, don't,
don't, don't...
Let's see, how does the syntax for this one go? Again, you go for it? The hash was
not found in any database, maybe Google has an idea? Google doesn't have any results, so sorry.
Okay, so, yeah. You're not gonna be able to crack this hash. But, what you can do is
basically copy it, this is one more thing that I've done here, but here's what you
can do as well to duplicate the procedure. Just copy it here,
and then see what Google has to say for real. So, there's an
md5decoder.org, and that seems to be the only site with this particular hash, and
this is in some foreign language, but it doesn't really matter.
Control + F, hashes are universal in all languages, apparently, nope, this is not
where we need to be. But, if you have a website like md5lab.com, you can
copy/paste it there. I can't copy/paste that actually here now because there's
this cracking process underway. But, if you are using this site for the first
time you're gonna get a prompt here, just copy/paste the hash and click on decrypt,
maybe they will have more luck than you. Anyway, in the follow up tutorials I said
we'll try out some other tools and see how our luck serves us there. Until then,
I bid you all farewell, and I hope to see you there.