Now that we have a wordlist ready whether you downloaded it from the internet or if you created it by
yourself.
Now we can go ahead and proceed to gain access to our target web site using a wordlist attack.
So we're going to use a tool called Tida and hydro can be used to brute force any type of service really
I can think of any service that you can brute force.
So it's a really handy tool to know how to use.
We're going to do our example on a Web log in but you can use it to gain access to S-sh FGP routers
anything that asks you for a username and password really so to use the tool.
The first thing we're going to do is we're going to type in Hydra and we're up with minus help to see
how to use it.
Now as you can see there's a lot of options for the tool but don't be overwhelmed with that.
They're all very pretty simple to use.
So if you go up you can see that the main syntax of using the tool is you have the first thing you have
to do is put in the name of the tool.
So we're going to put Hydra and then we're going to put the service that we want to attack so you can
see that they have examples here of you attacking an FPP service people attacking an eye map service
and other type of services.
So in our example we are interested into gaining access to our log in here to this page and we're going
to assume that we don't know a username and password and we're going to try to log in to the admin without
knowing their password.
So our target service is going to be this one.
So the first thing you want to use is its IP so the IP is 10 20 11:46.
So we're going to put it after the name of the tool
then lookin out the syntax here.
You can see that we have to specify a log in and password.
So let's have a look on the minus L and D minus P options in here.
And you can see that you can use a small l to specify one username.
Or I can tell L to specify a list of user names.
So in our example we're only trying to gain access to the admin.
So we're not going to use a list of user names are only going to try to gain access to the admin password.
So we're going to do is we're going to do minus L small and then we're going to tell it that the user
name is admen and then the next thing we need to specify is the password or a password list.
So similar to the option you can use a small p to give one password or you can use a capital P to specify
a file or a wordlist or a dictionary of passwords.
So I'm actually going to modify the passwords file that we created in the previous video.
I'm just going to open it and my text editor.
So this one right here is called testor ATX D.
And I'm just going to add the password for the admin.
I know the password for the admin is called admin pass and I'll just add it somewhere in the middle
here.
OK so I'm going to save it and quit it.
And now our word our word list contains the password.
So we're going to do.
Might not be tapped.
And then we're going to give it where the password is stored and it's stored and rude test takes the
so everything is good until now and there is only one more thing to do.
We still haven't specified what type of service that we're attacking.
So we gave it the IP we gave it the username and we gave it the list of passwords to try.
But hydras still doesn't know what type of service that we're going to attack.
And that is the most important option and the option that you need to pay the most attention to because
this is where it gets a bit tricky.
And this is where things can go wrong.
So before I start talking about that I'm actually going to copy our command so far and I'm just going
to paste it in a notepad.
So all we have to do now is tell Hydra what type of service and how to use the service to brute force
the username and password for me.
And you can see here in the help.
It's telling us that these are all the type of the supported services.
So as I said I can't actually think of a service that's not supported.
So you can have a look on all of these and try them.
What we're interested into is the Hastey t.p.
And you can see that there's going to be a minus and it's going to be either get or post depending on
our target.
And after that it's also going to be a forum because it's sent through the mail.
And I'll tell you why it's going to be like this.
Now let's go down
so I'm going the right click in here and I'm going to go to inspect element and I'm going to click.
I'm going to look for something called forum and you can see that there is a form there has to be a
form in the Hastey email pages and look for the method.
I'm going to zoom in for you.
And note that in here it says that the method is going to be Post.
And that way we know that it's a post.
And if you look at the R L here you'll see that the R L is a hash TTP it's not a hasty TTP as.
So therefore our module that we're going to use here or the service is going to be hasty post 4.
So it's right here you can see all the type of services like I said.
So it's hasty T.P. followed by a minus followed by post and followed by four.
And to see how we can use this and to see an example of how you can use the service I'm actually going
to Control-C this and I'm going to say Hydra why not you and I'm going to give it the name of the farm
or the name of the service that I want to use which is going to be hasty.
As you can see now.
Again it's giving you a long description about how you can use the service and at the bottom it gives
you examples and the examples are amazing.
The examples are really good because you can't just copy and paste them and adapt them to your target.
So the format of this service is you give it the location where the brute force where you want to brute
force the form from.
You're going to give it the user parameters so whether it's a you will whatever this parameter is called
and then you're going to give it the password parameter and then you're going to give it the incorrect
message so when there's a failed log in what happens to the web page.
So I'm going to copy this the way it is
and get modified to adapt to our target.
So the first thing we want to put is the page that the log in happens from which is this page.
So we're going to put all of this instead of log in that ph here.
So that's all good.
Now the next thing that we need to modify is the user on the pass.
So these are the names of the parameters that are sent to the web application and we don't know what
these are called.
And for this we're going to use Burts suits.
Now I'm not going to show you how to configure this because we've done that before.
So I'm just going to turn my interceptor on and I'm going to log in with wrong username and password.
So I just want to see what gets sent to the target web application.
So I'm just going to log in with the username admin and just any password so I'm just going to put random
characters hit enter and I'm going to go on the headers.
And this is what's being sent.
So you can see that the username parameter is just called username.
So I'm going to copy that and put it here instead of user.
And we can also see the passwords parameter.
Again it's called password instead of POS and you can see that we also have an or parameter here which
is.
And log in Submit button equals log in.
So you need to add that as well.
And in your case if you had other things that's been sent you need to add them as well to your request.
So we're going to add that after the past here exactly the way it is we're not going to modify anything.
So it's just going to be and Logan ph resubmit submit button equals log in.
The last thing that we need to modify Is this part and this part is the way that Hydra is going to know
whether the loggin is successful or unsuccessful.
So the way this is going to work is you either give it a capital F equals to the unsuccessful so it
equals to the failed attempt or you can give it a capital S and you tell it what happens when a successful
luggin happens.
So in my case I'm going to give it capital F to tell it what happens when I feel like it happens and
I'm just going to turn off the interceptor now and we can see that we have failed again.
And NFL again you can either use this or in my experimentation it was easier to just use this so if
you just use the message right here that says not log then.
So we're going to say F equals
So this is the most part the most important part and the most tricky part I'd say of the whole attack.
So I'm going to go over it again.
We can see that the whole quest is separated by three columns.
The start of it is the location where we want where the page that we're going to brute force is.
So we took that from here.
The second part is the parameters that we're going to be dealing with and that we're going to be sent
into the server and we took that from birth suit.
And the third part is the way that prep suit is going to know whether the slogan is successful or unsuccessful.
And we gave it kept alive to tell it that this is what happens when the password is wrong.
And we told it that you'll see a message called not logged in.
So we're going to combine this with the command that we already had so Commander we already had was
Hydra the IP followed by the user name that we're going to use which is admin followed by the password
list and we're going to put all of this after it and that's it.
That's our command done.
I'm going to copy this
paste it in here and execute and I forgot to tell it the type of service that we're going to be attacking.
So I only gave it the I only gave it what it should send but I didn't tell it what type of service we're
going to attack.
So like I said before it's going to be hasty TTP Post forum.
So it's the same service that we were inquiring about when we use the option.
So again copy this
pasted here.
Hit enter.
Now you can use the minus We option so that Hydra would actually display every request it sends to the
server.
I didn't use that right now so all this is literally just a blank screen.
But we're going to wait for it until it finds the password for us.
Hydra also supports pause and resume.
So if you just Control-C out of this the next time you're on it all you have to do is just put in minus
or and that'll actually allow you to continue from where were you left.
The last time
and as you can see now we managed to find a valid username and password and you can see that the user
name is admin and the password is admin pass.
And this works against any weblog.
And so literally this weblog it doesn't read doesn't need to have any skill injections or javascript
or access or anything.
So now I can log in with the username admin and password admin pass and as you can see now I'm logged
in as admin.