Hydra is a free and open source command line tool to crack valid log in password pairs online.
It's very fast and flexible and new modules are easy to add.
Hydra is embedded in Colly, but before using it, we'd better have a look at some of the parameters.
You can specify the username list, let's say the user dictionary with uppercase L as the parameter.
If you'd like to find the password a valid user, you can specify a single user with lowercase L. instead.
You can specify the password list, let's say the password dictionary with uppercase P as a parameter.
If you find a password, for example, while dumpster diving and don't know the user, you can specify
a single password with lowercase P as a parameter.
If one valid username password pair is enough for us, we can use the F parameter and that makes it
to exit when it finds a valid username password Perre.
Now, Serbia is another required parameter of the tool which stands for the target server.
Finally, we have to specify the service that we want to attack and some supported services are.
And a sequel, my sequel, Oracle listener, as I say, Cisco, and the list goes on.
So let's see how we can perform a dictionary attack on S.H. Service using Hydra.
So we want to open a terminal screening, Colly.
Now, I want to test a network connection first between Collee and the target system, which is one
nine to one six eight one zero one one for me at the moment.
Now I want to learn whether the USA service is running on the target, and to achieve this, I'm going
to use the unmap tool.
I know you're already a step ahead of me.
That's good.
The first parameter is the IP address of the target machine.
So let's scan the most common one hundred ports, which will cover the default assess port, which is
22.
Now, the last parameter is to detect the versions of the services if you don't use version detection
and map labels supports according to the default services, for example, if SSA is running on, let's
say, Port 80 and you don't use the version detection option and map labels as service as HTTP, which
is not correct.
So now we've got the results in 12 seconds.
And as you'll see, the SSA service is running on Port 20 to.
Next up is try to establish an SS age connection to the target.
Well, I'm feeling pretty lucky today, and I want to try for the user first, so.
Type S.H. route at the target IPE and hit Enter.
It's asking for the password, so we can suppose that the target system is open to connect with a route
user.
We don't know the password as of yet, so I'll just press control C to cancel the login period.
OK, now, is it time to use Hydra to perform a password cracking attack on to that target machine?
So if you type Hydra and press enter the help page appears explanation what Hydra is and here are the
options.
Now, these are the supported devices, including the S.H. Service.
So let's go ahead and build the command together.
Since we know the route user is enabled for the SSA service of the target machine, we can give a single
user route as the username with lowercase L as the parameter.
The uppercase P is to define the dictionary, which will be used in the attack.
Well, we're going to need a dictionary, so let's search Colly to find one, I'll just use the Find
Lennix command for this purpose.
The first parameter is where it's going to start to search.
It means that it will start searching from the root folder.
Name means that we want to find the files according to their file names.
Now, I want to find the files where the name starts with password.
Star here represents that the rest of the name might be, well, anything.
So it's OK to hit enter.
Well, now there are a lot of files I did not expect that, did you?
So I scroll up a bit.
OK, here I found a folder with the name.
Word lists, so let's go to the folder and look at those word lists.
URLs to list the files.
We'll look at that there are a lot of word lists for different purposes.
Here there's a wordlist Eunuch's passwords that's not a big file, in fact, but I don't want to waste
time while waiting to run along dictionary, so this would be enough for us to start anyway.
And of course, I'll choose a simple password for the SSA service to succeed the attack.
But don't tell anybody else.
The WC Linux command is used to count letters, words and lines of a text file, the result means that
Unix passwords file has one thousand and nine lines, one thousand and nine words and 7000 883 characters
inside useful information.
So let's continue to build a Hydra command, hydra, dash, l root dash, uppercase, p password file,
UNIX passwords, dot text.
After we exit, as soon as finding a valid credential.
Dash Capital V is to show the login and password pairs of each attempt.
That's used to increase the verbosity level.
Target, IP address.
And finally, the service to attack S.H..
And time to run the command.
OK, so al Shabaab, the attack by pressing the control keys.
But please look at the first lines.
There's a warning here which says many S.H. configurations limit the number of parallel tasks and it
recommends is to reduce the tasks using the T4 parameter value pair.
OK, I recall the command by pressing the up arrow and add five at the end and run the command again.
Now it warns me that it will overwrite the restore file of the previous session if we do not abort the
command in 10 seconds, countdown starts.
Now, the attack started, so as you see here, Haidara pauses the attack and every fifth try.
Now we've got the results in seconds, we found the password of the user of the SSA servers running
on the target system, Hydra says the password is password one.
Never seen that before.
Now, I have an SS age connection on the target system.
Haha, well done.