In this video, we are going to see what is brute forcing and how we can practice brute forcing with
dam vulnerable web application.
We are going to solve brute forcing challenges on dvwa with burp and hydra.
Brute forcing is a technique used in computer science to try a large number of possibilities, such
as passwords or keys in order to find the correct one.
It involves trying every possible combination until the correct one is found.
We will use Burpsuite and Hydra to brute force the login form provided by Dvwa.
In this challenge, we will test a password list against the user and try to log in as the target user.
Now you should be on Kali Linux or Parrot OS in VMware VirtualBox or running natively on your PC.
Now let's first see the low difficulty brute forcing challenge.
Go to settings and set the difficulty to low.
Now fire up the burpsuite in your Kali Linux Set the proxy in your Firefox to use burp as a proxy.
You can also use the Foxy proxy add on to set the burp proxy.
To submit a request from Firefox to log in with the wrong credentials.
The complete request will be shown in the BRB.
Now right click on it and send it to the intruder module.
In the intruder module, clear all targets and locate the password file and add it as a target.
Now in the payloads tab, you can set the word list.
I'm using John dot list.
Now start the tag.
BRB will try to brute force it.
Keep looking for the response size.
The request response with the changed response size will be our matched password.
We can also do this attack with Hydra.
Hydra is a network login tracking tool that is used to perform brute forcing attacks on network protocols
such as Http, FTP, Telnet and SSH.
Hydra can brute force the password much faster than Burpsuite Community Edition.
However, you need to format the command for it.
You need to provide it complete URL of the form which you can get from the network tab.
If you inspect a page, just replace username and password with the capital user and password respectively
with flags.
Get the cookie information from the storage tab in the debug menu.
And set the login failure information with the F flag.
Then you can use the following command to brute force the password with Hydra.
Their admin is a target user and we are using a word list to crack the password.
And the target is to get form.
Once the password is cracked, it will be displayed on screen.
Now let's get to the practical part.
So on your machine, you can see a web application just change the security level to low.
Now select the brute force tab.
And you can see a login form.
If you try to log in with the wrong credentials, you will get the error username and password incorrect.
And if you look at the you will see the complete URL which indicates that it is a get request.
We can also get the complete URL from the network tab.
Just inspect the page, go to the network tab and you can see the complete URL.
Now start the burp suite.
Create a temporary project.
And go to the proxy tab.
Now set the Firefox to use burp as proxy.
If you have Foxy proxy addon installed, you can just click on Burp.
Not done on the intercept in burp and send a request from Firefox.
And the request will be captured in burp.
Now, right click on the request.
And send it to the intruder.
Now clear all targets.
Choose the password field and add it as target.
Now in the payloads tab.
Select your word list.
I'm using John Doe list in this case.
And now start the attack.
Burke will start cracking the password.
Keep an eye on the length tab.
You can sort the responses by length size by clicking on length tab.
You can see that the password payload has a changed length size.
Which means that it is our correct password.
You can check it in the response tab.
And you can see that we have received the response.
Welcome to the password protected area.
You can also check it in our main tab.
Now from the inspect tab.
You can go to the network settings, get the complete URL of the page.
Go to the storage tab, get your cookie values.
And format the Hydra command, as we have discussed earlier.
Now use the command as shown on the screen.
Just press enter and Hydra will crack a password.
Now let's just solve the medium difficulty.
Brute forcing challenge.
The medium difficulty adds a delay between different attempts and can be solved in a similar fashion,
but the tech will be much slower.
Just capture a new request and send it to the intruder and brute force it in a similar fashion.
You will notice that only the cookie value has changed to medium and the attack is much slower.
Similarly in Hydra, we just need to change the cookie value to medium and use the same command as a
flow difficulty and we can still get the medium difficulty password.
We will notice a much slower attack, but we will be able to break through it.
Now on your Kali Linux change the difficulty to medium.
Go to the brute force tab.
You can view the source code at the server.
And you can see that only a sanitization of user input is being performed.
And the other thing is that it is adding delay of two seconds.
Nor in Burton the intercept on and capture a new request.
Send it to the intruder.
Clear our targets and use the password field as the target only.
Set your payload as John Doe list file.
And start the attack.
BRB will start cracking the password.
But you can see that our responses are much slower.
And Burp has successfully cracked the password, which is password in this case.
Now to crack the password with Hydra.
Use the command as shown on the screen.
We have just changed the cookie value to medium.
We are using dash V flag to get more information from Hydra and dash.
I is being used to ignore any errors if there are any.
And you can see that Hydra has successfully cracked the password, but it has taken much more time than
the last challenge.
Now let's solve the high difficulty.
Brute forcing challenge.
In high difficulty.
A csrf token is generated for each request, so it becomes very difficult to brute force through it.
Hydra fails completely and give false positives so we cannot use it in isolation to break the password
in high difficulty.
Now generate a new request and send it to a burp proxy.
Following the same steps, send it to the intruder.
In Tudor we need to perform a few additional steps.
Select both the password and token fields as targets.
Now change attack.
Type to Pitchfork.
Attack.
Now in payload section for Target one select the same John dot list file for the second payload select
to use recursive grep.
Now in the options tab, add a new grep extract and select the token to extract it.
Ensure that the reader actions are set to always.
Now in the resource pool, create a new pool with only one thread and start the attack.
The bird will find the password, which will have a change response length.
Now let's see the attack in action.
Back on your gorilla necks.
Change the sky to high.
First of all, let's use Hydra to brute force it.
And you can see that it is giving us false positives.
If you look at the source code, you will see that it first of all checks for anti csrf token.
So in verb, turn the intercept on.
The rate a new request.
Captured it in burp.
Forwarded to the intruder.
Change the tag type to Pitchfork.
Select the password field as your first target.
And token field as your second target.
Now go to the payload section.
Now choose John Dot list as your first payload list.
For the second payload set.
Change the type to recursive grep.
Now go into the options tab.
In the grape extract section.
Click to add a new grape extract.
A new window will open.
Click on Fetch response.
Find the generated token.
And highlight it.
Now choose the option to start at offset and end at fixed length.
And click okay.
Now in grab mass action.
Clear the existing list.
Add incorrect as we received password incorrect response in case of a wrong password.
So scroll down and set the redirections to always.
Now go to the tab of resource pool.
Now create a new resource pool and set the threads to one.
And click on Start Attack.
And you will see that BRB will start cracking the password.
And in a few seconds it will crack our password.
The tag is much slower, but it will still work.
And we can see that it has found our password.