Now that we have a wordlist ready, whether you downloaded it from the Internet or if you created it
by yourself, now we can go ahead and proceed to gaining access to our target website using a wordlist
attack.
So we're going to use a tool called Hydra and Hydra can be used to brute force any type of service,
really, I can't think of any service that you can't brute force.
So it's a really handy tool to know how to use.
We're going to do our example on a web login, but you can use it to gain access to stage FTP routers,
anything that asks you for a username and password.
Really?
So to use the tool, the first thing we're going to do is we're going to type in Hydra.
And we're going to put minus help to see how to use it.
Now, as you can see, there is a lot of options for the tool, but don't be overwhelmed with that.
They're all pretty simple to use.
So.
If you go up, you can see that the main syntax of using the tool is you, the first thing you have
to do is put in the name of the tool.
So we're going to put Hydra.
And then we're going to put the service that we want to attack so you can see that they have examples
here of you attack in an FTP service, people attacking and IMAP service and other type of services.
So in our example, we are interested into gaining access to our log in here to to this page.
And we're going to assume that we don't know a username and password and we're going to try to log in
to the admin without knowing their password.
So our target service is going to be this one.
So the first thing you want to use is its IP, so the IP is 10, 20, 14 to 12, so we're going to put
it after the name of the tool.
Then looking at.
The syntax here, you can see that we have to specify a login and a password, so let's have a look
on the minus L and the minus options in here.
And you can see that you can use a small L to specify one username or a capital L to specify a list
of usernames.
So in our example, we're only trying to gain access to the admin.
So we're not going to use a list of user names are only going to try to gain access to the admin password.
So what we're going to do is we're going to do A minus L small and then we're going to tell it that
the username is admin.
And then the next thing we need to specify is the password.
Or a password list.
So similar to the other option, you can use a small fee to give one password or you can use a capital
P to specify a file or a wordlist or a dictionary of passwords.
So I'm actually going to modify the passport file that we created in the previous video.
I'm just going to open it in my text editor, so this one, it's right here, it's called test text
and I'm just going to add the password for the admin.
I know the password for the admin is called Admin Pass, and they'll just add it somewhere in the middle
here.
OK, so I'm going to save it and quit it.
And now our word our word list contains the password, so we're going to do minus B tap top and then
we're going to give it word.
The password list is stored and stored, include text or text.
So everything is good until now, and there is only one more thing to do.
We still haven't specified what type of service that we are attacking.
So we gave it the IP, we gave it the user name, and we gave it the list of passwords to try.
But Hydro still doesn't know what type of service that we're going to attack.
And that is the most important option and the option that you need to pay the most attention to, because
this is where it gets a bit tricky and this is where things can go wrong.
So before I start talking about that, I'm actually going to copy our commands so far and I'm just going
to paste it in a notepad.
So all we have to do now is tell Hydra what type of service and how to use the service to brute force
the username and password for me.
And you can see here in the help, it's telling us that these are all the type of the supported services.
So as I said, I can't actually think of a service that's not supported.
So you can have a look on all of these and try them.
What we are interested into is the TTP and you can see that there's going to be a minus and it's going
to be either get or post depending on our target.
And after that, it's also going to be a forum because it's sent through e-mail.
And I'll tell you why it's going to be like this.
Now, let's go down.
So I'm going to right click in here and I'm going to go to inspect Element.
And I'm going to click I'm going to look for something called Forum, and you can see that there's a
form, there has to be a form in the HTML pages and look for the method.
I'm going to zoom this in for you.
And note that, and here it says that the method is going to be post, and that way we know that it's
a post.
And if you look at the URL here, you'll see that the URL is a HTTP.
It's not a https.
So therefore, our module that we're going to use here or the service is going to be http post form.
So it's right here.
You can see it all the type of services, like I said.
So it's http followed by a minus, followed by post and followed by for and to see how we can use this
and to see an example of how you can use the service.
I'm actually going to control see this and I'm going to say Hydra minus you and I'm going to give it
the name of the farm or the name of the service that I want to use, which is going to be HTTP.
Post.
Form.
As you can see now, again, it's giving you a long description about how you can use the service and
at the bottom it gives you examples.
And the examples are amazing.
The examples are really good because you can just copy and paste them and adapt them to your target.
So the format of this service is you give it the location where the brute force where you want to brute
force the form from, you're going to give it the user parameters.
So whether it's a you whatever this parameter is called, and then you're going to give it the password
parameter and then you're going to give it the incorrect message.
So when there's a failed log in, what happens to the webpage?
So I'm going to copy this the way it is.
And we'll get a modified to adapt to our target.
So the first thing we want to put is the page that the login happens from, which is this page.
So we're going to put all of this instead of log in to be here.
So that's all good.
Now, the next thing that we need to modify is the user and the person.
So these are the names of the parameters that are sent to the Web application and we don't know what
these are called.
And for this, we're going to use batsuit.
Now, I'm not going to show you how to configure this because we've done that before.
So I'm just going to turn my interceptor on and I'm going to log in with our own username and password.
So I just want to see what gets sent to the target web application.
So I'm just going to log in with the user name admin and just any password.
So I'm just going to put random characters hit enter.
And I'm going to go on the headers.
And this is what's being said, so you can see that the username parameter is just called username,
so I'm going to copy that and put it here instead of user.
And we can also see the password parameter.
Again, it's called password instead of pass.
And you can see that we also have an extra parameter here, which is and log and submit button equals
log in.
So you need to add that as well.
And in your case, if you had other things that's being sent, you need to add them as well to your
request.
So we're going to add that after the pass here.
Exactly the way it is, we're not going to modify anything, so it's just going to be and log and submit
button equals log in.
The last thing that we need to modify is this part and this part is the way that Hydra is going to know
whether the logging is successful or unsuccessful.
So the way this is going to work is you either give it a capital F equals to the unsuccessful, so it
equals to the failed attempts or you can give it a capital S and you tell it what happens when a successful
logging happens.
So in my case, I'm going to give it a capital F to tell it what happens when I feel like it happens.
And I'm just going to turn off the interceptor now and we can see that we have a failed again.
And in a field log in, you can either use this or in my experimentation, it was easier to just use
this.
So if you just use the message right here that says not logged in, so we're going to say F equals.
So this is the most part, the most important part and the most tricky part, I would say, of the whole
attack, so I'm going to go over it again.
We can see that the Holocaust is separated by three clans.
The start of it is the location where we want, where the page that we are going to brute force is.
So we took that from here.
The second part is the parameters that are going to be dealing with and that we are going to be sending
to the server and we took that from suit.
And the third part is the way that it is going to know whether the slogan is successful or unsuccessful,
and we gave it capital to tell it that this is what happens when the password is wrong.
And we told it that you'll see a message called not logged in.
So we're going to combine this with the command that we already had, so the command that we already
had was Heidrun, the IP.
Followed by the username that we're going to use, which is Admon, followed by the password list.
And we're going to put all of this after it.
And that's it, that's our command done.
I'm going to copy this.
Pasted in here.
And execute.
And I forgot to tell it the type of the service that we're going to be attacking, so I only gave it
the I only gave it what it should send, but I didn't tell it what type of service we're going to attack.
So like I said before, it's going to be HTP.
Post four, so it's the same service that we were inquiring about when we use the option.
So again, copy this.
Pasted here, hit enter.
Now you can use the minus V option so that Hydra would actually display every request it sends to the
server I and use that right now.
So all this is literally just a blank screen, but we're going to wait for it until it finds the password
for us.
Hydra also supports pause and resume.
So if you just control C out of this, the next time you're on it, all you have to do is just put in
minus R and that'll actually allow you to continue from where where you left the last time.
And as you can see now, we managed to find a valid username and password and you can see that username
is admin and the password is admin pass, and this works against any web log in.
So it literally this Web log, it doesn't read, doesn't need to have any Ezekial injections or JavaScript
or Exercice or anything.
So now I can log in with username admin.
And password admin pass.
And as you can see now, I'm logged in as admin.