Welcome back.
I told you we would do some more fuzzing,
and this is a great lab to test out some fuzzing.
In this case, we're going to use Hydra,
which is great for logins.
Hydra, from Greek mythology, multiple heads.
And just like Hydra, we can try being multiple users,
authenticate into, in this case, a web app
and see if the different users and different passwords
that we feed it will eventually get us to the right spot.
So let's jump into the environment.
We need our IP address.
It always changes in these labs, and that is perfectly fine.
I'll do it here, and just to show that we've got it.
That's HTTP and our MySQL server.
Let's take a look at what we're messing with.
There's a few things that we're going to need for Hydra.
We go to the homepage, and it redirects us
to this login page.
And we've got our login, and we know the credentials here.
But what happens if we don't know the credentials?
What if I put like random and password.
What does it say?
It don't say above here.
Do we get-- oh, hey, invalid credentials or user not
activated, exclamation point.
OK, cool.
That is perfectly fine.
We know what we want to attack.
So Hydra.
Hydra-- it says don't use in military or secret service
organization.
Sure.
The syntax, hydra, and then if you want to do login,
you could do passwords or capital P for a file, login,
like if you've got a file, capital L,
otherwise individual logins.
OK, you can output to files, and it explains it more here.
It's fairly straightforward.
And then what you do is you replace certain variables
with pass or login.
Let's try it out.
So we've got hydra--
oh, let's make some password lists and a user list.
So a couple of these are going to be--
let's just-- nano users, OK.
No, no, it's fine.
Let's just call it users.
And admin, bee, Josh.
That's our user list.
We'll save that as users, and in root is perfectly fine, OK.
And let's get users, boom, it's right there.
Awesome.
And then let's go grab--
let's cat user share word lists.
And what's a good word list?
How about-- I think you've got one right here,
should just be--
oh, I've got them on my desktop.
Let's go there.
So root, desktop, word lists.
OK, I guess that's the only one in there.
Yes.
And we'll just want to cat it and put them
all into passwords.
And we get head passwords, boom, top, 10 sweet.
Let's also make sure that bug makes it into passwords.
If we tail passwords, OK, bug is on there.
We know what the login for this is, it's bee and bug.
So I just want to make sure that we get good ones in there when
we run Hydra.
It'd be a shame to go through all of this
and not find anything.
So tech L, and we have users, and tech capital
P and passwords, tab, completing those to make sure that I
hit it the way I wanted to.
And I'm looking up at my browser, 192.107.115.3.
And then the way that we are attacking
it, let's go take a look.
This is the login page, let's view the page source.
Here, it's a post request, what is it asking for?
We log in and login, password and password,
and that should be good.
So it is an HTTP post form, it's what it posts.
So we will tell HTTP post form, and it is login.php
and then our, right, login.php.
And then login, and that's going to be equal to
and then we do this cool thing with Hydra,
uppercase user with these up arrows,
and that's then going to use our list over here.
And then an and, and passwords.
Password equals and pass capitals with the up arrows.
And then we also need a security level.
Security level, it's rare.
Also citing a security level, so 0, 1, or 2.
You see 0, 1, or 2.
And we'll just go with 0 because 1
equals 0, heck with this full screen.
And we also need the pass form equals submit.
And we could-- I mean, we could test this just
to make sure that that's all the things that it needs.
I mean, the last one here is submit.
And it's form value submit, so that should be the last of it.
We are comfortable with Burp slight here a second, a minute,
Burp's got to start up.
But let's just check to make sure
that, that is exactly what it's asking for.
Send this to Burp, refresh the page, and--
yes, so login equals and then we are replacing user.
I mean, you could just copy this whole thing
and then just replace those things.
That would have been a lot faster.
Security level equals 0 and form equals submit, boom, done.
That is there.
And then what we want to add is then our negative reply.
So let's turn off the--
oh, it's right there.
That invalid credentials or username not activated.
We want to steal that and include that here.
That way, we are telling Hydra what
it should be looking for like rejects on a page
if it doesn't get the proper login.
And let's-- is that everything?
Hydra, login, user, capital P, passwords, URL,
it's an HTTP post form with this destination, this information,
and invalid credential.
OK, sweet, send it.
It is attacking with all that-- wow, that was fast.
That was really fast.
It said you used 16 tasks per server,
303 login tries, and that didn't take very long at all.
We came across bee and bug, and that's the only valid password
and username.
Fairly straightforward.
I'm a fan of Hydra.
It works really well, goes very fast.
Using password lists is really helpful,
and making good password lists is crucial.
So information gathering, we got a lot of passwords.
Well, usernames, hopefully.
Login credentials, hopefully.
This is where we're going to test them.
We throw them into our word lists,
and then we can utilize Hydra and run through them
very quickly.
And no matter--
I don't know, you get to a certain point
and the word lists are really long,
but if you set this up correctly,
it can go pretty fast and be really helpful.
That is this lab, and we'll jump into the next one.