‫Hydra is a free and open source command line tool to crack valid login password pairs online.
‫It's very fast and flexible and new modules are easy to add.
‫Hydra is embedded in Colly, but before using it, we'd better see some of its parameters.
‫You can specify the username list, let's say the user directory with uppercase L parameter, if you'd
‫like to find a password of a valid user, you can specify a single user with lowercase L parameter.
‫Instead, you can also specify the password list.
‫Let's call it the password dictionary with uppercase P parameter.
‫If you find a password, for example, while dumpster diving and don't know the user, you can specify
‫a single password with lowercase P.
‫If one valid username and password pair is enough for us, we can use the F parameter and that makes
‫a tool exit when it finds a valid username password Perre.
‫Server is another required parameter of the tool which stands for the target server.
‫And finally, we have to specify the service that we want to attack some supported services are http
‫post form, https post form htp get form, https get form http proxy MSFC.
‫Well, my Uncle Oracle listener, S.H., Cisco, etc.
‫Every protocol has its own unique options to set.
‫We'll see the options for HTTP post form in the following demonstration.
‫So now go to Collie and run a Web browser.
‫Do you remember Oos broken web applications, abbreviated BBWAA server?
‫Well, it's on my network with the IP number of one three nine.
‫Right in the IP address, in the address bar of the browser and hit Enter.
‫Now here's the homepage of the WASP BWP.
‫I'll scroll down a bit and click down vulnerable web application link.
‫Now, we arrived at a login page that asks for the username and the password.
‫Now we don't know any credential and we'll try to find a valid username, password, pabai online password
‫tracking attack.
‫To open a terminal screen, Hydra is embedded in Cali, so you can start to use it simply by typing
‫its name if you type Hydra with no parameter, the help page appears.
‫Here is the list of options and supported services.
‫So let's start to build her attack.
‫Elle is the first parameter to keep the attacks simple and fast, I suppose that we'll know a valid
‫user, which is going to probably be admen.
‫So I'll use the lowercase L parameter.
‫Now we specify the password dictionary with uppercase P.
‫Well, there are some dictionaries in Colly, let me find them and I'll use one, so I open a new terminal
‫screen and search for the dictionaries using the Find Lennix command.
‫So I'm looking for the files that start with pass and have.
‫That NIST extension.
‫I found a few.
‫So let's look at the contents of one of them using the less Lennix command.
‫You can search a phrase with forward slash indicator within the last command.
‫So I look for admin if the word exists in the dictionary.
‫Well, because I know the password of the admin user is admin, and I want to show you a successful
‫attack.
‫OK, now this is the target server, oos BBWAA one three nine, I have to specify the service we attack.
‫So to learn the service, let's go to the browser again.
‫But before trying to log in, I run berp.
‫Sweet.
‫Now, I think I should tell you a little bit about Sweet, Sweet is used in Web application penetration
‫tests and I've explained and used it extensively in hacking Web applications and penetration testing.
‫That's the course that fully lays it out in detail.
‫But I'll just give you a little introduction to it now if you haven't done that course.
‫Berp Suite is a Web application penetration testing framework, it has become an industry standard suite
‫of tools used by information security professionals to identify vulnerabilities and verify attack vectors
‫for Web based applications.
‫I suppose in its simplest form groups, we can be classified as a personal proxy or interception proxy,
‫a penetration test configures their Internet browser to route traffic through the proxy, which then
‫acts as a sort of men in the middle by capturing and analyzing each request and response to and from
‫the target web app.
‫Individual HTTP requests can be paused, manipulated and replayed back to the Web server for targeted
‫analysis of parameter specific injection points.
‫The injection points can be then specified for Manuell, as well as automated fuzzing attacks to discover
‫potentially unintended application behaviours, crashes and error messages.
‫You got all that?
‫So now we can continue to the online cracking session with Hydra.
‫Suite is started.
‫We have to route traffic through berp suite to be able to listen to the requests and responses and analyze
‫them.
‫So to do this, we should change the proxy settings of the browser to listen to the port AT&T of the
‫localhost, you can change the proxy of the browser from the preferences menu.
‫I just use Foxe proxy.
‫It's a plug in to change the proxy of the browser easily.
‫This little Fox icon is Foxe proxy.
‫I'll click on it.
‫And here there's proxy settings for the port AT&T of the localhost.
‫Now you can use the proxy from your browser's network setting as seen in the picture here.
‫So I'll choose the proxy localhost 80 and now my browser's traffic is routed through the sweet.
‫So now I'll make a logging attempt.
‫So intercepted the login request, it's a post, so we find the service to attack.
‫Back to the Heidrick query, the next parameter is http post form.
‫Now is the most critical part of building a Hydra attack, setting the options of the service.
‫There are three parts of the options of the service, HDP post form separated by the calling character.
‫The first part is the address of the authentication forum.
‫The second part is the form parameters, and here they are, I'll copy them and paste them as the second
‫part of the service options.
‫Now, this is an important point.
‫Again, the place that the password's will be set for online tracking attacks are labeled as pass between
‫two carried signs.
‫Same as a password feel the place of the username is signed as user between two correct characters as
‫well.
‫The third part of the service option is a unique part from the response message of a failed logging
‫attempt.
‫So I go to the browser, copy the login, failed message and paste, that is a third part of the option.
‫I think the service options are ready.
‫So at last, I put a F parameter to make the dual exit when it finds a valid credential.
‫So we're ready to run the command now.
‫Just hit enter and online password cracking attack starts.
‫Now, we'll wait as much as it takes it reports every minute.
‫And this is the first minutes report, 933 TREIS per minute, that's pretty good, and it says it has
‫2600, 26 tries to do.
‫Now, he had found a valid username password Perre, just after the second minutes report username was
‫already fixed admin and it found that the password is admen for the user.
‫And since we use the F parameter, it stopped working as soon as it found a valid credential.
‫Now we can go to the app and enter admen for the username and again admen for the password to log in.