Hello, guys, and welcome to another video of this chapter
in this video, we're going to learn how to perform a Brute-force Attack and
specifically in this situation on FTP, Brute-force, Attack on one of our FTP
servers that we are going to host on a Windows environment.
And of course, we are going to learn how
to detect such an attack by using Wireshark and how to filter out.
The traffic in Wireshark in order to see the freight looking a dent in this.
So let's start.
First of all, you're gonna need to
download in one of your Windows machines, XAMPP.
So once you have installed XAMPP, you can just go ahead and open it
and you're going to need to start File-Zilla, which is the FTP Server.
So just go ahead and start the service
with this machine so you can see that File-Zilla had started.
And these are the ports and we're going to need to add the user.
In our File-Zilla Server
that we are going to use, we're going to add a user
to file File-Zilla Server that we are going to be able later on to Brute-force.
And use Wireshark
to detect that Brute-force Attack so you can just go ahead and press on Admin.
OK.
This panel.
Blow, you can just go to Edit users and.
You can add a user here at the top
the user with a user name of course, you can just press add.
You press the.
And the username that you are not.
And you can press user name that you would
like press ok once you create a username
Once you create a new user, you will need to add the Directory that you would like.
To be in the shared folder, that username.
To be activated, so in this case, we're going to use.
The user.
The user name user.
In this case, we are going to use the username user. Click Ok, and you can see.
The account has started, now we can just go ahead to our Linux
machine and use Hydra, which is the one of the tools that we were using to
Brute-force our HTTP Server that we just set up on
windows and see how before you would go to Kali Linux machine.
You can just fire Wireshark choose
network interface press, start capturing the Picart and let.
Wireshark here captured in the Network traffic, and then in the meantime, we are
going to go to our Linux machine and prepare for our Brute-force Attack.
So here we are in a Kali Linux machine,
and now we are going to prepare for the Brute-force attack by
using Hydra, so did this go ahead by typing Hydra.
So if you would like to learn more about how you set up the command for the
Brute-force, Attack you just go ahead and use the help.
You can just go ahead and use Hydra and
you get all sorts of information about how you're supposed.
How are you supposed to make a command?
So for these Brute-force Attack, we are going to use Hydra
before we set up our command in order to Brute-force Attack our FTP Server.
You can just go ahead and type Hydra and
you can see all the information about how you can construct your
Hydra command in order to Attack FTP or SSH. For that Attack, we can just
go and type Hydra, as you can see of the manual we are going to use.
A file for guessing.
The login name, suppose that we don't know the user name,
although we set it up earlier or FTP Server and we're going to use
a password file and the user name file that we previously created.
So this it's not documents.
So we can.
Go ahead, if you would like to see.
The location of each of these txt files and just go ahead properties and its.
My machine is home.
So we're going to use.
The user name location is a name file first.
Space dash capital P and you stop.
The location.
Of your Password file that you have created or downloaded before.
We would like our results to be proposed, so in this case, we're going to
use Dash v capital V, and then we
going to write the IP of our target.
So in this case.
The FTP Server is sitting on localhost on our machine, so we are going
to use the IP address of are we dismissing to Attack, which is in this case is.
And then space.
And then we can write FTP in order to start Brute-force.
So let's just go ahead.
Remember that we fired up Wireshark on our
Windows machine, so we are expecting it to cut or.
So we are expecting it to catch our looking attempts, so let's go and
perform the Attack by pressing under and you can see those multiple attempts.
And we are going to wait for our attack to begin.
And we are going to wait for our Attack to
finish before we go to our Windows machine and see if Wireshark captured.
It felt like an attempt on our FTP, so now we are going to press enter.
In order to perform the attack on our target machine and.
While we're waiting for the Attack to finish the Brute-force Attack.
We are going to see if it found the correct username Password, and of course,
we are going to run back into our Windows machine
to see if and how Wireshark captured this
traffic, this unusual traffic, or enough to be port with the looking attempt.
So as you can see, there is all sorts of combinations
happening between the username and password from these two files that we used
you can see all the Brute-force Attack has finished.
And as you can see, it found the username and password.
So now we can use
this conditions to remotely Exploit login and Exploit that service.
But that's not what we're here for, so
let's run back to our Windows machine and see how
Wireshark captured this attempt for locating the Backdoor windows machine.
We have Website here still capturing what
we are going to just go ahead and stop this traffic capture.
And remember that we started capturing
network traffic long before we start the Brute-force Attack from our Kali machine.
So there is a lot of like stuff happening
here and you can, of course, just go ahead with one by one.
You can see here there is a request that is captured from our Kali Linux machine.
About the user attempt, but you can filter out the looking at them if, let's
say you have like a Server that is like multiple connections happening so you
don't have the time to go through each and every line.
You can just go ahead and apply the FTP display filter Wireshark and the
results appear for the protocol to be and how many requests have been made.
So user is a Brute-force Attack is.
In this case, we're using a dictionary
Attack it is like a normal looking attempt, except the Plugins had been done.
Uh.
As we demonstrated by a program instead of a human, so.
The passwords and the user names are
coming from a text file and the login attempts are tried
repeatedly, as you saw from from HYDRA in this case, until it succeeds using a
username and password combinations from the list that we provided.
So in this filter that we applied on
in our Wireshark, you can see that there is multiple request with the same username
name trying different passwords for the user name.
And then the next on the list, which is the same user name
like in this case, Péter, different from the last time, which is user name and.
trying multiple Password to see if it fits the username so
we can achieve Login, so you can just go ahead.
This is.
Definitely not a human train the same.
A user name and password all over.
For the same username, so there you go, you have it.
This is how you can filter out from all
this traffic that you captured, possibly from FTP Server, so you can see
a suspicious looking attempt in your network traffic.
So that was it for this video.
And when you're ready, please go ahead and click on the next video.
What are you going to learn?
How to detect suspicious traffic with Wireshark?