Hello, and welcome to the next video, example of
Brute Force attack on this
video, what we are going to learn. So, we are going to learn the basics of Brute Force
attack, and I'm going to explain the whole process. So let's
open the lab setup.
The guys I'm inside Kali Linux machine and
we're learning about an attack example and
we are taking care of Brute Force attack. So,
what is good for sore back? So for
example, if you have a website and you
have login page has inside it. So what we can do
here, we can create a username list. We can create a password
list and we can basically create combinations
that we can attack on the login page to get
access inside. We don't have
username and password, but we can create a list
and then we can attack.
If there is no restriction.
Then we will be able to perform Brute
Force attack the Restriction. Then
obviously, we are not able to perform what kind of estrogen examples.
if use it as
provided three incorrect, username and passwords for
application can lock the account. But if
this facility is not, were not available. It means, if this
person is not available, then obviously we can
perform Brute Force attack with the thousands of words or
username and passwords. We can create
combinations and then attack.
So let me
show you an example of Brute Force attack using burp read.
So first of all, like me up in Berkeley today.
Here we go.
All right. Now we're taking how about
Intruder in this example, so we
can perform attack with the help of intruder. We can
insert a load with dolphin too. So I'm
taking elephant or the folded. Let's check
the proxy settings. Sunset, proxy and deception, Beyond in
options. Proxy should be sent here. 127. 0.
1. + 88 is the most food
is all set. Let me open the browser.
So I can minimize this. Let me open a new browser.
Packages of 3 test page. We don't want the web. Com login
page.
So let me up in foster fall like a
sting page to test bhp.com is
our Target.
Here, we have the sign up page.
and here we go, so this is
basically
The login and password page but we
have no idea about login and password, but you can see here that
please use the username test and password test because it's
a sample website, but I'm assuming
that we have no idea about the
credentials or username and password. So how we
are going to perform Brute Force attack on this webpage.
Interesting.
Now, we need to generate a request so
that we can intercept data questions. I'd love to read. This is
the first step for that. We
need to change the proxy settings off the browser celebrity
in the boxes thing. We are on the beach. Then she
is a proxy settings. All right, so
references.
I'm here. You can pick up
settings.
Then you can select manual, proxy configuration provide
IP address 127. 0311. Number 8080,
selected use a proxy
server for all protocols to remove everything
from here and Jordan Creek, okay.
Next is we need to provide some parameters are
because username and password is available.
So we need to provide.
Example, I'm typing. Admin. Admin.
Obviously does not write your name and password and username password.
It's test test, but we are just sending a
request with the amateur in Burke Street. So when
I click login, it will generate a request that it
could be intercepted by Webb Street. And you'll be
able to switch seat inside.
Okay, let's click on login.
Here we go. Let me go back to bed, flute.
so,
it does not intercepted.
Let's try again. Interceptors on.
Alright, let me try again.
Go back in browser.
Try again. All right.
Bruxie in City of Industry. We have
a request now that we have to be. One of them. Calm.
If I click here.
I can see the request.
I can see here. The page was user info. BHP,
and the exact URL was test.
We don't want the web. Cam says, login. BHP.
Now you can see here that we have provided the username
and password. So username of admin and password was admin,
obviously does not right username and password. So we
will not be able to login inside application. Okay, so
we have successfully intercepted, a request
inside Brookfield. Next is,
as I already told you, we are going to use
Intruder function inside Brookfield because we
have not used it yet.
So let me right click right click
and you can send this request into into that. Send
you into.
You can see here. The color has changed click intruder.
Inside that you can click on positions.
And I you can see here that we have
the same request inside Intruder. Now, destroying YouTube Alameda.
CA when is use an email about his password automatically. If
you can see any of the parameter you need to clear
it, so I need to select it and then click clear.
All right now and attack type as
we are performing Brute Force attack. So we need to
select her cluster bomb. All right.
Everything is fine if I select your
pillows, so we need to provide pillows here. Means
username list in password list, so you
can generate a list are
easily and you can try there. Otherwise you can
also paste.
Passports one by one. So as we're
just testing you, so let me insert your photo
username and CR for passports to check.
So, first of all, number
one is username. And number two is for passport select.
Select number one year.
So I'm interesting 300 password to
Ingrid usernames and one correct. Use an
image that don't like me. Diaper example, Sunol.
Add an admin.
At it and let's try 3. So
I'm typing your final. Okay, so
two incorrect, one connect again, select
a number to for passport, then provide
any other like guests.
Added route.
That's what I do them in basketball this test. So just
checking.
So this is for username. This
is what password. Let's see. If Intruder
can provide us the right combination of username and password or
not.
Everything is fine in options. You don't
need to change anything and be Lord. We are set to
be loads are Asians Asians one
for username of OnStar password. That's correct. Interrogatory other
idea whether everything is set here
now it's time to start it at
So on the right hand side, you can see it but don't
start attack. So what it is going to
do, it is going to take combinations of cinnamon
password.
I will check the click on Star Trek.
If you go so you can see here that the disgusting and
it's not done yet. You can check below.
All right, so you can see here that you just taking
username and password one by one.
Alright completed. You
can see if so how we
will know which user name and password commission is
correct to login inside the website. First
of all, you can check the status in status.
We can see 302 302 in everywhere. But
if you can check the last one, last, when it's 200 means looks
like this is the username and password. Destin best
example, if you have thousands of username and password in
your list, you can test it with the help of our Fleet
and buff, it will take some time, but they are surely right?
Username and password is available inside the list, shauni, Williams.
And also check length so you can see his land is
253. But if you check the last one, we just 6287. It
means this is the right combination of
user and password. And we have successfully.
So username is test and password, is better than combination.
That's how you can perform Brute Force
attack inside an application. And we
have used introduction inside.
Read. So we can build it.
Let me change the proxy settings again. Note to
no proxy.
Settings. No proxy.
Let's try to login.
Especially.
Let's try that. I do the name and password test.
Best.
Click login.
And here we go. We are you can see the logout
button.
So I just wanted to show you a simple attack with the
help of Brookfield and we have also used a new
feature in box, it reaches into. So
this is all about the scanning
process inside Brookfield in the
Mexican. We are going to learn the manual techniques
to perform attack.
So, in the next election, we are going to exploit vulnerabilities
in of application.