Welcome back.
Let's continue with our brute forcing of a page so we successfully brute force the welcome login screen,
but now we also got this brute force page right here that also requires username and password.
Now, this is pretty much the same thing.
Just this is a different page to the syntax of the Hydra command will be different.
Of course, if I were to type admin and password right here, it would still work.
It would tell me.
Welcome to the password protected area admin.
But if I were to type something like a test and then test, it would not work this time.
So we must craft a specific command just for this pitch.
If we were to use the command that we used from the previous video, which is this one, it would not
work because it is not the same page.
It is not the same type of HTTP forum post, and it is also not the same type of field.
So let's clear the screen right here and let's start crafting our comment.
We're going to start to the same, which is Hydra and then the IP address of our target machine.
Remember that in the previous video we used HTTP forum post because our usernames and passwords were
sent with post request.
This time, if you take a look at the link right here, we can see that the usernames and passwords
are being sent inside of the link.
And this is a good indication that this is a get request.
Of course, you can also check that by visiting the page source, finding the form where you submit
usernames and passwords and here it is.
And under the form we can see that the method is get.
So this time we cannot use http forum post, we must use http get form.
So this is the syntax.
Once we're sending the get the request, the next step is remember we opened it up with quotes and in
between the double quotes, the first argument is specifying the path to the page.
So we must go right here.
Let's close this and let's just refresh this page just so we can get the path to it.
So I'm just going to go right here and right here and we get the path to the page, which is going to
be TBWA Slash Vulnerabilities, slash brute and slash at the end.
Copy this and specified as the first argument right here.
And remember, once we do that, we separate the second argument by typing two dots.
And now comes the part where we specify the username, password and button field.
So let's go to the page view page source once again and let's find the name of the user name field first.
Here is the form.
The first part is the user name field and its name is just username.
So let's go to our comment and type username equals Pereiro user Pereiro, we separate the user name
from password to design.
Let's go and check out what's the password name.
It is just password and let's do the same as in the previous video pass a PEREIRO and the last part
is the button, which we can even get from the link itself.
So if I type alow as username and world as password, we can see right here in the link that the button
login equals login.
So we can just copy this.
Go to our comment and paste it right here.
And the last argument inside of the double quotes is, if you remember, we must specify what is destroying
that we get funds.
We specified the incorrect username and password and we can see it right here.
It says username and or password incorrect.
So let's just hope is.
And let's based it right here.
Great, now, if we go outside and specify that Shell and then usernames, 30 and 40 passwords at 60,
if I press enter.
You will notice that it will not work.
It will tell me that every username and every password is correct.
Sometimes when this happens, you haven't specified enough arguments, either you have a syntax error
inside your command or you didn't specify something well, or you're missing additional arguments such
as the cookie value.
So sometimes we must specify the cookie value also in order for this to work.
Let me show you what I mean.
To specify the cookie value, we must go right here.
And before closing the double quotes, we're going to add another arguments so separate to dots and
we can type H dash cookie, two dots and the cookie value right next to it.
How do we get the cookie value?
Well, we get it with the help of it.
So let's find the HTTP request where we send the helo and world as usernames and passwords.
And let's see what cookie do we have right there.
So let's go right here.
Let's try to find it.
It is right here, deep vulnerabilities, let's just find the correct request and here it is here we
can see inside of the link that we are sending helo as username and world as password.
And the cookie that we have is this right here.
So we want to copy all of it, including the security equals low and including the session ID equals
and then our cookie value SCoPI that go to the command.
And right here you can paste the cookie value.
So after the two dots, each dash cookie, two dots and then the cookie value right here.
If I tried once again.
Well, now it works.
Now it tells me that the username is admin and that the password is password, just keep in mind the
sometimes Hydra doesn't really make a difference between capital and lowercase letters.
That's why we got two results right here.
But it gave us the correct username and the correct password.
So once you notice that the brute force doesn't work, try adding this cookie value and then it might
actually work.
Because if you remember, once we didn't have it, it gave us that all of the usernames and all of the
passwords are valid and that we can log in with all of that.
So the difference once again between this and previous command is inside of this http get form because
we are sending with the get request, then we have the different link.
The username and password fields are the same and the string that we get once specifying the incorrect
password is also different.
And here we also specify a cookie value, which we didn't have to specify in the previous video.
OK, great.
Now that we covered the Hydra tool in the next video, I will show you a way how you can perform brute
force much, much easier with the help of Burset to see you there.