Welcome back.
In this video, we're going to be creating a brute force tool using our python skills.
So in the previous section where we talked about the application penetration testing, we covered tools
that are used for brute force.
But this time, I want to see whether we can create our own tool that will be able to brute force a
login page.
Now, before we even start, I want to mention that this tool will not be universal.
So for every different page, you will have to perform some minor modifications the same way that we
did inside of our Hydra tool and inside the bubble.
It nonetheless let us see how we can create it.
So if I type Élysées and navigate to my desk directory here, we got the tools directory for our coding
projects and here I'm going to create the web app test directory so I will never get there.
And currently this directory is empty.
So let's send our Python program.
We can type NENO and then brute force dot p y.
Great, now there is only one library that we are going to need to perform this project, and that library
is the requests library, it will allow us to automate the process of sending the get and post requests.
So let's just import it straight away and let's start our program.
So first thing that we must think about is what are the information that we need from the user of this
program in order to brute force a login page.
So we will need you are a link to that page and we're going to need a user name for that specific account.
Then we're going to run a bunch of passwords onto that user name.
And if you manage to get the correct password, great.
We are going to print it to the screen.
If we don't manage to find the password, we're going to print password, not enlist.
Simple as that.
So let's start with those information.
First, let's create a variable called your URL.
And that variable is going to be the input value, which means that the user of this program can input
which Web page they want to brute force.
Let's open double quotes and specify that to them.
Let's do it like this.
Enter page.
You are out here, they can enter the page zero.
And right after we do that, we can create another variable called username and this variable will do
the same thing.
So it'll be the same input value.
Does this time we're going to ask for the user name.
So let's just type enter user name for the account to brute force.
And this is pretty much it for now.
Now, later, we are going to add some other information regarding this project, but for now we only
need these two variables.
So how are we going to approach this?
Well, first, since we have the URL and the user name, we can start with opening a file that will
contain the passwords that we are going to use to brute force.
So we can do that with open and we can call that file passwords DOT 60.
And this is also something that we can ask the user, for example, in the name of the password file
to use, and that would actually be a good thing.
So what I'm going to do is this is another information that we're going to ask from the user, which
is password default equals input.
And then.
Enter password.
File to use, simple as that, let's not forget the single quotes.
Otherwise, this will throw us an error and let's close the brackets at the end.
Now, we can open that fall by specifying a password file and we want to open it for reading so we can
specify just are between the single quotes, which means opening file for reading text.
Now here we need to specify how we want to open it.
So with open password file as passwords, that is how we are going to call our file object.
Then we're going to enter a function which I'm going to call cracking and dysfunction doesn't exist,
will have to code it, but nonetheless, this function will perform.
The brute forcing this function will take two arguments.
The first one is going to be the user name, of course, that we specify at the beginning of the program
execution.
And the second argument will be the you are out.
Great, now that we've got this, we need to create the cracking function and we're going to do it right
here so they find cracking and we specify username and URL as the arguments that it needs.
So how are we going to do this?
Well, we already mentioned that we are going to perform reading of the passwords.
So for each password in this password list, we're going to try to send our request to the page with
that password and username.
And if the response contains some valid argument that we have a valid username and password, we're
going to print it to the screen as the correct username and password.
And if we get something like log it failed or something like that, we're going to move on to the next
password.
So how are we going to do that?
Well, we already open the file for reading that contains our passwords.
And now what we can do is we can type for password in passwords.
And remember, passwords is our file.
Then for each password inside of that password file, we can first strip it out of any additional characters
using these strip functions or password will be equal to password dot strip.
This will remove any, for example, empty characters or something like that that might cause us a problem
in brute forcing this page.
Then once we do that, we're going to print to the screen trying and then the password that we are currently
trying just to the user of the program can see which password is it currently trying to brute force.
Once we do that, we need to send the request to that page.
So how can we do that?
Well, in this case, since we're going to brute force.
As usual, our W a login page first, if I log out, we know that this is being sent with post form,
so the method of sending the usernames and passwords is post.
And we can check that once again just by finding the form and we can see that the method is post.
That's why inside the bubble coat, we're going to type requests that post.
And we're posting and this request, that post takes two arguments in our case, the first one is going
to be the URL, which is logical because we need to tell our program where you want to post that data.
And the data that we want to post will be equal to this data equals data.
Just we don't have the data yet, we need to tell our program what is our data.
So how can we do that?
Well, we can go right here and find data and data has to be a dictionary inside of this dictionary.
We have a key and the value and we need to specify all the information that the program needs in order
to perform a successful login.
And that information would most likely be the username, the password and the button that it has to
click.
Remember the same thing we had in Hidayatullah?
We need to click on this button in order to successfully submit the username and password.
So how can we define it right here?
Well, we defined it like this username.
To that username.
And this username is just the name of the field on our page, and this is the part of the program that
you might need to change, depending on the page that your brute forcing.
If the user name field on the page that your brute force is called something like user, then you must
change this to user.
And this right here is just the username that we're sending, which is the one that we asked the user
of the program to input at the beginning of execution.
The same thing we must do for passwords, and the reason why I'm already typing the username fields
is because I already know that the name of the field is username and password, because we all detect
that in our Web application penetration testing section.
OK, once we do that, we can do the same for password.
And once again, we need to put the password into that password field and the password will be this
stripped value that we read from our passwords file or from our passwords list.
And the last argument that we need to specify is going to be the button, as you remember, once we
send it right here, the button name is Log-in and the type of button is submit.
So we must specify it like that just this time.
Both of these values are going to be between the single quotes because none of them is an actual variable.
So this is going to be our data.
And in this requests that post, we are sending that data to our Europe and luckily our request library
will perform everything else for us so it will know where to put this data that we are sending, of
course, instead of just sending this data.
We also want to store the response somewhere so we can create a response variable.
And that response variable will be equal to whatever the return value is from data requests that post
function.
And the return value is going to be the double page of the response.
Once we received the response, we have to check whether the password was correct or not.
So how can we do that?
Well, we can do that the same way that we did inside of our Hydra.
Remember that in Hydra, we had to specify the string that occurs once we specified the incorrect username
and password, which is this down here.
As we can see, a log in failed.
Well, we can do something similar inside of our program.
Let's ask the user of the program.
First, we can create a variable login failed string and we can ask the user.
Enter a string that occurs when logging fails.
Simple as that, and once they enter the string, hopefully they enter something like failed or log
in failed.
They don't have to enter the entire thing.
They can just enter failed, which occurs on this page.
Once you specify incorrect username and password, then what we can do is we can check whether we find
that string inside of our response.
Now, to do that, we must type the if statement and if statement will be something like this.
If logging underscore failed underscores string in response that content dot decode code, then we have
the incorrect password.
And the reason why we're decoding this is because otherwise it won't be able to find this value inside
of our content.
So we must decode it first.
And then it is basically searching for this string inside of the HTML page of the response.
If it finds that string, that means we found the incorrect password because that occurs only when it
is incorrect, that's why we're just going to pass.
We're not going to do anything.
And if it doesn't find which would be the statement, then what we can do is we can print found username.
And we can plus the username and we can print the same thing for the passwords, so found password.
And plus password, so this will print the current username, which is always the same, and it will
print the current password, which is currently in this iteration of this loop, which will be the correct
password because it didn't find this string inside of it.
After we find it, we can just exit the program.
There is no need to continue brute forcing so we can just exit out of the program.
OK, now that we did this, I'll let us see whether this works, so if I go down here.
And once we finish the cracking of the function, we can also print at the end in case it doesn't find
anything, the password not in a list.
So we can just do it like this.
Once it finishes the cracking function, it will go to this statement and it will print password, not
the list.
If it finds the password, it will go to this statement's right here and it will exit out of the program.
So this will never get printed.
Let's give it a try to see whether this works, so if I could try to save and the first thing that I
want to do is I want to copy the passwords that text file that I got on my desktop to the home, Mr.
Hacker, desktop tools and then webapp penetration testing.
And if I here we are going to have our passwords that the default and since this seems to be an incorrect
password is the text file, I'm just going to delete this and I'm going to create a new one.
Not really sure where is the last one, but let's just create it real fast so the passwords can be something
like test, test one, two, three, one two three four five six seven, a password, one, two, three
admin route and then the correct password.
So we're just going to write password right here.
And let's also write the password for the code, an account just so we can test two different accounts.
And let's write another incorrect password at the end, which could be ABC, ABC.
OK, this is just a test example of the program and let's control.
Oh, and let's Python three, our brute force or dot pie.
So the first argument that it asks is the page you are out.
So what we can do is we can visit that page, copy the link to that page and paste it right here.
HTP to dogbone it to the 168 fanda to two TBWA and then slash login dot click enter it asks for the
user name for the account brute force.
We're going to use admin the password file to use these passwords and make sure if the password file
that you want to use is outside of the directory of your program, you will need to specify the entire
path to that file.
Once we do that, let's click enter.
And it asks us for the string that the Kurzman login fails and we can just type log in failed because
that is what occurs on our page right here for different pages.
This will be different.
Press enter.
And it found the correct username and correct password, and it did it really fast, it tried these
seven passwords, none of those worked.
Then it went onto the password and it printed out found username and found password.
Let's also try for the Gordon just to make sure everything works, so I'm going to pastie, I'm going
to base the link for just type it in
the user name.
Is this time going to be Gordon B..
The password's file is going to be passed for 30 60.
And this Trink is going to be once again Log-in Fáilte Press enter and it also finds the username and
password for that account as well.
Great.
Our program works, but let's also see how would we be able to brute force the inner page of this DPW,
a program or application.
We also got this brute force page right here, but this is something that will have to brute force differently.
Why?
Well, first, it requires a different type of request.
It requires to get request.
And the second thing is this can only be brute force within a current session.
So if we are not logged into this page, we cannot even access this brute force page and therefore we
cannot really brute force.
So we must also see how we can send this session inside of our program so we can be able to brute force
this username and password.
Let's give it a try.
If I go to our program and not the brute force stop Stoppie, first thing that we must specify, as
I already said, we're going to need to specify the session.
So we need to ask for the user for the cookie value of that session.
And they can just read it from the person just like we did once we covered our Hydra tool.
So we can specify right here, enter coqui value.
And this can be optional because we don't need it always, just like we didn't need it currently.
But if they're brute forcing something within a session, then they must specify this as well.
Now what we can do is inside of our cracking function, right above the if statement.
We can write another if statement.
So if.
Cookie value is not equal to an empty string, and if it is equal to an empty string, that means that
the user doesn't require the cookie value.
And in that case, it will not send the cookie value and it will just brute force without the session.
If it is set to something, then we are going to send the cookie value inside of our request.
So in this case, if response if cookie value is not empty, that means we must send it.
So the response will be equal to requests that get.
And this time we are using get because inside of this page.
Our form is using the method get, that's why this time we're using the requests that get this is something
that you want to change depending on the page that your brute forcing.
So requests that get in the first parameter is going to be the URL, the second parameter, we're going
to set our parameters, which we specify like parameters, and those parameters are going to be equal
to, once again, a dictionary.
And that dictionary will be rather the same like this.
Just a few minor changes we are going to set.
So cope with this and we're just going to paste it right here, the first change is under the button.
So the username and password field are named the same like in our last page, as we can see right here
inside the form.
The name for the username is just username and the name for the password is password.
But the login is not the same.
We got the value for login to be login and name, for login, to also be login so we can set it like
this login and then two dots and once again login.
And the last parameter to this function or the last argument to this function is going to be cookies
that are equal to a dictionary of cookie value.
Two dots and then key value variable.
And you can read the name of that field by going to our website and once they, for example, specified
test and test one, two, three as our username and password here.
And then I go and find that request inside the bubble.
Let's find it real quick, and I believe it is this one right here.
Here it this.
We can see that the cookie field is named just Cookie.
That's why we specified right here as cookie between the single quotes and we paste the cookie value
to that field.
Once we do all of that.
We have all of our parameters to this function, and this seems to not be able to fit inside of my screen,
but it doesn't matter.
It is there and all we are left to do right now is create the statement as well.
And the EL statement, he's going to be else in this case, we don't have the cookie value, so we can
just copy this part of code.
And based it right here and now we can delete it from here because we no longer need it.
So this program is pretty much only used to brute force the main login page to the WSJ and this brute
force page inside of the DB.
You will need to adjust a few things right here once trying to brute force a different page, such as,
for example, the name of the fields, the name of the cookie, and you will also have to adjust whether
it is a get request or post request.
Everything else I believe can stay the same.
Now that we got our code ready, let us see whether this works.
So if I save this and I go and try to run this, let's first of all try once again to brute force the
main login page by typing, give it a slash login that the user name is going to be admin.
The password file is going to be password.
And the string that occurs is going to be login failed.
Cookie is going to be optional, so I'm just going to press enter because I don't need it for the main
login page and it will still manage to find it.
But let's see whether it will manage to find the correct username and password.
If I use the cookie value and if I brute force inside of this session, let's give it a try.
I will enter the page.
You are L.A. page.
Your L is going to be the URL to this page right here, which is this.
So let's keep.
Paste it right here, press enter the username is going to be the same, so it is going to be admin,
the passwords file is going to be the same.
The string that occurs is not going to be the same, so let's give it a try and see what happens once
we send helo username and hello as password.
We get username and password incorrect now, we don't need to specify this entire statement, we can
just specify incorrect.
And if it just finds the incorrect, that means we specified the incorrect password.
Therefore, it is going to go on to the next one.
So let's press enter.
And the cookie value is something that we can read from our burset.
So let's find the request that we use to send hello and hello as username and password.
And here it is.
All we need to do from here is find the cookie field and copy the cookie value so security equals high
and the session ID is set to a random value.
All we need to do is paste that right here and press enter.
This will start the brute forcing of our pitch, and you will notice that this time it goes a little
bit slower because we a brute force inside of a session, let's see whether it will manage to find once
it gets to the correct username and password.
Let's give it a few seconds, and here it is.
It worked successfully.
We found the correct username, which is admin and the correct password, which is password.
And now we can use that to log in to this page.
As it says, welcome to the password protected area, Edman.
So we successfully call that a brute force.
Now you can perform some minor changes to make it even better, such as, for example, importing from
Thurm color, import, the function colored, and this will allow us to print everything in a different
color.
For example, let's go down here and this first print statement we can print like this colored.
And at the end, we specify inside of the for example, let's bring this in, Fred, we close to Brackett's
and once we also find the correct username and password, we can print this in green.
So print colored.
At the end, we add comma and then green and for close to brackets, same thing we can do right here.
And let's not forget the color function right here, so colored.
And now if we run this by three brute force older people, let's use the regular main page, which is
the log that BHP admin is the account password.
That is the file.
And failed is going to be the string that occurs.
And it is even better right now.
It prints the incorrect passwords in red color and fonts.
It finds the correct username and password.
It prints it in the green.
Great record, the double project.
Everything works perfectly.
Just don't forget to change certain values inside of our program once you try this on a different Web
page.
The two main things that you need to keep an eye on is the name of the fields inside of our source code.
So you just find the form and you see how the fields are named.
Then you use that inside of your dictionary.
And the next thing that you need to pay attention to is the method that is used to send these usernames
and passwords, whether it is a get method or post method.
And at last, you also need to check the name of the button.
So this can basically be named anything.
That's why you always need to view page source and check it out before running your program.
Great.
Thank you for watching this coding project, we're getting better and better in Python and in the next
lecture.
We're going to create another small project in Python that will be used to brute force directory names
inside of a Web page.
This will be a smaller program that this one, but nonetheless, it will still be a useful program that
you will use in your penetration tests, see in the next video.