Instructor: Welcome back.
And in this lecture I want to talk about the subject
on brute forcing different login pages.
So we talked about many different attacks
that were based on some type of a vulnerability,
either in a code injection
or CSRF attack or command injection.
All of those were bugs that we covered,
but we haven't covered how to brute force a login page.
And for this entire section,
we have been logging into this username and password field
whenever we want to access the DVWA page.
Let's say that we don't have the credentials for this page.
We know of course that they are admin and password,
but let's also see how we can try to brute force them,
how we can try to guess the credentials.
Of course, for this,
we are going to need to have a little bit of luck
because this will require that
inside of the password list that we are going to use,
we have their password there.
So this will only work if their password is pretty weak,
which in our case it is,
since the password is just password.
For this, we're going to use a tool called Hydra,
and Hydra already pre-installed in Kali Linux
so you can just type Hydra inside of your terminal
and this will give you the help menu of the tool.
However, I advise you not to look at this help menu
because it will be in no way helpful
for these types of the attacks.
As we can see right here, it gets the example of usage
but once attacking the actual webpages,
this becomes harder and harder to use.
The syntax becomes harder and harder.
So I advise you to actually pay attention
once I'm writing syntax
so you can see how exactly am I doing it
because for every web page that has a login page
with username and password, this syntax will be different.
So let's start crafting our command.
We're going to start with Hydra
and then after it we specify the IP address of our target,
which in my case is 192.168.1.9
as we can see right here.
Then you got a few options
that you need to specify right here,
which are based on how are you sending
the username and password to the target.
So in this case, if I type test right here
and test this password, I click on login.
This is being sent as a post form.
So we are applying these usernames and passwords to the form
and we are sending this to the target with post request.
You can always check that right here
inside of your Burp Suite.
So you can go down here
and we can see that this is a post request
where we send the test username and test password.
Okay, so how we can specify that inside of Hydra,
well, we can specify http-form-post.
After this, you need to open the double quotes
and in between the double quotes
the first argument that you must specify
for the page that you're brute forcing
is the path to that page
which requires username and password.
And in our case,
that path is /dvwa/login.php.
So that is the first argument
specified in between the double quotes.
And arguments that you specify between these double quotes
are separated with two dots.
So once we type the path,
we type two dots for the second argument,
and the second argument is the username.
So for this, we must go to the page
that we are brute forcing.
We must right click and go to view page source
and we must find the name for the username field
inside of the code.
Usually, the username and password fields
will be inside of some type of a form
as we can see right here.
Form action login.php method post.
And if I go to the label for the username,
we can see that the name for username field
is simply just username.
Okay, so we must copy the name of this field
and we must go right here and type it in,
so paste it right after.
And this username field will be equal to
upper arrow and capital USER
and then, once again, upper arrow.
Now you might be wondering what is happening here.
Well, after we specify the name of the field on our page,
we equal that to this syntax right here.
And this is just Hydra syntax.
You use this upper arrow right here
and you type user in between that
and you close it with upper arrow.
What this is telling to the program to do
is it will exchange any username that we have in a list
between these two upper arrows.
So essentially any type of username
from the list that we are going to use
will be stored right here.
But this is not the only field that we have.
We also must specify the same thing for the password field.
Now, to separate the username field from the password field
we use this sign right here.
So specify this sign
and then after it we can specify the password field name,
just like we did right here.
So let's go and find the label for the password.
Here it is.
And the name for the password field is simply just password.
And this is something that can change
depending on which page you are brute forcing.
So let's go right here and type password,
which is the name of our field,
and this will be equal to upper arrow and then PASS
and then, once again, upper arrow.
And this is also the same as with the username.
So just any passwords that we use from our list,
will get stored right here instead of this capital PASS.
And the last thing that we must set
for this second argument of our command
is the button that we're using.
So every time you actually try to log in,
you click on this login button.
And this is something that we also want to simulate
inside of our Hydra command.
To do that, we go view page source,
we find the button, which is usually right after
the username and password field.
And in our case, here it is.
We take a look at the type of button and the button name.
So we can see that the button name is Login,
which we are going to specify
and then we are going to equal that to submit.
So, we can do it like this.
Again, we need to separate it with this sign right here,
and we type the name of the button, which is Login,
and then equal to the type of the button,
which is, in our case, submit.
So we equal that to submit.
And these three steps right here,
which is username, password, and button,
are enough for us to actually submit a request
for a specific username and password.
But we also need to differentiate
valid username and valid password
from the incorrect username and incorrect password.
So, how are we going to do that?
Well, luckily Hydra allows us
to specify something that will stick out
once a password is incorrect.
And if we go to our page
and we specify the incorrect username
and incorrect password,
once you click on login,
you will notice that down here
we have this string that says, "Login failed."
Now just by thinking,
we can figure out that this string will not exist
if we manage to login with successful credentials.
So we can specify this string
to our Hydra command to search for it
and every time it finds it,
it'll not print out that username and password
as valid username and password because they are incorrect.
So we can specify it with two dots
and then paste it right here.
Login failed will be the string that we are searching for
which will indicate that the username
and password is incorrect.
After we specified this,
we can exit out of the double quotes
and all we're left to do is to specify -L
and then the list for the usernames,
which we are going to call usernames.txt
and -P, which will be the list for the passwords
which we are going to call passwords.txt.
Now for this lists,
you can use any type of list that you want.
In my case, since we don't have them,
I'm just going to create them real quick
for the purposes of this tutorial.
I need to make sure that I'm in the same directory
where I'm running this command,
and then I'm going to nano usernames.txt
and I'm going to type right here, root, account, Admin,
then lower case admin, password as a username, test123,
and bunch of other things we are not going to specify.
We can just leave it to be this small,
just so we don't waste too much time
brute forcing that page.
And here we can type test, test123,
123456789,
and then, we can type admin, root,
password, and password123.
So we do have the correct username
and the correct password inside of both of these lists.
Now that we have this,
what we can do is we can run our command.
Let's just double check it real quick.
So hydra, the IP address of our target.
We're using the http form post
because we are sending a post request
and we are sending our username
and password inside of a form.
Then we open double quotes
and the first argument is going to be
the path to the page that the login form is located in.
The second argument is going to be username, password,
and the button that we are submitting
the username password with.
And the third argument inside of double quotes
is going to be a string that we get
once we specify the incorrect username and password.
After it, we just specify -L for the usernames list
and -P for the passwords list.
If I click enter,
and here it is.
It managed to find the correct username
and correct password.
It printed it out right here
and it tells us that the username is admin
and that the password is password.
So, it finished relatively quick
but it only had around 49 login tries,
as it says right here.
So you can feel free to use bigger password lists
in order to give this even higher chances to work.
Now that we did this, let's give it a try
and let's log in with the username
and password that we got and it indeed works,
so our tool successfully brute forced the login.
Now, in the next video, we're also going to take a look
at how we can brute force this page right here,
which is the brute force login page inside of our DVWA.