Instructor: Welcome back.
In this video we are going to be creating a Brute Force tool
using our Python skills.
So in the previous section,
where we talked about web application penetration testing,
we covered tools that are used for Brute Forcing
but this time I want to see whether we can create
our own tool that will be able to Brute Force a Login Page.
Now before we even start, I want to mention
that this tool will not be universal.
So for every different page you will have
to perform some minor modifications,
the same way that we did inside of our Hydra tool
and inside of our Burp Suite.
Nonetheless, let us see how we can create it.
So if I type LS and navigate to my Desk Directory.
Here we got the tools directory for our coding projects
and here I'm going to create the Web App Pen Test Directory.
So I will navigate there and currently this directory
is empty, so let's Nano our Python program.
We can type Nano and then Bruteforce.PY.
Great.
Now there is only one library that we are going
to need to perform this project
and that library is the Requests Library.
It'll allow us to automate the process
of sending the get and post requests.
So let's just import it straight away,
and let's start our program.
So first thing that we must think about is,
what are the information that we need from the user
of this program in order to Brute Force a Login page.
So we will need a URL link to that page and we are going
to need a Username for that specific account.
Then we're going to run a bunch of passwords
onto that Username and if you manage
to guess the correct Password, great.
We are going to Print it to the screen.
If we don't manage to find the password,
we're going to Print Password Not In List.
Simple as that.
So let's start with those information.
First, let's create a variable called URL
and that variable is going to be the Input value,
which means that the user of this program can input
which webpage they want to Brute Force.
Let's open double quotes and specify that to them.
Let's do it like this.
Enter + Page + URL.
Here they can enter the page URL
and right after we do that,
we can create another variable called Username
and this variable will do the same thing.
So it'll be the same input value.
Just this time we're going to ask for the Username.
So let's just type Enter + Username +
For The Account To Bruteforce.
And this is pretty much it for now.
Now later, we are going
to add some other information regarding this project,
but for now we only need these two variables.
So how are we going to approach this?
Well first, since we have the URL and the Username,
we can start with opening a file
that will contain the passwords,
that we're going to use to Brute Force.
So we can do that with Open
and we can call that file Passwords.TXT.
And this is also something that we can ask the user,
for example, input the name of the password file to use
and that would actually be a good thing.
So what I'm going to do, is this is another information
that we are going to ask from the user,
which is Password + File = Input +
and then Enter Password File To Use.
Simple as that, let's not forget the single quotes,
otherwise this will throw us an error.
And let's close the brackets at the end.
Now we can Open that file by specifying Password + File
and we want to Open it for reading.
So we can specify just R between the single quotes
which means opening file for reading text.
Now here we need to specify how we want to open it.
So with Open Password File as Passwords,
that is how we're going to call our file object.
Then we are going to enter a function
which I'm going to call Cracking
and this function doesn't exist.
We'll have to code it, but nonetheless
this function will perform the Brute Forcing.
This function will take two arguments.
The first one is going to be the Username,
of course that we specify,
at the beginning of the program execution
and the second argument will be the URL.
Great.
Now that we've got this,
we need to create the Cracking Function,
and we're going to do it right here.
So Define Cracking and we specify Username
and URL as the arguments, that it needs.
So how are we going to do this?
Well, we already mentioned
that we are going to perform reading of the passwords.
So for each Password in this Password List,
we're going to try to send our Request
to that page with that Password and the Username
and if the response contains some valid argument,
that we have a valid Username and Password,
we're going to Print it to the screen
as the Correct Username and Password.
And if we get something like login failed or something
like that, we're going to move on to the next password.
So how are we going to do that?
Well, we already opened the file
for reading that contains our passwords
and now what we can do is, we can type For + Password,
In + Passwords and remember passwords, is our file.
Then for each password inside of that passwords file
we can first strip it out
of any additional characters using this strip function.
So Password will be equal to Password.strip.
This will remove any, for example, empty characters
or something like that that might cause us a problem
in Brute Forcing this page.
Then once we do that we're going to print
to the screen, Trying and then the Password
that we are currently Trying,
just so the user of the program can see
which password is it currently trying to Brute Force.
Once we do that, we need to send the request to that page.
So how can we do that?
Well in this case since we're going to Brute Force
as usual our DVWA Login page first.
If I log out we know that this is being sent
with post form, so the method of sending the usernames
and passwords is post and we can check that once again just
by finding the form and we can see that the method is Post.
That's why inside of our code we're going to
type Requests.Post ,and we are posting,
and this Request.Post takes two arguments in our case.
The first one is going to be the URL which is logical
because we need to tell our program where
you want to post that data,
and the data that we want to post will be equal
to this, Data = Data.
Just, we don't have the data yet.
We need to tell our program what is our data.
So how can we do that?
Well, we can go right here
and define Data and Data has to be a Dictionary.
Inside of this Dictionary, we have a key and the value
and we need to specify all the information that
the program needs in order to perform a successful login.
And that information would most likely be the Username
the Password and Button that it has to click.
Remember the same thing we had in Hydra tool.
We need to click on this button,
in order to successfully submit the username and password.
So how can we define it right here?
Well, we define it like this Username : Username
and this Username is just the name of the field
on our page and this is the part
of the program that you might need to change depending
on the page that you're Brute Forcing.
If the Username field
on the page that you're Brute Forcing is called something
like user, then you must change this to User.
And this right here is just the username
that we are sending, which is the one that we ask the user
of the program to input at the beginning of execution.
The same thing we must do for passwords
and the reason why I'm already typing the username fields is
because I already know that the name
of the fields is Username and Password
because we already checked that
in our web application penetration testing section.
Okay, once we do that, we can do the same
for Password and once again we need to put the Password
into that Password Field
and the password will be this stripped value
that we've read from our Passwords File
or from our Passwords List.
And the last argument,
that we need to specify is going to be the button.
As you remember, once we send it, right here,
the button name is Login and the type of button is Submit.
So we must specify it like that.
Just this time, both of these values are going to be
between the single quotes
because none of them is an actual variable.
So this is going to be our data and in this requests.post
we are sending that data to our URL
and luckily our request library will perform everything else
for us, so it'll know where to put this data
that we are sending.
Of course, instead of just sending this data,
we also want to store the response somewhere.
So we can create a response variable
and that Response variable will be equal
to whatever the return value is
from this requests.post function.
And the return value is going
to be the HDML page of the response.
Once we receive the response,
we have to check whether the password was correct or not.
So how can we do that?
Well, we can do that the same way
that we did inside of our Hydra.
Remember that in Hydra,
we had to specify the string that occurs.
Once we specify the incorrect Username and Password
which is this down here as we can see a Login Failed,
well we can do something similar inside of our program.
Let's ask the user of the program first.
We can create a variable Login Failed String
and we can ask the user,
Enter + String That Occurs When Login Fails.
Simple as that.
And once they enter the string, hopefully they
enter something like Failed or Login Failed.
They don't have to enter the entire thing,
they can just enter Failed.
Which occurs on this page,
once you specify incorrect username and password.
Then what we can do is, we can check whether we find
that string inside of our response.
Now to do that, we must type the If Statement
and if statement will be something like this.
If + Login underscore Failed, underscore String +
In Response.Content.Decode,
then we have the incorrect password.
And the reason why we're decoding this,
is because otherwise it won't be able
to find this value inside of our content.
So we must decode it first
and then it is basically searching for this string
inside of the HTML page of the response.
If it finds that string,
that means we found the incorrect password
because that occurs only when it is incorrect.
That's why we are just going to Pass.
We're not going to do anything.
And if it doesn't find which would be the Else statement,
then what we can do is, we can Print + Found + Username
and we can + the Username.
And we can Print the same thing for the passwords.
So Found + Password and + password.
So this will Print the current Username
which is always the same
and it'll Print the current Password.
Which is currently in this iteration of this loop,
Which will be the correct password
because it didn't find this string inside of it,
After we find it.
We can just exit the program.
There is no need to continue Brute Forcing,
so we can just Exit out of the program.
Okay, now that we did this
I'll let us see whether this works.
So if I go down here,
and once we finish the cracking of the function,
we can also Print at the end.
In case it doesn't find anything,
Password + Not In List.
So we can just do it like this.
Once it finishes the cracking function,
it'll go to this statement
and it'll print password not in list.
If it finds the password,
it'll go to these statements right here
and it'll exit out to the program.
So this will never get printed.
Let's give it a try to see whether this works.
So if a Control Code to Save
and the first thing that I want to do is I want to
copy the Passwords.TXT file
that I got on my Desktop, to the Home.
Mr Hacker + Desktop + Tools
and then Web App Penetration Testing.
And if I LS here,
we are going to have our Passwords.TXT File.
And since this seems to be an incorrect passwords.TXT File,
I'm just going to delete this
and I'm going to create a new one.
Not really sure what is the last one, but let's just
create it real fast.
So the passwords can be something like test, test
1, 2, 3, 1, 2, 3, 4, 5, 6, 7, password, 1, 2, 3, admin route
and then the correct password.
So we're just going to write Password right here
and let's also write the Password for the Gordon account
just so we can test two different accounts.
And let's write another incorrect password
at the end which could be ABC ABC,
okay, this is just the test example of the program
and let's Control + O and let's Python3
our Bruteforcer.PY.
So the first argument that it asks is the Page URL.
So what we can do is we can visit that page,
Copy the link to that Page, and Paste it right here.
HTTP : slash slash 192 . 168 . 1 . 2 slash DVWA and then
slash Login.PHP.
Click Enter.
It asks for the username for the account Bruteforce,
we're going to use ADMIN.
The Password File to use is Passwords.TXT.
And make sure if the Password File that you want
to use is outside of the Directory of your program,
you will need to specify the entire path to that file.
Once we do that, let's click Enter
and it asks us for the string that occurs when login fails,
and we can just type Login Failed,
Because that is what occurs on our Page right here.
For different pages this will be different.
Press Enter and it found the correct Username
and correct Password, and it did it really fast.
It tried these seven passwords, none of those worked.
Then it ran onto the password and it printed out
Found Username and Found Password.
Let's also try for the Gordon
just to make sure everything works.
So I'm going to Paste the, whoops
I'm going to Paste the link or just type it in.
The Username is this time going to be Gordon B.
The passwords file is going to be Passwords.TXT
and the string is going to be once again Login Failed.
Press Enter and it also finds the Username
and the Password for that account as well.
Great, our program works, but let's also see how
would we be able to Brute Force the inner page
of this DVWA program or application.
We also got this Brute Force Page right here
but this is something that we'll have
to Brute Force differently.
Why? Well first, it requires different type of request.
It requires to GET request and the second thing is,
this can only be Brute Forced within a current session.
So if we are not logged into this page,
we cannot even access this Brute Force page
and therefore we cannot really Brute Force.
So we must also see how we can send this session,
inside of our program so we can be able
to Brute Force this Username and Password.
Let's give it a try.
If I go to our program
And Nano + Bruteforce.PY.
First thing that we must specify, as I already said,
we're going to need to specify the session so we need to ask
for the user for the Cookie Value of that session
and they can just read it from the Burp Suite
just like we did once we covered our Hydra tools.
So we can specify right here Enter Cookie Value
and this can be optional
because we don't need it always,
just like we didn't need it currently.
But if they're Brute Forcing something within a session
then they must specify this as well.
Now what we can do, is inside of our cracking function,
right above the if statement,
we can write another if statement.
So If Cookie Value is not equal to an empty string
and if it is equal to an empty string
that means that the user doesn't require the cookie value
and in that case it will not send the cookie value
and it'll just Brute Force without the session.
If it is set to something, then we are going
to send the cookie value inside of our request.
So in this case, if Response
if cookie value is not empty, that means we must send it.
So the Response will be equal to Requests.GET.
And this time we are using GET
because inside of this page our form is
using the method GET.
That's why this time we're using the Requests.GET.
This is something that you want to change depending
on the page that you're Brute Forcing.
So Requests.GET
and the first parameter is going to be the URL.
The second parameter, we're going to set our Parameters
which we specify like Params
and those Params are going to be equal
to once again a Dictionary
and that Dictionary will be rather the same like this.
Just a few minor changes we're going to set.
So Copy this and we're just going to Paste it right here.
The first change is under the Button.
So the username and password field are named the same,
like in our last page as we can see right here,
inside the form the name for the Username is just Username
and the name for the Password is Password,
but the Login is not the same.
We got the value for Login to be Login
and the name for Login to also be Login.
So we can set it like this Login
and then : and once again Login.
And the last parameter to this function
or the last argument to this function
is going to be Cookies that are equal
to a Dictionary of Cookie value :
and then Cookie value variable.
And you can read the name of that field by going
to a Burp Suite and once say, for example,
specified test and test one, two, three as our Username
and Password here.
And then I go and find that request
inside of our Burp Suite.
Let's find it real quick.
And I believe it is this one right here.
Yeah, here it is.
We can see that the Cookie field is named just Cookie.
That's why we specified right here as Cookie
between the single quotes
and we space the cookie value to that field.
Once we do all of that, we have all of our parameters
to this function
and this seems to not be able to fit inside of my screen,
but it doesn't matter, it is there.
And all we are left to do right now
is create the Else statement as well
and the Else statement is going to be Else.
In this case, we don't have the cookie value,
so we can just Copy this part of code
and Paste it right here
and now we can delete it from here
because we no longer need it.
So this program is pretty much only used to Brute Force
the Main Login Page to the DVWA
and this Brute Force Page inside of the DVWA.
You will need to adjust a few things right here,
once trying to Brute Force a different page.
This is for example the name of the fields, the name
of the cookie, and you will also have to adjust
whether it is a get request or a post request.
Everything else I believe can stay the same.
Now that we've got our code ready,
let us see whether this works.
So if I Save this
And I go and try to run this, let's first of all
try once again to Brute Force the Main Login Page
by typing DVWA slash Login.PHP.
The Username is going to be Admin
the Passwords File is going to be Passwords.TXT
and the string that occurs is going to be Login Failed.
Cookie is going to be optional,
so I'm just going to press Enter because I don't need it
for the Main Login Page and it'll still manage to find it.
But let's see whether it'll manage to
find the correct Username and Password,
if I use the Cookie Value and if I Brute Force
inside of this session, let's give it a try.
I will enter the page URL
and the page URL is going to be the URL
to this page right here, which is this one.
So let's Copy it, Paste it right here, press Enter.
The Username is going to be the same
so it is going to be Admin.
The Password's File is going to be the same.
The string that occurs is not going to be the same.
So let's give it a try and see what happens.
Once we send Hello as Username and Hello as Password
We get Username and or Password incorrect.
Now we don't need to specify this entire statement
we can just specify Incorrect
and if it just finds the Incorrect
that means we specify the Incorrect Password
therefore it is going to go onto the next one.
So let's press Enter.
And the Cookie value is something that we can read
from our Burp Suite.
So let's find the request that we use to send Hello
and Hello as Username and Password.
And here it is.
All we need to do from here is find the Cookie Field
and Copy the Cookie Value.
So Security equals High
and the PHP session ID is set to a random value.
All we need to do is Paste that right here and press Enter.
This will start the Brute Forcing
of our page and you will notice
that this time it goes a little bit slower
because we are Brute Forcing inside of a session.
Let's see whether it'll manage to find once it gets
to the correct username and correct password.
Let's give it a few seconds.
And here it is, it worked successfully.
We found the correct Username
which is Admin and the correct Password, which is Password.
And now we can use that to log in to this page.
As it says, welcome to the Password Protected Area Admin.
So we successfully coded a Brute Forcer.
Now you can perform some minor changes to
make it even better, such as for example,
importing From Termcolor Import the function Colored.
And this will allow us to print everything
in a different color.
For example, let's go down here
and this first print statement, we can Print
like this Colored and at the end we specify
inside of the, for example, let's print this in Red,
we close two brackets.
And once we also find the correct Username and Password
we can Print this in Green.
So print Colored at the end we add Comma
and then Green and we close two brackets.
Same thing we can do right here.
And let's not forget the Colored Function right here.
So Colored, and now if we run this Python3 Bruteforce.PY.
let's use the Regular Main Page
which is DVWA slash Login.PHP.
Admin is the account Passwords.TXT is the file
and Failed is going to be the string that occurs
and it is even better right now.
It prints the incorrect passwords in red color
and once it finds the correct username
and correct password it prints it in green.
Great. We coded our project, everything works perfectly.
Just don't forget to change certain values
inside of our program,
once you try this on a different webpage.
The two main things that you need to keep an eye on,
is the name of the fields inside of our source code.
So you just find the Form
and you see how the fields are named.
Then you use that inside of your Dictionary.
And the next thing that you need to pay attention to,
is the method that is used to send these Usernames
and Passwords, whether it is a GET method or POST method.
And at last, you also need to check the name of the Button.
So this can basically be named anything.
That's why you always need to View Page Source
check it out before running your program.
Great, thank you for watching this coding project.
We're getting better and better in Python.
And in the next lecture we're going to create
another small project in Python
that will be used to Brute Force Directory Names
inside of a Web Page.
This will be a smaller program that this one
but nonetheless it'll still be a useful program
that you will use in your penetration tests.
See you in the next video.