In this video you're going to learn how to perform password base
attacks, but most importantly the fundamental of
different type of password attacks. So let's
dive on in
there are various types of passwords based attacks such
as Brute Force dictionary password guessing
password spring is even credential stuffing.
There's even online based password attacks
and even offline bees faster attacks.
Firstly let's talk about the online paths would be so
ducks in online password attacks the painstreation tester
or let's say the hacker simply attempts to
gain all authorized access to let's see who started
running a common type of remote access
network service such as remote desktop
protocol secure shell assh telnet
or even another common
service this attack simply allows the
owner drives user which is let's say the patron Testa
the article Haka oivon the
shirt actor to log into a system remotely.
A common example is trying to retrieve a valid
username and password for let's say
silver that is running the remote desktop protocol
service.
And an offline base password attack the traductor or
the penetration tester simply uses various tools
and techniques to truth of
valid password for a password protected file to put
simply let's imagine you have a document
but every time you open a document it is
requesting a password. It's simply means not
only authorized users who has a valid password
will be evil to open the document and read
a contents as a patriot tester. You can
simply attempt to retrieve the valid password
document and this is all fine-based
password attack simply because the encrypted
file is stored locally on your system.
Any Brute Force attack every possible combination of
the password is tried against the system.
This process is very an extremely
time-consuming because it tries every
possible combination of a
password against the system.
The downside is it can take years
or even decades even retrieve a valid
password.
However, if it Brute Force attack is successful. It
will definitely be able to find a current
combination for the password and allow you
to access the system. But again, it's very
very time-consuming, hence. It is
not commonly done on systems unless the password is very
simple and not complex.
Most commonly there's a dictionary based attack with
a dictionary based attack the true doctor or the
pantry shontester will simply use a wordless that
contains some predefined Woods.
This will list me contain hundreds thousands or
even millions of possible common passwords that
I use on systems around the
internet. These passwords are then tested against let's
say though 10 Keyshawn system of the target the tool
that you are using simply takes each password within
the woodless and test it against a
particular system until it finds a valid password.
The downside is if the password does not exist
in a wordless. Then the attack is not successful.
Since a dictionary file contains a finite
or limited number of words. The dictionary attack
doesn't take long to complete. However, the success
rate is really dependent on whether a valid
password exists within a wordless that
you are using.
Another common technique is called password guessing. This
is where the penetration Tester the article
hacker or the tread actor simply. Yes impossible
password that a user will use
to access a system.
While password guess same is song a bit funny because you
will think hey Noah's gonna set a
simple password. You will be surprised by how many users set
very common and easy to
guess passwords. This is why it's always
recommended to do not use default passwords or passwords
are easily guessable.
Another technique is called password spring this technique
is where the traductor or the penetration tester
uses a single password and testes it
against authentication system while using different usernames.
The idea is to test
each user account within a system using a
list of different usernames, but the same
password this technique is good when testing
which users within the organization's Network
uses a week or a common
password.
Another technique is called credential stuffing.
This technique simply allows the penetration Tester the
tagal hacker or the traductor to use a
common woodlist that contains both usernames and
passwords against the authentication system
of a Target device this technique simply
checks, which combinations of usernames and
passwords are followed credentials for the
Target system.
So now that you have an idea on various types
of password-based attacks, let's dive in and let's
take a look at actually performing an online based password
attack to allow us or notice access
into a Target system.
Ensure you pone and log into your Kali learns
virtual machine additionally ensure that
you are running the metasploitable tree Windows Virtual Machine,
as you can see put my Kali Linux
virtual machine on metasploitable tree Windows Virtual
Machine is also running.
We are going to break into the metasploitable tree
virtual machine.
firstly let's open the terminal like so
and let's perform an end map scan to
determine the IP address of our Target system.
we can simply use nmap like so we could
specify the network ID like
so
and let's specify a ping scan. So this
will be Dash SN like so and we
can exclude our own
IP address.
Hit enter. This car will take a few
seconds to complete and now we have the IP address
of all target system gonna copy this
next let's determine if the
remote desktop protocol service is
running on our Target system.
Firstly we can simply type and map like
so Dash p specified by
the port ID or the
port number for remote desktop protocol, which is 3389.
followed by the IP address of all target hit enter
and this can usually takes a few
seconds or pops a minute or two to complete as you
can see it has the two men that Port 33
eight nine is upon on
the target system.
So great. This device is running remote desktop
protocol.
So now we could fit a verify the operating system of
this target.
you can simply type nmap Dash capital O
followed by the IP address
and we need sudo privileges to
execute this command.
Let's enter password hit enter and
within a few seconds, this will complete.
So great. We can see where we execute a
command it. Did I entire port scan for the top 1000 ports?
It was still able to identify port 3389
is open.
Most importantly it helped us
identify that it is running a Windows operating system.
For instance. The details is either a
Windows 7 operating system or a windowsill
2018 spark 1 operating system.
So now we know for sure it is running Windows operating system
on port 3389 is
open.
So excellent. Let's attempt to perform
an online based password attack to
gain access to the remote desktop services that
is running on the target system.
The cool thing about Kali Linux is there's a lot
of woodlist that is already pre-loaded inside of
Kali.
To access these woodless we can simply type woodlist Dash
each Lysol and hit enter.
Currently all of these woodless are stored
within the USR share woodless directory.
Within this directory we have subdirectories as
well.
Here you can see it's a text file. Then we
have a word list for John the report. There's also
the rocky woodless typically on
your system. If it's a new installation of
Kali Linux the rock you would list will be
with our zip folder. If you want to extract the
rock you would list you can
simply type.
G un Zippy G unzip
specify the directory like
so
and specify the actual rock you
the txc.gz file.
Once you execute this command you might need
pseudo privileges, but let's say you execute this
command. It will extract The Rock You the txc
file as shown on my screen.
Okay. So now that we are within
our directory.
Which is slash user share wordless. If I type
LS - L we can see
all the files that I existed within the directory, but let's
say you're not in a directory. So what I'll do
I'm going to close the terminal and open a new terminal.
So to perform a full spouse would be attack. We can
use a tool called and crack.
And crack is a very well known tool
that will simply allow us to
perform an online-based password attack against the
RDP service.
for instance, you can type-v for vubus
Dash capital T. That's specifies a
time of the attack we could specify the timing
to be four. It has a maximum value
of five. Let's use five.
The timing simply specifies how quickly
to perform testing against the service.
We'll type - common U to specify
a specific username. So let's say
the username is administrator.
You get type Dash common, P or lowercase
Peter specifies single password or if
you are using a word list, you could use capital B and all
we would list a stored in the USR share with
this directory. Let's use a
rock you the txt next we need to specify the
service, which is RDP.
Let's specify the IP address of our
Target system, which is 172 tt1.t.
I'm simply going to copy this IP address of future reference.
Great.
I'm going to enter now.
As shown in the screen the attackers field.
Even though it says finish but it says too
many field attempts.
simply because
the target has a Lahore policy.
I showed on a screen the attackers finish but
the attackers on successful simply because
there's a lockouter show on a Target system. This
means to say after a few wrong entries.
The target system simply prevents anyone or
any systems on trying to log in remotely.
Let's test this attack using a different technique
Let's create our own password list. But in
this way, we'll create just a few passwords.
So let's type Nano.
Let's type word list.
like so
let's use woodless one the txt. This will
allow us to create a text file within our
current working directory hit enter.
The first entry let's type administrator.
Let's type password.
Let's type.
password 1 2 3 let's type
vagrant like so
So within our word list that we are creating now there are
four possible passwords
To save this simply type or press control
on X on your keyboard.
And hit Y to see this and enter for
yes.
if I type ls-l
you can see there's a wordless file.
if I type cut
and let's see woodless one the txt. We can
see the entries for this file.
So excellent. Let's use a solid list
within our attack, press up a couple of times and you
will get the last set of commands.
And this time I'm going to specify the wordless
file.
and type with less 1.txt
I'm going to specify all the target like so.
Good enter.
And it is only a test for a few
passwords.
Simply because there's only four possible passwords with
an old woodless. But this time the attack is successful.
Simply because we see discovered credentials on
a specified Target on the
port number, especially username and password
so great.
Discovered credentials I gave us
the credentials that was found.
So excellent.
We are performed all fullest Parts would be attack. So
we know for certain the username is administrator
passes vagrant, but let's try another
technique.
using this other technique
We will use a different tool. We'll use a
tool called Hydra.
So let's type Hydra like so
Dash T this specify timing of the attack
this I will put it to 4 - L.
to specify the username
The username will be administrator.
Dash capital P to specify
with lists simply because our own
with us are you just curated is located in our
same directory all person looking directory. You can
simply type with less one the txc like so next we'll
specify the service.
Which is RDP, let's specify.
the target IP
Which is 172t1.t?
I'm going to enter.
And after a few seconds, this attack
should complete successfully.
Currently we can see the attack is successful specify the
host the service support.
The login username and password most importantly
a tools. Hey, one of
one target successfully completed one valid
password song great now that
we know the user and password. Let's actually check to see
if we can actually already pee into the
target service well into the target
system.
Let's type our desktop like
so - common U.
administrator and specify the username
Dash lower key speed specify the
password vagrant
Target IP
and next let's specify the resolution for the
resolution. Let's use 12 ET.
by one
by 1024 actually.
Once you're ready simply, press enter.
To accept the certificate type. Yes hit enter
one more time.
And there we go. We have just
RDP into the target system
pretty cool, right?
As you can see we can scale the desktop and
we have full control access to the
Target system.
If I type ipconfig, we can see the IP address
of the target is displayed on the
targets Windows command prompt.
I'm simply going to close the window to disconnect.
In this video you have learned a fundamentals of password Attacks An
Additionally you have learned how to retrieve fast food from
remote access services on a Target
system.
In the next video, you will learn how to perform SSH
cracking across the network. I
hope this video has been informative for you and I
hope to see you in the next one.