‫Hydra is a free and open source command line tool to crack valid login password pairs online.
‫It's very fast and flexible, and new modules are easy to add.
‫Hydra is embedded in karwai.
‫But before using it, we'd better see some of its parameters.
‫You can specify the username list.
‫Let's say the user directory with uppercase L parameter.
‫If you'd like to find the password of a valid user, you can specify a single user with lowercase L
‫parameter instead.
‫You can also specify the password list.
‫Let's call it the password dictionary with uppercase p parameter.
‫If you find a password, for example, while dumpster diving and don't know the user, you can specify
‫a single password with lowercase p.
‫If one valid username and password pair is enough for us, we can use the f parameter and that makes
‫a tool exit when it finds a valid username, password pair.
‫Server is another required parameter of the tool, which stands for the target server.
‫And finally, we have to specify the service that we want to attack.
‫Some supported services are HTTP Post Form, HTTPS Post Form, HTP, Get Form https get form http proxy
‫MySQL Will My SQL Oracle Listener, S.H., Cisco, etc..
‫Every protocol has its own unique options to set.
‫We'll see the options for HTP post form in the following demonstration.
‫So now I'll go to Carly and run a Web browser.
‫Do you remember OWASP broken web applications abbreviated BW, a server?
‫Well, it's on my network with the IP number of one three nine.
‫Right in the IP address, in the address bar of the browser and hit Enter.
‫Now here's the home page of the OWASP BW.
‫A scroll down a bit and click Dam Vulnerable Web Application Link.
‫Now we arrived at a login page that asks for the username and the password.
‫Now we don't know any credential and we'll try to find a valid username, password pair by online password
‫cracking attack.
‫So open a terminal screen, HYDRA is embedded in Cali, so you can start to use it simply by typing
‫its name.
‫If you type Hydra with no parameter, the help page appears.
‫Here is the list of options and supported services.
‫So let's start to build her attack.
‫L is the first parameter to keep the attack simple and fast.
‫I suppose that will know a valid user, which is going to probably be admin, so I'll use the lowercase
‫L parameter.
‫Now we specify the password dictionary with uppercase p.
‫Well, there are some dictionaries in Cali.
‫Let me find them, and I'll use one.
‫So I open a new terminal screen and search for the dictionaries using the Find Linux command.
‫So I'm looking for the files that start with pass and have.
‫That LSD extension.
‫I found a few.
‫So let's look at the contents of one of them using the less Linux command.
‫You can search a phrase with forward slash indicator within the last command.
‫So I look for admin if the word exists in the dictionary.
‫Well, because I know the password of the admin user is admin and I want to show you a successful attack.
‫OK, now this is the target server, OWASP, BWR.
‫One, three nine.
‫I have to specify the service we attack.
‫So to learn the service, let's go to the browser again.
‫But before trying to log in, I run Burp Suite.
‫Now, I think I should tell you a little bit about Burp Suite Roof Suite is used in web application
‫penetration test, and I've explained and used it extensively in hacking web applications and penetration
‫testing.
‫That's the course that fully lays it out in detail, but I'll just give you a little introduction to
‫it now if you haven't done that course.
‫Burp Suite is a Web application penetration testing framework.
‫It has become an industry standard suite of tools used by information security professionals to identify
‫vulnerabilities and verify attack vectors for web based applications.
‫I suppose in its simplest form, burps, we can be classified as a personal proxy or interception proxy.
‫A penetration tester configures their internet browser to route traffic through the proxy, which then
‫acts as a sort of man in the middle by capturing and analyzing each request and response to and from
‫the target web app.
‫Individual HTTP requests can be paused, manipulated and replayed back to the Web server for targeted
‫analysis of parameter specific injection points.
‫The injection points can be then specified for manual, as well as automated fuzzing attacks to discover
‫potentially unintended application behaviors, crashes and error messages.
‫You got all that.
‫So now we can continue to the online tracking session with Hydra.
‫Burp Suite is started.
‫We have to route traffic through Burp Suite to be able to listen to the requests and responses and analyze
‫them.
‫So to do this, we should change the proxy settings of the browser to listen to the poor 83 of the local
‫host.
‫You can change the proxy of the browser from the Preferences menu.
‫I just use Foxy Proxy to plug in to change the proxy of the browser easily.
‫This little fox icon is foxy proxy.
‫I'll click on it.
‫And here there's proxy settings for the Port 80 80 of the local host.
‫Now you can use a proxy from your browser's network setting, as seen in the picture here.
‫So I'll choose the proxy local host area, and now my browser's traffic is routed through the Burp Suite.
‫So now I'll make a login attempt.
‫So intercepted the log in request.
‫It's a post, so we find the service to attack.
‫Back to the HYDRA query, the next parameter is HTTP post form.
‫Now is the most critical part of building a HYDRA attack, setting the options of the service.
‫There are three parts of the options of the service HTTP post form separated by the call and character.
‫The first part is the address of the authentication form.
‫The second part is the form parameters, and here they are.
‫I'll copy them and paste them as the second part of the service options.
‫Now this is an important point.
‫Again, the place that the passwords will be set for online cracking attacks are labeled as paths between
‫two carried signs.
‫Same as a password field, the place of the username is signed as user between two correct characters
‫as well.
‫The third part of the service option is a unique part from the response message of a failed login attempt.
‫So I go to the browser.
‫Copy the login failed message and paste that as a third part of the option.
‫I think the service options are ready.
‫So at last, I put a f parameter to make the tool exit when it finds a valid credential.
‫So we're ready to run the command now.
‫Just hit enter an online password cracking attack start.
‫Now we'll wait as much as it takes.
‫It reports every minute.
‫And this is the first business report, 933 tries per minute, that's pretty good.
‫And it says it has 2000 626 tries to do.
‫Now here it found a valid username, password, pair.
‫Just after the second minutes report, the username was already fixed admin.
‫And it found that the password is admin for the user.
‫And since we use the F parameter, it stopped working as soon as it found a valid credential.
‫Now we can go to the app and enter admin for the username and again admin for the password to log in.