‫Hydra is a free and open source command line tool to crack valid login password pairs online.
‫It's very fast and flexible, and new modules are easy to add.
‫Hydra is embedded in Cali.
‫But before using it, we'd better have a look at some of the parameters.
‫You can specify the username list.
‫Let's say the user dictionary with uppercase L as the parameter.
‫If you'd like to find the password of a valid user, you can specify a single user with lowercase l
‫instead.
‫You can specify the password list.
‫Let's say the password dictionary with uppercase p as a parameter.
‫If you find a password, for example, while dumpster diving and don't know the user, you can specify
‫a single password with lowercase p as a parameter.
‫If one valid username, password pair is enough for us, we can use the f parameter and that makes it
‫to exit when it finds a valid username, password pair.
‫Now, server is another required parameter of the tool, which stands for the target server.
‫Finally, we have to specify the service that we want to attack.
‫And some supported services are.
‫And a sequel, my sequel, Oracle listener, as I say, age Cisco and the list goes on.
‫So let's see how we can perform a dictionary attack on S.H. service using Hydra.
‫So want to open a terminal screening collie?
‫Now, I want to test a network connection first between Cali and the target system, which is one nine
‫two one six eight one zero two one one for me at the moment.
‫Now I want to learn whether the state service is running on the target and to achieve this.
‫I'm going to use the map tool.
‫I know you're already a step ahead of me.
‫That's good.
‫The first parameter is the IP address of the target machine.
‫So it scanned the most common 100 words, which will cover the default associated port, which is 22.
‫Now, the last parameter is to detect the versions of the services if you don't use version detection
‫and map labels of ports, according to the default services, for example, if SSA is running on, let's
‫say, Port 80 and you don't use the version detection option and map labels the services HTTP, which
‫is not correct.
‫So now we've got the results in 12 seconds.
‫And as you'll see, the SSA service is running on Port 22.
‫Next up is try to establish an S-H connection to the target.
‫Well, I'm feeling pretty lucky today, and I want to try for the root user first, so.
‫Type SRH route at the target IP and hit enter.
‫It's asking for the password, so we can suppose that the target system is open to connect with a root
‫user.
‫We don't know the password as of yet, so I'll just press Control C to cancel the login period.
‫OK, now, is it time to use Hydra to perform a password cracking attack on to that target machine?
‫So if you type hydro and press, enter the help page appears explanation what hydro is and here are
‫the options.
‫Now, these are the supported devices, including the Secret Service.
‫So let's go ahead and build the command together.
‫Since we know the root user is enabled for the state service of the target machine, we can give a single
‫user route as the username with lowercase L as a parameter.
‫The uppercase case is to define the dictionary, which will be used in the attack.
‫Well, we're going to need a dictionary, so let search Carly to find one.
‫I'll just use the Find Lennox command for this purpose.
‫The first parameter is where it's going to start to search.
‫Slash means that it will start searching from the root folder name means that we want to find the files
‫according to their file names.
‫Now I want to find the files where the name starts with password.
‫Star here represent that the rest of the name might be, well, anything.
‫So it's OK to hit enter.
‫Well, now there are a lot of files.
‫I did not expect that, did you?
‫So let's scroll up a bit.
‫OK, here I found a folder with the name word lists.
‫So let's go to the folder and look at those word lists.
‫Else to list the files.
‫Well, look at that there are a lot of word lists for different purposes.
‫Here there's a word list, unique passwords, and it's not a big file, in fact, but I don't want to
‫waste time while waiting to run a long dictionary, so this would be enough for us to start anyway.
‫And of course, I'll choose a simple password for the same service to succeed the attack, but don't
‫tell anybody else.
‫The W c Linux Command is used to count letters, words and lines of a text file.
‫The result means that Unix passwords file has 1009 lines, 1009 words and 7000 883 characters inside
‫useful information.
‫So let's continue to build a Hydra command HYDRA.
‫Dash L Root Dash Uppercase P.
‫Password file Unix passwords.
‫Dot DST.
‫After you exit as soon as finding a valid credential.
‫Dash Capital V is to show the log in and password pairs of each attempt.
‫And that's used to increase the verbosity level.
‫Target IP address and finally, the service to attack assess each.
‫And time to run the command.
‫OK, so I'll the attack by pressing the control c keys.
‫But please look at the first lines.
‫There's a warning here which says many sage configurations limit the number of parallel tasks.
‫And it recommends us to reduce the tasks using the T four parameter value pair.
‫OK, I recall the command by pressing the up arrow and add T five at the end and run the command again.
‫Now it warns me that it will override the restore file of the previous session.
‫If we do not abort the command in 10 seconds, the countdown starts.
‫Now the attacks started, so as you see here, Hydra pauses the attack and every fifth try.
‫Now we've got the results in seconds.
‫We found the password of the user of the SSA servers running on the target system, Hydra says the password
‫is password one.
‫Never seen that before.
‫Now I have an SS Age connection on the target system.
‫Ha ha.
‫Well done.