Hello everybody and welcome back.
And in this trial we will cover the brute forcing of the username and password.
Now this is very common on since this will work on any website that basically has the user name and
password input so in order to do that let us first open up our OS machine.
So make sure it is turned on.
Make sure that your burps suit is turned on and make sure that your purpose it is used as the proxy
in the Firefox.
Once you turn all of that on just go onto the IP address of your virtual machine and where we want to
go right now is we want to go on to the OS breaks.
So click on the OS breaks and right here you will see this page and where we want to go is here.
Bricks and then log in pages it will lead you to basically these six different logging pages.
We want to click onto the log in page three and you will see it will prompt us with the user name and
password which is probably very familiar to you since we see these kind of user ID on every Web site.
So basically Facebook Twitter all of them use these kind of form input in order for us to brute force
this.
First of all we will need to make a user list and password list.
So I already made mine.
So let me just open a new terminal and as we can see right here if I type here or else I have a user
that 60 and password and password not to exceed.
So let me just now Nano the users that 60 so you can see that it basically has a few user names so you
can just copy all these user names from me and create your users not the 60 file.
How we do that we are basically just now the users of text file type.
These user names city URL plus all that enter and then control X to exit.
Same do that do that also with these passwords that list better the text.
Excuse me.
So here is my passwords list file as we can see one two three four five six Password password one admin
web code then capital web code quietly One two three one two three and so on and so on.
So these are just readily read through small lists.
We use small lists right now so it doesn't take a lot of time in order to brute force this.
And what we want to do right here is we want to turn our intercept on once we do that.
Go on to your logon page which is log entry and type here anything.
Dee dee dee dee dee dee dee dee dee dee.
Doesn't even matter.
Just click here submit and we can see right here the packet that we're sending.
So of course we're sending WITH THE POST request we are sending on to this page which is the same as
this one.
And we're sending a user name of this and password of this.
So once we see the packet you can turn the intercept off and right here it will say wrong username or
password which we really didn't expect that to work.
So let's just find the packet right now.
Let me just find it.
It is under over bricks log in three.
It's not this since this is a GET request you basically tried to find the posts request Oh US bricks
log in three and here at this my posts request for the log in three page
what we want to do right here we want to create an attack where we will send a bunch of usernames and
passwords and wait for the different server response for some of them which will tell us that that username
and password is correct.
Now it is similar to the previous attack which we used on the user name but right here what we want
to do is we want to check out the server response for every attack for every user name and every password
and we want to see if the server responds in its h the email code has this string right here.
As you can see wrong username or password and this is this string.
So this is the same as this.
This is just in the HMO code of the page the user name and passwords and password which doesn't have
the string right here is the valid username and valid password.
So the concept of this attack is brute forcing until we find a response which doesn't contain this string.
So let us do that what we want to do is basically do the same as in the previous video we want to send
this packet into the intruder.
And once this packet ID is in the intruder go into the positions and you will see also once again that
all these positions are selected you want to clear all of them and right now instead of selecting one
position we want to select both username and password so click here on ADD and select.
Also the password.
Click here on add for the type of the attack you do not want to use sniper since it is used to only
put forth one input.
We want to use the cluster bomb the cluster bomb is basically used to brute force two different inputs.
So once you select here the attack type cluster bomb and once you select here the user name and password
go onto the payloads and here as the payload set one we want to leave this and go down here and click
on load and we want to basically load our username and password list that we created.
So the username and password is that I created is in the root folders.
Let me just find where root is.
Here it is.
And as we can see here our 2 Uh lists that we created so on for the first list we pick the user dot
the extent and click here open and this is our list right here.
And then after you select that list which is the user list you want to go onto the payload set and on
here you just click here on 2 which is basically referring to the second input of our packet which is
the password.
So once you select that there to click here on load and select the passwords not the 60 which is our
list for passwords now after you do that you want to select one more thing which is we want to add to
the burbs should this ring that it should search for in the packets which is this string since we the
district will only be prompted once the user name or password is wrong so let me just find where the
adoption is.
It is just cohere here on the options
and once you go onto the options scroll right here down and in the grep match.
But you want to do with basically grep match is the option that people use in order to find the string
in our packet.
So just remove all of these strings right here.
We do not need them.
Let me just click right here on the remote.
Once again since it doesn't work or clear it could be clearer.
Yeah.
Just click here on the clear and it was asking you if you want to quit list.
We want to end it in the ad section but you want to type is wrong.
User name or password dot.
Now make sure that it is the same.
Exactly the same as this.
So the user the MySpace name must also be the user space name right here.
This dot must also be right here.
So if you for example type your user name that is the one word it will not work.
So make sure you had a space right there.
And once you do that click here on ad and we selected the string that we want to search for our response.
So the server.
So once you select all of that what you want to go is here on the stock deck you will get the same prompt
window as before.
So just click here on the OK.
And as you can see right now it is trying out different combinations of our usernames and passwords
and here as we can see where this is checked.
It is basically showing us the responses that have this string in there.
So all of them have this string which is the wrong user name or password.
And one what we want to do is find the one that doesn't have that as we can see.
We found it right here.
So this response doesn't have wrong user name or password in the output of the server to read for example
if you were to use this one which is user and admin.
So let's just try it right here.
User admin you will get the wrong user name or password.
And that's why it's checked.
But this one isn't.
So it must be a valid account.
If we type here admin and admin below and submit you will see that is that you have successfully logged
in
once you do that you basically brute force it a log in and you can log in as a different user.
Now of course most people won't really have to use the user name and password set admin admin but for
the real life attacks you want to use much bigger lists and you want to use more probable usernames
and passwords.
Now in order to perform this same attack faster.
What I will show you in the next video which is the another tool that calculus comes with which is Hydra
it is a brute force search for the log in pages for the Web site log and pages.
But it works much faster than the burps with brute force or sea as as you can see right here.
I just find it.
Whereas our page it has finished but it took some time to run this 60 different types of combinations
in order to find one which was the the valid username and password.
Now you will see that the Hydra which is a tool that we will use in the next video will do that much
faster.
So I hope I see you in the next video and take her by.