Hello and welcome!
In this video we'll talk about the brute forcing passwords of remote services using Hydra, which is a
parallelized login cracker that can perform fast dictionary attacks against more than 50 Protocols, including
Telnet, SSH, FTP, HTTP, HTTPS, SMB, Cisco AAA, several databases and many more. Hydra is
very fast and flexible and the new modules are easy to add. This tool makes it possible for researchers
and security consultants to audit remote systems. Just for the record, other online crackers are Medusa
and Ncrack. If you are running Kali Linux
you will have a version of Hydra already installed. For all other Debian based Linux operating systems
install it from the official repository using: apt install hydra.
There is also a graphical interface available that's already shipped with Kali Linux.
This is the graphical interface of Hydra.
On other distributions you can install the GUI by running: apt install hydra-gtk.
In this lecture will use the command line because it's easier and most of the time you execute a
security audit from a remote server, without a graphical interface installed.
Let's get started! In the first example
I'll try a dictionary attack on ssh.
This is the ssh server.
This is its IP address and listens on the default port
22. There is a user called Mark that has a weak password. As root
I'm starting Hydra: hydra -l the user whose password I want to crack
mark - P and to the path to a dictionary file /usr/share/wordlists and I'll use a password
file that comes with metasploit and contains some of the worst passwords. The password file is called
the Unix passwords.txt then -t the number of threds
to start, let's say 10, ssh, the service colon :// and the IP of the server
192.168.0
.19
:22 If you change the default port you'll use here the correct number.
Before hitting enter I want to see the authentication logs on the server and I'll use tale - f.
I want to see them in real time.
Here on the server tail -f and the path to the file where the ssh logs are saved
/var/log/auth.log
And I'm starting Hydra by hitting enter. And we notice how the password was already found.
One valid password found! On the ssh server
we notice how it has tried different passwords until it has found the good one.
Let's try another brute force attack this time on FTP on the same server. On the victim machine
I am installing an ftp server: apt install proftpd; this is a well known ftp server; it's installing
proftpd - professional ftp daemon
Okay!
It was installed.
Next I'm executing tail -f on the ftp server logs. I want to see in real time the attack: tail
-f /var/log/ proftpd/ proftpd.log and back to Kali I am executing Hydra again; this
time
the service is ftp; it listens to Port 21 and I want to find out the password of user
Tor. I've already created the user: Tor
and we see how it tries password after password.
In a few seconds, or tens of seconds the user’s password will be found.
It has been found. The password of user Tor is tinkerbell.
This is also a very weak password; it's a dictionary word. To mitigate these attacks
the first thing you can do is to enforce strong passwords to each user then configure for each service
that permits authentication
the maximum number of authentication attempts permitted per connection. If possible, at least for ssh,
disable password authentication and enable public key authentication.
This is much more secure!