Hi, and welcome to Credential Access‑Brute Force with THC Hydra.
My name is Lee Allen.
In this course,
you will be presented with a quick overview and
demonstrations of how you can leverage THC Hydra towards
identifying the usage of weak passwords.
THC Hydra was created by Van Houser back in 2001,
and he has continually updated Hydra, throughout the years.
The tool can be used towards brute forcing of network logins.
It is a powerful and fast parallel password cracking tool with a
wide variety of supported network protocols,
which include, but are not limited to, SSH,
HTTP, RDP, MySQL, Microsoft SQL, and so many more.
Basically, if it can be reached over the network and requires credentials,
there is a good likelihood that Hydra will be able to assist.
Hydra is open sourced and licensed under the GNU of Pharaoh
General Public License and is available for download and
compilation at github.com/vanhouser‑thc/thc‑hydra.
The tool has support for most platforms,
including MacOS, Windows with Cygwin, Solaris,
FreeBSD, and Linux, and even mobile installs that are based on QNX, Linux,
or MacOS.
The demonstrations in this course will take advantage of the
pre‑installed version that comes available on Kali.
If you take a look at a kill chain, you will find that THC Hydra,
which is a brute‑force network login cracker,
will typically be used somewhere in between reconnaissance and lateral movement.
For instance, during your engagement,
you may come across a network device or a website that
requires a username and password credential set.
Hydra can then be used to guess valid credential pairs.
As you gain more access into the target network or application,
you may have other opportunities to use the brute forcing
capabilities that Hydra makes available to you.
MITRE has put together a wonderful knowledge base known as the MITRE
ATT&CK framework that details and categorizes the different tactics that
they've seen attackers use in real world attacks.
Within the credential access tactic, you'll find technique T1110 Brute Force.
THC Hydra is a very specialized tool that is good
at brute forcing network logons.
Keep in mind that brute forcing is typically used when other,
less intrusive and noisy alternatives are not an option.
There are three sub‑techniques that apply directly to Hydra's capabilities,
the first of which is T1110.001 Password Guessing.
This involves making logon attempts until valid credential sets are found.
This could be done with a password list or iterating through
character sets until you get a valid match.
T1110.003 involves password spraying.
Password spraying involves looping a couple of likely passwords,
such as winter 2020 around a very large list of usernames.
This can then help an attacker reduce the chance of
accidentally getting locked out of accounts.
And the third sub‑technique is known as credential stuffing.
An attacker will grab a credential set that has been leaked and
then attempt to find other services that allow you to log in
using those very same credentials.
This has a high likelihood of working if the user has been reusing the
same username and password combo for several services.
Let's take a look at an environment so that we can see the attack path
that someone might need to take when using Hydra.
As an attacker or defender in hopes of identifying the
usage of weak or commonly used passwords,
you could potentially come from the inside of the network or,
as in this case, from the outside.
Usually your reconnaissance effort will have already been completed,
and they'll provide you with some information about the target.
Using Hydra,
you will then be able to make attempts at brute forcing any
externally exposed login opportunities.
This could be any of the many network services that Hydra supports,
such as VPN, email servers, websites, and so on.