All right, before we get started,
you should know that this lab and demonstration
required the use of four virtual machines.
We have a Windows 2016 server running Active Directory,
which is pre‑configured with a long list of Globomantics users.
There is also a Windows 10 client that has been
added to the Globomantics domain.
This will become our target when brute forcing RDP, or Remote Desktop.
In addition, the lab also includes bee‑box version 1.6,
which gives us a nice target for the HTTP login
cracking attempts in the form of bWAPP, which is an intentionally vulnerable,
extremely buggy web app.
And it's really good for learning about web application security issues.
And then we have Kali Linux 2019, which comes with THC Hydra
pre‑installed and is used to launch all of the brute force
attacks within the demonstration.
And one last thing. During this demonstration, two files are
used to perform the brute force attacks.
One is named usernames.txt,
and it contains a long list of usernames that have been pulled
from the Active Directory domain in the target environment. And
the other file is named passwords.txt,
and it contains a short listing of passwords that are targeted at the
environment that we're testing. In a real‑life situation, you would
leverage downloadable password lists or create your own password
lists using specialized tools.
Now that we've reviewed where Hydra fits into the big picture,
we are going to jump into a demonstration where you will learn the
basics of Hydra, brute forcing a website login,
combining a list of usernames with a list of
passwords, resuming an interrupted session,
looping passwords around users, targeting RDP, using a proxy,
and leveraging debug to identify problems.
We are going to start off on the Kali Linux machine I've got set up
here in the lab, and I'm going to go to the Terminal Emulator and
then take a look at the man page for Hydra.
And what I really wanted to highlight here is the section down
towards the bottom, Currently this tool supports. And then look at
that list. We've got FTP, and SSH, and SIP,
and the list just goes on.
So if you're facing a situation to where you need to brute force a
credential set, make sure that you take a look at this list and see if the
service that you want to target is supported by Hydra.
And then you may want to take a look at this section down here
where it says OPTIONAL SERVICE PARAMETERS. Some modules have
optional or mandatory options.
Type hydra ‑ U space servicename. For our first demonstration,
we're going to take a look at http‑post.form.
So let's exit out of the man page here and then hydra ‑U
http‑post‑form. I'm going to scroll up here a bit.
So the ‑U section will give you some information
about the module that you're using.
In this case, you have the syntax and a description,
and this will help you make sure that you collect all of the required
information that you need when attempting a brute force attempt.
So let's go ahead and bounce out of the Terminal Emulator
here and take a look at our target.
In this case, I'm going to open the Web Browser, and I've got a bWAPP,
extremely buggy web app, running, and it has a login form.
We are going to attempt to brute force this credential set.
So, let's go ahead and type in bee, and then I'm going to
type in password and see what happens.
As you can imagine, it did not let me log in.
But one thing of note here is if you look at the bottom,
you've got invalid credentials or user not activated.
That's important because that is something that you're
going to need for the HTTP POST form.
Let's go ahead and look under the hood here, and I'll Ctrl+Shift+E for the
developer tools and then reload that page, resend the information, and then
I'm going to scroll up here. In order to make things a bit more readable, I'm
going to click Edit and Resend and then scroll down. In the Request Body
we've got this piece right here.
This is super important for what we're attempting to do.
So I'm going to copy it as it is and then minimize the web browser. I'm going
to jump over back into the terminal and clear the screen.