So now, let's go ahead and start our first brute force session.
Go to the lists directory and type hydra ‑l and the
username that we want to use, which is bee, then ‑P, and then our password list,
followed by the IP address of our target,
which in this case is 192.168.30.129.
And that is followed by http‑post‑form, and we're going to
enter quotes with a /bWAPP/login.php:, and then I'm going to
paste that request body that I had.
So there we go.
We've got
/bWAPP/login.php:login=bee&password=PASSWORD&security_level=0&form=submit.
So now there are a couple of things that we need to change here,
so let's take care of that first. I'm going to replace login with
^USER^. And this is where Hydra will place our login, which in this
case is set as bee. And then we will do something similar over here.
We'll go ^ and then PASS, P‑A‑S‑S, ^, and then we'll leave these other
two as they are. Now we need to tell Hydra what a failed login attempt
looks for.
So, you can just type : here and then just the word invalid.
The reason behind this is Hydra will make a login attempt,
and then it will search the result for this word, invalid.
This could be a string.
It could be something such as invalid login, page not found.
And the closer to the actual statement that you are with this,
the more accurate your results will be.
So, more information is better in this case.
So let's go ahead and close this out and give it a try.
Looks like our password file did have the correct password.
So let's take a look at that. We'll grep it out.
And sure enough, there it is.
It's actually in there twice. And we can try this again. Let's scroll down here,
and in this case,
we're going to use a different login name just to see what happens.
Replace that with beetle, press Enter, and 0 valid passwords were found.
So we've got a pretty good idea that our brute forcing
is working against this website.
Now we can move on to more complicated items. So I'm going
to change the login name again and then go to the end here
and add a couple of options.
We'll use t1, and that will cause Hydra to only use one task at a time,
and we're going to use ‑v,
which will be representative of verbose so that we get more
output, and we'll use the capital V so that we see all of the
attempts that are being made.
After that,
we will use ‑e and then nsr where the n instructs Hydra to
check if a blank password can be used to login,
and the s will attempt to use the username as the password, and then the r will
reverse the username and then leverage that as the password.
So, moving on, we'll then use ‑o for output so that it will output
the information into a file of our choosing.
In this case, credz.txt. And Hydra does support a couple of different formats.
It supports text, which is the default,
and then also JSON and JSON1. So we'll try JSON.
But in order to do that, we need to use the ‑b option.
And now let's give that a try.
There we go.
We can see that it's going through, and we had several different attempts,
all of which are identified here.
And then we found bee and bug.
So let's go ahead and take a look at our file that should've been written.
And there it is, credz.txt. Cat that out.
And as we had requested, it's in JSON format.
Let's clear the screen.
What about situations where you don't want to look for the failed
state or a failed login, but you already know that you want to
look for something that's from a success state? So, if you
remember the last scan that we ran,
we'll run it again here, had a VERBOSE statement for Page redirected
to http://, the IP address, and then portal.php.
So what we can do here is actually change this piece
right here and add S=portal.php.
So now Hydra will know that it is a successful login
because it's able to identify portal.php.
Let's give that a try.
And there we go.
As this was a redirect,
we could very easily also make the assumption that
there's going to be a 302 in the response.
So, let's see if that response would include that. So 302, and once again
success. Just to make sure that everything is working as intended, replace
this with 400, and no valid combinations were found.
Now what if you wanted to use a list of usernames
along with a list of passwords?
Well, that's pretty easy.
We'll just do exactly that and take a look at the results.
Change this to ‑L and then username.txt,
and we'll keep everything else the same.
I did change the S= from 302 back to portal.php, if you notice that, and I
got rid of some of the other options that we had just to keep things simple
for this demonstration. So pressing Enter,
we can see that Administrator goes through password 123456.
And what it's doing is it's going to cycle through the entire
list of passwords that you have.
Then it'll go on to the next user, which is Guest,
and it'll do the same thing. Now, as you can probably imagine,
that's a really good way to possibly lockout accounts.
So what you may want to do is attempt to loop passwords
around users rather than the other way around.
So before we get started on this,
I wanted to highlight if you take a look where it says The session file
./hydra.restore was written. Type "hydra ‑R" to resume session.
This is important because sometimes if you have an interrupted scan,
you might lose hours and hours of time if you did not
have some way to resume that session.
So let's go ahead and take a look at that file.
And sure enough, we've got hydra.restore.
It's not really clear text readable. I mean you can see some things,
but it's not very useful from that perspective.
However, if you need to restore your session,
it's simply hydra ‑R, and we'll start exactly where we ended the last session.
So let's go ahead and cancel this out, and we'll make one small change
here. And we'll add ‑u and also ‑I. The lowercase u will loop the passwords
around the users just like we just spoke about.
So let's go ahead and give that a try and see what that looks like.
And now you'll notice that we're seeing the same password repeatedly,
and then we see all of the users.