Hey everybody welcome to the next video.
We're gonna be talking about how to attack an account using a word list.
So in this particular example we're going to be using a single account user name that we've already
known and we're gonna run through a password word list of common passwords to see if we can access the
application or the host.
In this case we'll be doing as a sage but with this particular tool we can work with it TTP and FCP
our P.S. There's there's a lot of different things we can do with this particular tool.
The one we're going to be looking at it's called Hydra Hydra performs a lot of different things we'll
see what the option is for this Dash.
H.
Perfect.
OK.
So we can see here we have a lot of options we can do here and this can cover things like SS h h TTP
H2 G.P.S. like I said there's there's a lot of options we can do here.
So what we're gonna do is we are going to use Hydra to go ahead and attack a machine over SS age with
unknown account admin.
So we do as you Hydra dash l could using a dash capital P cause we're gonna give it a word less.
Now keep in mind you can use Hydra to give it a word list of usernames as well as a word list of passwords.
And that will give you a different result because it'll check a whole bunch of you ever user name against
every password in the word list.
It can take a while and it's very noisy but it can work.
So we'll use some of the common word lists share or list and we'll do we'll do fast track.
Next as we the amount of threads that we want to provide the application for SSA.
It's normally four but four.
But for our particular video we want to speed this up a little bit so we'll do 20.
Keep in mind for it means it's stable for most systems and it doesn't miss anything as much but when
you start getting into higher threads you could miss a valid check.
So we're gonna go head to dash T for threads and we'll give it 20 and we'll give it the hostname to
two and we're gonna give it what protocol we want.
So in this case s h so we go ahead and run that so you can see here it does give a warning saying that
we want parallel threads to recommended before for SS H but we're going to go ahead and ignore that
just for the sake of this particular video.
But keep in mind that in the real world not a real engagement you're going to want to definitely keep
this at for just to keep things a little bit more reliable from that standpoint and there we go.
We can see that it was successfully able to gain access to this machine with username admin and the
password.
So you can notice that this is a very easy example because Admin Admin is a very simple thing that you
could just guess on your own but think about taking this a step further when maybe as a red team or
your team has built up a word list of common passwords that you've found over 2 4 6 10 years working
at that company and since the Red Team was started.
And then if somebody reuses a password from an old system as an example and you go ahead and attempt
a dictionary attack against your own personal wordless for the company then you can start finding reuse
a lot quicker and a lot easier for even complicated passwords that you happen to found in clear text
at one point in time as a red team or for that company.
So it's always good for red teams to build their own word lists and we're going to go over a little
bit more about this in the past cracking module but just keep in mind that when you start finding and
cracking passwords or you find clear text passwords always keep a tab on them in a secure location for
the red team to be able to use and keep something called like simple something similar to a master word
list that has a set of word passwords for your company that you've found previously.