Everybody welcome to next video we're gonna be talking about password spring now password spraying is
the technique where you take a known username and password such as you've got a compromised you've cracked
the password from a machine or they had a plain text username and password on the system in a config
file for example or you might have pulled that the plaintext from a different machine.
So this technique allows you to take that single username password and attempt to authenticate across
the specific service across the entire network range.
Now what's important about this is it allows you to stay under the radar of a password lockouts.
So on the other hand a password brute forcing which will go over and different video the ability for
that is to hit the same account with different passwords but in most cases they have a three password
lock out after three failed.
And if you lock somebodies account out normally it's a red flag for them and the admin especially if
the user did not initiate it and some places have an auto response where they get an email and their
passwords been locked out and that could cause a giant red flag for you.
But with password spraying you're only making one attempt on one account through all of the machines
now depending on the type of setup.
This could lock that particular account if they're all hooked up.
But if it's a local account on these machines such as an admin which is normally what you to try this
as not an old app user or an AIDS user but you would try this on a local account on the machine.
It's always it's local and each individual machine counts are technically separately on each machine
and that allows you to stay under that radar.
Now there are ideas and log monitoring which means if if for some reason on a multitude of systems the
same account has a password failure of a failure rate on every machine or X amount of machines on a
certain set of time that might draw a red flag as well.
So it's not foolproof but it's a good way for you to test a username and password across an entire service
such as SS age for example.
So there's not a lot of tools that will do password spraying specifically.
There's a few that can be used for it but the quickest way and the reason I'm doing it manually is because
I want you all to be able to write your own script to do it.
So if we look in here we have a sprayed up.
So if we go ahead and look at that this is our code in Python 3.
Note that it's Python 3 not Python 2.
The reason for that is because the import of IP addresses right here is in Python 3.
Now take a look at this code.
The first thing it's you can do is get two functions here.
We'll skip those in a second.
So IP addresses is we're getting the first argument.
So in this case the first argument or technically is the zero with ARG is the sprayed up.
Why the file itself.
So the next one after that is going gonna be the first argument so one is the first argument.
So this is going to get this arrange cider notation range.
Now we're gonna give it a username a password and then we're going to default the port of twenty two.
In this particular case we're looking at SS H and then we're gonna go through every IP in that range
and check the port.
We'll just checks at the ports open as well as if the host is alive and it returns true if it is.
And false if it's not.
So if it's false it skips it and continues on to the next one.
And then if it is it prints it out and then it checks the password so it checks the username and password
by making a connection over apparently go and then go ahead and returns true if nothing no issues occurred
and if the password failed it would throw an exception.
So we're just going to print the exception and return false.
And if that's the case will not get this working creds on host.
So this is just a quick script for us to go out and hit a slash 24 range within a reasonable amount
of time you could thread this make it much faster which I recommend you all doing.
And as part of the this video I want you guys do a little bit of homework and take this script which
is in a link above the video.
Take this rebuild it with a different library not using param Migo but use a different library to make
the SSA connection expand it so it can do.
SS age and FTB and also make it multi threaded.
So you guys should have all those skills to be able to do that without using pair Emiko with having
gone through the python module so we're gonna go ahead and take a look at how this works.
So when do Python 3 we'll do sprayed up here.
Why do the 1 9 2 1 6 8 1 0 slash 24 so the whole 1 9 2 1 6 8 1 x range.
We're going to give it let's say admin admin so admins username admin is password so we'll go and run
this
so after second we could see one dot Nine has SSA Goldman but the authentication failed so give it another
second here and we got 1 9 1 that 22 A.
And it's got working creds.
So we've stop that we'll verify.
What if we do SS H admin at 1 9 2 1 6 8 1 22 and we'll go ahead and do admin as the password and boom.
There we are.
We are not logged into the system.
So this is a nice way for us to be able to quickly check usernames and passwords or a username and password
across multiple systems while staying under the radar of password lockout feature.
So again take this script rebuild it with a different library make it useful for SSD age and FTB and
then make it multi threaded as well go ahead and post that up to your get hub for free to use and you
select to it in the Facebook group so we can see how you guys did that.