Welcome back.
Time to perform our brute force attacks.
We're going to cover a couple of examples of brute force, whether with Burset or some other tool,
but nonetheless, the principle behind them is always the same.
We want to use lists with a bunch of usernames and passwords to try to get credentials of a certain
account.
So this doesn't always work.
Matter of fact, it usually won't work unless the target has a common user name or a weak password.
The first example that we cover is going to be with our Burset intruder.
We only saw a couple of examples of using intruder, but right now we're going to take a look at a different
approach to this attack.
So first, that we want to do is we want to navigate to this application that says a wasp bricks.
Click on that and it will lead us to this page under the bricks tab.
We will have some tab that says login pages.
Click on that.
And here we will have multiple login pages that we can practice on.
Now, for this example, we're going to go with login number one.
And then if you want, you can practice on the rest of the log.
It's the steps to performing.
This attack will be the same for each challenge right here.
OK, let's navigate to log in one.
And we have a simple login for if we type, test and test.
It will tell us wrong username or password.
OK, let's intercept this request right here inside of our Burset.
And let's send it straight to the intruder here, we can turn off the intercept right afterwards and
let's navigate to our position, step inside of our HTP request.
Sit down here, we have our username and password field.
Now, before, when we used intruder, we used this attack type sniper and we only targeted one field,
right now we're going to target two fields at the time, the user name field and the password field.
So let's first clear all the other payloads and let's double click on username, click on that and double
click on password and also click on Add under the attack type one to switch from sniper to cluster bomb.
And if you remember correctly, the cluster bomb is the attack type where we can use multiple payload
sets in order to perform the attack.
In other words, we have multiple input fields that we want to brute force the username and password.
Now let's go to the payload step and it looks rather the same just this time.
We have payload set one and we can also choose payload set to the first one is the user name payload
set.
And here we want to load a list that contains the user names.
Now, in real life scenario, you would use a list much bigger than we use in our examples, because
for this attack, we're going to use the default users again, which is in our WORDLIST directory inside
the display directory.
This list only has like 14 common usernames, but this is just to prove that the attack works.
In reality, you would use a much, much bigger list once you select it right here, click on set and
select paillard.
Set number two under the payload set.
Number two, we want to load HTTP default passwords.
In other words, it's called http underscore default underscore pass dot the the double click on that
and it will load 19 common passwords right here.
If we just do this and we start the attack, as it says right here, it will have a number of two hundred
and sixty six combinations.
So this will take a minute or two to finish.
But as soon as we start we notice something strange.
Every single request or every single response almost has a different length.
So how are we going to determine which username and password is correct?
We need some other approach.
So let's close this for just a second.
We're going to stop this attack and let's go back to our page.
Once we typed in the incorrect username and password, we got this message right here.
So maybe we can use something like this to determine which username is incorrect and which password
is incorrect.
Let's go back to it.
And if we navigate to options tab right here, we're going to see this option that says grep equals
match.
These settings can be used to flag result items containing specified expressions.
So let's clear this list and let's perhaps add this statement right here.
So, in other words, what this means, let me just paste it first,
that it will flag each result that contains this sentence in its response.
In other words, it should flag every incorrect username and password combination that it tries.
Let's run the attack again to go back to payloads and start the attack.
Now, you can see each of these usernames and passwords combination is getting flagged, except one
of we got this admin and admin combination that didn't get flagged, which means that the sentence of
wrong username or password isn't contained in its response.
This most likely means that this is a correct username and password combination.
As we can see, the rest of them are all flagged and it's still going with this attack.
But we can stop it since we already found the correct username and password.
In reality, this attack would take much, much longer with much, much more combinations of usernames
and passwords.
And even at the end, you might not be able to find any correct combination.
Nonetheless, let's give it a try to our correct combination to see whether it worked and let's type
admin and add.
Cement.
And it worked, we successfully locked in, as it gave us right here.
Now you can try this on other examples as well inside of these bricks application.
However, in the next video, we're going to take a look at a more useful tool for brute force attacks,
which is called Hydra.