OK, so we're used intruder from our Burset to perform brute force attacks, but now it's time to move
on to the more advanced specifically made for these type of the attacks.
And that tool is called Hydra.
Now, I said it was an advanced tool, not because the attack itself is hard to perform, but because
the syntax for this tool can be a little bit tricky sometimes.
And there isn't a unique command that you can run for every website in order to brute force it.
So we're going to dissect the command and explain how can you craft one for specific pages.
The first page that we are going to take a look at is going to be B Web page on our almost purtle machine.
So navigate there.
And we can see here we have a login screen and this is exactly what we need in order to brute force.
Now, keep in mind that we do get the correct credentials right here, which is useful for us to practice
this attack.
So we know that B is username and bug is a password and this will work once we try to login.
But we want to see how we can get this as an output with the help of a hydra tool and with the help
of usernames and passwords list.
OK, first of all, to run Hydra, we can open terminal and type in Hydra.
This will open its health manual and this help manual will not be of much use to you once you're opening
this tool for the first time.
It might seem like it has little options and that it's easy to run.
But in reality, once your brute forcing HDP pages, there are a few things that you need to take a
look at.
So let's start off with crafting our comment.
The first thing they want to type is Hydra and then the IP address of the target that we are attacking,
in my case it is the first on machine which has an IP address or wanted to that 168 that one dot.
The second thing that we need to specify is which type of the attack are we performing?
So we know that we have get request and post request.
We can either specify the username and password right here with a get request or with a post request.
And what will help us determine which one it is, is if we simply go to view page source and we find
the form that is used to submit username and password, which is right here, we will notice that the
method is post.
So we're submitting the username and password with post request.
OK.
Let's go right here and let's type that after our IP address in Hijrah, in order to type that we type
HTP bash form bash post.
If it was a get request, you would type HTP bash, get that for simple as that.
So those are the two options that you need to keep an eye on.
And usually you will have them inside of the page source of the form that you're trying to brute force.
The next thing that we need to specify is the path to the log in page now in order to get the correct
path, we want to type and username and password.
So I'm just going to type, test and test and click on log in.
And see, what do we get so we get invaded credentials and it's under the path, perhaps logging that
we want to copy this path and we want to specify it in our comment in order to specify the first thing
we need to do is open double quotes.
After that, we paste our path.
And we add to that.
Now, why are we adding to that?
Well, in the Hydra, there are a few things that we need to specify.
The thing, number one, is the path which we specified right here.
The thing number two is specifying the name of the username field, the name of the password field and
the bottom itself.
Now, I know this sounds confusing, but will do it right now.
Hang on for just a second.
That's the second thing.
The third thing that we usually specify inside of our command is which error message do we get once
we specify incorrect username and password, which in our case is this one right here.
And at the end we add the users list and the passwords list.
OK, so let's go back to the comment we specified at the beginning of the comment and we specified the
first thing that comes in double quotes, and that is the path.
Now comes the name of the username field, the name of the password field and the name of the bottom.
So in order to get the name of those fields, we once again want to go to the page source and we want
to navigate to the form here, we want to find the code that identifies the user name input.
And it's right here.
If we take a look at the name tag and ID tag, we will notice that it's called Lockin.
So this will be the name of our user name field in order to specify that we're going to type log in
equals.
And then comes this arrow that is pointing upwards after this.
So we want to specify capital user and then again, this arrow that points up.
OK, what did we do right here?
Well, the first thing that we did is we specified the name of our user name field.
And this part right here is just the syntax that tells Haidara to replace this user tag with the user
names that it will read from the user names list that will specify at the end of the comment.
So essentially, it will just replace this with all of the user names that it's trying to brute force
with.
Same thing goes with password.
Now, before we specify password, we need to type this sign right here in order to separate these two
fields.
Now comes the name of the password field, which we can read from the page source.
And it's right here.
We can see that the name is just password.
So let's specify it like that password and equals a Pereiro pass and then not Pereiro once again.
So the idea is basically the same for the password as well.
It will replace the passwords from the list with this pass right here and we want to separate it once
again.
And the last thing that we specify is the button itself.
So we need to find the bottom code inside of the page source.
And it's right here.
As we can see, the name for the bottom is called for and the value is equal to submit.
So what we want to do is we want to go right here in type form equals submit.
That will tell the Hydra tool that once it replaces the username and password, it has to click on a
button in order to submit them and check whether they're correct or not.
Now, finished with the second part of this command, we can go on to the third part by separating it
with two dots once again.
And we need to type the string that we get once a password is incorrect and we have it right here,
we can copy it.
Invalid credentials or user not activate it.
Let's copy that string or that message and we can paste it right here.
Once you do that, you want to close the double quotes and at the end we specify the usernames and passwords
list.
Now, since we don't have one yet, let's just open another terminal.
Kyprolis and NENO users, the 60 here, we can type any user names whatsoever.
Let's go test test one, two, three, root admin and let's add the correct user name just so we can
see whether the tool will work and whether it will manage to find this to be the correct username.
Let me just double check.
Yeah.
B is username and password.
So we will be adding the correct credentials in the list just for the purposes of this tutorial, in
order to see whether it will work in reality, of course, you to know the correct credentials and you
would use a much bigger list than this.
OK, let's head, for example, mean one, two, three, and that would be about it for our users.
Now, let's go and do the same for the past 30, 60, and here will be our passwords.
So let's go password pass.
One, two, three.
Password, one, two, three.
Let's go bug, which is the correct password.
And let's go with test.
One, two, three, four.
OK, say this as well, and now we go back to our command, what where we need to specify if we want
to use these two files in order to brute force to specify the user names of how we type a dash and then
capital out.
After that comes the name of the file, which in my case is user's data.
And after that we specify capital P for the passwords file and then the name of the passwords file,
which is pass dot the OK, this is the entire comment.
And I know it might sound confusing and you probably have no idea what we did right here.
But don't worry, this is the same reaction that everyone has once they first encountered the Hydra
talk.
And we will be taking a look at another example of crafting the command for a different Web page in
the next video.
For now, let's go through this command once again and explain what we did.
So first we type Hydra, then the IP address of the target, then which type of the brute force we want
to perform based on how the credentials are being processed by the webpage since they are processed
with post request.
We use HTP Dash form Desh Post.
If they were processed with get request we would type http dash get dash for after that comes the double
quotes part, which has three different things.
The first thing or the first part is the path to the page that we want to brute force.
The second part is the name from the user name field, the name from the password field and the pattern
itself.
And the third part is the string or the message that we get once we specify the incorrect username and
password.
This will help Hijrah determine which credentials are correct based on this message.
If we specify some credentials and we don't get this message, it will flag those credentials as correct
ones and it will output it right here for us.
At the end, we specified Dash Capital L and we specified the users that the default or any list that
we want to use for user names and their DSP and then the passwords file.
OK, let's press enter and see whether this command will work.
And you will notice in just one second we managed to perform all the combinations of usernames and passwords
and we got the correct one right here.
So not only did this finish much, much faster than perhaps it intruder, but it also outputted our
correct credentials in clear text right here.
Let's give it a try and let's try to log in B and back and click on Log in.
And here we are.
We logged in successfully.
Awesome.
So once again, this is a little bit complicated, but don't worry.
In the next video, we're going to check out another example of using Hydra on a Web page.
Thank you for watching.
And I will see you in the next lecture.