Now it's time to create our look in brute force, OK, for the application right now.
Actually, I already uploaded this file, which is the brute force that bite so you can download it
and writing the code step by step or tracing the code step by step.
And already I have this file, which is RockYou that text.
And actually this is the file, as you can see, it is here.
So this is the file, the same fight as the Linux file, which is which contains a lot of text file.
So Vacanti here, it will take a lot of time, as you can see, still bending as you can see it.
Copy that.
So it's if I get here, dude, this is to see the size of the file.
You can see it is one hundred and forty four megabyte.
And by the way, I already uploaded that for you if you want to use it.
This is a huge wordlist, and by the way, if you have Kelly, you can find it.
It's OK, but if you don't have it, you can download it and start with me.
And by the way, I will use this you the text as a wordlist so we can check and check the users or the
bus.
What I mean for this specific user that we provide.
Don't worry, we will handle that right away.
But for me for now.
OK, now but again, please don't use this to attack people to damage systems and so on.
OK, I want you.
I'm not responsible for anything of that.
OK, please use it for you as a white hacker to have a career, to have a job, to defend people and
so on.
OK, now let's start.
So this is the first thing which is that important.
We already talked about this in the previous section.
Now here I.
I'm using something new, which is color and it is no big deal.
Actually, it is just print cut out for a specific text or something, because as you can see from color,
we imported colors here.
So the colored function, as you can see, this found username or password will be printed as a green.
And you can see that where it is.
Yeah, yeah.
You can see that here.
The trying with the best will it will be printed as written.
What we would like when we handed that right away step by step.
But for now these are used just for coloring the text.
OK, just to give you the vibe of a hacker or something anyway.
No big deal.
All right.
So now let's have this.
This is the first thing you are.
This is a barrier between what these bejewelled.
So you so the beautiful you are right here that you want to try and brute force on it.
OK, now we have the user name here.
Please enter the user name for the brute force.
So you are using user route admin user one, whatever.
OK, so it depends on you.
And by the way, we can have a list this for this as well.
But actually it is, it would be exponential.
So it will take a it will take forever anyway.
But we are assuming that we know the user.
So that's why they use them.
OK, now here we have the buzzword file and here you can see in the five to use.
So you put the name of the file.
But by the way, which is the RockYou, the text, this is the text file or the word file that has all
the passwords inside it.
And you can see that they are in the same division as the post posted by which is the program we are
writing or we are interpreting.
OK, now finally we have this variable, which is the login string.
So here you can see that please enter a string that occurs when logging fits.
So when you type root and with the password taught, for example, which is the inverse of root, it
will give you login failed or an invalid credential or access denied or something like that.
So you need to know that the target machine, what will give you when you watch it?
OK, don't worry, we will handle all of that in this picture.
So just follow me for now and we will reach that level.
OK, now we have this function, which is the diff cracking.
But before I go into it, actually, this is the main logic of the forcing.
Before I go through it, I want to check here or I want to have a look here.
So to understand this more so you can see here, actually this will be executed before or interpreted,
let's say, before that cracking because we call the cracking from here and wait for me for now so you
can see that you with open and here you can see that we are using the width and as statement.
OK, so with this function, which is open Basswood fight the fight we opened for the Basswood, as
you can see, which is this one.
And as I read more so with that as a basswood, so which means that everything you opened here as read
or all the best words that you have it here, open it as a buzzer to you so in there and we will start
that right away.
OK, so after that, you can see that we have a code in here with this w this inside that inside there
with s statement.
We are calling the cracking function OK, which is cracking the username that we insert here.
We assuming it is user admin root whatever.
And with the Warrell, which is they are we put here interbody, you are OK.
So we are calling the cracking function with these arguments on these various bits that we thought here
and using that with as statement by doing with open this file, which is the buzzword file as readable
and as a buzzword.
Make it as a buzzword.
OK.
OK, now actually after we use that with s statement and we call the cracking function, so now it is
time to hand it the cracking function so you can see that we define a cracking function.
This is the first parameter, by the way.
I'm using username here.
By the way, this is not the same variable.
This is only for the scope of the tracking, not for this one.
Don't don't get confused, please.
OK, and the warrant here is not the same for this.
You are I mean, as a variable, not as a value.
Yeah.
By the way, because we are basing this username as which is this one, as you can see, this variable
that we are passing to the cracking function here, but we defined the name here is user name, by the
way.
I can put username to OK and user and you are to and I need to change the necessity here inside this
function, OK, because this is username or this variable is not the same as this from the direct point
to the same address.
OK, anyway, for now, just for me it's listed as is which is username and you are in now here we have
that for password and passwords.
OK, now we already talked about the false statement and by the way, we are using the passwords that
we use it with the open password but read as a password.
All right, good.
Now we are handling the best words one by one.
So you can see that we open this password file, that they are OK for you file and you can see it is
better.
Huge, fine.
So if I catch it here, you can see I'm still still printing.
Yeah.
So I interrupted.
Alright, so you can see that it will start using this password one by one so and all of that will be
inside the for loop which is this one.
OK, so it will start with, with this one for example, until it reach or complete or whatever.
It will start with this one.
This one.
This one until we got what we want or anyway we we handed that right away.
So here we have after the first statement, which is the password, the password.
Now it would be best for touchup again.
We already saw that in the previous section as we don't need white spaces or whatever.
So we are using this one.
OK, now, Brent, now, as you can see now, we are using that colored function here that I mentioned,
which is using the term library.
So Sokolove by actually actually this is a function except a table.
And with that first thing, which is, as you can see, the first thing and the second thing, which
is.
As you can see, so the first thing which is trying with the Basswood and the other thing, which is
that cut out of this text, which is.
All right, don't worry.
We will handle that as hands on right away.
But currently, let's understand the code first, then we can try it at.
All right, so we just printing trying with the Basswood, which is we have it here after we strip it
and we have it Azerrad.
So this detail that we are trying this bastard currently so we don't need something or utility.
So to give me a black screen and it is still rendering, we don't know the progress about it.
No, we need to know where are we currently, what is the best work that we are currently trying on
and so on.
So that's why we are printing, trying on this.
Bestway so now we have data and this is a variable inside that you can see that we have these things
and you can see that the username with username, the password is password as a dictionary if you noticed,
and the login as a login or the log in here is as a submit, OK, because here this is used for that
login button when when we put the user name and when we put the password and so on.
And you can see that the user name here is the user name.
We have it here actually.
We got it from the user name.
And the best word here is the password.
We got it after we strip it.
OK, all right.
Now you may get confused, but for me in the next step, we will understand actually in the next line.
So here you can see we have a response variable and we are using the request post this time, OK, we
don't use the gate and we have that you are in, which is the right way inserted here, which is this
you are, by the way.
Yeah.
And data equals data.
So the data here, this is used for the post function and the data at this time would be this data,
which is this one that we have.
That includes the username, as you can see, which is the username, the buzzword, which is the password
after we serve it.
And then again, which is submit, OK, because this is a post request.
Now, you may get confused or you don't know what we are talking about, but don't worry, when we try
this court, you would understand everything, OK?
Now, if this Logan fence drink in various points, that to good.
And you can see that the response here, which is this one after we got it from the requested post.
So the response that content that the code.
So if we find the look in felt string that we entered here, that when that occurs, when we login fails,
which means that we need to pass, which means that that this didn't work or else which means that,
yeah, we found that we didn't find it.
We didn't found that Logan for string, which means that yeah, we connect successfully, which means
this time we need to break with the current function.
Yeah.
Found this username and we would with the username we found with a screen this time that that is added.
And yet Brint found the password and again, the password we have here after we distribute it out.
Yeah.
As a green as well.
And let's exit from this function.
So as we don't need as you can see, this is an infinite loop, or maybe it's not an infinite, but
it is a very huge actually, it is the same as the number of lines here inside this that this fight,
which is the rockyou.
So if I use this command, which is the word count nacelle, so this is to count the lines inside the
robot you takes, you can see that we have a huge number of action.
You can see there's a huge number of lines.
So we will wait until that.
This doesn't make sense.
If we find the password and the username or the password for this username, then we are good to go.
We don't need the other things right.
OK, now imagine or let's assume that we didn't found anything.
We still inside the bass bass bass until we reach the last command or the last password in this file,
which is which is this number.
OK, so after we finished the Q the text file and still we didn't find the password, it will get out
from this tracking function and it will print password, not in the list.
OK, so that's why we what the exit function here.
So this exit function, it will exit from the current brute force, that python, which is this one.
OK, so if we find it it will exit.
If we didn't find it, it will still keep this until we get out from this cracking function and then
we will print this password.
Not in the least, by the way.
This is my logic.
You can use your own logic.
Actually, there are a lot of critics out to do that and to do such as things.
You need to try this out.
Actually, it's getting boring here, so it's time to do this.
So, yeah, by three.
So brute force to try and enter.
Please enter the orbit of the wall.
By the way, I recommend you to download and install the meters plot of it, which is the ultimate machine.
And here you can see that we have this thing, which is the DPW or the Web application.
And actually this is something very popular.
That is your Web application and so on to test your skills on hacking the.
So actually, this is very good for the username.
We have this one, anything and the password, anything.
So you can see that we have a login fit.
All right.
Now let's return here.
So what is that badge for the.
As you can see, I just copy and paste it like this, as is press enter.
Now, what is the username?
So actually, by the way, if you can see that the username is maybe Ruwart, maybe admin, I don't
know.
So let's admin.
I think it is admin.
Yeah.
And for the basswood, by the way, actually, this is something very simple because the user name is
admin, by the way, and the password is password.
So it is something very simple and easy.
I didn't need to be programmed actually to point this out, but let's assume that it is something complex
anyway.
Now enter password use, which is rock you the text file that we have and enter the stream that occurs
when logging fades, which is look and feel like this.
So let's put it like this.
And here you can see that trying this, trying this, trying this until we reach the password.
So you can see that trying password admin basswood.
So let's try this out.
All right.
Time for testing password.
Yeah.
Everything working as expected so you can see that yak's you change your password because it is very
simple and very easy, but actually better than the simple stupid password anyway.
Now you can see that we are able to log in to the page with this username and password and with very
and you can see the way as you can see, this will give you the vibe of a hacker.
As you can see, this is the cutout here is red and the carrot here is green.
But you you can see that because I'm using already a green card up here.
So you can see that this is why it is green.
But actually the green skill here of the green color is not bright like this one.
This is just for it to be fun.
OK.
And by the way, one last thing I want to mention, please.
I want you to use this on a real target or machines.
OK, so actually, I'm not responsible for any attacks, damages or anything that I'm teaching you and
ethical hacking to use it to.
Good for you and good for your company or your organization, country, institution, whatever.
OK, so don't use it for bad purposes.
Thanks for watching.