Welcome back and in this lecture, I want to talk about the subject on brute forcing different login
pages.
So we talked about many different attacks that were based on some type of a vulnerability, either in
a code injection or Sarraf attack or command injection.
All of those were bugs that we covered, but we haven't covered how to brute force a login page.
And for this entire section, we have been logging into this username and password field.
Whenever we want to access the TBWA page, let's say that we don't have the credentials for this page.
We know, of course, that they are admin and password.
But let's also see how we can try to brute force them, how we can try to guess the credentials.
Of course, for this, we are going to need to have a little bit of luck because this will require that
inside of the password list that we are going to use.
We have their password there.
So this will only work if their password is pretty weak, which in our case it is, since the password
is just password.
For this, we're going to use a tool called Hydra, and Hydra is already preinstalled in Callinan's,
so you can just type Hydra inside of your terminal.
And this will give you the help menu of the tool, however, I advise you not to look at this help menu
because it will be in no way helpful for these types of attacks.
As we can see right here, it gets the example of usage.
But once attacking the actual Web pages, this becomes harder and harder to use.
The syntax becomes harder and harder.
So I advise you to actually pay attention once of writing syntax so you can see how exactly am I doing
it, because for every Web page that has a login page with username and password, this syntax will
be different.
So let's start crafting our comment.
We are going to start with Hydra and then after we specify the IP address of our target, which in my
case is one, add to that 168, that one that nine, as we can see right here.
Then you got a few options that you need to specify right here, which are based on how are you sending
the username and password to the target?
So in this case, if I type test right here and test this password, I click on login.
This is being sent as a post form.
So we are applying these usernames and passwords to the form and we are sending this to the target with
post request.
You can always check that right here inside of your burset so you can go down here and we can see that
this is a post request where we send the test username and password.
OK, so how we can specify that inside Hydra.
Well, we can specify HTP Dash for Basche post.
After this, you need to open the double quotes and in between the double quotes, the first argument
that you must specify for the page with your brute forcing is the path to that page, which requires
username and password.
And in our case, that path is a legal logging dot b.
So that is the first argument specified in between the quotes and arguments that you specify between
these double quotes are separated with two dots.
So once we type the path, we type two dots for the second argument.
And the second argument is the username.
So for this, we must go to the page that we are brute forcing.
We must right click and go to view page source and we must find a name for the username field inside
of the code.
Usually the user name and password fields will be inside of some type of a form, as we can see right
here for action log in that method post.
And if I go to the label for the username, we can see that the name for the user name field is simply
just username.
OK, so we must copy the name of this field and we must go right here and type it in.
So paste it right after.
And this username field will be equal to upper arrow and capital user and then once again, upper error.
Now you might be wondering what is happening here.
Well, after we specified the name of the field on our page, we equal that to this syntax right here.
And this is just hydrous syntax.
You use this upper error right here and you type user in between that and you close it with upper error.
What this is telling to the program to do is it will change any username that we have in a list between
these two upper arrows.
So essentially any type of user name from the list that we are going to use will be stored right here.
But this is not the only field that we have.
We also must specify the same thing for the password field.
Now to separate the user name from the password field.
We use this sign right here.
So specify this sign and then after it we can specify the password field name just like we did right
here.
So let's go and find a label for the password.
Here it is.
And the name for the password field is simply just password.
And this is something that can change depending on which page you're a brute forcing.
So let's go right here and type password, which is the name of our field, and this will be equal to
Upper Arrow and then pass and then once again, upper error.
And this is also the same as with the username.
So just any passwords that we use from our list will get stored right here instead of this capital pass.
And the last thing that we must set for this second argument of our command is the pattern that we're
using.
So every time you actually try to log in, you click on this logging.
But and this is something that we also want to simulate inside of our hydro command.
To do that, we go over your speech source.
We find the button, which is usually right after the username and password field.
And in our case, here it is.
We take a look at the type of button and the button name so we can see that the bottom name is in which
we are going to specify and then we are going to equal death to submit so we can do it like this again.
We need to separate it with this sign right here.
And we type the name of the button, which is login.
And then equal to the type of the bottom, which is in our case, submit, so we equal death to submit.
And these three steps right here, which is username, password and button, are enough for us to actually
submit a request for a specific username and password, but we also need to differentiate are valid
username and password from the incorrect username and incorrect password.
So how are we going to do that?
Well, luckily, Hijrah allows us to specify something that will stick out once a password is incorrect.
And if we go to our page and we specify the incorrect username and incorrect password, once you click
on login, you will notice that down here we have this string that says login failed.
Now, just by thinking, we can figure out that this string will not exist if we manage to login with
successful credentials so we can specify this string to our Hydra command to search for it.
And every time it finds it, it will not print out that username and password as valid username and
password because they are incorrect.
So we can specify it with two dots and then paste it right here.
Log-in failed will be the strength that we are searching for, which will indicate that the username
and password is incorrect after we specified this, we can exit out of the double quotes and all we
are left to do is to specify that shell and then the list for the user names, which we are going to
call username and dash IP, which will be the list for the passwords which we are going to call passwords
that the.
Now, for this lists, you can use any type of list that you want in my case, since we don't have them.
I'm just going to create them real quick.
For the purposes of this tutorial, I need to make sure that I'm in the same directory where I'm running
this command and then I'm going to Nannerl usernames that text and I'm going to type right here, root
account admin, then lowercase admin, passwords, username, test, one, two, three, and bunch of
other things we are not going to specify.
We can just leave it to be this small just so we don't waste too much time brute forcing that page and
here we can type test test one, two, three, one, two, three, four, five, six, seven, eight,
nine.
And then we can type admin root password and password one, two, three.
So we do have the correct username and the correct password inside of both of these lists.
Now that we have this, what we can do is we can run our comment ledgers double check it real quick.
So high the IP address of our target.
We're using the HTP for post because if we are sending a post request and we are sending our username
and password inside of a form.
Then we open double quotes and the first argument is going to be the path to the page that the login
form is located in, the second argument is going to be username, password and button that we are submitting
the username and password with.
And the third argument inside of double quotes is going to be a string that we get once we specify the
incorrect username and password after it.
We just specify the URL for the user names list and dash for the passwords list.
If I click, enter.
And here it is, it managed to find the correct username and password, it printed it out right here
and it tells us that the username is admin and that the password is password.
So it finished relatively quick, but it only had around forty nine Log-in tries, as it says right
here, so you can feel free to use a bigger pastoralist's in order to give this even higher chances
to work.
Now that we did this, let's give it a try and let's login with the username and password that we got
and it indeed works.
So our tool successfully brute force the login.
Now, in the next video, we're also going to take a look at how we can brute force this page right
here, which is the brute force login page inside of our TBWA.