Instructor: Welcome back.
Let's continue with our Brute Forcing of DVWA page.
So, we successfully Brute Forced the welcome login screen.
But now we also got this Brute Force page right here
that also requires username and password.
Now, this is pretty much the same thing,
just this is a different page
so the syntax of the Hydra command will be different.
Of course, if I were to type "admin",
and "password" right here, it would still work.
It would tell me,
"Welcome to the password protected area admin."
But if I were to type something like "test"
and then "test",
it would not work this time.
So, we must craft a specific command just for this page.
If we were to use the command that we used
from the previous video, which is this one
it would not work because it is not the same page,
it is not the same type of HTTP form POST
and it is also not the same type of fields.
So, let's clear the screen right here
and let's start crafting our command.
We're going to start to the same,
which is "hydra",
and then the IP address of our target machine.
Remember that in the previous video we used HTTP form POST
because our usernames
and passwords were sent with POST request.
This time, if you take a look at the link right here
we can see that the usernames
and passwords are being sent inside of the link.
And this is a good indication that this is a GET request.
Of course, you can also check
that by visiting the page source,
finding the form where you submit usernames
and passwords and here it is.
And under the form we can see that the method is GET.
So, this time we cannot use HTTP form POST.
We must use HTTP GET form.
So this is the syntax once we are sending the GET request.
The next step is remember we open the double quotes
and in between the double quotes,
the first argument is specifying the path to the page.
So, we must go right here.
Let us close this
and let's just refresh this page.
Just so we can get the path to it.
So. I'm just going to go right here and right here
and we get the path to the page,
which is going to be slash DVWA slash vulnerabilities
slash brute and slash at the end,
copy this and specify it as the first argument right here.
And remember, once we do that
we separate the second argument
by typing two dots and now comes the part
where we specify the username, password, and button field.
So, let's go to the page,
view page source once again
and let's find the name of the username field first.
Here is the form.
The first part is the username field
and its name is just "username".
So let's go to our command
and type username equals upper arrow USER upper arrow.
We separate the username from password with this sign.
Let's go and check out what's the password name.
It is just "password".
And let's do the same as in the previous video.
PASS, upper arrow.
And the last part is the button which we can even get
from the link itself.
So, if I type "hello" as username and "world" as password
we can see right here,
in the link that the button login equals login.
So, we can just copy this,
go to our command and paste it right here.
And the last argument inside of the double quotes is,
if you remember
we must specify what is the string that we get,
once we specify the incorrect username and password.
And we can see it right here.
It says username and/or password incorrect.
So, let's just copy this
and let's paste it right here.
Great, now if we go outside
and specify dash L and then usernames dot txt
and dash P for the passwords dot txt.
If I press enter,
you will notice that it will not work.
It will tell me that every username
and every password is correct.
Sometimes when this happens,
you haven't specified enough arguments.
Either you have a syntax error inside of your command
or you didn't specify something well
or you're missing additional arguments,
such as the cookie value.
So, sometimes we must specify the cookie value also
in order for this to work.
Let me show you what I mean.
To specify the cookie value,
we must go right here and before closing the double quotes
we're going to add another arguments.
So, separate two dots and we can type H dash Cookie,
two dots and the cookie value right next to it.
How do we get the cookie value?
Well, we get it with the help of Burp Suite.
So, let's find the HTTP request where we send the "hello"
and "world" as usernames and passwords.
And let's see what cookie do we have right there.
So let's go right here.
Let's try to find it.
It is right here slash DVWA slash vulnerabilities.
Let's just find the correct request.
And here it is.
Here we can see inside of the link
that we are sending "hello" as username
and "world" as password.
And the cookie that we have is this right here.
So we want to copy all of it
including the security equals low
and including the PHP session ID equals
and then our cookie value.
So copy that, go to the command
and right here you can paste the cookie value.
So after the two dots, H dash cookie two dots
and then the cookie value right here.
If I try it once again.
Well, now it works.
Now, it tells me that the username is "admin"
and that the password is "password".
Just keep in mind
that sometimes Hydra doesn't really make a difference
between capital and lowercase letters.
That's why we got two results right here.
But it gave us the correct username
and the correct password.
So once you notice that the Brute Force doesn't work,
try adding this cookie value and then it might actually work
because if you remember,
once we didn't have it, it gave us
that all of the usernames and all of the passwords are valid
and that we can log in with all of that.
So, the difference once again between this
and previous command is inside of this HTTP GET form
because we are sending with the GET request
then we have the different link.
The username and password fields are the same
and the string that we get once specifying the
incorrect password is also different.
And here we also specify a cookie value
which we didn't have to specify in the previous video.
Okay, great.
Now that we covered the Hydra tool,
in the next video,
I will show you a way how you can perform Brute Force,
much easier with the help of Burp Suite tool.
See you there.